THM - AllSignsPoint2Pwnage

August 19, 2021 THM

AllSignsPoint2Pwnage

Created by apjone

A room that contains a rushed Windows based Digital Sign system. Can you breach it?

https://tryhackme.com/room/allsignspoint2pwnage

Task 1

Enumeration

 ┌──(root💀K)-[/home/mik/Downloads] 
 └─# nmap -p0-1025 -sV -O -A 10.10.103.18
 Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-15 14:51 EEST 
 Nmap scan report for 10.10.182.43 
 Host is up (0.068s latency). 
 Not shown: 1020 closed ports 
 PORT STATE SERVICE VERSION 
 21/tcp open ftp IIS ftpd 7 
 | ftp-anon: Anonymous FTP login allowed (FTP code 230) 
 |_11-14-20 04:26PM 173 notice.txt 
 | ftp-syst:  
 |_ SYST: Windows_NT 
  80/tcp open http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11)  
 | http-methods:  
 |_ Potentially risky methods: TRACE 
 |_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 
 |_http-title: Simple Slide Show 
 135/tcp open msrpc Microsoft Windows RPC 
 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 
 443/tcp open ssl/http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11) 
 |_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 
 |_http-title: Simple Slide Show 
 | ssl-cert: Subject: commonName=localhost 
 | Not valid before: 2009-11-10T23:48:47 
 |_Not valid after: 2019-11-08T23:48:47 
 |_ssl-date: TLS randomness does not represent time 
 | tls-alpn:  
 |_ http/1.1 
 445/tcp open microsoft-ds? 
 No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). 
 TCP/IP fingerprint: 
 OS:SCAN(V=7.91%E=4%D=8/15%OT=21%CT=1%CU=34603%PV=Y%DS=2%DC=T%G=Y%TM=6118FFD OS:6%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=109%TI=I%CI=I%II=I%SS=S%TS= OS:U)OPS(O1=M505NW8NNS%O2=M505NW8NNS%O3=M505NW8%O4=M505NW8NNS%O5=M505NW8NNS OS:%O6=M505NNS)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y% OS:DF=Y%T=80%W=FFFF%O=M505NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD= OS:0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S OS:=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R= OS:Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F= OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T OS:=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD= OS:Z)  
 Network Distance: 2 hops 
 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows 
 
 Host script results: 
 | smb2-security-mode:  
 | 2.02:  
 |_ Message signing enabled but not required 
 | smb2-time:  
 | date: 2021-08-15T11:51:45 
 |_ start_date: N/A

Apache

Check Smb

┌──(root💀K)-[/home/mik/Downloads] 
└─# smbclient -L \\\\10.10.103.18\\ -N 
Sharename Type Comment 
--------- ---- ------- 
ADMIN$ Disk Remote Admin 
C$ Disk Default share 
 images$ Disk  
Installs$ Disk 
IPC$ IPC Remote IPC 
Users Disk 
SMB1 disabled -- no workgroup available

Check Ftp

┌──(root💀K)-[/home/mik/Downloads] 
└─# ftp $IP
Connected to 10.10.103.18. 
220 Microsoft FTP Service 
Name (10.10.182.43:mik): anonymous 
331 Anonymous access allowed, send identity (e-mail name) as password. 
Password: 
230 User logged in. 
Remote system type is Windows_NT. 
ftp> ls 
200 PORT command successful. 
125 Data connection already open; Transfer starting. 
11-14-20 04:26PM 173 notice.txt 
226 Transfer complete. 
ftp> get notice.txt 
local: notice.txt remote: notice.txt 
200 PORT command successful. 
125 Data connection already open; Transfer starting. 
226 Transfer complete. 
173 bytes received in 0.35 secs (0.4765 kB/s) 
ftp>

Task 2

Ok we have the site, we have the confirmation that the images folder is RW we upload a php shell.

Use https://reverse.7sec.pw/ to create a reverse PHP CMD shell and try to load it in the images folder:

now we need to get a reverse shell:

the classic reverse shell of pentestmonkey does not work, we are on a Windows machine with apache uses XAMPP, searching on google I find: ivan-sincek / php-reverse-shell download and try to load it on the server: