Giddy

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.96.140 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-08 10:00 EDT
Nmap scan report for 10.129.96.140
Host is up (0.0083s latency).
Not shown: 65531 filtered tcp ports (no-response)
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
3389/tcp open  ms-wbt-server
5985/tcp open  wsman

Both RDP and WinRM are accessible on this machine, which is new.

SQLI -> Stacy Shell

Port 80 just shows a cute image:

I ran a gobuster scan on this, and found 2 directories:

Visiting it reveals a Windows Powershell Web Access page:

The MVC site reveals some online store:

When products are viewed, it loads this URL:

If we replace the number with a ' character, a lot of SQL errors are returned:

This is vulnerable to SQL injection. Googling any of the errors here reveals that this is MSSQL, which we can actually get RCE from through xp_cmdshell.

We can start responder and intercept the response by sending the above command:

Then we can crack this hash easily using john:

By right, this machine came our before evil-winrm, so the intentional route is to use the Remote Powershell Web Access to download and execute a reverse shell. I did it the evil-winrm way.

Privilege Escalation

Unifivideo

Within the Documents directory, there's one folder present:

Also, we can enumerate and see that Windows Defender is enabled for this machine, meaning any payload we use has to be obfuscated and encoded.

So we cannot run WinPEAS on this machine too. I decided to check if the Powershell history files were present still, because it could contain some good information, and it did exist:

Now we can exploit this.

LogoUbiquiti UniFi Video 3.7.3 - Local Privilege EscalationExploit Database

We need to create a reverse shell file that would bypass Windows Defender. I was a bit lazy, so I used msfconsole to generate this:

Afterwards, we just need to transfer this reverse shell over and name it as taskkill.exe within C:\programdata\unifi-video and then run the stop-service -name Unifivideoservice command.

Then, we would get a meterpreter shell on the listener:

Rooted!

PreviousFuseNextHaircut

Last updated