TryHackMe Writeup: Hack Park

Start by enumerating the machine

nmap -sC -sV -A -Pn 10.10.180.242

Results:

The scan has given us some valuable information.

Ports 80 (HTTP) and 3389 (RDP) are open

Server is Windows Server 2012 with IIS 8.5

ROBOTS.TXT disallows 6 directories:

/Account/*.*

/search

/search.aspx

/error404.aspx

/archive

/archive.aspx

Start Burp so that the traffic generated during our glance at the web page is captured. Next, lets open the web page by visiting the IP Address in the browser (since its running on port 80, no need to append a port). The first thing we want to do is navigate to the robots.txt file and visit the area disallowed by the file. This is so we can increase our visual footprint, as well open up additional attack paths.

/Account

We get a 403. Likely because we are not logged in

/search

This area gives us a search function. This would be good for testing SQLi, XSS, directory traversal and command injection. Lets note it and move on

/search.aspx gives us the same thing as the previous area

/error404.aspx

This is just a standard 404 error page

Both /archive and /archive.aspx serve up what appears to be an archive of previous posts/blog messages

Lets add a few more things to our sitemap in burp. While looking at the last few pages we noticed there are other links scattered throughout the site. There is also a hamburger menu that gives us access to other pages. Lets navigate through all of these, noting all user inputs and parameters along the way. Ensure that you are only hitting pages that are in scope (i.e. only pages that start with your targets IP). Also, check out the source code and visit any links you may find in there that aren’t immediately obvious to regular users.

Throughout our adventure, we noticed several inputs, logins, password reset forms, and the name/version of the blog application.

Lets start with the login form. We could try a few common usernames to see if we can elicit different responses in which to build a brute force attack off of. But could there be an easier way to get usernames? Looks like theres a password reset function. Lets explore that. First I’ll handjam a few random characters and see what kind of response ill get.

Hmmmm…. This looks promising. Before we try automating, let’s try a few usernames that we constantly run across on a normal basis. Root, user, admin, administrator, etc. You know, common stuff.

Well, well, well. This could be valid. Using the information that we’ve gathered so far, we can likely build an effective username harvest in Burp Intruder. Lets capture a request, send it to intruder, and configure the attack.

Attack Type: Sniper

Payload: Simple list, Seclists “top-usernames-shortlist”

Grep — Match: User not found

Request Engine Settings: Threads — 1, Throttle — Fixed at 3000 (we are throttling because not doing so isn’t resulting in responses we are expected. So we will slow down the number of requests to ensure the requests are fully processing)

Redirection: Always

Start attack

Once completed, only one username didn’t have the User Not Found error. Funny enough, ti’s the same username we identified earlier on our quick glance at the password reset function

So lets attack the login form with burp intruder with our new username! You can set up the attack similarly to how we did the last attack. Just change the Grep Match to the error message from the login form, “Login failed”, as well as changing the payload to be your passlist of choice. I will be using the seclists list “10-million-password-list-top-10000.txt

Attacking the webform returned a single entry that didn’t contain “Login Failed”. That’s our password!

Now that we have both the username and password, we can log into the admin panel. While in the site, we can see that we have administrative rights to the site. That’s great, but we’re not here to deface. We want to compromise the underlying infrastructure. Clicking the “About” link brings us to a page which confirms the applications version number that we found earlier. Now, we COULD play with user inputs to try to gain access to the infrastructure, but before we do that lets see if there’s an exploit available for this application. Luckily, there is.

Now, we will download the exploit and modify the code to include our IP and a port we will use for connect back.

Also according to the exploit writer, we must rename this file to PostView.ascx. Next we will upload the file by selecting the edit function for the admins post, then uploading the file.

After saving, we will set up a netcat listener and then visit the root URL and append “?theme=../../App_Data/files” to it. This should trigger the exploit.

Excellent!Now we are going to attempt to enumerate the machine using WinPEAS. First, we need to get it onto the target machine. To do this, navigate to the folder containing the winPEAS exe and spin up an http server.

Now on the target machine, navigate to a folder that you know you have permissions to, and download the file. In this case, ill use C:\Windows\temp

And then we run winPEAS. In the first set of results, it looks as though we already found some admin credentials stored due to autologon

Lets note this credential and continue reading our results.

Looks like we have a service that we have access to modify! Trying to navigate around in our current form is a bit clunky. So lets try to switch to meterpreter. First, create a payload, then set up a web server to serve up that payload

Then set up a handler to catch the incoming session

Great. Now lets get our payload onto the target and run it

Excellent. Now lets use “getsystem” and……

Well crap. That wasn’t quite what we wanted. Looks like we should re-train our focus on that service we found earlier. Now we know that WService.exe isn’t the file we’re looking to modify. But inside that directory is an “Events” folder with a log file 20198415519.INI_LOG.txt. If we cat that file, we see that there’s a file names “Message.exe”. Lets use that as our launching point.

Lets take the payload we created earlier, delete the old Message.exe, replace it with our payload and wait….

And 30 seconds later…..

Success! Now we can read and submit the rest of the flags

--

--

--

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Thoughts from Rootconf 2019

Pen-Testing Salesforce Apps: Part 1 (Concepts)

$MSN has passed Techrate security audit!

SRI leads collaborative effort that uncovered cybersecurity issues in industrial control system…

Vulnerability Management without auto-deduplication is inefficient

2,000 ICX Giveaway Event

Band Protocol Staking is on ICONFi!

Outing German spy agencies by mailing them Airtags

A product shot of Apple’s Airtag; superimosed on it in meme-style all-caps Impact is ‘SNITCHES GET STITCHES.’ Image: Apple https://www.apple.com/airtag/

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
PwnPalace

PwnPalace

More from Medium

HackTheBox: Previse

THM’s Steel Mountain CTF Writeup

HackTheBox Unicode Write-Up

Unicode Avatar