Legacy
Reconnaissance: NMAP
INITIAL:
┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV 10.10.10.4
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows XP microsoft-ds
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)
|_nbstat: NetBIOS name: LEGACY, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:b9:2e:2e (VMware)
| smb-os-discovery:
| OS: Windows XP (Windows 2000 LAN Manager)
| OS CPE: cpe:/o:microsoft:windows_xp::-
| Computer name: legacy
| NetBIOS computer name: LEGACY\x00
| Workgroup: HTB\x00
|_ System time: 2023-12-14T05:22:36+02:00
|_clock-skew: mean: 5d00h57m37s, deviation: 1h24m51s, median: 4d23h57m37s
┌──(kali㉿kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.4ALL PORTS:
UDP:
Nmap shows just remote desktop (3389), and the SMB/NetBios ports (TCP 139, 445 and UDP 137) Our initial recon shows that the only point of entry is possibly through exploiting SMB.
Enumeration:
SMB: Null Auth
Neither smbmap nor smbclient show any ability to log in without authentication:
SMB: Vulnerabilities
SMB has had its fair share of vulnerabilities in the past, so let’s first run nmap scripts to determine if it is vulnerable. I can see a list of these scripts by looking at the files in the nmap scripts directory:
The result shows us that it is vulnerable to CVE-2009–3103 and CVE-2017–0143 and likely vulnerable to CVE-2008–4250. The target machine is running SMBv1 so we’ll go with CVE-2017–0143 (MS17–010). It looks like this box is vulnerable to two infamous SMB exploits, MS-08-067 (made famous by Conficker) and MS-17-010 (made famous by Shadow Brokers).
System Shell:
Both of these vulnerabilities give a shell as system. Both also have Metasploit modules that are basically automatic pwns. But to make this interesting (and relevant to anyone doing PWK / OSCP), I’ll show how to do each without Metasploit.
MS-08-067
//Locate Exploit I’ll use the exploit from jivoi on Github here. It’s a python script that requires Impacket (which comes installed on Kali) and for me to replace the default shellcode with some of my own. (Interestingly, the default is a reverse TCP shell to 10.11.0.157… looks like the author may have been in PWK.)
//Shellcode Generation To make the shellcode, I’ll use msfvenom. I’ll copy the bad characters list (-b) from the examples in the exploit code. I’ll use the following parameters:
I’ll take this shellcode into the script, and paste it in replacing the default. I like to also paste in a comment above it with the msfvenom command string I ran to generate it so that when I come back to it someday, I’ll know what it’s doing.
//Guess Version The exploit requires that I know the version of Windows and the Language pack:
//Run Exploit I’ll open a nc listener, and run the exploit:
We have a reverse shell! Next, we need to figure out what privileges we are running with.
Whoami doesn’t seem to work and we can’t echo the username. Therefore, we’ll have to get creative. Kali has a whoami executable that we can import to our target machine.
Both netcat and powershell are not installed on the target machine, so we can’t use them to import the executable. Therefore, let’s try and setup an SMB server for the transfer.
Locate the SMB server script on kali.
Run the script to launch an SMB server on port 445 with the share name temp and the path to the whoami executable.
FIND USER.TXT
FIND ROOT.TXT
MS-17-010:
//Locate Exploit There’s a few GitHubs out there with MS-17-010 code, but not as many that work on XP. My favorite is a fork of worawit’s MS17-010 repo by helviojunior. He added a send_and_execute.py, which I can give an executable and it will upload and run it.
I’ll grab a copy of the script:
//Generate Payload I’ll use msfvenom again. This time, I don’t need to worry about bad characters or variable names, as I can use an exe:
//Run Exploit Now I’ll start a listener, and then run the exploit:
And I get a shell:
METASPLOIT:
The vulnerability we’ll be exploiting is called Eternal Blue. This vulnerability exploited Microsoft’s implementation of the Server Message Block (SMB) protocol, where if an attacker sent a specially crafted packet, the attacker would be allowed to execute arbitrary code on the target machine.
I came across this article that explains how to exploit the Eternal Blue vulnerability without using Metasploit. We’ll use it to run the exploit on the target machine.
First, download the exploit code from Github.
Use MSFvenom to create a reverse shell payload (allowed on the OSCP as long as you’re not using meterpreter).
Start up a listener on your attack machine.
Run the exploit.
We have a reverse shell!
Last updated