Perspective
Recon
nmap_scan.log
Open 10.129.227.158:22
Open 10.129.227.158:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.129.227.158
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH for_Windows_7.7 (protocol 2.0)
| ssh-hostkey:
| 2048 d6:7f:3f:d4:22:15:ce:64:f3:c8:00:79:bf:f6:f8:f8 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvvNvqDHY0La79TRuhP3rVsxGaYbPZ5rZm601149jVSvANLse2QFcV5+I0J7rPcyv/QnBzKuFjL2LnkQ2PILhXmxp3Lx6DH/CjpLUhDqmNILTkNrfqYmc1FY5tb9PQ6xThCn+/ArvezWlrwkyzD3MeVLFBqz37A2gNTXrRHD9TjTnkQB4hCjaG2vqTXtrwgjeZT60+WCJfrrHkvBpWxj6cTtU8k7IRsQ6x6hgVvNAE7iaCiJXMSXNZb2FHqX8F8Lomm6yb9MBciGwk3y1lUAnpBrgLpJ3oguj8fVne7HtRmLQqkoLChbnY0Cofb+JfMEArowm3sIjeoqx5n/aZe1AN
| 256 08:c6:d4:f3:98:84:0f:fd:4b:ed:e3:a6:25:bd:e7:70 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGKidzCrvHuj5D+VtvMBYwBaNG5xkYCKkdC5bAGYSTi7aeQCCTqvUbAGpOUOJGZCy9LwnZF70drFxCuMmRhFCEw=
| 256 32:81:6a:8b:4d:f9:61:09:ff:d3:99:6c:e7:3f:a3:ac (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKkzcBfW0X+tsMrF7duDsKuD5uocdxaXFKoT/hKcQtb5
80/tcp open http syn-ack Microsoft IIS httpd 10.0
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsHTTP (80)
Oddly enough this is Windows box with only SSH and HTTP 🤔 Something aint right.
Backend is IIS and __VIEWSTATE is being used, which is known to be vulnerable to RCE if we have a correct payload.
If we request asp[x] files we get different error and headers:
We can add products, it only seems to accept JPEG files.
Fuzzing Upload Extension
We can try fuzzing for different extensions. First validate correct match and then start real fuzzing.
FFUF supports burp requests, copy it to file, edit the filename to be filename="whatever.FUZZ", filename contents doesn't matter much, leave the content type as is, and also change name to whateverFUZZ so it's unique and doesn't cause an error.
Manually reduced matches to somewhat usable extensions, because there was a lot... 75/93 matched.
We can upload JS so possible XSS, conf might not be useful, cgi probably not, jhtml is something interesting alongside with shtml; archives, images and else probably not useful too.
SSTI
shtml is supported by IIS, jhtml seems Java application specific so not going to dive in there.
SSTI is successful
<!--#exec cmd="ls" --> returns The CMD option is not enabled for #EXEC calls, no RCE :/
LFI
web.config returns:
but ../web.config returns:
Interesting values:
Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net
ViewStateUserKey is encoded so encryption is used, and we have no keys for that, __VIEWSTATE exploit has to wait.
Note: In above blog author uses ViewState Editor plugin in burp
There's a proxy in SecurePasswordServiceUrl going to port 8000 locally 🤔
ASPXAUTH Cookie
.ASPXAUTH cookie stands out in the http request, turns out we can decode it: Decoding Forms Authentication Cookies With Mono
I wasn't going to run this on Widows, so in search of online runners I used https://www.programiz.com/csharp-programming/online-compiler/
Output:
Soo... if we can decrypt, can we encrypt too?
We need a valid username for this to work. Via "Forgot Password" we are able to enumerate users from application, most common name for admin accounts is, of course, admin!
Once again avoid the Windows at all cost D: and use online compiler.
Welp... that was a good try, but it didn't work :/ I had to succumb to the Windows. Using previous project encrypt the cookie, make sure to include System.Web.Security in libraries as it's not loaded by default and make sure to have web.config correct like README mentions.
This is the correct cookie:
Admin Session
After editing cookie .ASPXAUTH we get to the admin session which has ability to load user data
Exporting admin data failed, but normal user was ok.
Dynamic PDF XSS
username field doesn't seem vulnerable to SQLi, but we can probably do Dynamic PDF XSS Injection
I thought h1 tag failed, but Name field just didn't like that html, but Description accepted and we can see it making text bold.
HTML Tags Fuzzing
Let's start fuzz for enabled tags:
Now that sample is tested, let's do real fuzzing:
135/190 is valid. base and meta are probably the easiest to use, but meta will be easier to exploit because we can redirect to malicious JS code and base scripts are mostly going up a directory so some trickery will be required.
https://punksecurity.co.uk/blog/base_tag_injections/
XSS
https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf -> <meta http-equiv="refresh" content="0;url=file:///etc/passwd" /> (didn't work)
LFI still doesn't work even with dynamic XSS and iframe, but probably don't need LFI because we already found it witho shtml...
SSRF
There was local service running on port 8000 so we can perform SSRF to check it out.
We can keep reusing the same index.html file, because we, server, are reloading it.
CSRF PoC Generator && Autosubmit Form CSRF PoC
Key:
SAltysAltYV1ewSTaT3
__VIEWSTATE RCE
__VIEWSTATE RCETo fill the command values refer to Official Tool docs https://github.com/pwntester/ysoserial.net
Paste the value in any request that has __VIEWSTATE
Reverse Shell
Finally a shell! 🎉
SSH (22)
Upgrade reverse shell to SSH session
User.txt
Privilege Escalation
There's some kind of executable file in this user's folder.
Download the file for further analysis
We can decompile with dnSpy to view the source code in plaintext. This seems to be the production application which is running on 80, so nothing interesting there. All SQL queries are parametrized and no SQLi too. There were hardcoded whitelist/blacklist of tags tho.
Good stuff from powershell, looks like there's same application running on different port and stage. web.config contains dynamic keys, not hardcoded ones.
Staging App
Command Injection
The change password is using PasswordReset.exe, which is called from cmd.exe. This call makes it susceptible to Command Injection.
The command that is ran:
password is protected and can only be Regex("^([a-zA-Z0-9!@#.^]{6,15})$") pattern, so we can't just chain other commands. decryptedstring is not blacklisted, but it must be valid.
Padding Oracle Attack
From the messages we can guess that we are dealing with a block cipher, and most probably the Padding Oracle Attack
Initially I found padding-oracle-attacker, but that tool didn't go well. So then I tried padre, results:
What we did is
Root.txt
Hashdump
Last updated