search

Artic

Reconnaissance:

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.11

135/tcp   open  msrpc   Microsoft Windows RPC

8500/tcp  open  fmtp?

49154/tcp open  msrpc   Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|7|2008|8.1|Vista (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows Embedded Standard 7 (91%), Microsoft Windows 7 or Windows Server 2008 R2 (89%), Microsoft Windows Server 2008 R2 (89%), Microsoft Windows Server 2008 R2 or Windows 8.1 (89%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (89%), Microsoft Windows 7 (89%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (89%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (89%)
No exact OS matches for host (test conditions non-ideal).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows


┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.11   

All 1000 scanned ports on 10.10.10.11 are in ignored states.

nmap found three open TCP ports, RPC (135, 49154) and something on (8500):

Protocol Enumeration: TCP 8500

Let’s do some more enumeration on port 8500. Visit the URL in the browser.

http://10.10.10.11:8500/arrow-up-right

It takes about 30 seconds to perform every request! So we’ll try and see if we could perform our enumeration manually before we resort to automated tools. When you visit the cfdocs/ directory, you’ll find an administrator/ directory.

http://10.10.10.11:8500/CFIDE/ http://10.10.10.11:8500/CFIDE/administrator/arrow-up-right

When you click on the administrator/ directory, you’re presented with an admin login page. Default/common credentials didn’t work and a password cracker would take an unbelievably long time (30s per request), so we’ll have to see if the application itself is vulnerable to any exploits.

Vulnerabilities: The login page does tell us that it’s using Adobe ColdFusion 8, which is a web development application platform. We’ll use the platform name to see if it contains any vulnerabilities.

The application is using version 8, so we only care about exploits relevant to this specific version.

Exploiting CVE-2009-2265 – Arbitrary File Upload

Since the RCE looks the most appealing and is specific to the version running on the target, I decided to grab a copy of that into my working directory to have a closer look.

Now that the exploit is in the working directory, I checked what the script is doing and if there are any changes that need to be made.

Here the script has LHOST, LPORT, RHOST, and RPORT, which will need to be edited. It also shows that it crafts a java (JSP) payload and uses a post request to upload it onto the webserver. Above that, it shows the definition “execute payload” and “listener connection” to define where the script navigates to execute the payload, and to catch the shell using netcat.

Privilege Escalation

Starting with systeminfo to get an idea of the OS running on the victim as well as the architecture and installed hotfixes.

From the output, it was quickly observed that this is a fairly old version of Windows Server running on an x64 arch and has NO hotfixes installed.

  • When you find an old OS and no hotfixes installed, immediately you should be thinking kernel exploit.

Since the OS is quite old, there are likely many kernel exploits that can be used to elevate privileges; however, before going down that route, I like to enumerate further to ensure I do not miss a learning opportunity as a kernel exploit may not be the intended method by the machine creator.

On an exam like OSCP, try the kernel exploit first, but for learning purposes, save it for last. After gathering information about the target host, I checked the current user tolis’ privileges, like so:

Windows-Exploit-Suggester:

Given the complete lack of hotfixes, this is likely vulnerable to an exploit. I can use the sysinfo results to run Windows Exploit Suggester. I’ll clone the repo into /opt:

Let’s find out more about the system.

Copy the output of the systeminfo command and save it in a file. We’ll use Windows Exploit Suggester to identify any missing patches that could potentially allow us to escalate privileges.

I’ll create a database:

Now I can run that against the sysinfo output:

Elevating Privileges to SYSTEM – Kernel Exploit (MS10-059)

I did some googling around for exploit code and found this GitHub from egre55 that included an exploit for MS10-059. I was particularly drawn to the fact that this binary requires an IP and port to connect to. Many of the exploits will start a new cmd as SYSTEM, which is nice if you are standing at the computer, but not so useful from a remote shell.

Logowindows-kernel-exploits/MS10-059: Chimichurri at master · egre55/windows-kernel-exploitsGitHubchevron-right
LogoGitHub - SecWiki/windows-kernel-exploits: windows-kernel-exploits Windows平台提权漏洞集合GitHubchevron-right

Now I start a nc listener, and run it:

PreviousGrannyNextGrandpa

Last updated