Devel Writeup
Another one of the first boxes on HTB, and another simple beginner Windows target.
Vulnerability Exploited: Insecure Configuration of FTP Server (CVE-1999-0497)
System Vulnerable: 10.10.10.5
Vulnerability Explanation: Anonymous authentication is an FTP vulnerability that allows users to log in with a username of FTP or anonymously. Therefore, any remote user may connect and authenticate to the server without providing a password or unique credentials. This allows the user to access any files made available by the FTP server.
Vulnerability Fix: Disable anonymous FTP if it is not required. Routinely check the FTP server to ensure that sensitive content is not being made available.
Privilege Escalation Vulnerability: Windows kernel vulnerability. The Ancillary Function Driver (AFD) supports Windows sockets applications and is contained in the afd.sys file. The afd.sys driver runs in kernel mode and manages the Winsock TCP/IP communications protocol. An elevation of privilege vulnerability exists where the AFD improperly validates input passed from user mode to the kernel. An attacker must have valid logon credentials and be able to log on locally to exploit the vulnerability. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode (i.e. with NT AUTHORITY\SYSTEM privileges).
Vulnerability Fix: The user should have updated and patched his system when the vulnerability was publicly disclosed, and a security update was made available.
Severity: Critical
An initial Nmap scan revealed the FTP server on port 21 and HTTP server on port 80.
Anonymous login is enabled, any user can access the FTPserver using anonymous username and no password
On this machine, the port 80 (HTTP) is opened too, the attacker can see the content of this folder using the browser, which is the content of the webserver. For example, we can access and check the content of the text.txt file as follow:
Create a reverse shell payload using msfvenom and save it on file “me.aspx”
Upload the shell to the victim machine using the ftp server (open the ftp on the same working folder that contains the shell to follow the next steps)
Launch a local listener using nc command and visit the following link: http://10.10.10.5/me.aspx
A reverse shell received as IIS APPOOL\WEB
Privilege Escalation:
Check the OS version using systeminfo command:
Based on the OS version “6.1.7600 N/A Build 7600”, we can use the following exploit:
https://www.exploit-db.com/exploits/40564
Download the exploit file and compile it on the local machine as the follow:
Launch a simple http server using python on the local machine to transfer the exploit file to the victim machine
Download the exploit on the victim machine using certuil command on the c:\inetpub\wwwroot directory
Execute the MS11-046.exe exploit to get the SYSTEM privilege
user.txt
root.txt
Lessons Learned
There were essentially two vulnerabilities that allowed us to gain system level access to the machine.
The first vulnerability was insecure configuration of the FTP server that allowed us to gain an initial foothold. Our initial way in was through the anonymous login. Then we found out that the FTP server shared the root directory of the web server. Therefore, when we uploaded a reverse shell in the FTP server, we were able to run it using the browser. This gave us a low privileged shell on the machine.
The user should have done two things to avoid this vulnerability:
Disabled anonymous access to the FTP server.
If anonymous access was necessary, the user should have configured the FTP server to only allow downloads. This way the attacker would not have been able to upload files.
The second vulnerability was a Windows kernel vulnerability that allowed us to elevate privileges. The user should have updated and patched his system when the vulnerability was publicly disclosed, and a security update was made available.
Last updated