GitHubPsMapExec

Compromised

Proving Grounds PG Practice Compromised writeup

Nmap

sudo nmap 192.168.178.152  -p- -sS -sV

PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
443/tcp   open  ssl/http      Microsoft IIS httpd 10.0
445/tcp   open  microsoft-ds?
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49666/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Jumping in immediately over to SMB for any low hanging fruit we can see can authenticate with null credentials and list the available shares.

└─$ smbclient -U '' -L \\\\192.168.178.152   
  
Enter WORKGROUP\'s password: 

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        Scripts$        Disk      
        Users$          Disk      
SMB1 disabled -- no workgroup available

From here we can see four separate PowerShell .ps1 files. I downloaded all the available files which have been listed below:

However, after going through these files they do not appear to be related directly to any exploitation.

Examining the Users$ SMB Share we see that the c:\users directory is mapped as a share. Typically the Administrators user folder is off limits. We are however able to access the entire user directory for the user 'scripting'.

Whilst this produces a large amount of files and directories we can instead utilize the smbmap tool to assist with recursively going through each directory for interesting files.

Where once finished we find the following files of interest:

Using smbclient we can download README.txt from the user scripting's Desktop.

We also have a file called profile.ps1 located in c:\users\scripting\Documents\WindowsPowerShell.

Extracting the Base64 string from the script and running it through base64 we find a potential password string.

We have the credentials of scripting:FriendsDontLetFriendsBase64Passwords Considering port 5985 is open we can test the credentials using Evil-WinRM.

Interestingly checking the users group memberships we see the user scripting is a member of the 'Event Log Readers' group.

Often times PowerShell commands and scripts that are executed on the system will be logged to the 'Windows PowerShell' event logs.

From the output we notice multiple instances of the command below being execute on the system. As we can tell by the command the payload in encoded in base64.

Decoding the string with Base64 reveals the command below:

As we can see we have a lot going on with the decoded script. This writeup will not go into depth on this however references will be provided for further reading. Essentially after slowly breaking down the script and decoding a couple of the lines we see the following is performed:

Essentially the script will exit on the target system as per the script if the machine cannot ping 8.8.8.8 (Google DNS Servers) and if the machine name is 'compromised' the script will exit. Removing these conditions we are left with the script below.

When executed on the target system we are given the Administrator password.

For the credentials: Administrator:TheShellIsMightierThanTheSword!

We can then log in as the Administrator using Evil-WinRM.

References

Last updated