Relevant Writeup | TryHackMe
ENUMERATON
Nmap
We do an Nmap scan and find the following ports open on the target machine.
Directory busting
We performed a subdirectory enumeration using dirb and its default wordlist, and we did not find any interesting directories.
VULNERBILITY ANALYSIS
Microsoft IIS
The version of IIS on target is httpd 10.0 . No interesting exploits found.
SMB
From our nmap scans, we know that the target is runing a windows server. Lets utilize some additional script scans to get more information about smb.
After we run smb-protocols, we find that SMBv1 is supported on the target network. Maybe a possible eternal blue?
The target smb allows anonymous access on some of its shares. Lets enumerate all these shares.
nmap -p445 — script smb-enum-shares <ip>
Finally, we found an interesting file called passwords.txt in the nt4wrksv share.
smbclient //10.10.229.211/nt4wrksv
We are able to find 2 hashed passwords in this file.
We quickly identify from the format that both of these are base 64 encoded strings. Lets decode it using online decoders.
And these are the decoded strings. They look like some sort of credentials. We try this to get an rdp session but it didnt work.
I tried a lot of things and I couldnt find any vulnerability using the info that we gathered till now. So i decided to go back to basics and do a deeper nmap scan on all the ports , since the default scan only scans the 1000 most common ports.
Get Asad Parkar’s stories in your inbox
Join Medium for free to get updates from this writer.
And… we were right. After doing a full port scan on the target we find some additional open ports.
nmap -p- target
Lets further enumerate these ports to enumerate if we find anything.
nmap -p49663,49666,49668 -sV 10.10.229.211
We perform service version scans on the newly found ports and we finally found something interesting that we missed. Another web server is running on port 49663.
And we are indeed right. After visiting this port in the browser, we see the same web page. Lets perform a gobuster again.
After running gobuster, we find the following subdirectory
/nt4wrksv/
Did you notice something ? This is the same name as the share we earlier accessed. Lets visit this route.
Initially nothing is found in this route.
But since this was also a share, lets try accessing one of the files that we downloaded earlier. And we were right, we are able to view the contents of passwords.txt.
So basically, we are able to execute any files present on the nt4wrksv share. We could use this to gain an initial access.
EXPLOITATION
Now, Lets upload a reverse asp shell and upload it to the share ( since we have read and write access to it). We can then run it by going to its route on the browser.
After we have uploaded a reverse shell to the share, lets start a netcat listener on the mentioned port.
Now we visit the /shell.aspx route on the browser and that should create our reverse connection to the target.
We got our user flag
PRIVILEGE ESCALATION
Lets look at what privileges our current account has.
Hmm.. Interesting .. we have the SeImpersonatePrivilege. Maybe we could try a token impersonatation attack. But an impersonation attack will fail as there are no tokens to impersonate.
We ll use an exploit called printsspoofer.exe to exploit the Impersonate Privilege.
We upload the PrintSpoofer.exe via smb to the target.
Now we simply execute this exe file on the shell which we gained earlier.
And boom! We get an NT Authority privileged windows shell.
We can now access the root.txt flag.
