HTB: Remote Walkthrough (Windows)

Remote is a now retired Windows machine and an easy one

As usual I started with a series of NMap sweeps, initially a quick scan with attempt to verify the service running on the given port:

Poking the machine a little harder, scanning all TCP ports.

A few interesting ports open but TCP:2049 and TCP:111 stick out – not that this means we skip the others

Remote Management and NFS are looking attractive already.

Poking even harder, this time, I’m letting NMap run and attempt to interrogate the services.

TCP:111 is looking very promising given we have TCP:2049 mountd available; adding to the list for further checks

Before jumping down a potential rabbit hole, we carry on with checking the remaining surface area

Nikto finds the two directories and the Umbraco web app with a “ping.aspx” page – another item to add to our potential vectors.

Finally, we’ll open the page in a browser to see what we have

Sadly simple SQLi bypass didn’t work, nor did the rendered page code

GoBuster is way better than Dirbuster (IMO) but the below is Dirbuster mapping out the site

At this point I decided to head back and poke the NFS service a little more, TCP:111 was happy to talk so there’s likely a mount point, rather than blindly try to mount it, I went for MSF to find the mount point name.

And there we have it

Further poking shows “everyone” – oh dear 🙂

Next up, mount the share

And see what’s there for us

Digging around the web.config uncovers some more items of interest:

We now have confirmation that admin@htb.local is a “thing”

Further digging into the filesystem we find the data files sat underneath Umbraco

We now have two accounts, the SHA1 is easy to reverse, John failed but online tools managed it quickly

Testing the credentials on the Umbraco web app:

And we now have admin on the web app

A vulnerability search for Umbraco uncovered an authenticated Remote Code Execution (RCE) vulnerability.

Testing with a simple “Whoami”

And we have a response from the server, let’s see what else we can get

Nice, user flag 🙂

Digging around the server, I found our beloved TeamViewer, running as SYSTEM, plenty of vulnerabilities to choose from here:

https://www.cvedetails.com/vulnerability-list/vendor_id-11100/product_id-19942/Teamviewer-Teamviewer.html

At this point I generated a payload with MSFVENOM to start a reverse shell and uploaded to the victim

Then executed it

And caught it with netcat.

The initial shell was very unstable, so I generated a second shell and started a listener in MSF, this time it was far more stable

MSF has the exploit already baked so moving to MSF saved some time

Given how prevalent password reuse is, I went straight for WinRM (Evil-WinRM) and authenticated as local administrator

We now own it 😉