Symbolic

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.202.177
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-06 20:55 +08
Nmap scan report for 192.168.202.177
Host is up (0.17s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

SSH was open on this machine, which was unusual for Windows.

WebPage to PDF -> LFI

Port 80 was rather simple:

I created a HTML file with one word within it, then hosted it on my HTTP server and submitted the URL with my IP. This returned a PDF:

I downloaded the PDF and used exiftool on it to enumerate any version:

Googling exploits for this version show that LFI is a possibility:

Logowkhtmltopdf File Inclusion VulnerabilityVirtue Security
LogoJoshuaMart - OverviewGitHub

The exploit here is the content of the HTML file being used. Here's my PoC:

When we host this HTML file on a HTTP server and use the website's converting feature, this is what we are returned:

This confirms that LFI works. We can edit the PoC to show all the content:

Now, we just need to find the correct file to read. The website gives us a username p4yl0ad, and SSH is open, so let's try to read the user's private key.

Using this, we can ssh in as the user:

Privilege Escalation

Backup Script -> Symbolic Link Write

There was a C:\backup directory with a script in it:

There was a backup directory being updated, and this script was running once every minute or so. The script is also owned by the administrator:

We also have write access over C:\xampp\htdocs\logs\request.log, meaning that we can create a symbolic link to make the script read and copy any file we want. Again, since SSH is open, we can attempt to get the admin's private key.

First we need to delete the logs directory:

We cannot create a symbolic link to the private SSH key using conventional means because we aren't given access:

We can create a junction however:

But the above won't work. What worked was CreateSymlink.exe from this repo:

LogoGitHub - googleprojectzero/symboliclink-testing-toolsGitHub

We can download and upload that binary. Then, we can run it:

I waited for a while and then deleted the symlink. When we check the C:\backup\logs directory's newest file that is significantly larger than the rest, we find an SSH key:

Then, use this key to ssh in as the administrator:

PreviousSquidNextVault

Last updated