Personal WebsiteLinkedin

Visual

IP of kali machine: 10.10.15.101

Scanning

Nmap

HTTP

Fuzzing directories reveal only uploads directory:

Try to upload a git project to test webapp:

After submit of GIT link we have a redirect to URL with this pattern: http://visual.htb/uploads/ae27098c16b9bddc8abd36eb1c64cc/

Info

  • PHP 8.1.17

  • Apache 2.4.56

  • Windows Server 2019

Gaining Access

Github url seems to not work, so create a GIT server and expose it using Apache on Kali linux attacker machine.

  1. Install Git and Apache: sudo apt install git apache2 apache2-utils

  2. Configuring Apache HTTP Server for Git: sudo a2enmod env cgi alias rewrite

  3. Create a new directory /var/www/git for keeping all the Git repositories: sudo mkdir /var/www/git

  4. Create a new Apache site configuration /etc/apache2/sites-available/git.conf for Git: sudo nano /etc/apache2/sites-available/git.conf

  5. Disable the default Apache site configuration: sudo a2dissite 000-default.conf

  6. Enable the Git site configuration: sudo a2ensite git.conf

  7. Restart Apache HTTP server sudo systemctl restart apache2

  8. In order to bootstrap a new Git repository accessible over the Apache HTTP server, you will have to run a few commands. You don’t want to do the same thing over and over again just to create a new Git repository. So, I decided to write a shell script for that purpose. sudo nano /usr/local/bin/git-create-repo.sh

  9. Add execute permission to the shell script: sudo chmod +x /usr/local/bin/git-create-repo.sh

  10. Create a new Git repository test in the Git project root /var/www/git using the git-create-repo.sh: sudo git-create-repo.sh evil

  11. Now you can clone the test Git repository as follows: git clone http://ip.of.kali.machine/git/evil.git

Prepare evil code

A quick review of Visual Code documentation revealed that it is possible to execute a predefined command before the actual build happens.

MSBuild's PreBuildEvent can be manipulated to execute custom commands before the actual build process starts. This is done by defining a custom target (PreBuild) that runs before the PreBuildEvent. Create a simple C# console project in Visual Studio and then modify the Pre-build event as follow:

Prepare exploit tools

Run a python server inside /usr/share/windows-resources/binaries in order to deliver netcat to windows machine:

Prepare the Evil git repository

  1. Copy evil directory from Visual Studio Code project on Kali Machine

  2. Copy all the contents from evil directory to evil.git directory: cp -Rf /home/kali/Downloads/evil/* evil.git

  3. Temporary change ownership of evil.git: chown -Rf root:root evil.git

  4. Initialize git inside evil.git: git init git checkout -b main git add . git config user.email "[email protected]" git config user.name "test" git commit -m "first commit"

  5. Now we can upload it!

The payload force the Apache to grab netcat and then we will obtain a reverse shell:

Privilege Escalation

Typically, web and database services possess "ImpersonatePrivilege" permissions. These permissions can potentially be exploited to escalate privileges. Given that a PHP application is running on this machine, I decided to upload and trigger a PHP reverse shell insideC:\xampp\htdocs\uploads.

Inspecting the privileges, I noticed the absence of ImpersonatePrivilege:

Upon further research, I came across FullPowers.

LogoGitHub - itm4n/FullPowers: Recover the default privilege set of a LOCAL/NETWORK SERVICE accountGitHub

This tool allows the recovery of the default privilege set for LOCAL or NETWORK SERVICE accounts:

With the required privileges in hand, I turned to

LogoGitHub - BeichenDream/GodPotatoGitHub

a tool known for elevating a service user with low privileges to NT AUTHORITY\SYSTEM privileges:

And finally we will get root flag:

PreviousHospitalNextManager

Last updated