search
Blog

Analysis

A Window Machine with an unintended privilege escalation

hashtag
Enumeration

โ”Œโ”€โ”€(kaliใ‰ฟkali)-[~/Desktop/CTF/Boxes/Analysis]
โ””โ”€$ nmap -sC -sV -Pn 10.10.11.250
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-21 20:14 EST
Nmap scan report for analysis.htb (10.10.11.250)
Host is up (0.69s latency).
Not shown: 987 closed tcp ports (conn-refused)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Site doesn't have a title (text/html).
| http-server-header: 
|   Microsoft-HTTPAPI/2.0
|_  Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-22 01:14:26Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3306/tcp open  mysql         MySQL (unauthorized)
Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: -2s
| smb2-time: 
|   date: 2024-01-22T01:14:29
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.58 secon

DNS + http sounds like a great combination for subdomain fuzzing.

Upon loading the site, we get a 403 error forbidden. Time to brute force the directories and file path.

Visiting list.php, we get missing parameter and if we put a valid name we get back results!

LDAP injection

Judging from this columns, it seems that the name parameter is susceptible to LDAP injection.

After a long while, I disc

hashtag
Privilege Escalation (Unintended)

We can perform a DLL hijacking based on having write-permissions in the C:\Snort\lib\snort_dynamicpreprocessor directory.

According to the snort.conf located in C:\Snort\etc\ it defines the following

We can tell that snort is restarting on intervals as the snort log is getting updated.

Therefore, we can drop our malicious DLL named sf_engine.dll into the C:\Snort\lib\snort_dynamicpreprocessor directory.

After uploading our malicious DLL to the directory and running snort with the config file listed above, we see that our DLL is actually laoded with no shell sadly.

However after awhile, my metrepeter listener manages to catch a privileged shell, presumably from the Adminstrator running the batch script to restart snort.

PreviousCozyHostingNextRebound

Last updated