Intro

This machine will cover brute-forcing account credentials & handling public exploits. Here’s a link to the box.

Enumeration

Nmap scan

As usual, we’ll start with a Nmap scan.

We have an open Microsoft web server & an RDP port. While inspecting the website, let’s brute-force for other interesting directories in the background.

Gobuster directory brute-forcing

With the results from gobuster, we find the admin login page. Checking out its request type by inspecting the form element shows us POST requests that send data to the webserver.

We also found the username to be admin, shown in the URL of the login form. Now that we know the request type and have a URL for the login form, we can start brute-forcing the account.

Exploitation

Hydra account brute-forcing

1. Go to the website’s login page and try to login with random credentials.
2. Press “F12” or open “Toggle Tools” in Firefox.
3. Select the “Network” tab.
4. Make an attempt to login with random credentials.
5. Find & select the “POST” request under the “Method” column.
6. Copy the URL starting from “/Account/login” and paste it somewhere to build your command:

7. On the right tab, press on “Request“, scroll all the way down and copy the contents of “Request payload“, and append to the previous link separated by a colon ( : )

8. Replace your typed username & password with ^USER^ & ^PASS^
9. Append “:Login failed” to your command at the end.
10. Result:

This string has three parts divided by colons:
path to the login form page : request body : error message indicating failure

Searchsploit

After logging in as admin, we find the BlogEngine version to be 3.3.6.0 & search for an exploit:

Copy the exploit locally, change the IP & port & start listening to the choosen port.

According to the exploit description, we need to do the following:
1. Navigate to Content
2. Posts
3. New
4. Upload Exploit (name must be PostView.ascx)
5. Publish
6. Visit http://TARGET_IP/?theme=../../App_Data/files to get a shell

Privilege Escalation

Systeminfo to get an overview

Let’s see the machine’s specs:

Whoami privileges check

Windows uses tokens to ensure that accounts have the right privileges to carry out particular actions. Account tokens are assigned to an account when users log in or are authenticated.

 

There are two types of access tokens:

• primary access tokens: those associated with a user account that are generated on log on
• impersonation tokens: these allow a particular process (or thread in a process) to gain access to resources using the token of another (user/client) process.

We could use token impersonation to gain system access.

Winlogon credentials

Let’s check the registry for User Autologon / Winlogon credentials:

It looks like we found some admin credentials; let’s use the open RDP port to connect to the machine.

We’ve unusually retrieved the flag. Let us continue with the normal path to exploit another weakness this box has.

Unquoted Service Paths

Let’s search for unquoted service paths:

Let’s query the service name for more info.

Check out the log files for the right binary name that’s being run automatically. In the system scheduler map, you can replace the message.exe with a generated shell exec to get an admin shell as an alternative.