Love

Windows : Easy

10.10.10.239

Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.239

80/tcp   open  http         Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1j PHP/7.3.27)
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: Voting System using PHP
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set

135/tcp  open  msrpc        Microsoft Windows RPC

139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn

443/tcp  open  ssl/http     Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
| ssl-cert: Subject: commonName=staging.love.htb/organizationName=ValentineCorp/stateOrProvinceName=m/countryName=in
| Not valid before: 2021-01-18T14:00:16
|_Not valid after:  2022-01-18T14:00:16
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1

445/tcp  open  microsoft-ds Windows 10 Pro 19042 microsoft-ds (workgroup: WORKGROUP)

3306/tcp open  mysql?
| fingerprint-strings: 
|   LPDString, TerminalServer, WMSRequest, giop: 
|_    Host '10.10.16.4' is not allowed to connect to this MariaDB server

5000/tcp open  http         Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27

1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3306-TCP:V=7.94SVN%I=7%D=1/19%Time=65AB207E%P=x86_64-pc-linux-gnu%r
SF:(LPDString,49,"E\0\0\x01\xffj\x04Host\x20'10\.10\.16\.4'\x20is\x20not\x
SF:20allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(Termi
SF:nalServer,49,"E\0\0\x01\xffj\x04Host\x20'10\.10\.16\.4'\x20is\x20not\x2
SF:0allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(WMSReq
SF:uest,49,"E\0\0\x01\xffj\x04Host\x20'10\.10\.16\.4'\x20is\x20not\x20allo
SF:wed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(giop,49,"E\
SF:0\0\x01\xffj\x04Host\x20'10\.10\.16\.4'\x20is\x20not\x20allowed\x20to\x
SF:20connect\x20to\x20this\x20MariaDB\x20server");
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 10|Longhorn|2008|7|2019|11|Vista|XP|8.1 (95%)
OS CPE: cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_8.1
Aggressive OS guesses: Microsoft Windows 10 1709 - 1909 (95%), Microsoft Windows Longhorn (94%), Microsoft Windows 10 1703 (93%), Microsoft Windows Server 2008 SP2 (93%), Microsoft Windows 7 SP1 (93%), Microsoft Windows 8 (93%), Microsoft Windows 10 1709 - 1803 (93%), Microsoft Windows 10 1809 - 2004 (93%), Microsoft Windows 10 2004 (93%), Microsoft Windows Server 2019 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Hosts: www.example.com, LOVE, www.love.htb; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 3h01m34s, deviation: 4h37m10s, median: 21m32s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows 10 Pro 19042 (Windows 10 Pro 6.3)
|   OS CPE: cpe:/o:microsoft:windows_10::-
|   Computer name: Love
|   NetBIOS computer name: LOVE\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-01-19T17:45:25-08:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2024-01-20T01:45:22
|_  start_date: N/A

Enumeration: SMB Port 139/445/tcp

I’m not able to get a guest session with SMB:

Check vulns:

Enumeration: MSRPC Port 135/tcp

Enumeration: mysql Port 3306/tcp

MariaDB server

Connections from my IP are not allowed to MySQL:

Enumeration: Unknown Ports 5080 / 7680 /tcp

I wasn’t able to get anything useful out of 5080 or 7680:

Enumeration: HTTP Port 5000/tcp

The server on 5000 returns Forbidden as well:

Enumeration: HTTP Port 443/tcp

The site just returns a 403 forbidden:

https://10.10.10.239/ Apache httpd 2.4.46: (OpenSSL/1.1.1j PHP/7.3.27)

Tech Stack: The TLS certificate shows the domain love.htb and staging.love.htb:

Common Name: staging.love.htb Email Address: roy@love.htb Organization: ValentineCorp

There’s an email address for roy@love.htb. I’ll add both domains to /etc/hosts:

https://staging.love.htb/ Forbidden

Enumeration: HTTP Port 80/tcp

Both by IP and love.htb, the page returns a login form for a voting system The page title is “Voting System using PHP”. Some basic password guessing didn’t lead anywhere. No matter what I entered, it returned:

Basic SQL injections didn’t lead anywhere either.

Voting System: http://10.10.10.239/

VIEW SOURCE:

SSL CERT:

WHATWEB:

DIR BRUTE-FORE:

It returned a bunch of 403 forbiddens, and 301/302 redirects. I am most interested in /admin. Visiting presents another login form:

NIKTO:

BURP:

SQLMAP:

I’ll run with -r login.request to give it the file to work from, --force-ssl (as that’s where the site is), and --batch to accept the defaults at the prompts. It finds four injections:

I’ll add --dbs to the end of the command and run it again to list the dbs:

I will list the tables in public, finding one:

I will dump a single user, admin, and their password hash. sqlmap tries to crack it but fails, and Google doesn’t know it either.

