search

Fuse

HTB Writeup

Lets start with a Nmap Scan:

root@liberty:/home/kali# nmap -Pn -sC -sV fuse.htb
Starting Nmap 7.80 ( https://nmap.org ) 
Nmap scan report for fuse.htb (10.129.2.5)
Host is up (0.022s latency).
Not shown: 988 filtered ports
PORT     STATE SERVICE      VERSION
53/tcp   open  domain?
80/tcp   open  http         Microsoft IIS httpd 10.0
88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2020-10-09 13:58:10Z)
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: fabricorp.local, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: FABRICORP)
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap         Microsoft Windows Active Directory LDAP (Domain: fabricorp.local, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=7%D=10/9%Time=5F8068D4%P=x86_64-pc-linux-gnu%r(DNSV
SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\
SF:x04bind\0\0\x10\0\x03");
Service Info: Host: FUSE; OS: Windows; CPE: cpe:/o:microsoft:windows

Take notice to the domain :

Its at this point with most HTB Machines that I'll add the hostname to /etc/hosts

Now lets enumerate the box with SMBClient & Enum4Linux:

Now lets take a port 80. After adding our host's FQDN to our /etc/hosts file we should get this page:

Fuse.HTB Home Page

After downloading and grepping the cvs files we now have the following usernames:

Lets make a simple word list to accompany our newly found users. We can do this using cewl. CeWL is a tool which spiders a given URL to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper.

To check these credentials against the SMB service using Metasploit:

Using this module we discover we have working creds!!!

Lets circle back on our enumeration now that we have working creds!

These creds worked in the metasploit module why arent they are working now? Just just go with the error message and change the password. We can to this with smbpasswd:

Logosmbpasswdwww.samba.orgchevron-right

So there is a password policy enforced so I changed my password to Fabricorp02:

Tried connecting over powershell but wasn't getting anywhere so I moved on to using rpcclinet, another great tool for enumeration.

LogoPassword Spraying & Other Fun with RPCCLIENT - Black Hills Information Security, Inc.Black Hills Information Security, Inc.chevron-right

Lets take note to the new users we have discovered:

After running through most of the enumeration commands I came across this gem:

WE have now have another credential!

Since psh is out the window let use evil-winrm:

We can use these credentials to grab the user flag:

LogoAbusing SeLoadDriverPrivilege for privilege escalationTarlogic Securitychevron-right

Now that we access let grab a shell with netcat:

Lets begin our privilege escalation question with Windows Exploit Suggester - Next Generation (WES-NG) :

Or lets not.

Lets get a meterpreter shell up there while we are at it:

Next you'll want to create a resource file to quickly launch your handler:

We now have the ability to interact with the host via a netcat shell or a meterpreter session.

Now lets get back to our privilege escalation:

https://www.tarlogic.com/en/blog/abusing-seloaddriverprivilege-for-privilege-escalation/arrow-up-right

The article mentions these PoC codes

LogoGitHub - tandasat/ExploitCapcom: This is a standalone exploit for a vulnerable feature in Capcom.sysGitHubchevron-right
LogoGitHub - TarlogicSecurity/EoPLoadDriver: Proof of concept for abusing SeLoadDriverPrivilege (Privilege Escalation in Windows)GitHubchevron-right

Lets download that and compile them on our Kali machine:

Now we can reconnect to our machine, upload the exploit and root the box:

PreviousProxmark 3NextBlunder

Last updated