All right.
So the first box up is Arctic.
And if we take a look at the end map scan we have three ports open we've got port one thirty five point
eighty five hundred and forty nine 154.
Now Port eighty five hundred is unknown to us.
The other two are our P.S..
So I kind of want to investigate the eighty five hundred before we go the RTC route and what I like
to do is just go out and see maybe it's a web page.
It's not a web page and I'll go to telnet and see if it responds on telnet or any sort of connection
that we can make.
So the first thing I'll do is go out to the inter webs and see if we can't get to tend to attend 10
to 11 on eighty five hundred.
And it loads here.
And for me I see the S.F. ivy and the S.F. docs and I already know what this is from experience.
But let's play by not knowing at all what it is.
Let's just click on the CFR idea e and if I came across this page as a pen tester I would definitely
dig into both of these.
We can look around and see and this is going a little slow.
Another thing while we wait for this is we could say something along the lines of just google it and
say hey what's CFI the ad it should pull up that it is cold fusion and you'll still see and hear all
sorts of cold fusion.
Hey yet another cold fusion vulnerability.
That's not a joke.
When I was going through a certain exam period or a certain lab I was doing research on cold fusion
to find exploits and there was literally I would say a 50 to 100 page document on just exploits for
cold fusion.
So there are a ton of them.
So while we're in here we see a bunch of different directories application admin API administrator and
we should dig through all of these now to save time.
I'm going to go down the direct path but if you're doing proper renumeration you should be looking through
all of these and seeing if there's anything in here you don't know if maybe an adamant API for example
there is an API key or some sort of token or maybe in scripts somebodies put some sort of password into
a document etc..
So you always want to dig through these but the correct path that we should be taking is the administrator
path.
And the reason for that is when we go to the administrative page we're going to see that there's actually
a version number.
So we have to know the version of the application right in order to make sure that we know what we're
attacking against.
So we can research of the multitude of vulnerabilities that do exist.
We could try to find which vulnerabilities out there for this cold fusion in particular.
All right so the page loads for us and we could see that we're up against Adobe cold fusion 8.
So the first thing I want to do is I'm going to go out and I'm going to see one.
Hey maybe there are admin or default admin password for cold fusion.
So we should look that up because maybe that's just an easy win to get in.
And another thing is hey are there any vulnerabilities for this.
So I'm just going to go take a quick peek and say Adobe cold fusion.
Hey look what's coming up eight exploit.
I haven't even signed it at this point so we've got directory traversal and we've got arbitrary file
upload so let's go ahead and just take a look at these two.
So you've got cold fusion directory traversal and this gives us some information here or we can take
a look and see maybe if we can execute directory reversal and pull down password properties it looks
like maybe we can steal a password from this which isn't bad.
Let's take a look at this other one here OK.
This one looks like we can do some sort of file upload and we just dropped show code into here and it
will execute that is what it looks like but this isn't a direct exploit this is just kind of telling
us hey let's do it very manually.
So I don't want to just look and say OK well if I know that there is Adobe fusion eight or cold fusion
eight let's do look for a file upload file upload execution for Metis boy but let's try to avoid met
a split on this one.
So let's take a look at arbitrary file upload Adobe eight point one eight point zero point one let's
scroll through and see if we can find any sort of exploit here
actually the eight point zero point one that just showed up
simplified to exploit
Callas.
Check this one right here this looks like a script OK so we found it.
It takes a little bit of digging.
Sometimes on the inter.
If you go out it's going to keep pulling up Google or it's gonna keep pulling a medicinal type stuff
on Google.
So we have the Mets play option and this option works very well.
I'm just trying to avoid it to teach a more manual way throughout the this capstone.
But if you use medicinally there's absolutely nothing wrong with that.
So I am not against using this weight whatsoever.
So let's dig into this option here this upload dot pie.
I'm just at a coffee this
and we could see the usage here we have to have a target IPA hostname a target port particle fusion
path to payload that GSP.
So we have a GSP payload.
All right.
And we're gonna go ahead and try to execute that.
So let's go ahead and just go to a terminal and I'm going to make this I'm gonna say get it.
We'll just call it upload.
Pie and call what everyone paces in there and say that now we need to create a Java or GSP shall is
what it's saying.
So here's an example of what we're doing.
And OK.
So the GSP shall let's go ahead and do that really quick.
Now it should be something along the lines of MSA venom the dash P for payload Java and then GSP shell
reverse is what we should be looking for.
Now our l host I actually don't know my IP address.
I'm at tend to end up 14 to 4 so 10 that 10 14 not four.
We'll set the airport to four for three and we'll just do a file type of raw into shell that GSP
OK.
And this will just take a second to generate.
And then once it does generate we can go ahead and whoops sorry it is absolutely shell reverse.
Give that one go.
And then once this does generate we should able to go in here and just run this let's go ahead and get
this ready and this gives an example.
So we need the port which is going to be eighty five hundred access to the shell.
So let's go ahead and just open up a new one and we'll just say Python uploader dot pi and then we're
going to need the IP address which is 10 10 10 to 11.
We're going to need the port which is eighty five hundred.
The shell that GSP and we're going to need to have a net cat session listening.
So and BLT 4 4 3 have that listening.
And we should be able to execute this.
So now we just navigate to this page which has our file uploaded and it should pop a shell for us it
might just take a second to actually pop all right.
There we are.
