search

Love Write-Up - HTB

hashtag
Recon

hashtag
Network Scanning:

Starting of with nmap:

sudo nmap -sS -Pn -n 10.10.10.239 -oN syn_common_ports.txt
#Output:
PORT     STATE SERVICE
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
3306/tcp open  mysql
5000/tcp open  upnp

Moving towards vulnerability scan:

PORTS=$(grep "open" syn_common_ports.txt | awk -F '/' '{print $1}' | tr '\n' ',' | sed 's/,$//'); sudo nmap -sVC -Pn -n -p ${PORTS} -oN vuln_scan.txt 10.10.10.239
#Output:
PORT     STATE SERVICE      VERSION
80/tcp   open  http         Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1j PHP/7.3.27)
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: Voting System using PHP
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
443/tcp  open  ssl/http     Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: 403 Forbidden
| tls-alpn: 
|_  http/1.1
| ssl-cert: Subject: commonName=staging.love.htb/organizationName=ValentineCorp/stateOrProvinceName=m/countryName=in
| Not valid before: 2021-01-18T14:00:16
|_Not valid after:  2022-01-18T14:00:16
445/tcp  open  microsoft-ds Windows 10 Pro 19042 microsoft-ds (workgroup: WORKGROUP)
3306/tcp open  mysql?
| fingerprint-strings: 
|   DNSStatusRequestTCP, FourOhFourRequest, HTTPOptions, Help, Kerberos, LDAPBindReq, LDAPSearchReq, LPDString, RPCCheck, RTSPRequest, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServerCookie, X11Probe: 
|_    Host '10.10.16.8' is not allowed to connect to this MariaDB server
5000/tcp open  http         Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: 403 Forbidden

Ports of interest: 80, 443, 5000 | 445 | 3306. I will first check SMB due to simplicity.

hashtag
Enumeration

hashtag
SMB:

hashtag
HTTP/S:

hashtag
Port 80:

hashtag
Port 443:

Port 5000:

After trying few SSRF attempts and more enumeration. All that I found to be useful is the /admin endpoint.

Therefore I tried more directory busting on it to see if there are some php files that are less sanitized. At first I thought it really works because this endpoint had plenty!

Although nothing much. Then I brought up the injections.

hashtag
Footholding

I directly tried them on the /admin endpoint.

Let's see what tables are in there:

Let's now go for the admin table:

Eventually this time-based SQLi made me realize we are not on the intended path. The BCrypt is 100% not to be cracked.

So I start google more, actually I ditched google some time ago and now I use russian and chinese search engines beacuse they are more convinient and reliable when querying nowadays, especially for pentest.

I stumbled upon this: https://www.exploit-db.com/exploits/49843arrow-up-right

Followed the PoC: https://secure77.de/php-voting-system-admin-authentication-bypass-sqli/arrow-up-right

The add new voter function permits upload.

Uploaded a php webshell:

Open it and run commands:

Let's get a reverse shell:

Sweet!

hashtag
PrivEsc

As we see we already got user access. I ran a quick whoami /all:

Suffice is to say that only Phoebe and Administrator are on this sys. So it's super worth checking the history, at some point Phoebe had to use admin rights.

I couldn't find this file on the system.

Moving forward. AlwaysElevated is on, along-side with so many other PrivEsc vectors.

I crafted a .msi with msfvenom.

Set-up a listener on 4444

Transfer the exploit to the target.

Run it and receive the reverse shell back:

Easy!

PreviousDriver Write-up - HTBNextAdministrator Write-up - HTB

Last updated