OSCP PREPROTİONS – HTB Granny

Granny machine is a vulnerable machine with windows operating system among retired machines. User and root flags are expected to be obtained
We perform a network scan with nmap to recognize the target machine.
Classic scan

Full port scan

As a result of the port scan, only port 80/tcp open http Microsoft IIS httpd 6.0 is open.
We are enumerating port 80.
In the Nmap scan we saw that the version is “Microsoft IIS httpd 6.0”. And it uses WebDAV.
Webdav (Web Distributed Authoring and Versioning) is an http protocol that allows us to manage files on web servers. We can think of it like ftp. It can be installed on both IIS and Apache and is used with ports 80 or 443. It allows us to manage files from the browser without the need for an extra application.
Having Webdav means that we can potentially add and remove files.
Let’s go through the browser

We looked at the source code, we looked at the developer room, we checked with wappalyzer and there was nothing that caught our eye. There may be hidden files and directories, so we assigned them with gpbıster but we didn’t get any results.
We will use the davtest tool to see which files we can upload to webdav.

This means that only HTML, TXT files can be executed, while aspx, asp shells cannot PUT. This is very important information because the extension must be correct for the Web server to run the uploaded file. Here we are not installing asp and aspx. It would be advantageous for us to install a web shell here, but we can’t, so we upload it as a txt file and then convert it to aspx by renaming it.
I use curl to do this.

We prepared our webshell and transmitted it in txt format with curl

Let’s go to the target and see

Now we will change this txt file to aspx

Now we go to the destination as aspx

I asked him to give us all kinds of revershell here, he gave us shell, let’s search for exploits on Google about it

I tried exploit codes on github, downloaded a python code I found here and ran it as they asked and it gave me reversehll
https://github.com/crypticdante/CVE-2017-7269/blob/main/ii6_reverse_shell.py

As you can see, the exploit I dowloand gave us our shell
We could not reach user and root flags when we do not have authorization in this shell

Here we provide local enumeration to provide privilege escalation
We get information about the system with Systeminfo

Instead of looking at what kind of vulnerabilities are there, we use the Windows-Exploit-Suggester tool

We encountered a lot of vulnerability here

Microsoft Windows Server 2003 – Token Kidnapping Local Privilege Escalation
Vulnerability.

We know that we can provide privilege escalation using the Churrasco tool, we download this tool.
Then we transferred it to the target machine using the smbserver.py tool.

When we run the command using this exe we see that we are in the nt authority\system user.
Then we pass nc.exe to the target and set it to give us revershell

As you can see we have received revershell in high authorized user

In this way we obtained user and root flags

Comments

  1. sklep internetowy

    Hi there, I do think your web site may be having browser compatibility issues.
    Whenever I look at your website in Safari, it looks
    fine however, if opening in Internet Explorer, it has some overlapping
    issues. I merely wanted to provide you with a quick heads up!
    Other than that, great site! I saw similar here: Najlepszy sklep

  2. ecommerce

    Hey! Do you know if they make any plugins to help with SEO?

    I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good success.

    If you know of any please share. Thank you! You can read similar art here:
    E-commerce

  3. Phone Tracker Free

    You can use parent management software to guide and supervise children’s behavior on the Internet. With the help of the following 10 smartest parent management software, you can track your child’s call history, browsing history, dangerous content access, apps they install, etc.

  4. Backlink Building

    Hello there! Do you know if they make any plugins
    to assist with Search Engine Optimization? I’m trying to
    get my website to rank for some targeted keywords but I’m not seeing very good gains.
    If you know of any please share. Kudos! You can read similar art here: List of Backlinks

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir