AVenger
Recon
We first start with a simple Nmap scan and discover several open ports and services running on them. Some notable services are HTTP on port 80, HTTPS on port 443, SMB on port 445, RDP on port 3389, WinRM on port 5985
For more results we can run a more detailed scan with specified services and default script scan on the initially found ports
After the Nmap scan is completed, We run a Gobuster scan to enumerate all possiblle directories running on the web server.
We can see few services are running such as Wordpress. Upon manual enumeration /wordpress led to the below page.
Any links on the /wordpress would redirect to avenger.tryhackme/gift.
Manually opening http://avenger.thm/gift would do the same.
After adding the same to /etc/hosts.
A wpscan of http://avenger.thm/wordpress/ did not reveal much information, however a scan of http://avenger.tryhackme/gift/ revelead the following.
We see Forminator version 1.24.1 is in use. Which is affected by the vulnerability of unauthenticated remote command execution in version 1.24.6 (CVE-2023-4596). This vulnerability would allow us to upload a reverse shell, execute it and gain access.
Upon further manual enumeration of http://avenger.tryhackme/gift/ at the bottom we find a form with an upload file. This is where we can exploit this vulnerability.
Initial Access
First I tried uploading a reverse shell and accessing it but it was not available. I could not find the uploaded file. When we upload a file and submit, we get a message that states "Thank you for your submission . Our team is delighted to review every message carefully. You will hear from us shortly!."
We can create a html file containing an img tag, we then point the source of that image to our IP address. If we get any requests then the file is definitely being opened.
To test this
We upload the file 'cat.html' and setup a http server with python, and after some time we get a request.
This is confirmation that the file is being opened. Now we just need to upload a malicious file that can give us a reverse shell.
I was lucky enough to get it on first try with a batch file, batch files are essentially text files that contain a set of commands that can be executed when run.
We create a simple one with the same concept of the HTML file to check if we get a request back.
I initially messed up this command with the wrong IP and it did not work, after quite some time, I realised I had entered the wrong IP and then it worked.
This confirms that we have command execution. Now we need to generate and upload a powershell reverse shell.
This can be done with the help of powercat.
We need to modify our batch file to give us a reverse shell.
We then upload this and set up a listner for our reverse shell.
we see that our powershell reverse shell works, and after that we immediately got a shell as the user hugo.
After that we can look at the desktop of hugo for our first flag
Privilege Escalation
We first check in what groups our user Hugo is in.
We can see we are part of Administrators, so let's try changing into Administrators directory.
We however get Access is denied. It is possible that UAC or (User Account Control) is preventing us from performing any administrative tasks, we can check if UAC is enabled with this command :
We got 0x1, this means UAC is enabled, and also we see that we're in the Mandatory Label\Medium Mandatory Level group, this means that we are in a medium integrity level shell, and UAC is preventing us from doing administrative tasks.
If we know the password of the user Hugo we can connect via RDP and just get access.
One common place where we can search for credentials is autologon, which is a feature that allows a user to configure the system to automatically log in to a specific user account without requiring manual input of the username and password.
We can find the saved credentials in the HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon registry.
Here we have the password of Hugo
Now we simply connect with RDP.
Now we have successfully connected via RDP.
When trying to ccessing the Administrator folder we get a UAC prompt, simply click continue and can get our root flag.
Last updated