Appsanity
Recon
nmap_scan.log
Open 10.129.146.201:80
Open 10.129.146.201:443
Open 10.129.146.201:5985
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.129.146.201
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to https://meddigi.htb/
443/tcp open https? syn-ack
5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsHTTPs (443)
HTTP redirects to HTTPs
We can sign up as Patient.
Passive recon of subdomain enumeration returned nothing for HTTP, but there's subdomain for HTTPs
Our token
Become Doctor
When we sign up we have hidden field attached to form called Acctype which by default is 1, changing to 0 doesn't create account and 2 is Doctor.
Now we are a Doctor
When we try to add ourselves (patient account) in request we are ID of 7, changing ID doesn't show anything in response.
Portal
Let's visit the subdomain
The login urls are somewhat same and in the requests we don't have cookies from main domain to this domain. If we go back to main domain, change the access_token domain scope to .meddigi.htb (note the dot) we will get this cookie on all subdomains.
Go back to the portal, refresh and voila! We are logged in as Doctor.
Upload Bypass
https://portal.meddigi.htb/examreport let's us upload files, but only PDFs.
During upload we can add magic bytes to detect this file as PDF
And we get Examination report sent to the management.
Run passive recon to find where it gets uploaded ; Nothing interesting
SSRF
Meanwhile in Prescriptions we have SSRF
Port 80 has response after ages... but all others have delay of 2 seconds.
We can filter by time
SSRF to RCE
Looks like we can view reports, but our is long gone. Im actually going to change the payload to straight up reverse shell because interactive session doesn't look that bright.
Reverse Shell (svc_exampanel)
Upload -> SSRF on 8080 -> https://portal.meddigi.htb/ViewReport.aspx?file=5c7b8af3-70d9-4d94-bcfd-4fcd5dc4ca98_shell.aspx -> Change protocol, url and port => http://127.0.0.1:8080/ViewReport.aspx?file=5c7b8af3-70d9-4d94-bcfd-4fcd5dc4ca98_shell.aspx -> Get reverse shell
User.txt
Privilege Escalation (devdoc)
Decompile the DLL https://www.decompiler.com/jar/7d19edcf2760481892228654a92d724b/ExaminationManagement.dll
It's getting some kind of decryption key from registry
This looks like a password.
Get the users
Brute the password with wirnm, smb was not open.
WinRM
Enumerate with winpeas
There's something running on port 80 by ReportManagement, which lives in Program Files
Privilege Escalation (Administrator)
We only have access to ReportManagement.exe
From the strings if we had to make a rough guess, it's probably loading DLLs from C:\\Program Files\\ReportManagement\\Libraries
The directory is empty and we have write access to it.
netcat was dying on evil-winrm and not letting me to interact with program, plain reverse shell was also dying so I had to port forward.
Scratch the filename, it seems as long as DLL is in the folder then it can be loaded. I messed up the filename, so externalupload2 worked too.
Root.txt
Last updated