search

Pov Write-Up - HTB

hashtag
Recon

Nmap scan report for 10.10.11.251
Host is up (0.054s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 113.20 seconds

Interesting. Only port 80 is open:

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: pov.htb
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

hashtag
Enumeration

Going on the webapp, I quickly see:

Adding the vhost to our /etc/hosts file.

I tried fuzzing for both, nothing shows up. So my vision is that we have some internal admin console and we need to get there through some disclosure.

Checked the source code of the main page and we will try to see what goes on with the download cv function, that seems like a good entry point for LFI.

Burp Request:

Interesting response, it discloses both keys. Deserialization is the name of the game:

This onearrow-up-right gives us a good explanation for this.

Crafting the following payload:

Running a python server on 9090 and waiting for a request.

Sweet. Now let's get reverse shell.

I listen with nc over 4444 and craft the following payload:

I ran a few commands like netstat -ano and get users to see what goes on around and could find:

I tried using this file to get alaading, but no luck:

So I chose to extract it:

Tried using it to open PS, but no luck:

Though this works:

Got a reverse shell:

PreviousJab Write-Up - HTBNextLinkVortex Write-Up - HTB

Last updated