AuthBy
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 3000 -Pn 192.168.160.46
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-13 14:56 +08
Nmap scan report for 192.168.160.46
Host is up (0.17s latency).
Not shown: 65531 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
242/tcp open direct
3145/tcp open csi-lfap
3389/tcp open ms-wbt-serverI didn't didn't recognise prot 242 and 3145, so I ran a detailed scan on them.
$ sudo nmap -p 242,3145 -sC -sV --min-rate 3000 192.168.160.46
[sudo] password for kali:
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-13 14:57 +08
Nmap scan report for 192.168.160.46
Host is up (0.17s latency).
PORT STATE SERVICE VERSION
242/tcp open http Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
|_http-title: 401 Authorization Required
|_http-server-header: Apache/2.2.21 (Win32) PHP/5.3.8
| http-auth:
| HTTP/1.1 401 Authorization Required\x0D
|_ Basic realm=Qui e nuce nuculeum esse volt, frangit nucem!
3145/tcp open zftp-admin zFTPServer admin
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsFTP Anonymous Access -> .htpasswd
The FTP service on port 21 accepts anonymous logins:
The accounts folder is the most interesting:
We cannot download these files, but now we know there's also an admin and offsec user. I tried re-logging in using admin:admin, and it worked:
We can crack the hash within .htpasswd:
We can then login to the web application hosted on port 242:
RCE
I put a cmd.php file in the admin FTP folder, and it worked in getting RCE:
The machine didn't have powershell, so I generated a reverse shell payload:
Placed it within the FTP server and executed it using my webshell:
Privilege Escalation
SeImpersoantePrivilege -> Potato
This user had the SeImpersonatePrivilege enabled:
I tried transferring x64 binaries over, but they didn't work, indicating that the machine was x86. As such, I transferred juicypotatox86.exe and nc32.exe over to exploit this. We can dowload files using certutil.
We can then run nc.exe as the SYSTEM user using Juicy Potato:
Last updated