search

Arctic

OS: Windows, Difficulty: Easy, IP: 10.10.10.11

hashtag
Initial Enumeration

# Nmap 7.70 scan initiated Thu Jul 18 19:22:23 2019 as: nmap -sV -sC -O -A -p 135,8500,49154 -oN O-detailed 10.10.10.11
Nmap scan report for 10.10.10.11
Host is up (0.22s latency).

PORT      STATE SERVICE VERSION
135/tcp   open  msrpc   Microsoft Windows RPC
8500/tcp  open  fmtp?
49154/tcp open  msrpc   Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: phone|general purpose|specialized
Running (JUST GUESSING): Microsoft Windows Phone|2008|7|8.1|Vista|2012 (92%)
OS CPE: cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012
Aggressive OS guesses: Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 8.1 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 Professional or Windows 8 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%), Microsoft Windows Vista SP2 (91%), Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

TRACEROUTE (using port 135/tcp)
HOP RTT       ADDRESS
1   216.87 ms 10.10.14.1
2   216.90 ms 10.10.10.11

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jul 18 19:24:47 2019 -- 1 IP address (1 host up) scanned in 144.76 seconds

I tried several MSRPC vulnerabilities on port 135 and 49154 but neither of them worked so I moved onto the port 8500.

Reading exploit 14641 got me the directory reversal exploit that reveals the password for the admin account.

Ran the password hash against the Hash Killer and got the password for the admin account.

Login as admin got me access to the task scheduler which had the ability to fetch data from a website and save the output into a location on disk.

Using MSFVenom I generated a jsp exploit to be uploaded to the server and uploaded it to the CFIDE directory of the installation. (C:\ColdFusion8\wwwroot\CFIDE\reverseshell.jsp)

hashtag
User Own

This got me a reverse shell as user tolis and let me capture the user flag.

hashtag
Root Own

My next target was to upgrade the current reverse TCP shell to a meterpreter shell. So I created another msfvenom payload and downloaded it on the target machine and got meterpreter shell.

This got me a meterpreter shell as the same user (tolis) however, the shell I was running was a x86 shell and the box was a x64 machine so I had to upgrade the shell to a x64 shell.

I used the longer route, it could have been done better using the migrate command builtin into meterpreter shell, but anyways, got the job done.

Now I ran local exploit suggester on the box to list all the possible attack options.

hashtag
Learning Outcome

I have to stop being so dependent upon metasploit for my post exploitation. Learned a way to download files using CMD line, and how to upgrade shell to x64.

PreviousOptimumNextBounty

Last updated