✅Bounty (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Improper validate file extension
System Vulnerable: 10.10.10.93
Vulnerability Explanation: The machine is vulnerable to improper validate file extension which could allow us to bypass the filter and upload reverse shell payload and allow us to gain shell.
Privilege Escalation Vulnerability: Out of date kernal version
Vulnerability Fix: Sanitize User Input and Apply patch to the system
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 Microsoft-IIS/7.5
There is only port 80 open on the remote machine. By going through, we found a simple web page and viewing the source code nothing is interest.
Let find hidden directory with gobuster. By going through the directory /uploadFiles, it returns back 403 Forbidden access. As we know it's microsoft IIS, let run again with asp, aspx extension.
By this time, we found other file /transfer.aspx which is status 200.
We can try to upload an image file, and it's successfully upload and we can view as well.
Let try to upload payload with aspx extension but it was rejected.
But if we upload .config extension, it's accepted.
By going through the blog post, we can copy the script for bypass file extension. Let save the code into file web.config and upload it. It's successfully run the script and display number 3.
Exploitation web.config
Let replace it with simple shell.
Let replace the command whoami with Powershell payload from nishang.
Let start our netcat listener on port 4444 and HTTP server to share payload.
Let upload the file web.config once again and we executed it.
We didn't found any flag on merlin/Desktop unless we use command attire to display hidden files.
Otherwise we can use Get-ChildItem in powershell to display files that are located in the current directory and its subdirectories.
Privilege Escalation
Checking the privilege of the user merlin on the system. Seem like it's vulnerable to potato attack.
Let run windows-exploit suggester to check for privilege escalation vulnerable.
MS10-059
Let start smb server to share exploit file and start netcat listener on port 5555
On our victim machine, connect to the share folder and execute the file.
Juicy Potato
Proof of concept file: https://github.com/ohpe/juicy-potato/releases
Now let copy another Powershell payload and use port 5555.
Then, transfer juicypotato.exe to our victim machine.
Then, create a file call shell.bat and the content is powershell script to download our reverse shell and executed.
Let transfer the shell.bat file to our victim machine as well.
Let start our HTTP Server and netcat listener on port 5555.
Now, let execute our juicypotato.exe file.
Last updated