HackPark
Bruteforce a websites login with Hydra, identify and use a public exploit then escalate your privileges on this Windows machine!
Scanning
Nmap
root@ip-10-10-168-173:~# nmap -A -T4 10.10.134.173
Starting Nmap 7.60 ( https://nmap.org ) at 2021-09-22 10:57 BST
Nmap scan report for ip-10-10-134-173.eu-west-1.compute.internal (10.10.134.173)
Host is up (0.00063s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-methods:
|_ Potentially risky methods: TRACE
| http-robots.txt: 6 disallowed entries
| /Account/*.* /search /search.aspx /error404.aspx
|_/archive /archive.aspx
|_http-server-header: Microsoft-IIS/8.5
|_http-title: hackpark | hackpark amusements
3389/tcp open ssl Microsoft SChannel TLS
. . .
[SNIP]
. . .
Running (JUST GUESSING): Microsoft Windows 2012 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2012
Aggressive OS guesses: Microsoft Windows Server 2012 (89%), Microsoft Windows Server 2012 or Windows Server 2012 R2 (89%), Microsoft Windows Server 2012 R2 (87%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE
HOP RTT ADDRESS
1 0.63 ms ip-10-10-134-173.eu-west-1.compute.internal (10.10.134.173)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 35.99 secondsEnumeration
Port 80
/Account/login.aspx login form in this directory
lets brute force this form with hydra
hydra -l [username] -P [passlist] $IP -V http-form-post "[directory]:[form_parameters]:[grep]"
form_parameters catch it with burpsuite
Credentials admin:1qaz2wsx
WE IN
ABOUT tab we can find the version of BlogEngine 3.3.6.0
Initial Access
search exploit for this blog engine v3.3.6.0
Let’s follow the instructions:
Start by modifying the script so that we report the correct value for IP and port.
Rename your script as
PostView.ascxGo to posts (http://10.10.79.198/admin/#/content/posts) and click on “Welcome to HackPark” to edit this post
From the edit bar on top of the post, click on the “File Manager” icon
Click on the “+ UPLOAD” button and upload the
PostView.ascxscriptClose the file manager and click on “Save”
Now, open your listener (
rlwrap nc -nlvp 1234)
now we have reverse shell
Windows Privilege Escalation
Enumerate running services
WindowsScheduler.exe looks interesting
check it's privilege
running localSystem Priv ...
Message.exe running every 30 second lets overwrite it with reverse shell
generate reverse shell with metasploit
setup smb server on attacker box
on target box
setup listener
after 30 seconds we have system shell
Last updated