search

Craft

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.197.169
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-05 23:30 +08
Nmap scan report for 192.168.197.169
Host is up (0.18s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE
80/tcp open  http

hashtag
OpenOffice Macros -> Shell

The HTTP site was a Lorem Ipsum website:

If we scroll down, we can see that there is a file upload for our 'resume'.

I tried to upload an image, and this triggered an error:

An ODT file is similar to a Microsoft Word document, which can be created using libreoffice. Seeing that we can only upload ODT files, this machine might have a script opening the files and being able to trigger some macros embedded within the file.

We can use msfconsole to generate this file:

Afterwards, we can upload this file to the machine and wait for the script to open it:

Resume this sesison to drop into our shell:

hashtag
Privilege Escalation

hashtag
Apache User Shell

When checking the users present, we can see that there's an apache user:

The next step might be to get a shell as this user. Since there's a website being hosted on the machine, we can start there. I found that we can write to the webroot folder:

As such, we can drop a cmd.php webshell within this file and verify that we have RCE as apache:

We can then download nc64.exe onto the machine and get a shell as apache:

hashtag
SeImpersonatePrivilege

This user has the SeImpersonatePrivilege enabled:

We can use godpotato.exe to exploit this:

Rooted!

PreviousButchNextCraft2

Last updated