Access

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 -Pn 192.168.201.187
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-08 14:45 +08
Nmap scan report for 192.168.201.187
Host is up (0.17s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49666/tcp open  unknown
49667/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown
49671/tcp open  unknown
49697/tcp open  unknown

This looks to be an AD machine because of Kerberos. We can do a detailed scan on the ports that matter:

We can take note of the domain name access.offsec and add it to our /etc/hosts file.

Port 80 -> File Upload Fail

Port 80 hosted an event site:

The entire site looked static, except for the buy tickets part:

We could upload files using this system. I ran a gobuster scan on this site and proxied traffic through Burpsuite. There weren't many interesting directories:

Earlier, our detailed nmap scan picked up on the HTTP Server Header having 'PHP/8.0.7' within it, which means that we should be attempting to upload PHP web shells.

Attempting to upload files ending in .php result in this:

This is bypassable using a null byte:

However, when we view our file, it does not execute our code.

.htaccess Overwrite -> RCE

I found this pretty weird, why would NOT be executing PHP? I googled for what can block PHP execution on websites, and it brought me to this page detailing about how the .htaccess file can do that:

LogoHow to Disable PHP Execution in Certain WordPress DirectoriesWPBeginner

Since we have an LFI, we can try to overwrite the current .htaccess file. This file sort of 'executes' for the directory it is in. So if we upload a .htaccess file to the /uploads directory allowing PHP exeuction, it should allow webshells to work within the /uploads directory only.

We can upload this file:

Then, we can upload our PHP webshell as cmd.gif, which would work properly now:

Then, we can get a reverse shell using nc64.exe.

Privilege Escalation

Kerberoast -> svc_mssql Shell

We cannot grab the user flag just yet. Within the C:\Users directory, there's another service user present:

We can check whether this user has an SPN for us to Kerberoast using setspn.exe, which is a built-in Windows binary:

This user is indeed kerberoastable. We don't have any credentials, so this needs to be done on the domain itself. We can use Rubeus.exe for this.

Afterwards, we can transfer this back to our machine and crack it:

The svc_mssql user is not part of the Remote Management Group, so we have to get a shell via RunasCs.exe.

Then, download another copy of nc64.exe and execute it to get another reverse shell:

SeManageVolumePrivilege -> WerTrigger

This user has the SeManageVolumePrivilege enabled:

There are repositories (including one made by the creator of this box) available to exploit this:

LogoGitHub - CsEnox/SeManageVolumeExploitGitHub

When run, it gives us full permissions over the entire file system:

Using this, we can actually exploit WerTrigger to get an administrator shell.

Rooted!

PreviousWindowsNextAlgernon

Last updated