Return

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.95.241 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-05 02:24 EDT
Nmap scan report for 10.129.95.241
Host is up (0.0073s latency).
Not shown: 65512 closed tcp ports (conn-refused)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49671/tcp open  unknown
49674/tcp open  unknown
49675/tcp open  unknown
49678/tcp open  unknown
49681/tcp open  unknown
49698/tcp open  unknown

SMB Enum

enum4linux returned nothong of interest with both null and guest credentials.

LDAP

ldapsearch returns nothing because we have no credentials.

HTTP -> Printer Creds

There is a HTTP port open, and when viewed, it shows a Printer Admin Panel:

When we view the settings, this is what we see:

This looks poisanable since we can control the server address. As such, I started responder.

We now have some credentials. We can use these to login with evil-winrm.

We can grab the user flag.

Privilege Escalation

SeBackupPrivilege Fail

When we check our privileges, we see that we have a lot:

With this, we can save the system and sam files, then dump the hashes with secretsdump.py.

Afterwards, we can dump hashes:

However, when trying to pass the hash, it seems that this doesn't work.

Services Exploit

When we check which groups we are part of in the machine, we see that svc-printer is part of Server Operators.

We can also check the services running with services.

Since we have privileges over some of the services, we can follow this article online to execute a reverse shell via nc.exe as SYSTEM.

LogoWindows Privilege Escalation: Server Operator GroupHacking Articles

However, it seems that although we have privileges over these services, we cannot restart them for some reason. So we need to find a service that is currently stopped, then change its configuration and start it.

Again, we fail in this aspect because we don't have access to the Service Control Manager to view what we can control. So in this case, I used a writeup and saw that they used the VSS service to do the exploit.

I wasn't too sure how they got to using this. Anyways, we can configure it like so:

This would create a reverse shell on our listener port:

PreviousRemoteNextRouterSpace

Last updated