So we are on.
It looks like a Microsoft Windows machine 2009.
So maybe we're on a Windows Server 2008 or maybe you on Windows 7.
So let's take a quick look we're going to just do.
Who am I.
We could see where Arctic told us so it doesn't look like we're in the admin group.
We can do a net user real quick or net user told us and see where we belong.
We just belong in the local group here.
So we're going to need to escalate this.
Now we could pull down the system info very quickly and just let windows exploit suggest or start running
on this while we're going.
Now this is a two thousand hour machine.
Chances are not very patched.
There's a likely kernel exploits running against this that we can just pop and go on.
But just to make sure we're going to go ahead and run this so I'm going to locate my windows XP suggested
which is here.
And I always forget the syntax.
So I'm just going to do a quick history and then grep on it.
And we've got this right here so I'm was going to get it my sister's info that t t replace the one that
I had in there from before and then I was going to copy one of these lines and this should automatically
start running for me.
OK so while that's running we can look around the machine.
We always do net stat Dash.
You know just get a quick lay of the land see what ports are open and what's going on out there.
So we have some ports open internally that we don't have open externally.
We can see what connections are out there.
So anything from 10 that 10 out of eleven looks like we've got a few connections going out to dot for
which is us.
There was a time wait.
These are likely just us making the initial upload.
And here we are with the shell that's established.
I don't see anybody else on this machine.
Sometimes if you're in the lab like hack the box you could see other people actually on the machine
as well.
And then it's got some ports up and these like our P.C. these ports.
I'm not entirely certain what they are.
So we'd have to dig into them a little bit but moving on we can check the network.
We can do a quick I have config.
It's just good practice or IP config to see what's in here.
Again this are just habits you want to be in especially if you're in a lab environment.
There's no do a whole machine.
You could do a dark RF dash a here and to see what we're talking to a dot to that two fifty five.
Those are expected.
So here.
Nothing special either.
So from here we can do a quick look at like who am I slash crave and see what's enable for us.
Now impersonate privileges are available so maybe we have some sort of potato attack here or we can
do a impersonation like a token impersonation if we want.
This would require getting a shell on this machine or running a hot potato or something along those
lines to try to elevate.
So we're going to take a different route and we're going to just take a non medicinally route where
we try to do an exploit.
Let's see what's come back over here.
Now if you've been following along with the course this will look very familiar in terms of what you're
seeing.
We see the same kind of exploits from before right.
And one of these should stand out as one that you've actually ran before and that one is M.S. 1 0 0
5 9.
Remember that Jimmy cherry that is Jimmy Cherry.
Now I don't know if we still have Jimmy cherry on our machine by we'll do a quick locate and see if
we do we doubt.
So I'm gonna go grab a go quick and I'm going to go out to Google and remember the M.S. 1 0 0 5 9 exploit
and we'll have the kernel exploits right here.
So we've got to do is just download this.
Actually it's probably listed under M.S. 1 0 0 0 5 9.
Let's go ahead and download and say that and then I'm going to move the M.S. or the downloads M.S. 1
0 0 5 9 out ELC over to my transfer folder.
So I'm going to C.D. and to transfer and then I'm just going to go ahead and set up a python HBP server
are actually simple HP servers sorry on port 80 let that listen and then we're gonna grab the file from
So let's go ahead and maybe try to get somewhere that's right ABL.
I like just doing we'll go to CDC and maybe there is a temple there.
Let's take a look here if there's any sort of temp we may be able to make a directory called temp so
to say make their temp C.T. to temp OK.
And then we could just do something like a search you till your cash and then a file of a TGP.
I think I was 10 that turned out 14 not for a mess.
1 0 0 5 9.
I see.
We'll this call it XP that you see or something along those lines.
See if that grabs OK do a quick.
See if it's here it is.
Now let's go ahead.
Just try to run the XP that you see OK.
So we see that we need to have a chimney jury to XY IP address and port.
So we're gonna give this a e XP to EMC we're gonna give the IP address of 10 dot dot 14 dot four and
we'll give a port over at 5 5 5 5 and let's go ahead and just load this up over here so net.
And the IP 5 5 5 5 and run that.
See if it pops
okay and it pops so let's do a quick.
Who am I.
And you see that we authority system so let's quickly recap.
We found a very vulnerable Adobe cold fusion page now with the cold fusion page.
We could have used Metis boy and this would have been game over with Metis play very very fast.
We could have just ran the Metis play module executed a shell dumped into a local exploit suggested
and you could have ran any of your choice when you see something like Windows 2008 server or Windows
7.
Your brain should start focusing immediately on Hey what kind of kernel exploit might be here.
Now there might not be any it might just be a dead end there might just be a rabbit hole there or even
intentionally place for you to chase but you should always look at the kernel exploit first because
that might be something that is an easy win you see how easy this is.
We didn't have to go try to do any sort of potato attack or try to do impersonation or dig around the
machine any further than we needed to.
We could've started running power up we could have tried running wind peas we could have tried running
any sort of tool just to see where we could have dumped we could have done manual enumeration look for
passwords and config files etc. all the training we've done this far could have done it.
But we know we're an older machine.
We could try to run a kernel exploit and we were successful doing that.
So might as well take the easy road if we have the easy road available to us.
So that is it for this box.
Now let's move on to the next box and see if you can pull off something similar.
So I will catch you over in the next machine.