This is a Windows 2019 server machine running an Apache 2.4.56 server on port 80. A web app recovers visual studio projects from external gits, compiles them and stores them in the server. The web application can be abused leveraging "pre events" on visual studio project files. Once inside the machine, we can move laterally to a local service user and restore its privileges with Full Powers binary. Finally, system shell is obtained with God Potato.
KEYWORDS
Git, Visual Studio, pre/post events, Full Powers, God Potato.
There is an Apache 2.4.56 web server running on port 80. We inspect the site with Firefox, a web app which compiles and stores visual studio projects comes into view. After supplying a Git repository link, the app pulls the files, compiles the Net 6.0 and C# projects and uploads them in the site.
USER
Our goal is to prepare a local HTTP Git repository serving a Visual Studio solution. For this, we start making a directory called repo and create a new Visual Studio solution called repo.sln
> mkdir repo> cd repo> dotnet new sln -n repoThetemplate"Solution File"wascreatedsuccessfully.
From the repo directory, create a new project (specifically, a console C# app) called myapp
> dotnet new console -o myappThetemplate"Console App"wascreatedsuccessfully.Processingpost-creationactions...Running'dotnet restore'on/home/kali/htb/repo/myapp/myapp.csproj...Determiningprojectstorestore...Restored/home/kali/htb/repo/myapp/myapp.csproj (in 106ms).Restoresucceeded.
This will generate a new folder called myapp containing a project file called myapp.csproj and a C# source file called Program.cs. Finally, we add the C# project to the Visual Studio solution.
Once Visual Studio part is finished, we need to initialize a Git repository in the repo directory and serve it via HTTP. For this, firstly initialize the Git repository on directory repo
> cd repo> git init
The directory repo/.git is created after this. The .git directory contains the repository files and metadata. Next step is to add all files on the repo directory to the git.
> git add .
Check there are no more untracked files in the Git repo to be added.
> git commit -m 'first commit'[master (root-commit) c1149ed] first commitCommitter:Kali<kali@kali>Yournameandemailaddresswereconfiguredautomaticallybasedonyourusernameandhostname.Pleasecheckthattheyareaccurate.Youcansuppressthismessagebysettingthemexplicitly.Runthefollowingcommandandfollowtheinstructionsinyoureditortoedityourconfigurationfile:gitconfig--global--editAfterdoingthis,youmayfixtheidentityusedforthiscommitwith:gitcommit--amend--reset-author8fileschanged,254insertions(+)createmode100644myapp/Program.cscreatemode100644myapp/myapp.csprojcreatemode100644myapp/obj/myapp.csproj.nuget.dgspec.jsoncreatemode100644myapp/obj/myapp.csproj.nuget.g.propscreatemode100644myapp/obj/myapp.csproj.nuget.g.targetscreatemode100644myapp/obj/project.assets.jsoncreatemode100644myapp/obj/project.nuget.cachecreatemode100644repo.sln
Finally, move to the .git directory and update server info.
> git update-server-info
Now the git is ready to be served on HTTP. We can test it, move to .git and serve the repository with a Python HTTP server. Then, in the web app, enter the local machine IP. Shortly after, the app starts downloading the C# files and uploading them into the server. Once they are complied, they are stored in a random folder and the app supplies the user with the resulting URL.
Once we are sure our Git repo works, we have to find a way to make the server execute the code after compiling it. This can be done manipulating "pre" and "post" events in the C# .csproj project file.
These events are triggered by the msbuild compiler before or after the compiling process ends. We will add a "pre event", calling a powercat reverse shell before the building process begins. Just create any simple Program.cs source file and, in the myapp.csproj file, add the "pre event".
After this, add again all files to Git, commit, update server info and restart the Python HTTP server (from .git directory).
> cd repo> git add .> git commit -m 'commit'> cd .git> git update-server-info> python3 -m http.server 80
Start another Python HTTP serving powercat.ps1 and start a listener. Enter red box IP in the web app URL box, when the C# files are pulled and processed a reverse shell is received on port 1919.
After enumeration, we discover we have write access to web root folder so if we copy a .php shell in the web root, we could move laterally to the user who is running the web server. Let's check who is running the HTTP service.
> wmic service where started=truegetname,startnameNameStartNameApacheHTTPServerNTAUTHORITY\LocalServiceBFENTAUTHORITY\LocalServiceBrokerInfrastructureLocalSystemcamsvcLocalSystemCDPSvcNTAUTHORITY\LocalService
The user turns to be ApacheHTTPServer, who is nt authority\local service. Copy a simple-backdoor.php and an EXE msfvenom payload into the web root folder (download with certutil). Then start a listener and execute the payload using a browser and the simple-backdoor.php. A reverse shell for user nt authority\local service is received on the listener.
It's the same as before, seems we have not progressed so much; however, there is a tool which restores original privileges (including impersonation) to local services account.
Download and use fullpowers.exe (https://github.com/itm4n/FullPowers) on the local service account shell, verify impersonation privilege is restored afterwards.
> fp.exe[+] Started dummy thread with id 2388[+] Successfully created scheduled task.[+] Got new token!Privilegecount:7[+] CreateProcessAsUser() OKMicrosoftWindows [Version 10.0.17763.4851](c) 2018 Microsoft Corporation. All rights reserved.> whoami /privPRIVILEGESINFORMATION----------------------PrivilegeNameDescriptionState=============================================================================SeAssignPrimaryTokenPrivilegeReplaceaprocessleveltokenEnabledSeIncreaseQuotaPrivilegeAdjustmemoryquotasforaprocessEnabledSeAuditPrivilegeGeneratesecurityauditsEnabledSeChangeNotifyPrivilegeBypasstraversecheckingEnabledSeImpersonatePrivilegeImpersonateaclientafterauthenticationEnabledSeCreateGlobalPrivilegeCreateglobalobjectsEnabledSeIncreaseWorkingSetPrivilegeIncreaseaprocessworkingsetEnabled
Once we have impersonation privilege restored, we can try all range of potatoes. The working one is God Potato (https://github.com/BeichenDream/GodPotato). We need another msfvenom shell to execute with God Potato.
