Craft
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 4000 192.168.197.169
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-05 23:30 +08
Nmap scan report for 192.168.197.169
Host is up (0.18s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open httpOpenOffice Macros -> Shell
The HTTP site was a Lorem Ipsum website:
If we scroll down, we can see that there is a file upload for our 'resume'.
I tried to upload an image, and this triggered an error:
An ODT file is similar to a Microsoft Word document, which can be created using libreoffice. Seeing that we can only upload ODT files, this machine might have a script opening the files and being able to trigger some macros embedded within the file.
We can use msfconsole to generate this file:
Afterwards, we can upload this file to the machine and wait for the script to open it:
Resume this sesison to drop into our shell:
Privilege Escalation
Apache User Shell
When checking the users present, we can see that there's an apache user:
The next step might be to get a shell as this user. Since there's a website being hosted on the machine, we can start there. I found that we can write to the webroot folder:
As such, we can drop a cmd.php webshell within this file and verify that we have RCE as apache:
We can then download nc64.exe onto the machine and get a shell as apache:
SeImpersonatePrivilege
This user has the SeImpersonatePrivilege enabled:
We can use godpotato.exe to exploit this:
Rooted!
Last updated