search

keyAUTHBY

hashtag
Index

hashtag
1-Nmap

hashtag
2-FTP as anonymous

When performing the scan we see that there is an FTP server where we can access this with the user Anonymous and there is a folder called accounts, inside this we see that there are 3 users (offsec, anonymous and admin) but we do not have permissions to download the files:

FTP connection

hashtag
3-Hydra

So we will save this information for later, there is also a web server hosted on port 242 in which you have to authenticate to view it, we can use one of the previous users to run a brute force attack with hydra and thus authenticate:

Brute force with Hydra to HTTP auth

As we can see the user is offsec with the password elite and we can now authenticate, let's see what is inside the web page:

Log in HTTP

It shows us the following text Qui e nuce nuculeum esse volt, frangit nucem!, as we can't do anything here we are going to try to brute force the admin user in FTP, in this case, we will use the -e parameter to try to make the connection through SSL and if it fails we will try without SSL:

Brute force FTP admin user

hashtag
3-FTP as admin

We've got the password, let's see what's in the directory:

Log in as admin in FTP

hashtag
4-Reverse shell

As we can see, it is the same directory as the web page, so if we upload a reverse shell we can gain access to the machine:

Generate a reverse shell with msfvenom

We will then listen on port 4444 to receive the reverse shell:

Listen in 4444 port

Upload it to the web directory:

Upload the reverse shell

Now go to the reverse shell path on the web page to exploit it and then we get the shell:

Shell as livda

hashtag
5-Privilege escalation

If we look at the privileges we have we see that we have SeImpersonatePrivilege:

User Privileges

Knowing this we can use the juicypotato tool to escalate privileges, not being in RDP we can not generate another console with the user nt/atuhority system so we will send a reverse shell, we also see that the machine is x86, so you have to look for the compatible tool:

System

We can use one of the BITS CSLIDs from here: https://github.com/ohpe/juicy-potato/tree/master/CLSID/Windows_Server_2008_R2_Enterprise.

After downloading it from the link (https://github.com/ivanitlearning/Juicy-Potato-x86/releases) and uploading it via FTP, run the following command:

JuicyPotato

By listening on port 4444 we will receive the shell with privileges:

nt authority\system
PreviousAPEXNextBILLYBOSS

Last updated