Algernon —Proving Ground Practic eSmarterMail CVE-2019–7214 Windows

Hello, I’m Ashok, as a part of my OSCP certification preparation doing the Proving Ground Practice Windows easy box so it has one CVE.

Takeouts from this blog

Today we see the walkthrough of Algernon in this box, we will learn about FTP anonymous login is allowed to download all files from it, SmarterMail(CVE-2019–7214), Remote Code Execution.

Nmap

nmap -sC -sV --open -p- -A -T4 -Pn -oN Nmap_Algernon 192.168.104.65

Nmap scan -sC for default scripts, -sV for version enumeration of ports, — open it will run scripts on open ports, -A aggressive scan, -T4 faster scan, -Pn don’t ping the host directly start the scan, -oN save the output in text file.

# Nmap 7.94SVN scan initiated Tue Nov  5 19:26:08 2024 as: /usr/lib/nmap/nmap --privileged -sC -sV --open -p- -A -T4 -Pn -oN Nmap_Algernon 192.168.104.65
Nmap scan report for 192.168.104.65
Host is up (0.14s latency).
Not shown: 65380 closed tcp ports (reset), 141 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 04-29-20  09:31PM       <DIR>          ImapRetrieval
| 11-05-24  05:22PM       <DIR>          Logs
| 04-29-20  09:31PM       <DIR>          PopRetrieval
|_04-29-20  09:32PM       <DIR>          Spool
| ftp-syst: 
|_  SYST: Windows_NT
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
5040/tcp  open  unknown
9998/tcp  open  http          Microsoft IIS httpd 10.0
| uptime-agent-info: HTTP/1.1 400 Bad Request\x0D
| Content-Type: text/html; charset=us-ascii\x0D
| Server: Microsoft-HTTPAPI/2.0\x0D
| Date: Wed, 06 Nov 2024 01:29:20 GMT\x0D
| Connection: close\x0D
| Content-Length: 326\x0D
| \x0D
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">\x0D
| <HTML><HEAD><TITLE>Bad Request</TITLE>\x0D
| <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>\x0D
| <BODY><h2>Bad Request - Invalid Verb</h2>\x0D
| <hr><p>HTTP Error 400. The request verb is invalid.</p>\x0D
|_</BODY></HTML>\x0D
| http-title: Site doesn't have a title (text/html; charset=utf-8).
|_Requested resource was /interface/root
|_http-server-header: Microsoft-IIS/10.0
17001/tcp open  remoting      MS .NET Remoting services
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
No OS matches for host
Network Distance: 4 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-11-06T01:29:24
|_  start_date: N/A
|_clock-skew: -2s

TRACEROUTE (using port 135/tcp)
HOP RTT       ADDRESS
1   227.23 ms 192.168.45.1
2   227.00 ms 192.168.45.254
3   228.43 ms 192.168.251.1
4   228.39 ms 192.168.104.65

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Nov  5 19:29:38 2024 -- 1 IP address (1 host up) scanned in 211.15 seconds

Using Nmap open ports result

Port 80 anonymous some directories

Port 135 msrpc

Port 139, 445 SMB

Port 9998 HTTP Smarter Mail

Port 49154 msrpc

Port 21

Logged in using ftp port using anonymous login, downloaded all the files

wget -m --no-passive ftp://anonymous:anonymous@192.168.104.65

After downloading ther are some log files in that admin user trying to log in.

Port 80

Default IIS Page.

Port 9998

SmarterMail is the Microsoft Exchange alternative because it is the only other e-mail server on the market with native support for MAPI, the protocol that powers Exchange and Outlook. That means anything you can do on Exchange you can do with SmarterMail: no plug-ins and no additional software required.

Get Ashok’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

There is a login page with SmarterMail

Let’s try the exploits in Kali using searchsploit

Found that https://www.exploit-db.com/exploits/49216

Change the Target IP address and LHOST as your kali linux IP address and port number as you wish.

For running the exploit run the python script, before that listen to the port you have given in my case I gave port 4444.

1. In one tab run the Python script.
2. Another tab try to listen to the port

#One tab run the python CVE
python3 49216.py
# Listen in kali port
rlwrap nc -nlvp 4444

Directly got admin access. Webmail is running with administrative privileges, Let's grab the proof flag

For the practice of OSCP run commands whoami, proof, ipconfig.

Thanks for reading the entire article, Until then good luck.

Please feel free to reach out to me Linkedin