search

DVR4

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 -Pn 192.168.201.179
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-08 14:10 +08
Nmap scan report for 192.168.201.179
Host is up (0.17s latency).
Not shown: 65522 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5040/tcp  open  unknown
7680/tcp  open  pando-pub
8080/tcp  open  http-proxy
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown

SSH is open on this Windows machine, so let's take note of that.

hashtag
Argus Surveillance -> LFI SSH Key

Port 8080 hosted an Argus Surveillance instance:

There are quite a few exploits for this software:

The LFI one looks the easiest to exploit, and it involves using curl:

It works, so now we just need to find out what to read. I know that SSH is open, so we should be looking for a SSH private key of some user. On the website, we can view the users to see 2:

viewer is one them, and we can try to read their private key:

Using this, we can ssh into the machine as viewer:

hashtag
Privilege Escalation

hashtag
Password Decryption -> SYSTEM Shell

I tested the LFI in reading the administrator flag, and it actually worked:

This means that the application is being run by the administrator instead of viewer. There were other exploits that we didn't use yet. I found that the Weak Password Encryption was one of them. This involved reading the password hash from the configuration files of Argus.

We can decrypt this hash easily using the script:

The last character is unknown. When looking at the script, it doesn't seem to map special characters within the dictionary. In this case, we can create a wordlist of the special characters.

Afterwards, we can attempt to brute force the ssh access using hydra:

However, this didn't work for some reason, so maybe the administrator does not have SSH access. Instead, I brute forced the passwords one by one with RunasCs.exe to check which worked.

Eventually one worked:

Great! Now we just need to get a reverse shell. The exploits earlier have the x86 tag, meaning that this is a 32-bit Windows computer and we should be using nc32.exe for a reverse shell.

Then, we just need to execute it:

PreviousCraft2NextHeist

Last updated