Driver
Windows:
Reconnaissance: NMAP
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.11.106
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=MFP Firmware Update Center. Please enter password for admin
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone
Running (JUST GUESSING): Microsoft Windows 2008|Phone (87%)
OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows
Aggressive OS guesses: Microsoft Windows Server 2008 R2 (87%), Microsoft Windows 8.1 Update 1 (85%), Microsoft Windows Phone 7.5 or 8.0 (85%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: DRIVER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2024-01-17T07:26:10
|_ start_date: 2024-01-17T07:24:34
|_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m59s
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Enumeration: SMB Port 139/445/tcp
Without creds, I can’t connect to the share, or even list them:
Enumeration: MSRPC Port 135/tcp
Enumeration: HTTP Port 80/tcp
Visiting the page returns a request for basic authentication: Firefox isn’t showing me the additional context like nmap did, but looking in Burp at the response it’s there:
When a server wants to request the browser include auth, it will return this 401, and the WWW-Authenticate header says what kind of auth (in this case “Basic”) as well as a realm, which Mozilla docs describe as:
http://10.10.11.106/index.php We as a part of centre of excellence, conducts various tests on multi functional printers such as testing firmware updates, drivers etc. support@driver.htb
http://10.10.11.106/fw_up.php Select printer model and upload the respective firmware update to our file share. Our testing team will review the uploads manually and initiates the testing soon.
Directory Brute Force:
NIKTO:
Shell as tony
Capture Net-NTLMv2: The page says that what I upload will go to their file share. That implies it’s not going to the webserver necessarily, so looking for a way to upload webshell doesn’t make much sense.
A classic attack when you have write access to a file share is to drop a .scf file that references an icon file on an SMB share on an attacker-controlled host. If the folder containing the .scf file is opened with File Explorer, the .scf will inspire Explorer to connect back to get that icon file, and offer Net-NTLMv2 auth negotiation. If I control that host, and I can capture that exchange and try to crack the Net-NTLMv2 using an offline bruteforce (like hashcat). I used this technique on the Insane machine Sizzle back in 2019.
SCF files are Windows Shell Command files, and there are way more references on how to make a malicious one than legit uses. Some old Microsoft pages (that no longer exist, but are on the Wayback Machine) show how to create a Show Desktop Shortcut and a View Channels Quick Launch using SCF files. The format is:
Capture Hash: I’ll abuse the IconFile bit, but having it point to my server over SMB, and create exodus.scf:
I’ll start responder, which will start many different kinds of server (including SMB) to listen and try to get Net-NTLMv2 challenges.
I’ll upload the .scf file to Driver, and very quickly there’s a hit at responder:
Crack Hash: The Hashcat example hashes page shows this is mode 5600. It breaks instantly in hashcat to liltony:
Crackmapexec: crackmapexec is a nice way to show that the creds work:
WinRM: I’ll use Evil-WinRM to connect to WinRM (installed with sudo gem install evil-winrm):
Shell as administrator - PrintNightmare
Background: This box was developed as part of the Intro to Printer Exploitation track on HackTheBox. Just as it was in development, PrintNightmare exploded onto the scene (I did a post about it here). Drive was left vulnerable to PrintNightmare as well.
Import Exploit: The Invoke-Nightmare PowerShell script can be run with a low priv shell to add an admin user to the box. I’ll download the exploit with git (and rename the directory to something I’ll recognize:
Now I can upload the exploit over my WinRM session:
However, trying to import the module is blocked by execution policy The simplest way to handle this is to just read it from my host as an HTTP request and pipe that into iex (or Invoke-Expression). I’ll start a Python web server on my host in the directory where the PS1 script is with python3 -m http.server 80, and the request the file:
-UseBasicParsing will allow the file to come back even if the IE engine isn’t available. Now the commandlet is in my current PowerShell session:
Shell: By default, Invoke-Nightmare adds a user adm1n with the password “P@ssw0rd”. I’ll use arguments to add my own user and password:
The output shows how it is writing a DLL file as a payload, and then loading it as a driver. This DLL just adds a user to the system as a local administrator. Then the script deletes the DLL. Not only is 0xdf a user on the box, but also is in the Administrators group:
WinRM: Connecting as the new user gives me access to the full filesystem:
Last updated