Conceal
Conceal is an interesting box that sets a lot of challenges. What makes it unique is how it requires a VPN in order to check for other ports VIA UDP.
Scanning and Enumeration
This particular scan was interesting, it did not return anything VIA our regular nmap scan. When running a UDP scan however we were able to note down some interesting findings.
└─$ sudo nmap -sU 10.10.10.116 130 ⨯
Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-12 20:48 EST
Nmap scan report for 10.10.10.116
Host is up (0.14s latency).
Not shown: 999 open|filtered ports
PORT STATE SERVICE
500/udp open isakmpIt appears that we have a port 500 isakmp protocol, this appears to have something to do with a key that can be used to establish a VPN connection. Information on this protocol can be found here:
Knowing that this a vulnerable machine from hack the box, it is safe to assume that there is a key somewhere in this box that we can use inorder to establish a VPN connection and gain access to other ports. Rerunning the nmap scan we get the following results.
Looks like we have another port open, 167 which is SNMP. We can tell that this is a windows machine with the ttl 127 response, if this was another number such as 60something, we would have a linux machine. If it was something like 200 it would be a switch or some sort of networking device.
Enumerating via SNMP
Often SNMP is misconfigured, in order to enumerate via SNMP we can do so with the following command.
Doing so gives us a VPN password hash. Lets take a crack at it at hashes.org and see if we can crack this hash.
Looks like we found a password! Dudecake1. Its safe to assume that this is the VPN Password that we will need to establish the VPN connection.
We can also enumerate using the SNMP check tool with the following command:
Doing so will give us access to ports that we will not be able to access until we establish a VPN connection. Looks like we will be abusing port 500 and 4500.
Establishing VPN connection
Now that we have the VPN password, lets run ike-scan to enumerate for more valueable information that we can leverage into our VPN connection that we will create.
In the SA information we get information regarding the type of encryption, hashing algorithm, group, authentication type and Lifespan. We will need this in order to configure our VPN file down the road. Quick note we can convert the life span via python:
This is equal to 8 hours! Remeber as we will need this down the road for configuration. To configure our VPN, download the following
edit the ipsec.secrets file:
edit the vi /etc/ipsec.conf file
Once the connection is established, we can check for TCP ports with the following nmap scan.
Perfect, we have an established connection. Please note, you may need to restart your Kali VM in order to make it work, it took me a while and scratching my head. For some reason, the old school turn it off and on never seems to fail.
Also note, you can not do syn scans over a vpn connection using nmap, so you will have to do a TCP scan as above. Now that we have access less run a full TCP nmap scan and enumerate the results.
Looks like we have FTP and a Microsoft webserver. Usually this means that it may be vulnerable to file upload exploitation if we have anonymous ftp. We could upload a shell and access this to the webserver, then we can execute some code. Spooky stuff right there. Lets check it out.
Lets check for ftp access.
We have access! Next lets check the webserver and see if there could be a file uploads folder somewhere in there. Usually this is something like /upload /uploads.
Uploading Our Shell
Now it is time to upload our shell. Microsoft IIS uses either asp or aspx files, lets try to check both of them out.
Looks like we can upload both, it also appears that there is a time limit in the webserver becuase it deletes files, therefore we must be snappy and quick to run our reverse shell.
Download the following to execute commands:
We are going to upload the following asp file and execute commands.
Now keep in mind, the file is prepared to be removed ever so often, therefore we need to ensure we are ready to continue uploading - by any means necessary. Before we do so, download the following repo to gain access to our shell and copy the following into our ftp folder.
Establishing Reverse Connection
Edit the file shell file by adding the following to the bottom of the script.
Set up a listener.
Setup HTTP server to transfer
Transfer and execute the file by running the following command on the web browser.
Post Exploitation
Now that we have access lets do some enumeration.
Notice that SeImpersonatePrivilege is set to Enabled, this means that it is vulnerable to Juicypatato Exploit!
Similarly, just like you downloaded the shell to the webserver, we are going to download the juicypatatoe file via HTTP and execute manually. This will be done via ftp or with the following command.
Note, before doing so, lets find out where on the windows machine the file is stored. We want to do this because it is removed from the folder after a certain amount of time.
It appears to be in the following directory
So once it is downloaded, we are going to transfer it to
If that doesn't work, then we will try to upload it to another folder, but well see how that goes. The way to do this, to be efficent is with the following command after we upload the file
Another way of downloading the file is by executing the following command on our web server.
It will download it from our http server and put it automatically in the set specified path. Really the choice is up to you. In this instance we will be uploading via ftp.
Once it is uploaded into the server you will see the file as follows:
Running the file, you will see that it does not work. The reason is because the file was not uploaded in binary mode. You can specify binary mode in ftp before upload.
Putting FTP into binary mode
Copying jp.exe to our desired folder
Execute
We are going to need a few things here.
t we will set *
p a program to launch, something that will execute a reverse shell
l a listening port.
Lets create our program to launch a reverse shell back to kali, yes another reverse shell that will be executed as root. Before we create the program, lets edit ANOTHER .ps1 and change the port where we will be receiving the reverse shell.
This time it will be on port 9002.
Next step is to create a powershell script that will be ran by juicy patato, we will call it spooky.bat
Upload and copy the bat file to where the jp executable is located at.
Set up our listener
Run juicy patato with the following flags. This is going to attempt to get a token that impersonates system and then run our bat file with elevated privleges.
We get a CLSID error in order to fix that, we have to find another CLSID, there are different ones but after obtaing through trial and error you can find a compatible one, one that is most likely to work. We looked at widows 10 enterprise ones
On our Listener
Last updated