Analysis
A Window Machine with an unintended privilege escalation
Enumeration
┌──(kali㉿kali)-[~/Desktop/CTF/Boxes/Analysis]
└─$ nmap -sC -sV -Pn 10.10.11.250
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-21 20:14 EST
Nmap scan report for analysis.htb (10.10.11.250)
Host is up (0.69s latency).
Not shown: 987 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Site doesn't have a title (text/html).
| http-server-header:
| Microsoft-HTTPAPI/2.0
|_ Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-01-22 01:14:26Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3306/tcp open mysql MySQL (unauthorized)
Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: -2s
| smb2-time:
| date: 2024-01-22T01:14:29
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.58 seconDNS + http sounds like a great combination for subdomain fuzzing.
Upon loading the site, we get a 403 error forbidden. Time to brute force the directories and file path.
Visiting list.php, we get missing parameter and if we put a valid name we get back results!
Judging from this columns, it seems that the name parameter is susceptible to LDAP injection.
After a long while, I disc
Privilege Escalation (Unintended)
We can perform a DLL hijacking based on having write-permissions in the C:\Snort\lib\snort_dynamicpreprocessor directory.
According to the snort.conf located in C:\Snort\etc\ it defines the following
We can tell that snort is restarting on intervals as the snort log is getting updated.
Therefore, we can drop our malicious DLL named sf_engine.dll into the C:\Snort\lib\snort_dynamicpreprocessor directory.
After uploading our malicious DLL to the directory and running snort with the config file listed above, we see that our DLL is actually laoded with no shell sadly.
However after awhile, my metrepeter listener manages to catch a privileged shell, presumably from the Adminstrator running the batch script to restart snort.
Last updated