Jacko

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.197.66
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-04 18:07 +08
Nmap scan report for 192.168.197.66
Host is up (0.17s latency).
Not shown: 65520 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
80/tcp    open     http
135/tcp   open     msrpc
139/tcp   open     netbios-ssn
445/tcp   open     microsoft-ds
5040/tcp  open     unknown
8082/tcp  open     blackice-alerts
9092/tcp  open     XmlIpcRegSvc
41213/tcp filtered unknown
49664/tcp open     unknown
49665/tcp open     unknown
49666/tcp open     unknown
49667/tcp open     unknown
49668/tcp open     unknown
49669/tcp open     unknown
57199/tcp filtered unknown

Lots of ports. I did a detailed nmap scan to further enumerate the ports. We would find a H2 Instance on one of the ports from this scan:

The H2 Database does have a few code execution exploits that might work.

H2 Database -> RCE

Port 8082 shows us the login to the H2 database.

We can just click 'Connect', and login successfully.

This version has code execution exploits available:

To exploit this, we would need to just copy and paste the script contents of the searchsploit file twice, and we would get RCE:

To get a reverse shell, simply use these 2 commands with a msfvenom generated payload.

whoami.exe is located in C:\Windows\System32, and this machine has a broken PATH variable.

Privilege Escalation

PrintSpoofer Fail

We can check our privileges using whoami.exe:

The SeImpersonatePrivilege is enabled, so we can use PrintSpoofer.exe to exploit this. First, let's download the binary to the machine:

However, the exploit seems to fail:

So we have to find another way.

GodPotato.exe

We can try using GodPotato.exe since that privilege is probably the intended solution:

Looks like it works well. Now we can download nc.exe onto the machine and get ourselves another reverse shell.

This is a SYSTEM shell, and we can grab the required flags. Rooted!

PreviousInternalNextKevin

Last updated