Control
Control is a hard difficulty windows box that takes on Active Directory as well as registry misconfigurations
Recon
we start off by scanning Control's IP 10.10.10.167 with nmap
From our scan we get the following results
We find that we have HTTP MySQL & RPC running.
Doing a dirbust we find a admin.php page that we cannot access it with the errorAccess Denied: Header Missing. Please ensure you go through the proxy to access this pageGoing through the webpage's source code however we find a reference to a local IP on the machine
Armed with this information we can find that we need to have a proxy header to get to the page
Going through all Proxy Headers we find that X-Forwarded-For: 192.168.4.28 is our winning combination.
We can include this on our Burp requests to traverse the page.
After a little searching around we see that the website conducts some basic CURD operations but in addition to this also does searches. After trying basic SQLi on all fields we find that the search field is vulnerable.
Doing a basic union select 1, database(), user(),1,1,1-- -
Gives us a output
Great! we now have the DB Name warehouse and a user manager
With this we can go ahead and launch SQLMap
From this we're able to pull some user hashes cracking them we get
Jumping deeper with SQLMap
We find that we can use SQLMap to write files for this we'll once again rely on a webshell we've used multiple times before https://github.com/WhiteWinterWolf/wwwolf-php-webshell
Great now that we have a shell we can work on getting a full shell
Exploit
After running ipconfig we see that WinRM is running locally, luckily we can do port forwarding and access it on our machine, to do this we'll use plink so we upload plink and make sure ssh is running on our system after this we can
And
And with that we have user!
Post Exploitation
Searching around the machine we don't find any obvious paths to priv esc, however running
Gives us the powershell console history location, and reading this gives us
Not immediately obvious but from this we can see that privilege escalation via registry is the way https://attack.mitre.org/techniques/T1058/
From here we can put together a list of all services in Registry like
And prepare a little script to go through this and find our vulnerable service
And voila we have root!
Useful Links
Last updated