✅Arctic (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: LFI, Arbitrary File Upload
System Vulnerable: 10.10.10.11
Vulnerability Explanation: The machine is vulnerable to LFI which we can get hash of the admin account and crack it easily with weak password. The application allow arbitrary file upload and we could upload reverse shell code and execute it then we gain initial foothold on the machine.
Privilege Escalation Vulnerability: MS10-059
Vulnerability Fix: Apply patch to the system and Validate user input
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 8500 Adobe
By accessing on port 8500, we see there are 2 directories. Which we are interesting on /administrator which provides us login page of Cold Fusion 8.
Let search for public exploit and we will focus only on RCE, LFI, and Arbitrary File upload.
#1 Exploit (LFI)
Checking on exploit code of Directory Traversal.
Let accessing to our application to see whether it returns back the password or not. It's actually return back the hash rather than the password.
Next, checking whether we can crack the hash or not. As it's a weak password and we can easily crack it.
Login with PlainText
First time login, seem like it doesn't work but once we login again, it's working. It's require around 30s for every attempt.
Login with Hash
Checking the source code, notice that once we submit our password, it will covert to hash and add salt value . This mean that every 30 seconds, it will generate new salt. https://nets.ec/Coldfusion_hacking#Logging_In
Upload Reverse Shell
First we can generate our reverse shell payload.
We can check the file location on Server Setting > Mapping.
We can HTTP Server for share exploit code.
We need to go Debugging & Logging > Scheduled Tasks > Scheduled Tasks.
Alternative method we can use the python script to upload our shell.
Proof of concept code: Arbitrary File Upload
Let start our netcat listener on port 4444 and go to execute the exploit code.
Priv-Esc (MS10-059)
Let run systeminfo and window-exploit-suggester to check for vulnerable.
Checking on [E] exploitdb POC, we found the one is working MS10-059.
Let start smb server share the file to our victim machine and start netcat listener on 5555.
On our victim machine, connect to the share drive and execute.
Last updated