TryHackMe - Hack Smarter Security¶

Introduction¶

OS: Windows

URL: Hack Smarter Security

Level: Medium

A very simple and straight forward room. Enumeration being the key to get the initial foothold and root.

- Full port scan to find a vulnarable version of Dell OpenManage
- Using existing exploits to bypass authentication and get the file disclosure
- Enumerating IIS default config files to find the web.config file with credentials
- Using the credentials to get the initial foothold
- Privilage Escalation by abusing insecure file permissions and ability to restart the service

Recon¶

First We start of with the nmap scan to find open ports.

If you read the description of the room, it warns us to be stealthy and discreet. There might be some sort of Intrusion Detection System (IDS) on the system. But usually unless they're configured properly, they can easily be bypassed by setting our scan to be less aggressive and source port to be 53 (DNS).

User¶

FTP¶

Nmap Scan results shows that FTP is open and anonymous login is allowed.

We can login to the FTP server and download the files.

But the files do not contain any useful information.

HTTP¶

The Webserver is running IIS. This seems to be just a static website with no useful information for us. Trying to use gobuster to find any hidden directories does not yield any results either.

Nmap Full Port Scan¶

If a service is running on a non-standard port, it will not be detected by the initial scan. So it's generally a good practice to run a full port scan while you're manually enumerating the services discovered by the initial scan.

Dell OpenManage¶

The full port scan reveals that port 1311 is open.

Accessing the port in the browser https://$IP:1311 shows that it is running Dell OpenManage.

Clicking on About displays the version of the software.

Searching for Openmanage 9.4.0.2 Exploit on Google, We find a article from Rhino Security Labs which explains the vulnerability and provides a python script to exploit it.

• Exploit
• Article

I recommend reading the article to understand the vulnerability and how the exploit works.

But in short, The Exploit uses the Manage External Server feature of Dell OpenManage to create a fake openmanage server which yields us a valid session token. This token can then be used to chain with another exploit which allows authenticated users to read any file on the system.

Exploitation¶

Clone the exploit from the github repository

then run the exploit with your VPN IP and the target_IP:Port

We can now use this exploit to find the location of web.config file which usually contains the credentials on a IIS webserver.

This Documentation from Microsoft explains the default configuration files of IIS.

We need the location for ApplicationHost.config which stores the paths for all the websites hosted on the server.

from the documentation ApplicationHost.config is located at C:\Windows\System32\inetsrv\config\ApplicationHost.config

Now that we have the path for the web root directory for hacksmartersec website, we can use the exploit to read the web.config file.

We have a username and password. We can use these credentials to login to the system via SSH or RDP.

Privilege Escalation¶

Logging in using RDP fails. But SSH is open on the server and we can login using the credentials we found.

Antivirus definitions are upto date, so we cannot use auto enumeration tools like winPEAS to find the privesc vector.

Manually looking at the installed programs and services, we find a program named Spoofer is installed.

Checking for file permissions on the folder we see that the BUILTIN\Users group which our user is a part of has Full Control over the folder.

But this is of no unless we can somehow restart the service to take advantage of the permissions.

We do not have permissions to list all the services on the system. But googling for Spoofer Service Exploit nets us a result

now we can query the service details using sc.exe qc command

we can now replace the binary spoofer-scheduler.exe with a reverse shell and restart the service to get a shell as NT AUTHORITY\SYSTEM

• backup the original spoofer-scheduler.exe
• download the reverse shell payload and rename it to spoofer-scheduler.exe
• restart the service

And we get a shell as NT AUTHORITY\SYSTEM