Visual
Box info
Nmap
Let's start by enumerating open ports using Nmap:
The Nmap output shows that only one port is open, it is port 80 with an Apache HTTP server.
Exploring website
Let's visit the website located at http://10.129.210.129/ using a web browser.
The website appears to allow the compilation of projects in C# and .NET 6.0 platforms. The description on this website suggests that when you upload a link to a Git repository, it compiles the project on the remote machine, and then returns an executable or DDL files.
Let's try to verify whether the functionality of the downloading project works. Let's run the Python HTTP server:
Let's provide a link to our fake repository and click Submit button:
After pressing the button, we are redirected to the following page:
The Python HTTP server indicates that the target machine tried unsuccessfully to download the file:
After some time we receive the following error:
Based on the test performed, we already know that this machine is actually trying to download the contents of the Git repository. Cloning the repository seems to work. Now let's test whether the ability to compile projects works. Create an actual Git repository containing a Visual Studio project in C#. Sample .NET 6.0 project we can find in this repository:
We can clone the repository by the following command:
Let's go to the .git directory contained in the solution we downloaded:
Let's run the following command in this directory:
According to the documentation, this command updates auxiliary info files to help dumb servers. The information available on Stack Overflow indicates that as a dumb server, we can understand all servers containing Git repositories with access over HTTP and every Git repository hosted by this dump server needs to have this command. This command should be executed always after committing changes in a Git repository.
Start the Python HTTP server in this directory as well:
In another terminal window we can check whether cloning the repository is working properly:
Cloning seems to be working fine. We can now upload a link to our repository and try to build the project. After providing the link to the Git repository, we can see that the files have been downloaded from the server:
It turns out that the project build failed:
However, the errors received show that this project is actually being built:
Maybe a successful project build won't be necessary. Let's see if we can somehow use the project compilation process in Visual Studio to remote code execution. From information on Stack Overflow, we find out about possible attack vectors for Visual Studio, one of them is the use of pre-build events. Using this attack vector does not force us to build the project correctly because the malicious code should be executed before the project is compiled. Information found on the Internet indicates that in the case of Visual Studio projects, information about the pre-build event should be included in the project file.
From the Microsoft documentation, we find out that when solutions are created and built-in Visual Studio, Visual Studio uses MSBuild to build each project in your solution. Every Visual Studio project includes an MSBuild project file, which is an XML document that contains all the information and instructions that MSBuild needs to build a project, like the content to include, the platform requirements, versioning information, etc., and also build events. The extension of the MSBuild project file depends on the project type, in the case of a C# project it is .csproj file. In our case project file is the file Sample.DotNet6.Api.csproj. The documentation of building events contains examples of how to add a pre-build event to the project file. We can do this by adding the following lines of code to the Sample.DotNet6.Api.csproj file:
Let's search for payload, which should allow us to get a reverse shell. In this case, we will use payload PowerShell #3 (Base64), which can be generated here. Let's add the payload to the Sample.DotNet6.Api.csproj file:
Then, in the solution directory, let's commit the changes made to the file to update the repository:
After that in the .git catalog we have to update information for the server, by executing this command:
Once in the .git directory, let's run the HTTP server to host our solution:
Let's run the listener on the port that we included in the payload:
and provide a link to our repository:
After a while, we get a connection in the listener:
We have obtained a reverse shell as a user enox:
User flag
The user.txt flag can be found in C:\Users\enox\Desktop.
Privilege escalation
Shell as LocalService
In the C:\ directory we find xampp:
XAMPP is an Apache distribution containing MariaDB, PHP, and Perl. The web root directory is located at C:/xampp/htdocs/. All files placed in this directory should be processed by the web server. Let's go to this directory. Now let's create a simple web shell to find out what permissions this web server is running with:
Opening the webshell.php file and setting the cmd parameter value to whoami, we find out that the PHP server works as local service:
So we can get a reverse shell as a local service. We will use Ivan Sincek's PHP reverse shell from here. We can prepare the revshell.php file on our attacking machine and run the Python HTTP server. First, prepare the listener on the selected port:
Then run the Python HTTP server:
Download the revshell.php to the target machine:
By going to the address we run the script:
We have a connection:
As we expect, we are local service user:
Let's check what permissions have been assigned to this account:
According to the Microsoft documentation, the current permissions assigned to the local service account are not the default permissions for this account. To try to restore the default permissions for this account, we can use the FullPowers tool:
Let's download the FullPowers.exe executable file to our attacking machine from the release page, and then run the Python server:
Then, on the attacking machine, run the PowerShell console and download the file:
Let's execute the downloaded FullPowers.exe file:
Enumerate our rights again:
We recovered the default privilege set. One of the privileges we now have is SeImpersonatePrivilege. This privilege can be used to further elevate privileges to obtain access as the system user. To try to increase our rights and get a reverse shell as thesystem user, we use the GodPotato tool:
Let's download the GodPotato-NET4.exe file from the Release section to the attacking machine and then rename it:
Let's also download Netcat for Windows on the attacking machine. Netcat we will need a target machine to get the reverse shell. Then let's run the listener:
Now let's download Netcat to the target machine:
and GodPotao:
Let's run GodPotato.exe, with a command that should allow us to get a reverse shell:
We get a reverse shell :
After executing the whoami command, we see that we have received a reverse shell as the user system:
Root flag
The root flag can be obtained at C:\Users\Administrator\Desktop.
Last updated