β Bastard (Medium)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Remote Code Execution
System Vulnerable: 10.10.10.9
Vulnerability Explanation: The machine is vulnerable to Remote code execution due to application version out of dated which allow us to gain initial foothold on the machine.
Privilege Escalation Vulnerability: MS10-059
Vulnerability Fix: Apply patch or Update the system
Severity: Critical
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80, Microsoft IIS httpd 7.5
we will go through HTTP first. On port 80, we see the drupal webpage. Base on nmap scan, it detects some files and directory hidden. Most of the content are access denied. But on /changelog.txt we can access and the drupal application is running on version 7.
Let check for public exploit whether this version is vulnerable or not. As we can see there are many exploit script. Let check the content of exploit script.
Let grab the exploit on Remote Code Execution.
First the script will curl on endpoint of the application.
Following the /rest_endpoint on the application, it displays page not found. But testing on /rest it's working.
#1 Exploitation (Command Injection)
Let customize the code and replacing some argument value. It's going to connect to URL that we specify "10.10.10.9/rest" and create file name shell.php and it contains command execution.
It's going to create 2 files on our machine, session.json and user.json. On session.json file, we have valid session of admin user and user.json, we have admin hash.
Also we can execute command via curl on the file we created.
We can also issue command systeminfo to check the architecture of the system. Notice that system running in x64 architecture.
Startup SMB Server to share files netcat64.exe for victim to connect and execution reverse shell to our machine.
Intercept traffic through burp proxy and change the request for connect to our kali share and execute netcat. Let start listener with netcat on port 4444.
#2 Exploitation (Session)
On the files session.json we have valid session of the admin user. Let add those value to our browser cookie.
Then, refreshing the page on 10.10.10.9 and we are now login as Admin.
Going to add new content type of php format but it doesn't have. It's only available HTLM and plaintext. Let add PHP on modules tab tick enable and save configuration.
Let go to Add Content > Basic Page and create title exploit with command execution code.
Let start testing on command execution on webpage and it's working.
Privilege Escalation
For the easiest way, I will run windows-exploit-suggester.py on systeminfo of the system.
MS10-059
Let start our SMB server to share exploit executable file and start netcat listener on 5555
On our victim machine, connect to our kali share folder and execute file MS10-059.exe
Last updated