Remote

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.227.150
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-02 04:27 EDT
Warning: 10.129.227.150 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.227.150
Host is up (0.035s latency).
Not shown: 65026 closed tcp ports (conn-refused), 494 filtered tcp ports (no-response)
PORT      STATE SERVICE
21/tcp    open  ftp
80/tcp    open  http
111/tcp   open  rpcbind
135/tcp   open  msrpc
445/tcp   open  microsoft-ds
2049/tcp  open  nfs
5985/tcp  open  wsman
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49678/tcp open  unknown
49679/tcp open  unknown
49680/tcp open  unknown

NFS

Network File System was publicly available on port 2049, and this is not a port I see often. This service can have very interesting files and permissions, so let's enumerate it via showmount.

We can mount onto this and view the files inside:

We can go through each of the folders, and we would find an SDF file for Umbraco within App_Data, which normally contains hashes.

If we use strings on it, we would find a load of input. At the top, it seems that there are SHA1 hashes present:

The hash can be cracked via john.

So now we have some credentials at least.

Umbraco RCE

There were hints that Umbraco was used to host the sites, so let's view port 80. It seems to be a blog page:

The login page for the website is located at the /Umbraco directory. We can login with the credentials and email we found earlier.

After logging in, we can enumerate the version that it is running.

This version of Umbraco is vulnerable to an Authenticated RCE exploit:

We can use the PoC for the first one, and edit it for this machine.

Take note of the cmd and FileName parameter in the payload variable. In my case I just used Powershell to download and execute a reverse shell script.

Privilege Escalation

PowerUp

We can first enumerate our privileges as the user:

We see that we have a ton of privileges, and most importantly SeImpersonatePrivilege is enabled. This means that we probably have some cotnrol over services and this could be used for PE. I used PowerUp.ps1 to exploit this system.

We have control over the UsoSvc service. With this, we can run commands as the SYSTEM user. All we need to do is download nc.exe to the machine and run it as the administrator.

Rooted!

PreviousRedPandaNextReturn