Silo

Reconnaissance:

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.82

80/tcp    open  http         Microsoft IIS httpd 8.5
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/8.5
| http-methods: 
|_  Potentially risky methods: TRACE

135/tcp   open  msrpc        Microsoft Windows RPC

139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn

445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds

1521/tcp  open  oracle-tns   Oracle TNS listener 11.2.0.2.0 (unauthorized)

49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC

49159/tcp open  oracle-tns   Oracle TNS listener (requires service name)

49160/tcp open  msrpc        Microsoft Windows RPC
49161/tcp open  msrpc        Microsoft Windows RPC

No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=12/16%OT=80%CT=1%CU=35875%PV=Y%DS=2%DC=I%G=Y%TM=657
OS:E5D23%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10E%TI=I%CI=I%II=I%SS=S
OS:%TS=7)SEQ(SP=104%GCD=2%ISR=10E%TI=I%CI=I%II=I%SS=S%TS=7)SEQ(SP=105%GCD=1
OS:%ISR=10D%TI=I%CI=I%II=I%SS=S%TS=7)OPS(O1=M53CNW8ST11%O2=M53CNW8ST11%O3=M
OS:53CNW8NNT11%O4=M53CNW8ST11%O5=M53CNW8ST11%O6=M53CST11)WIN(W1=2000%W2=200
OS:0%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O=M53CNW8NNS%
OS:CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%
OS:A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%
OS:DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%
OS:O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%
OS:W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G
OS:%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)

Network Distance: 2 hops
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:0:2: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: supported
| smb2-time: 
|   date: 2023-12-17T02:29:46
|_  start_date: 2023-12-17T02:23:51
|_clock-skew: mean: -2s, deviation: 0s, median: -3s

We have fifteen open ports.

  • Port 80: running Microsoft-IIS/8.5

  • Ports 135, 49152, 49153, 49154, 49155,49158, 49161 & 49162: running Microsoft Windows RPC

  • Ports 139 & 445: running Samba

  • Ports 1521 & 4196: running Oracle TNS listener

  • Ports 5985 & 47001: running Microsoft HTTP API httpd 2.0

Port 80 is running a Microsoft IIS server. A quick google search tells us that the OS is probably Windows Server 2012 R2. The gobuster scan didn’t really find anything useful for this web server.

Enumeration:

If you don’t have ODAT installed on kali, the installation instructions can be found:

LogoGitHub - quentinhardy/odat: ODAT: Oracle Database Attacking ToolGitHub
LogoPage not found - HackTricksbook.hacktricks.xyz

The first thing we need to enumerate is the Oracle System ID (SID) string. This is a string that is used to uniquely identify a particular database on a system. This can be done using the sidguesser module in ODAT.

This takes a while, but it does find 4 valid SID strings.

We discovered an SID called ‘XE’. Now let’s try finding valid credentials on this server:

Now we have valid credentials: user ‘scott’ and password ‘tiger’ for the server ID ‘XE’. We can use them to upload a reverse shell and execute it.

To do that first we need to prepare our EXE reverse shell using MSFvenom:

Now upload the reverse shell:

Start the NC listener on the port that we used with MSFvenom:

Finally, execute the shell:

Go back to your NC listener:

We are NT Authority\System.

PreviousGrandpaNextBounty

Last updated