Bashed

Machine Level: Easy OS: Windows

Scanning

I ran an aggressive nmap scan to find some ports and services running on the machine.

ajread@aj-ubuntu:~/hackthebox$ nmap -A [TARGET IP]
Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-08 18:08 EST
Nmap scan report for [TARGET IP]
Host is up (0.013s latency).
Not shown: 998 filtered ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17  01:06AM       <DIR>          aspnet_client
| 03-17-17  04:37PM                  689 iisstart.htm
|_03-17-17  04:37PM               184946 welcome.png
| ftp-syst: 
|_  SYST: Windows_NT
80/tcp open  http    Microsoft IIS httpd 7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: IIS7
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.80 seconds

Enumeration

I was able to log into the machine with an anonymous ftp logon.

It looked as if the ftp server contained the image and htm from the page on port 80. I looked around on the ftp server and I appeared to find the version.

Initial Access

I created a shell in ASPX using msfvenom using this.

I put the shell on the server using the anonymous ftp logon.

I started an exploit/multi/handler with the correct LPORT and LHOST on metasploit and navigated to http://[TARGET IP]/shell.aspx. I was dropped into a meterpreter session on my local machine.

I noticed that I was an unprivileged user, so I backgrounded the session and ran a local windows exploit suggester in metasploit.

One of the exploits stood out to me which creates a new session with SYSTEM privileges via the KiTrap0D exploit, which realies on the kitrap0d.x86.dll.

I ran the exploit and was dropped into a privileged shell!

I was able to read both the user and root flags.

PreviousCurlingNextIrked

Last updated