search

Driver

Windows:

hashtag
Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.11.106

80/tcp  open  http         Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Basic realm=MFP Firmware Update Center. Please enter password for admin
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).

135/tcp open  msrpc        Microsoft Windows RPC

445/tcp open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone
Running (JUST GUESSING): Microsoft Windows 2008|Phone (87%)
OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows
Aggressive OS guesses: Microsoft Windows Server 2008 R2 (87%), Microsoft Windows 8.1 Update 1 (85%), Microsoft Windows Phone 7.5 or 8.0 (85%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: DRIVER; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2024-01-17T07:26:10
|_  start_date: 2024-01-17T07:24:34
|_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m59s

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

hashtag
Enumeration: SMB Port 139/445/tcp

Without creds, I can’t connect to the share, or even list them:

hashtag
Enumeration: MSRPC Port 135/tcp

hashtag
Enumeration: HTTP Port 80/tcp

Visiting the page returns a request for basic authentication: Firefox isn’t showing me the additional context like nmap did, but looking in Burp at the response it’s there:

When a server wants to request the browser include auth, it will return this 401, and the WWW-Authenticate header says what kind of auth (in this case “Basic”) as well as a realm, which Mozilla docs describe as:

LogoWWW-Authenticate header - HTTP | MDNMDN Web Docschevron-right

http://10.10.11.106/index.php arrow-up-rightWe as a part of centre of excellence, conducts various tests on multi functional printers such as testing firmware updates, drivers etc. support@driver.htb

http://10.10.11.106/fw_up.phparrow-up-right Select printer model and upload the respective firmware update to our file share. Our testing team will review the uploads manually and initiates the testing soon.

Directory Brute Force:

NIKTO:

hashtag
Shell as tony

Capture Net-NTLMv2: The page says that what I upload will go to their file share. That implies it’s not going to the webserver necessarily, so looking for a way to upload webshell doesn’t make much sense.

LogoSMB Share – SCF File AttacksPenetration Testing Labchevron-right

A classic attack when you have write access to a file share is to drop a .scf file that references an icon file on an SMB share on an attacker-controlled host. If the folder containing the .scf file is opened with File Explorer, the .scf will inspire Explorer to connect back to get that icon file, and offer Net-NTLMv2 auth negotiation. If I control that host, and I can capture that exchange and try to crack the Net-NTLMv2 using an offline bruteforce (like hashcat). I used this technique on the Insane machine Sizzle back in 2019.

SCF files are Windows Shell Command files, and there are way more references on how to make a malicious one than legit uses. Some old Microsoft pages (that no longer exist, but are on the Wayback Machine) show how to create a Show Desktop Shortcut and a View Channels Quick Launch using SCF files. The format is:

How to re-create the Show desktop icon on the Quick Launch toolbar in Windows XPweb.archive.orgchevron-right
How to Re-create the View Channels Icon on Quick Launch Toolbarweb.archive.orgchevron-right

Capture Hash: I’ll abuse the IconFile bit, but having it point to my server over SMB, and create exodus.scf:

I’ll start responder, which will start many different kinds of server (including SMB) to listen and try to get Net-NTLMv2 challenges.

I’ll upload the .scf file to Driver, and very quickly there’s a hit at responder:

https://hashcat.net/wiki/doku.php?id=example_hasheshashcat.netchevron-right

Crack Hash: The Hashcat example hashes page shows this is mode 5600. It breaks instantly in hashcat to liltony:

Crackmapexec: crackmapexec is a nice way to show that the creds work:

WinRM: I’ll use Evil-WinRM to connect to WinRM (installed with sudo gem install evil-winrm):

LogoGitHub - Hackplayers/evil-winrm: The ultimate WinRM shell for hacking/pentestingGitHubchevron-right

hashtag
Shell as administrator - PrintNightmare

Background: This box was developed as part of the Intro to Printer Exploitation track on HackTheBox. Just as it was in development, PrintNightmare exploded onto the scene (I did a post about it here). Drive was left vulnerable to PrintNightmare as well.

LogoHack The Boxapp.hackthebox.comchevron-right

Import Exploit: The Invoke-Nightmare PowerShell script can be run with a low priv shell to add an admin user to the box. I’ll download the exploit with git (and rename the directory to something I’ll recognize:

Now I can upload the exploit over my WinRM session:

However, trying to import the module is blocked by execution policy The simplest way to handle this is to just read it from my host as an HTTP request and pipe that into iex (or Invoke-Expression). I’ll start a Python web server on my host in the directory where the PS1 script is with python3 -m http.server 80, and the request the file:

-UseBasicParsing will allow the file to come back even if the IE engine isn’t available. Now the commandlet is in my current PowerShell session:

Shell: By default, Invoke-Nightmare adds a user adm1n with the password “P@ssw0rd”. I’ll use arguments to add my own user and password:

The output shows how it is writing a DLL file as a payload, and then loading it as a driver. This DLL just adds a user to the system as a local administrator. Then the script deletes the DLL. Not only is 0xdf a user on the box, but also is in the Administrators group:

WinRM: Connecting as the new user gives me access to the full filesystem:

PreviousToolboxNextReturn

Last updated