HTB - Pov
IP Address: 10.10.11.251
Machine Info
Pov is a medium Windows machine that starts with a webpage featuring a business site. Enumerating the initial webpage, an attacker is able to find the subdomain dev.pov.htb. Navigating to the newly discovered subdomain, a download option is vulnerable to remote file read, giving an attacker the means to get valuable information from the web.config file. The subdomain uses the ViewState mechanism, which, in combination with the secrets leaked from the web.config file, is vulnerable to insecure deserialization, leading to remote code execution as the user sfitz. Looking at the remote filesystem, an attacker can discover and manipulate a file that reveals the credentials for the user alaading. Once the attacker has code execution as the user alaading the SeDebugPrivilege is abused to gain code execution in the context of a privileged application, ultimately resulting in code execution as nt authority\system.
Enumeration
Nmap Scan
┌──(kali㉿kali)-[~/…/machines/Windows/Medium/Pov]
└─$ nmap -F $ip -Pn
PORT STATE SERVICE
80/tcp open http
┌──(kali㉿kali)-[~/…/machines/Windows/Medium/Pov]
└─$ nmap -p- --min-rate 2500 $ip -Pn
PORT STATE SERVICE
80/tcp open http
┌──(kali㉿kali)-[~/…/machines/Windows/Medium/Pov]
└─$ nmap -sC -sV -p80 $ip
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: pov.htb
|_http-server-header: Microsoft-IIS/10.0Fuzz for subdomains
Add to /etc/hosts
LFI
web.config
From the secrets from web.config file, I can create .NET serialized object and attempt to get RCE
Shell as pov\sfitz
Creating serialized object with ysoerial
I inject the object above in _VIEWSTATE parameter and get a shell as alaading
Shell as alaading
It is a PS Credential for alaading:
PowerShell credentials are often used for scripting and automation tasks as a way to store encrypted credentials conveniently.
The credentials are protected using DPAPI, which typically means they can only be decrypted by the same user on the same computer they were created on.
I'm the Administrator :)
If you have
SeDebug privileges, you can debug programs and processes from memory, so we can dumplsass.exeprocess and get all the secrets and hashes from the machine.To get RCE as SYSTEM account, you can start meterperter shell and migrate to winlogon process from Metasploit
Last updated