Bastard

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.84.254
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-30 04:29 EDT
Nmap scan report for 10.129.84.254
Host is up (0.0072s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
49154/tcp open  unknown

Drupal

Port 80 was a Drupal Instance:

This box is really old, the intended exploit is to use Drupal Module RCE. Here's the PoC:

LogoDrupal 7.x Module Services - Remote Code ExecutionExploit Database

We need to edit the top of the script to have the correct URL and endpoints accordingly:

Then, we can run the exploit:

We now have RCE, and getting a reverse shell can be done through nc.exe.

Grab the user flag.

Privilege Escalation -> Kernel

This is a really old machine, so tehre's bound to be some Windows Kernel exploit that we can use.

SeImpersonatePrivilege is also enabled, making this an easy exploit. For this particular case, we can use MS15-051.

Logowindows-kernel-exploits/MS15-051/MS15-051-KB3045171.zip at master · SecWiki/windows-kernel-exploitsGitHub

When run, we can see that it works:

We can run another reverse shell easily:

Rooted!

PreviousBartNextBook

Last updated