β Devel (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Misconfiguration of FTP Service and System version out of dated
System Vulnerable: 10.10.10.5
Vulnerability Explanation: The machine misconfigure on ftp service which could allow anonymous login and it's the root directory of web server which we could upload payload and execute through webpage and we gain initial foothold on the machine.
Privilege Escalation Vulnerability: Window Kernel vulnerable to privilege escalation
Vulnerability Fix: It recommended to disable ftp anonymous login. Update and apply patch to the system when the vulnerable publicly disclose and security updated available.
Severity: Critical
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 21 FTP
We see the ftp service open with allow anonymous login. Let start login with username anonymous and password can type any. There is nothing interesting.
Port 80 HTTP Microsoft-IIS/7.5
By going through port 80, we just see default webpage of IIS. Viewing the source code, we see the image file "welcome.png" which we have seen in ftp service.
For .asp which is VB Script Base (Window 2003 below) and .aspx which is .NET Base (2008 >)
Let start upload simple file for testing whether we can upload through ftp service and execute on the webpage.
We can upload file "test.txt" to ftp service. Let start execute that file through webpage.
Exploitation
For IIS Microsoft framework, it supports extension asp or aspx. Let generate reverse shell payload with aspx extension.
Let upload it to ftp service and start netcat listener on port 4444.
We can execute our shell payload through webpage. We are now on the machine.
#1 Priv-Esc (MS10-059)
Let start enumerating on system information first. Because it seem like old machine. As we can see this machine is running Microsoft Windows 7 Enterprise (x86) and No Hotfix install.
Once, we are onto the machine, let start enumerating on systeminfo. We can save the information of the system and check for any vulnerable with window-exploit-suggester.py.
First, we need to generate the new database and systeminfo as systeminfo.txt.
Let start check if there is any vulnerable that we can escalate our privilege. There are a lot of vulnerable which we could exploit.
The output shows either public exploits (E), or Metasploit modules (M) as indicated by the character value.
Let start with MS10-059. We can search for public exploit. We will use the one from SecWiki.
Start up python http server on kali machine.
I just enumerate on the system with icacls and user Public we have full access. On the remote machine we can use certutil to grab the file from our machine.
Let start our netcat listener on port 4444.
Now, we can execute the exploit file and point it to our IP and Port we are listening on.
#2 Priv-Esc (M11-046)
We can run systeminfo to check architecture of the system. The machine is running Window 7 Enterprise and there is no patch apply.
Proof of concept Code: https://www.exploit-db.com/exploits/40564
Let compile the payload:
Let startup smb-server and share current folder for our victim to access.
On our victim machine, connect to our kali share and execute the payload. We are now root.
Last updated