The previous command identified the OS as Debian 10. Given this is a Windows host according to HTB, this must be in a Docker container. The id command returns as well:

Searchsploit: While this looks potentially like an application developed for HTB, it actually isn’t. searchsploit returns three results:

Clearly admin is a valid username. If I can’t find anything else, I can come back and check for more.

staging.love.htb - TCP 80 The staging.love.htb website is different. It’s a file scanning application:

In the nav bar at the top, Home leads to this page, but Demo goes to /beta.php, where there’s a form that takes a url:

If I start a Python webserver and enter a url hosted on my IP, it does make a request to my server:

The resulting page is contains the result:

Shell as phoebe

SSRF Getting the server to make a request and potentially access something I can’t access otherwise is known as a server-side request forgery (SSRF) exploit. While typically they are a bit more well disguised than a site that asks for for the url, using this to access things I shouldn’t have access to is SSRF all the same.

I tried entering https://127.0.0.1, but nothing returned. However, when I checked the service on 5000 by entering http://127.0.0.1:5000:

It seems to be giving creds for the Voting System, and they work.

RCE via Searchsploit Script

Having identified an authenticated RCE exploit in Voting System earlier in searchsploit, and now creds, ‘ll give that a try. searchsploit -m php/webapps/49445.py will copy it to my current working directory. It’s a Python script. At the top there’s some config info to update:

Troubleshooting: I ran the exploit, and nothing happened Looking at the Python script, it is using requests to send HTTP requests to the website. At the start, it creates a session, which will hold things like cookies to enable things like logging in. It stores it in the global variable s. I’ll add Burp as a proxy to that session so that I can see the requests it is sending and potentially see what’s wrong.

On running the script again, I see three requests, all of which are returning 404: It’s not finding any of those pages. Above, I found the admin login page at /admin/login.php, but for some reason this script is adding /votingsystem before that. Right under where I configured the settings, there’s a handful of URLs defined: I’ll remove /votingsystem from each and save the script.

RCE Manually

Once logged in, there’s not a ton to see: Clicking around the panels didn’t lead to anything interesting. However, clicking on the logged in user’s name, Neovic Devierte, there’s an option to update: Clicking that brings up a form to update the admin profile:

http://love.htb/admin/home.php admin @LoveIsInTheAir!!!!

The profile picture is the first target that comes to mind, as it’s the chance to upload something. It looks like zero filtering is in place, as if I just select a simple PHP webshell and upload it as cmd.php, it doesn’t complain.

The image is now broken at the top: Looking at the source for the page, it saved the file as cmd.php: Visiting http://love.htb/images/cmd.php returns an error about missing cmd: Notice: Undefined index: cmd in C:\xampp\htdocs\omrs\images\shell.php on line 1 Warning: system(): Cannot execute a blank command in C:\xampp\htdocs\omrs\images\shell.php on line 1

Adding ?cmd=whoami to the end shows I have execution:

Reverse Shell:

I used the credintials to login as an admin, and after some search I found file upload vulnerability which I used to upload my both shell.php

and shell.exe that was generated via msfconsole

I activated exploit/multi/handler

Shell as SYSTEM

Enumeration After looking around the filesystem a bit manually, I opted to run WinPEAS. After cloning the repo to my VM, I went into the directory with winPEAS.exe and started a Python web server (python3 -m http.server 80).

https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASany_ofs.exegithub.com

There’s a hit on the webserver, and the file is present. Now I’ll run it with .\wp.exe. There’s a ton of output, so I’ll just highlight the interesting parts.

It finds a PowerShell history file:

Being able to create directories at the C:\ root is interesting.

AlwaysInstallElevated: These registry keys tell windows that a user of any privilege can install .msi files are NT AUTHORITY\SYSTEM. So all I need to do is create a malicious .msi file, and run it.

I’ll use msfvenon to create the MSI installer. I did show this process manually for Ethereal, but it’s a painful process, and msfvenom will work here. I’ll use a reverse shell payload that I can catch with nc:

I’ll upload it just like I did with WinPEAS:

This requests the file from my Python webserver (now running out of my love directory) and fetches the MSI.

This returns nothing, but there’s a shell at my listening nc:

PreviousTimelapseNextMonteverde

Last updated