HTB - Remote
Overview
Short description to include any strange things to be dealt with
TODO: finish writeup, add images, clean up...wow my notes were bad on this one!
Useful Skills and Tools
Connect to and mount a remote network file share - port 2049
showmount -e 10.10.10.180to show NFS sharesmkdir /tmp/remoteto make a local folder to mount the remote drive tomount 10.10.10.180:/site_backups /tmp/remoteto mount the available share directory onto the host machine.
Useful thing 2
description with generic example
Enumeration
Nmap scan
I started my enumeration of this machine with an nmap scan of 10.10.10.180. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all TCP ports, -sC runs a TCP connect scan, -sV does a service scan, -oA <name> saves all types of output (.nmap,.gnmap, and .xml) with filenames of <name>.
21/tcp open ftp 80/tcp open http 111/tcp open rpcbind 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 2049/tcp open nfs
Port 21 - FTP
Port 21 for FTP was open so I tried to login using anonymous access. I was able to connect, but the folder is empty.
Port 80 - HTTP
Acme widgets product page
Dirbuster
Dirbuster found a huge list of standard Umbraco directories and files, as well as a lot of random product and blog pages.
A search for Umbraco vulnerabilities led me to https://www.acunetix.com/vulnerabilities/web/umbraco-cms-remote-code-execution/ which described a way to get remote code execution.
This led me to the page http://10.10.10.180/umbraco/webservices/codeEditorSave.asmx, which should not exist on the production server.
rabbit hole?^
Navigating to /umbraco redirected me to a login page at http:10.10.10.180/umbraco/#/login.asp.
After reading through the documentation, I tried the admin password reset found at https://our.umbraco.com/packages/developer-tools/umbraco-admin-reset/ - looked interesting, but didn't work.
Port 2049 - NFS
since rpc is open and showing mountd service on port 2049:
Using the showmount -e command I was able to export the folders that were available to connect to, and list who could connect. This share was available for everyone. I obliged myself to the open share and mounted it to a local folder using the mount command.
After mounting the folder locally I was able to browse through the files at my leisure. This seemed to be a backup of the files for the website that was hosted on port 80. The file Web.config had a line that told me the version number, but there were so many files that I started searching the web to see if I could find out if there were any useful files here.
In the App_Data/ folder there was supposed to be a .sdf file it seemed.
There was indeed a .sdf file, creatively named: umbraco.sdf. This was a "standard database format" file, but I was still able to extract the data I needed using vim. There was information for a few different users, including email addresses and password hashes. I extracted the password hashes and sent them to hashcat for cracking.
The hash b8be16afba8c314ad33d812f22a04991b90e2aaa for the admin user cracked with the password baconandcheese.
after logging in
Lots of people were using this portal to try to gain access or run enumeration files it seemed.
Umbraco 7.12.4 Remote Code Exploit
https://github.com/noraj/Umbraco-RCE
exploit.py
it worked. now it was time to enumerate the system (very slow however)
Initial Foothold
got a hit on my host
once nc.exe was on the box could now get a shell with:
Road to User
not much to work with, though some of the Privileges sounded interesting.
User.txt
didnt realize for a long time that I already was logged in as a user with access to the flag; I had to hunt for the flag which was in the Public user folder C:\Users\Public
Path to Power (Gaining Administrator Access)
Enumeration as User
32bit windows 10 teamviewer 7 installed, searching for exploit leads to https://whynotsecurity.com/blog/teamviewer/, there author has a python exploit, need to compile to exe search manually in registry with powershell: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-itemproperty?view=powershell-7
Got tv info stored in registry, including the Management password
using the python exploit to decrypt the password stored in the reg key I found
This password didn't seem to do me any good. During research found a post exploit metasploit module that says it will find tv pass, I wanted to see if it was the same one. https://www.rapid7.com/db/modules/post/windows/gather/credentials/teamviewer_passwords https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/windows/gather/credentials/teamviewer_passwords.md
Any Windows host with a
meterpretersession andTeamViewer 7+installed.
So I will need a meterpreter session
Getting a shell
sending msfvenom payload to remote system
!R3m0te! from meterpreter, different than before...maybe this one works to log in.
Root.txt
Thanks to mrb3n for <something interesting or useful about this machine.
If you like this content and would like to see more, please consider buying me a coffee!
Last updated
Was this helpful?