search

Return

hashtag
Recon

chevron-rightnmap_scan.loghashtag
Open 10.129.95.241:53
Open 10.129.95.241:80
Open 10.129.95.241:88
Open 10.129.95.241:135
Open 10.129.95.241:139
Open 10.129.95.241:389
Open 10.129.95.241:445
Open 10.129.95.241:464
Open 10.129.95.241:593
Open 10.129.95.241:636
Open 10.129.95.241:3268
Open 10.129.95.241:3269
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.129.95.241

PORT     STATE SERVICE       REASON  VERSION
53/tcp   open  domain        syn-ack Simple DNS Plus
80/tcp   open  http          syn-ack Microsoft IIS httpd 10.0
|_http-title: HTB Printer Admin Panel
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2024-11-27 18:07:23Z)
135/tcp  open  msrpc         syn-ack Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds? syn-ack
464/tcp  open  kpasswd5?     syn-ack
593/tcp  open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped    syn-ack
3268/tcp open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped    syn-ack
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-11-27T18:07:32
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 36281/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 31622/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 54162/udp): CLEAN (Timeout)
|   Check 4 (port 13626/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 18m34s

hashtag
DNS (53)

└─$ dig ANY return.local @10.129.95.241

; <<>> DiG 9.19.21-1-Debian <<>> ANY return.local @10.129.95.241
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40410
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: e0aecc3fd2bd8c99 (echoed)
;; QUESTION SECTION:
;return.local.                  IN      ANY

;; ANSWER SECTION:
return.local.           600     IN      A       10.129.95.241
return.local.           3600    IN      NS      printer.return.local.
return.local.           3600    IN      SOA     printer.return.local. hostmaster.return.local. 123 900 600 86400 3600
return.local.           600     IN      AAAA    dead:beef::247

;; ADDITIONAL SECTION:
printer.return.local.   1200    IN      A       10.129.95.241
printer.return.local.   1200    IN      AAAA    dead:beef::1d65:68c2:f133:61bd
printer.return.local.   1200    IN      AAAA    dead:beef::1f6

;; Query time: 84 msec
;; SERVER: 10.129.95.241#53(10.129.95.241) (TCP)
;; WHEN: Wed Nov 27 12:50:27 EST 2024
;; MSG SIZE  rcvd: 238

hashtag
HTTP (80)

Writeup.png

POST request contains ip address and that's it, SSRF?

Writeup-1.png

hashtag
WinRM (svc-printer)

hashtag
User.txt

hashtag
Privilege Escalation

https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens#serestoreprivilegearrow-up-right

Cicada had similar privilege escalation path, more details there. [Cicada](

)

hashtag
Root.txt (Path 1)

hashtag
Root.txt (Path 2)

User is part of Server Operatorsarrow-up-right group; The group has full control over certain services, allowing for the execution of arbitrary commands and privilege escalation (sourcearrow-up-right)

Windows Privilege Escalation: Server Operator Grouparrow-up-right

PreviousResoluteNextSandworm

Last updated