Return
Windows:
Reconnaissance: NMAP
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.11.108
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: HTB Printer Admin Panel
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-01-18 01:00:22Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10|Vista|11|2012|2022|Longhorn|7|8.1|XP (93%)
OS CPE: cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7:::ultimate cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_xp::sp3
Aggressive OS guesses: Microsoft Windows Server 2019 (93%), Microsoft Windows 10 2004 (90%), Microsoft Windows Vista SP1 (90%), Microsoft Windows 10 1709 - 1803 (89%), Microsoft Windows 10 1709 - 1909 (89%), Microsoft Windows 10 1809 - 2004 (89%), Microsoft Windows 11 21H2 (89%), Microsoft Windows 10 1703 (89%), Microsoft Windows Server 2012 (89%), Windows Server 2022 (89%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-01-18T01:01:13
|_ start_date: N/A
|_clock-skew: 18m34s Enumeration: SMB Port 139/445/tcp
crackmapexec shows that the hostname os PRINTER.return.local, and I need auth to get any additional information from SMB:
Enumeration: MSRPC Port 135/tcp
Enumeration: HTTP Port 80/tcp
The site is the “HTB Printer Admin Panel”: http://10.10.11.108/index.php
“Settings” leads to /settings.php, which presents a form: http://10.10.11.108/settings.php
The “Fax” and “Troubleshooting” links don’t go anywhere.
SOURCE CODE: view-source:http://10.10.11.108/index.php
BURP: Everything points to this site being written in PHP, including the page extensions and the response headers: http://10.10.11.108
WIRESHARK: intercept and review packets
DIR BRUTE: I’ll run feroxbuster against the site, and include -x php since I know the site is PHP as well as a lowercase wordlist since IIS is case-insensitive:
NIKTO:
Shell as svc-printer
LDAP Credentials: My first thought on seeing the settings.php page is that it’s populating the “Password” field for me. This could be a case where the actual password is being populated into this field, and it’s just being displayed as *. But looking in Firefox dev tools, it’s actually pre-filling that field with all *, not the password
Request: When I submit this form, it sends a POST to /settings.php. The POST body only has one argument:
The other three fields in the form are not even sent. If the page does anything with this input, the user can only change the host (or “ip”), and not the port, username, or password.
Watch Request: I’ll change the hostname to my tun0 IP, and start nc listening on port 389. I’ll also start Wireshark. On clicking “Update”, there’s a connection at nc:
It’s probably clear from just that what the username and password that it’s trying to authenticate, but Wireshark breaks it out more nicely:
It’s an LDAP bindRequest, with the username return\svc-printer and the simple authentication (password) of “1edFg43012!!”.
WinRM: The obvious next step is to look at LDAP, but before that, I’ll check and see if these creds happen to give more direct access. They work for SMB:
Most interestingly, they also work for WinRM:
I’ll use Evil-WinRM to connect and get a shell:
Shell as SYSTEM
Enumeration: This account has a few interesting privileges:
There’s a bunch of stuff here that could lead to SYSTEM access. I’ve shown using SeBackupPrivilege to get arbitrary file read. SeMachineAccountPrivilege allows me to add a machine to the domain, and I could likely escalate there as well.
Groups: This user is also in several groups:
There may be others of interest, but Server Operators jumps out immediately. This group can do a lot of things:
A built-in group that exists only on domain controllers. By default, the group has no members. Server Operators can log on to a server interactively; create and delete network shares; start and stop services; back up and restore files; format the hard disk of the computer; and shut down the computer. Default User Rights: Allow log on locally: SeInteractiveLogonRight Back up files and directories: SeBackupPrivilege Change the system time: SeSystemTimePrivilege Change the time zone: SeTimeZonePrivilege Force shutdown from a remote system: SeRemoteShutdownPrivilege Restore files and directories SeRestorePrivilege Shut down the system: SeShutdownPrivilege
Reverse Shell: This user can modify, start, and stop services, so I’ll abuse this by having it run nc64.exe to give a reverse shell. Cube0x0 has a nice post that includes many privesc techniques, including this one.
I’ll upload nc64.exe to Return:
Typically, I would want to get a list of services that this account can modify, but it seems this user doesn’t have access to the Service Control Manager:
Going in a bit blind, I’ll try the one that Cube0x0 shows in the post:
It works! I’ll try to stop the service, but it’s not started. Then I’ll start it:
Last updated