Fuse
HTB Writeup
Lets start with a Nmap Scan:
root@liberty:/home/kali# nmap -Pn -sC -sV fuse.htb
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for fuse.htb (10.129.2.5)
Host is up (0.022s latency).
Not shown: 988 filtered ports
PORT STATE SERVICE VERSION
53/tcp open domain?
80/tcp open http Microsoft IIS httpd 10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-10-09 13:58:10Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fabricorp.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: FABRICORP)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fabricorp.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=7%D=10/9%Time=5F8068D4%P=x86_64-pc-linux-gnu%r(DNSV
SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\
SF:x04bind\0\0\x10\0\x03");
Service Info: Host: FUSE; OS: Windows; CPE: cpe:/o:microsoft:windowsTake notice to the domain :
Its at this point with most HTB Machines that I'll add the hostname to /etc/hosts
Now lets enumerate the box with SMBClient & Enum4Linux:
Now lets take a port 80. After adding our host's FQDN to our /etc/hosts file we should get this page:
After downloading and grepping the cvs files we now have the following usernames:
Lets make a simple word list to accompany our newly found users. We can do this using cewl. CeWL is a tool which spiders a given URL to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper.
To check these credentials against the SMB service using Metasploit:
Using this module we discover we have working creds!!!
Lets circle back on our enumeration now that we have working creds!
These creds worked in the metasploit module why arent they are working now? Just just go with the error message and change the password. We can to this with smbpasswd:
So there is a password policy enforced so I changed my password to Fabricorp02:
Tried connecting over powershell but wasn't getting anywhere so I moved on to using rpcclinet, another great tool for enumeration.
Lets take note to the new users we have discovered:
After running through most of the enumeration commands I came across this gem:
WE have now have another credential!
Since psh is out the window let use evil-winrm:
We can use these credentials to grab the user flag:
Now that we access let grab a shell with netcat:
Lets begin our privilege escalation question with Windows Exploit Suggester - Next Generation (WES-NG) :
Or lets not.
Lets get a meterpreter shell up there while we are at it:
Next you'll want to create a resource file to quickly launch your handler:
We now have the ability to interact with the host via a netcat shell or a meterpreter session.
Now lets get back to our privilege escalation:
https://www.tarlogic.com/en/blog/abusing-seloaddriverprivilege-for-privilege-escalation/
The article mentions these PoC codes
Lets download that and compile them on our Kali machine:
Now we can reconnect to our machine, upload the exploit and root the box:
Last updated