Medjed

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.233.127           
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-30 20:31 +08
Nmap scan report for 192.168.233.127
Host is up (0.17s latency).
Not shown: 65484 closed tcp ports (conn-refused), 33 filtered tcp ports (no-response)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
5040/tcp  open  unknown
7680/tcp  open  pando-pub
8000/tcp  open  http-alt
30021/tcp open  unknown
33033/tcp open  unknown
44330/tcp open  unknown
45332/tcp open  unknown
45443/tcp open  unknown
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown

Loads of ports that are open. We can do a detailed scan to see what services are running on each application.

Loads of enumeration to do. This box was full of rabbit holes to enumerate.

Port 45332 -> PHPInfo

This page was some kind of quiz thing:

I noticed that the nmap scan tells me this is a PHP site. I ran a directory scan via gobuster and found the phpinfo.php file being present:

On the phpinfo.php page, we can find the DOCUMENT_ROOT variable:

There were also no disabled functions, which was great:

We might need some additional information from here later.

Rabbit Hole -> Port 8000

Port 8000 had a BarracudaServer instance:

It appears that we can set the administrator for this machine:

Apart from that, we could not do anything else on this website after running directory scans on it.

Rabbit Hole -> FTP Anonymous

Port 30021 allowed for anonymous access via FTP.

There wasn't much in this entire directory, as it included loads of random files and what not. I didn't know what to do with all of it, so I moved on first.

Port 33033 -> Login Bypass

This website had a corporate page of some sorts:

There was a login page:

Weak credentials don't work, and we cannot bypass this login using SQL Injection of any sort. The reset password option just leads us to another page:

I attempted to reset the password of the admin user, but it seems that it doesn't exist:

If were to try with some of the users on the main page, we would trigger a different error:

Here's the part I found incredibly stupid, we actually needed to brute force the users to find the correct 'reminder'. Here's the correct user after trying a load of them:

Once we reset this, we can login to view the dashboard:

SQL Injection -> RCE

Within the "Edit" function, we can see that there's a Request Profile SLUG option at the bottom:

This brings us to another page with a hint that MySQL was being used somehow:

If we enter ' into the URL field, we get an SQL error:

Interesting. Since we basically have an SQL Interpreter here, we can make it write a webshell in PHP onto the file system. Earlier, we found that the DOCUMENT_ROOT of one of the web applications was at C:\xampp\htdocs, which we can use.

We can then use this payload to write a webshell:

This would work, and then we can attempt to access this shell on port 45332.

We can then download nc64.exe onto the machine and get a reverse shell:

Privilege Escalation

WinPEAS -> Insecure Service Binary

I ran winPEAS.exe to enumerate for me. Firstly, we can find some credentials:

We can also find a possible service to exploit:

It appears that can modify bd.exe:

This is a Windows Service, so it is run by the SYSTEM user. We can make use of this by overwriting the file with our own reverse shell. First, generate our reverse shell payload:

Then, we can replace the bd.exe file and then restart the machine:

After a while, we should get a reverse shell once the machine starts up again as the SYSTEM user:

Rooted!

PreviousKevinNextNickel

Last updated