Buff

Windows :

Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.198

8080/tcp open  http    Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
|_http-title: mrb3n's Bro Hut

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows XP (85%)
OS CPE: cpe:/o:microsoft:windows_xp::sp3
Aggressive OS guesses: Microsoft Windows XP SP3 (85%)
No exact OS matches for host (test conditions non-ideal).
┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.198 

All 1000 scanned ports on 10.10.10.198 are in ignored states.

Enumeration: HTTP Port 8080/tcp

Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)

http://10.10.10.198:8080/

view-source:http://10.10.10.198:8080/

mrb3n's Bro Hut Made using Gym Management Software 1.0

http://10.10.10.198:8080/index.php

NIKTO:

GOBUSTER:

I actually went down a rabbit hole chasing through these things, but there’s a ton of pages. Eventually I realized that given the sheer number of pages, and given things like a license page, this is likely not a custom site for HTB, but some software package.

Gym Management System: When I first solved, I couldn’t find the name of the software displayed on the site (I was blind). There were two ways I could think of to find it without seeing it explicitly, and the third way below is the intended path (which is simply reading, but I’ll include the other two as potentially interesting):

  1. On all the pages, there’s a copyright and/or link to Projectworlds.in. Visiting that page lists tons of projects in PHP (and other languages), some free, others paid. At number 18 is Gym Management System, which fits the name of this box:

LogoFree & Premium Coding Projects & Tutorials | ProjectworldsProjectworlds | Free & Premium Coding Projects & Tutorials

  1. Seeing that it’s some kind of framework, I could check for a README.md file at the web root, and it comes back: Gym Management System This the my gym management system it is made using PHP,CSS,HTML,Jquery,Twitter Bootstrap. All sql table info can be found in table.sql. more free projects click here - https://projectworlds.in YouTube Demo - https://youtu.be/J_7G_AahgSw

  2. On /contact.php, it clearly says the name of the framework:

Exploit: A quick search in searchsploit shows there’s an unauthenticated RCE vulnerability in the software:

Shell as shaun

POC Shell: I’ll grab a copy of the exploit using searchploit -m php/webapps/48506.py (and I like to rename it something more descriptive, like gym_management_rce.py). I took a look at the script, and it looks like it bypasses filters to upload a webshell, and then runs an infinite loop getting commands from the user, submitting them to the webshell, parsing the results, and printing them.

It uses print "string" syntax, so it must be legacy Python. Still, the script works pretty well, at least to get a foothold:

Priv: shaun –> administrator

nc64.exe: This shell gets a bit frustrating after a while, so I upgraded to nc64.exe. I started by running smbserver.py in the directory where I keep nc64.exe:

Netstat:

Checking the netstat shows two ports listening only on localhost. 3306 is MySQL, which makes sense for the PHP site and XAmpp stack. The other is 8888:

I’ll grab the process ID (2820) and grep (or findstr) for i in the tasklist (the listening process id changes every minute so I’ll have to search quickly):

If I dig a bit more in shaun’s home directory, there’s an exe in the Downloads folder:

Searchsploit:

I’ll throw cloudme into searchsploit and it returns several vulnerabilities:

The version number for the top two (1.11.2) lines up nicely with the EXE name from Buff (CloudMe_1112.exe).

Tunnel:

It also looks like the version number is being listed as well. Turning to ExploitDB to see if I can find any public exploits, I quickly find this one: https://www.exploit-db.com/exploits/48389. This is a Python script, which should be pretty straightforward to execute.

LogoCloudMe 1.11.2 - Buffer Overflow (PoC)Exploit Database

But there is one small hurdle we’ll have to get through first. Because this is exploit is written in Python, and Python is not normally installed on Windows machines, we’ll need to use a tool like Chisel to tunnel from my attacking machine to the target.

So, lets get the exploit cleaned up and ready to execute and then transfer over Chisel to set up a tunnel.

Shell: Chisel

LogoGitHub - jpillora/chisel: A fast TCP/UDP tunnel over HTTPGitHub

Chisel is my favorite tool for situations like this, because it can be used on both Windows and Linux machines, doesn’t require SSH access, and is incredibly straight forward

First things first I need to copy Chisel over to the Buff machine. To do this I’ll use the same PowerShell one-liner I used to transfer over netcat:

First we have to google chisel binary and download one for linux and one for windows and unzip both of them using the command gunzip and also give both of them executable permission using chmod +x

LogoReleases · jpillora/chiselGitHub

Now keep the linux version of chisel in your kali and transfer the windows version to the target as chisel.exe.

PORT FORWARDNG USING CHISEL:

Now I’ll run the Linux binary on Kali in server mode:

Next, from Buff, I’ll run as a client:

I can see my local box is listening on 8888:

Modifying The Exploit

This is a pretty straight forward buffer overflow exploit which will only need light updating. Looking at the code it looks like the shellcode provided opens up calc.exe, but we want something a bit more useful than that. So what we need to do is utilize msfvenom to create some new shell code that contains a reverse shell back to our box. We can do that as follows:

The payload in the script by default looks to be the output of msfvenom -a x86 -p windows/exec CMD=calc.exe -b '\x00\x0A\x0D' -f python. Given the four-byte addresses and references to ESP and EIP (as opposed to RSP and RIP), this is a 32-bit program.

I changed the payload type (and included LHOST and LPORT needed for this payload), and I used the -v payload to set the output payload variable name so I can just paste it into the script.

With: -a for the architecture -p for the payload -b for the bad-characters (we didn't need to fuzz these ourselves, just use what's in the exploit) -f for the format -v for the variable

After updating the shellcode in the exploit, that should be it for updating the script.

Shell:

Now I just run the exploit through the tunnel with nc waiting (work with either legacy Python or Python3):

PreviousServMonNextToolbox

Last updated