Hack Smarter Security
Can you hack the hackers?
Recon
Let's start with a nmap scan.
We can see anonymous login via FTP is possible. Let's do that.
To download the .PNG we have to switch to binary mode.
Credit-Cards-We-Pwned.txt shows a list of credt card details.
Gobuster revealed a directory called images but we can't access it.
We continue with the web service on port 1311. Unfortunately, the Gobuster scan on this endpoint did not reveal anything. When visiting the page we get the hint that TSL is required.
We switch to https://hacksmartersec:1311/, and we get redirected to https://hacksmaertersec:1311/OMSALogin?msgStatus=null. We are dealing with DELL EMC OPENMANAGE and have a login page, but let's take a look around first.
The about page reveals more details including the version running. 9.4.0.2
Initial Access
As already mentioned, we have it to deal with DELL EMC OPENMANAGE in version 9.4.0.2. CVE-2020-5377 is known for this version, which is explained in detail in the following articles.
The blog discusses vulnerabilities found in Dell OpenManage Server Administrator (OMSA) during an internal penetration test, including CVE-2020-5377 and CVE-2021-21514. It details an authentication bypass and file read vulnerability in OMSA versions 9.4.0.0 and 9.4.0.2. The authentication bypass was deemed intended functionality.
The file read vulnerability allows arbitrary file access. A security filter meant to address this was bypassed. A proof of concept for exploiting these vulnerabilities was provided.
The blog concludes with recommendations to secure OMSA usage. PoCs can also be found via Searchsploit / exploit-db.com. However, these do not work in this case, because that version does not include the security filter bypass of CVE-2021-21514.
The article links to the PoC of the company, which is also referenced at exploit-db. We will use this to retrieve data from the system:
Unexpected error with integration github-files: Integration is not installed on this space
We have file read permissions.
We have a username and password.
We can SSH using the above credentials.
This gives us the first flag.
Privilege Escalation
The system is protected by Windows Defender, attempts with WinPEAS were recognized and removed from the system. But the script PrivescCheck, which does something similar to WinPEAS, was not recognized.
We find a vulnerability, rated as high. The spoofer-scheduler service can be started and stopped by a normal user. The service runs under the LocalSystem. We should be able to replace the executable of the service, e.g. with a reverse shell or an executable that creates an admin account for us, we can escalate our privileges.
We confirm that we can write to C:\Program Files(x86)\Spoofer. We need a reverse shell executable that is not recognized by Windows Defender. Msfvenom payload gets easily detected and deleted.
We need a reverse shell executable that will not be detected by Windows Defender. A reverse shell written in Nim can be used for this.
To install Nim and mingw-w64 run the following:
After we make the necessary changes to host and port we need to compile it.
Once compiled we can start a python server and transfer the file. We first make a backup just to be safe
Next, we stop the service, replace the spoofer-scheduler.exe with ours.
Our reverse shell connects, we are the NT/ Authority System user and have access to C:\Users\Administrator. As the challenge says, the next targets of the threat actor are on the administrator's desktop:
Once you gain access to their server, navigate through their intricate network infrastructure, bypassing firewalls, encryption protocols, and other security layers. Locate the central repository where they store sensitive information, including their upcoming target list. Intel has reported this is located on the desktop of the Administrator user.
Let's set up persistence so we can log back in easily even if we loose our reverse shell
We can now SSH with the above credentials and find the targets for the last task of the challenge.
Last updated
Was this helpful?