Craft2

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.197.188
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-05 23:51 +08
Nmap scan report for 192.168.197.188
Host is up (0.17s latency).
Not shown: 65531 filtered tcp ports (no-response)
PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
445/tcp   open  microsoft-ds
49666/tcp open  unknown

This is a continuation of the original Craft machine, and it appears that SMB is open for this machine. The last machine was pretty minimalist, so I think we might need this later.

ODT Macro Fail -> NTLM Steal

The website is largely the same as the previous one. However, when we try to upload a ODT file, we get some additional information:

It appears that macros will not work again. Since SMB is open on this machine, I googled 'LibreOffice SMB Exploit' and this was the first result:

LogoLibreOffice/Apache Office Writer SMB Connection information disclosurevuldb.com

There was a public exploit available for it, and I found that rather interesting. Using searchsploit returns the exploit PoC:

When using it, it states that we can steal NetNTLM creds using this:

The script also generates the file bad.odt for us to upload. I started a responder instance and uploaded the file. After a while, responder would capture a hash:

This hash can be cracked immediately to get the password for the user:

SMB Shares -> Upload Web Shell

There wasn't SSH or WinRM open on the system, so instead, let's try to enumerate SMB using these credentials.

smbmap reveals that we can read some shares:

The WebApp one looked like the next stage. We can connect to it and view the files:

The previous machine Craft allowed us to upload webshells to the web directory, and it works here too:

We can then easily get a reverse shell by downloading nc.exe onto the machine and executing it.

Privilege Escalation

This time, the apache user had no abusable privileges, and there was nothing much about the current user.

RunasCs.exe -> Lateral Movement Fail

We still had thecybergeek password, and this is abusable using RunasCs.exe.

LogoGitHub - antonioCoco/RunasCs: RunasCs - Csharp and open version of windows builtin runas.exeGitHub

The user had nothing interesting though.

MySQL Arbitrary Write -> WerTrigger

I checked the ports open on the machine, and found quite a few such as HTTPS and MySQL not publicly facing:

Interesting. We can forward this using chisel.exe.

Then, we can access the MySQL database:

However, there was literally nothing in the database. Instead, let's view our privileges:

We seem to have all privileges enabled on the machine, and we can also read all files on the machine:

This was interesting, because it confirmed that we are running MySQL as the Administrator. However, we cannot execute commands as the exec module is just not present within the machine:

Since we can use load_file, this means we can also move files all over the place, giving us privileged file write over the machine:

This opens up quite a few exploits to getting an administrator shell, such as the WerTrigger exploit.

LogoGitHub - sailay1996/WerTrigger: Weaponizing for privileged file writes bugs with windows problem reportingGitHub

To exploit this, we would need to have these files within a directory we control:

Afterwards, using the MySQL instance, we can place the phoneinfo.dll file into C:\Windows\System32.

Afterwards, just run WerTrigger.exe and our reverse shell command:

This would execute the command as the SYSTEM user:

Interesting root!

PreviousCraftNextDVR4

Last updated