Driver
Last updated
Last updated
Nmap scan:
Interestingly, WinRM is open.
Port 80 requires credentials to access.
I tested weak credentials of admin:admin, and it worked. The page is some type of printer service panel.
The only working part is the Firmware Updates, which redirects us to this page:
This would take any file and upload them to the file share, and a user would open it. Because it uploads to SMB, we can create a malicious SCF File to exploit this.
This uses the SCF file to access our machine via SMB, and responder would capture the hash. Create an SCF file like so and start responder.
Once uploaded, responder would capture a hash:
This can be cracked easily:
We can then log in using evil-winrm since port 5985 is open.
I ran a WinPEAS scan to enumerate for me. While reading the output, we can see that there's Powershell history files:
Here's the file content:
This, combined with the box name was a hint that we had to expoloit this specific driver somehow. I could only find Metasploit exploits, so let's use that. First we have to generate a Meterpreter reverse shell.
Then, we need to upload it and start exploit/multi/handler.
Then, we need to first run migrate -N explorer.exe , then background this and use the exploit/windows/local/ricoh_driver_privesc module. Then, run the following:
Afterwards, we would get a shell as the SYSTEM user.
Rooted!
