Personal WebsiteLinkedin

Pov

Enumeration 1

nmap -A -p- -sC -sV -Pn -v pov.htb

Port 80 - pov.htb

The enumeration of possible directories does not lead to anything special attention:

Port 80 - dev.pov.htb

It's possible to download the CV:

The enumeration of possible directories does not lead to anything special attention:

Info

Exploitation (foothold)

If we intercept the request of downloading CV and we change the requested file with /web.config:

We can obtain the decryption key:

We can also request other files like default.aspx:

And we can see the backend code C#:

Referer to for the following exploitation tecnique used:

LogoGitBookapp.gitbook.com

Now, MAC has been enabled for ViewState and due to vulnerability of local file reads we got access to the web.config file with configurations like validation key and algorithm as shown above, we can make use of ysoserial.net and generate payloads by providing the validation key and algorithm as parameters.

We can use the following command to generate the payload to insert in place of original __VIEWSTATE value:

If we click on Send inside BurpSuite we obtain a request done to our netcat listening:

So we can now trigger a reverse shell using a Powershell base64 encoded (to avoid " escaping issues)

Enumeration 2

There is no user flag as sfitz but with command net user we can see that there are other users like alaading so we need to search furthermore. Under Documents folder there is a connection.xml file:

PowerShell gives us a built-in way to both store and retrieve username and passwords securely using the commands Get-Credential, Export-CliXml and Import-CliXml.

Here's how you'd save a PSCredential object to a file:

When you export credentials using the following command:

Then, you want to use these credentials that have been exported previously, in a script for example.

You cannot use these credentials because items encrypted with one account cannot be decrypted using another account.

So, you must “runas” the script with the account you created the credentials file.

We try to decrypt the credentials using sfitz user:

...and it's a win!

Info

  • username: alaading / password:f8gQ8fynP44ek1m3

Privilege Escalation

Escalating locally not work so If we cannot switch user due to such as reverse shell sessions, we can spawn another shell as another user by using RunasCS.

Try to obtain a reverse shell as another user:

...and we obtain the user flag!

Enumeration

SeDebugPrivilege

Easy system shell. You can update update proc attribute list with this privilege and can elevate privileges.

Generate a payload:

Configure the Meterpreter on your machine and run “exploit.exe” on the victim machine.

Type ps and find the PID of “winlogon.exe”:

Then type migrate PID_VALUE

and after that shell

Now, you have access as NT AUTHORITY\SYSTEM.

PreviousDevvortexNextSurveillance

Last updated