search

Shells & Payloads - The Live Engagement

First thing to do is connect to Foothold using Xfreerdp

xfreerdp3 /v:ipaddress /u:username /p:password

You will then be connected to the foothold host

hashtag
IFCONFIG

hashtag
Now we need to begin targetting Host-01

Run an initial nmap scan for the first question to get a brief of whats going on on the host

  • The host name is: shells-winsvr

  • This is a Windows Server 2019

Lets begin with some recon on the target

We shall visit the web server first and see whats going on there if there is any upload exploits that can be exploited.

  1. Checked if Firefox was installed because I was not seeing an installation application

  2. Then launched web server

Seems to be an Apache Tomcat/10.0.11 Webserver running

Lets look for some exploits for this version.

So far seems to be none that could provide us with an initial access

Next i've identified something that looks pretty promising

  • The Manager Web_App for Tomcat it seems

  • It also shows where the users are defined

When I click on the manaegr_webapp, it does bring me to someone of access authentication page, but the thing is we don't know the password yet

I took the shortcut method and checked for the Hint for Host-01.

  • We got told that there are two vulnerabilities

  • The creds for potentially vulnerable process is tomcat | Tomcatadm

I will revisit how to get the credentials later

I tested this in the above Manager page that I identified previously and the credentials worked

hashtag
Now Lets explore this page

  1. Got some nice info about the server

  1. We have some sort of Upload feature here

Now, based on the above upload feature, what exactly is a WAR file? quick GPT search and we get

  • So we will need a WAR Payload to upload to the Tomcat Server

But what tool can do this?

  1. Lets check out Laudanum

  • Quick search on my own VM and we can identify that there is a cmd.war payload

  1. Lets try it on the Remote Host

    1. Boom! the Remote host also has the same thing

  1. Lets copy this file to a better location

  1. Lets try and upload this f***** payload

    1. Go back to the browser and try upload it

  • Press Deploy and see what happens?

  1. We see that a new application was added, so i guess the upload worked?

  1. Lets try and browse to his directory now

    1. Seems like this payload method doesn't work

    2. We could try another method of creating a payload

    3. Lets try with MSFVenom

hashtag
PAYLOAD WITH MSFVENOM

  1. Setup a listener on the Attacker machine

    1. This will listen on port 8081 for any connections to that port

  1. Setup MSFVENOM Payload

    1. Set the IP Address and the PORT

    2. Set the type of payload

  1. We will use this payload and try upload it through the tomcat manager platform again and see if we get a shell

I tried it and realized it doesnt work, but the issue is that the payload type i set it to windows, where the platform is a apache webserver which uses JavaScript, so my bad, will change the payload type and hopefully it works this time.

BOOM, now it works, we have a shell

So we are done with HOST-01, lets move onto the next

hashtag
HOST-02

hashtag
Enum

hashtag
Nmap Scan

  • So we know that it is an Ubuntu machine that is running

  • There is SSH

    • We can try to access it later

  • There is a HTTP Webserver running

    • We see robots.txt > Something we can explore for hidden directories

circle-info

hashtag
Checking out the Webserver

Seems to be a guy named Slade Wilson posting some post on the blog website

The question in HTB ask something similar to the blog post by Slade Wilson

Lets check out the post maybe we can identify an answer

The answer is: php

  • Basically look at the link of the exploit and read through the code and you will see the following

Now to exploit this blog website, i guess we will have to identify a way to upload this exploit, so lets have a look back at the blog.

Seems to be a login for the user Slade Wilson.. ummm interesting..

I wounder what the credentials could be....

If we check the Hints for Host-2 we get some sort of credentials for the blog, lets try and use that

admin:admin123!@#

We gain access as Slade Wilson, nice!

We can now create some blog post as Slade Wilson

hashtag
Exploitation - With Metasploit

To exploit this we can use Metasploit which should have the exploit module identified by Slade Wilson.

Lets try

Now we set the options required

We need to identify the IP Address of the Blog Web Server

Now we set the remaining options

Now lets exploit this shit... and BOOM we are in!!

HTB ANSWER: B1nD_Shells_r_cool

hashtag
HOST-03

hashtag
Enum

hashtag
nmap scan

hashtag
Enumerating Webserver

When we visit the website, we see its just a directory listing

We see that there is an upload.aspx used for uploading aspx files, so in this case we can create an aspx payload utilizing various methods to gain a shell

hashtag
Exploit

  1. Lets try with 🧪 Laudanum – "One Web Shell to Rule Them All"

  2. Locate Laudanum and find the right shell payload

  1. We can copy this payload to our own directory

  1. Now lets change some settings, most likely the allowed IPs, lets see

    1. Ive added the foothold's IP Address

  1. Now lets try and uplaod this payload and see if we can get a shell

IT WORKED!!!!

ummmmm... Its seems that access is denied when trying to change directory into the Administrator account

I did look at the hint, it mentioned Blue, so this means that his host is vulnerable to Eternal Blue.. I went into a loophole through the webserver, but still at least we got a shell through their, we woulc have maybe done it another way..

Lets test the Eternal Blue Method

Search the exploit

We will use the 1 options, psexec payload

Set the other options

Now we can spray and pray!

BOOM WE GOT A GOOD SHELL

To answer the Final HTB Question

Previous🐘 PHP Web ShellsNextDetection and Prevention

Last updated