Bounty
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.85.240
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 08:57 EDT
Nmap scan report for 10.129.85.240
Host is up (0.012s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open httpThis is a pretty old machine AND its running Windows, so there's probably some kind of IIS exploit here.
File Upload
The web application just shows an image of a wizard:
A quick check on the requests reveals this is running Microsoft-IIS/7.5.
We can run a quick gobuster scan with aspx,html,txt extensions, and find a few files.
The ASPX page was a simple file upload.
I tried to upload an ASPX reverse shell, but it gives me an Invalid File error.
This can be bypassed via NULL byte by appending %00.jpg to the end of the filename in Burp.
However, when trying to view the file at /UploadedFiles/rev.aspx, it returns an error instead of a shell.
So uploading ASPX files doesn't work. But how about web.config files? It is possible to upload one that has VBScript embedded within it to execute commands. This is because we can potentially overwrite the existing web.config file and replace it with ours that executes commands.
Here's the file I used:
This would download a simple Powershell reverse shell from our device. We can directly upload the web.config file without bypassing any file extension checks. Afterwards, visiting the /UploadedFiles/web.config directory would make the machine download and run the script, giving us a reverse shell.
We can grab the user flag.
Privilege Escalation
MS15-051
I did a quick check on the machine's OS by running systeminfo.
This was running Windows Datacenter 2008 and had no hotfixes applied. This means it is vulnerable to MS15-051.
We can download the exploit and nc.exe to the machine via Powershell and run exploit.exe like this:
This would give us a reverse shell as SYSTEM.
Rooted!