✅Legacy (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: CVE-2008-4250 (MS08-67) and CVE-2017-0143 (MS17-010)
System Vulnerable: 10.10.10.4
Vulnerability Explanation: This machine is vulnerable exploited Microsoft’s implementation of the Server Message Block (SMB) protocol, where if an attacker sent a specially crafted packet, the attacker would be allowed to execute arbitrary code on the target machine.
Privilege Escalation Vulnerability: N/A
Vulnerability Fix: Recommend to upgrade SMB version and always apply to patch.
Severity: Critical
Step to Compromise the Host:
Reconnaissance
We found that there are 2 service ports open:
Port 139: netbios-ssn
Port 445: microsoft-ds
Enumeration
Let start enumerating on SMB Service to check if there is any vulnerable on this service. As we can see there is vulnerable to CVE-2008-4250 (MS08-67) and CVE-2017-0143 (MS17-010).
Exploitation #1 (MS17-010)
This machine is vulnerable to Eternal Blue (MS17-010). This vulnerability exploited Microsoft’s implementation of the Server Message Block (SMB) protocol, where if an attacker sent a specially crafted packet, the attacker would be allowed to execute arbitrary code on the target machine.
We can download the exploit script from the github.
Next, we generate our payload from msfvenom.
Let start our netcat listener on port 4444.
Execute the payload from the folder we downloaded and point to reverse shell location.
But unfortunately, we cannot figure out our privilege user on the machine as we could not execute command whoami or username.
We can set up our SMB server for share folder or transfer file to our victim machine. Let search for binary file whoami.exe on our machine.
Let start SMB server to share folder of binaries files.
Let connect to our share folder from remote machine. As we can see, we are AUTHORITY\SYSTEM.
Exploitation #2 (MS08-067)
The machine is vulnerable to MS08-067. The remote Windows host is affected by a remote code execution vulnerability in the 'Server' service due to improper handling of RPC requests. An unauthenticated, remote attacker can exploit this, via a specially crafted RPC request, to execute arbitrary code with 'System' privileges.
Proof of concept code: https://raw.githubusercontent.com/jivoi/pentest/master/exploit_win/ms08-067.py
By viewing the source code of exploit, we need to replace the shell code and as well as know the OS version.
Let generate new payload to replace the existing payload.
To discover OS version, there is nmap script was include in the exploit code.
Let check the syntax and parameter which are require to start execute the exploit python code.
Let start the netcat listener on port 443 and execute the exploit code.
Last updated