search

Omni

hashtag
Gaining Access

Nmap scan:

hashtag
Port 8080

Port 8080 requires credentials to access:

I did a detailed scan on port 8080, and found that it was running Windows Device Portal:

Windows Device Portal is related to IoT devices and it allows users to configure devices using it.

LogoWindows Device Portal - Windows IoTMicrosoftLearnchevron-right

So Googling for Windows Device Portal exploits led me to this:

LogoGitHub - SafeBreach-Labs/SirepRAT: Remote Command Execution as SYSTEM on Windows IoT Core (releases available for Python2.7 & Python3)GitHubchevron-right

It seems that this is a Remote Access Trojan script that can be used to achieve RCE on the machine. I tested it using powershell -c ipconfig, and it worked well.

We can use this to gain a reverse shell easily using nc.exe. This reverse shell would give us a SYSTEM shell, which is unique because we are already the administrator.

hashtag
User Flag

When trying to read the user flag, this is what we get:

The usage of PSCredential there means that the flag has been encrypted with the user's password. Since we are the SYSTEM user, what we can do is copy over the security, sam and system registry folders and use secretsdump.py on it.

This would give us a load of hashes. We can then use john to crack the hash for app, and find that it is mesh5143. Since we have the password, we can decrypt this to get the flag.

hashtag
Privilege Escalation

The administrator flag was also encrytped using the same method, so we have to find the administrator password. We can do the same thing to get the administrator flag.

Weird machine, but I do appreciate the unique flags.

PreviousNodeBlogNextOpenAdmin