search

Return

Windows:

hashtag
Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.11.108

53/tcp   open  domain        Simple DNS Plus

80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: HTB Printer Admin Panel

88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-18 01:00:22Z)

135/tcp  open  msrpc         Microsoft Windows RPC

139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn

389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)

445/tcp  open  microsoft-ds?

464/tcp  open  kpasswd5?

593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0

636/tcp  open  tcpwrapped

3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)

3269/tcp open  tcpwrapped

Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10|Vista|11|2012|2022|Longhorn|7|8.1|XP (93%)
OS CPE: cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7:::ultimate cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_xp::sp3
Aggressive OS guesses: Microsoft Windows Server 2019 (93%), Microsoft Windows 10 2004 (90%), Microsoft Windows Vista SP1 (90%), Microsoft Windows 10 1709 - 1803 (89%), Microsoft Windows 10 1709 - 1909 (89%), Microsoft Windows 10 1809 - 2004 (89%), Microsoft Windows 11 21H2 (89%), Microsoft Windows 10 1703 (89%), Microsoft Windows Server 2012 (89%), Windows Server 2022 (89%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-01-18T01:01:13
|_  start_date: N/A
|_clock-skew: 18m34s

hashtag
Enumeration: SMB Port 139/445/tcp

crackmapexec shows that the hostname os PRINTER.return.local, and I need auth to get any additional information from SMB:

hashtag
Enumeration: MSRPC Port 135/tcp

hashtag
Enumeration: HTTP Port 80/tcp

The site is the “HTB Printer Admin Panel”: http://10.10.11.108/index.phparrow-up-right

“Settings” leads to /settings.php, which presents a form: http://10.10.11.108/settings.phparrow-up-right

The “Fax” and “Troubleshooting” links don’t go anywhere.

SOURCE CODE: view-source:http://10.10.11.108/index.php

BURP: Everything points to this site being written in PHP, including the page extensions and the response headers: http://10.10.11.108arrow-up-right

WIRESHARK: intercept and review packets

DIR BRUTE: I’ll run feroxbuster against the site, and include -x php since I know the site is PHP as well as a lowercase wordlist since IIS is case-insensitive:

NIKTO:

hashtag
Shell as svc-printer

LDAP Credentials: My first thought on seeing the settings.php page is that it’s populating the “Password” field for me. This could be a case where the actual password is being populated into this field, and it’s just being displayed as *. But looking in Firefox dev tools, it’s actually pre-filling that field with all *, not the password

Request: When I submit this form, it sends a POST to /settings.php. The POST body only has one argument:

The other three fields in the form are not even sent. If the page does anything with this input, the user can only change the host (or “ip”), and not the port, username, or password.

Watch Request: I’ll change the hostname to my tun0 IP, and start nc listening on port 389. I’ll also start Wireshark. On clicking “Update”, there’s a connection at nc:

It’s probably clear from just that what the username and password that it’s trying to authenticate, but Wireshark breaks it out more nicely:

It’s an LDAP bindRequest, with the username return\svc-printer and the simple authentication (password) of “1edFg43012!!”.

WinRM: The obvious next step is to look at LDAP, but before that, I’ll check and see if these creds happen to give more direct access. They work for SMB:

Most interestingly, they also work for WinRM:

I’ll use Evil-WinRM to connect and get a shell:

LogoGitHub - Hackplayers/evil-winrm: The ultimate WinRM shell for hacking/pentestingGitHubchevron-right

hashtag
Shell as SYSTEM

Enumeration: This account has a few interesting privileges:

There’s a bunch of stuff here that could lead to SYSTEM access. I’ve shown using SeBackupPrivilege to get arbitrary file read. SeMachineAccountPrivilege allows me to add a machine to the domain, and I could likely escalate there as well.

Groups: This user is also in several groups:

There may be others of interest, but Server Operators jumps out immediately. This group can do a lot of things:

LogoWindows Built-in Users, Default Groups and Special Identities - Windows CMD - SS64.comss64.comchevron-right

A built-in group that exists only on domain controllers. By default, the group has no members. Server Operators can log on to a server interactively; create and delete network shares; start and stop services; back up and restore files; format the hard disk of the computer; and shut down the computer. Default User Rights: Allow log on locally: SeInteractiveLogonRight Back up files and directories: SeBackupPrivilege Change the system time: SeSystemTimePrivilege Change the time zone: SeTimeZonePrivilege Force shutdown from a remote system: SeRemoteShutdownPrivilege Restore files and directories SeRestorePrivilege Shut down the system: SeShutdownPrivilege

Reverse Shell: This user can modify, start, and stop services, so I’ll abuse this by having it run nc64.exe to give a reverse shell. Cube0x0 has a nice post that includes many privesc techniques, including this one.

https://cube0x0.github.io/Pocing-Beyond-DA/cube0x0.github.iochevron-right

I’ll upload nc64.exe to Return:

Typically, I would want to get a list of services that this account can modify, but it seems this user doesn’t have access to the Service Control Manager:

Going in a bit blind, I’ll try the one that Cube0x0 shows in the post:

It works! I’ll try to stop the service, but it’s not started. Then I’ll start it:

PreviousDriverNextTimelapse

Last updated