search
GitHub
Page cover

windowsWeek 8. Hospital

hashtag
TL;DR

This is a Windows Server 2019 domain controller running 2 web servers, one on port 443 (XAMPP webmail) and another on port 8080 (Apache). It is supposedly used by doctors in a hospital and a feature is enabled to upload medical records. This can be abused to upload a p0wny PHP shell and get access to a Linux container running Ubuntu 22.04. Subsequently, this is rooted using a kernel exploit. Once we have rooted the container, we get credentials for an email account from which we can launch a phishing attack to get access to the Windows machine. Write permissions on the 443 service web root folder allows us to upload a PHP reverse shell and get a system shell, since this web service is being run under high privilege.

hashtag
KEYWORDS

Insecure file upload, p0wny PHP shell, GameOver(lay), phishing, Ghostscript.

hashtag
REFERENCE

https://github.com/flozz/p0wny-shellarrow-up-right

https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629arrow-up-right

https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injectionarrow-up-right

hashtag
ENUMERATION

Port scan.

> nmap $target -p- -T4 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-18 15:35 EST
Nmap scan report for 10.129.70.232
Host is up, received user-set (0.041s latency).
Not shown: 65506 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE          REASON
22/tcp   open  ssh              syn-ack
53/tcp   open  domain           syn-ack
88/tcp   open  kerberos-sec     syn-ack
135/tcp  open  msrpc            syn-ack
139/tcp  open  netbios-ssn      syn-ack
389/tcp  open  ldap             syn-ack
443/tcp  open  https            syn-ack
445/tcp  open  microsoft-ds     syn-ack
464/tcp  open  kpasswd5         syn-ack
593/tcp  open  http-rpc-epmap   syn-ack
636/tcp  open  ldapssl          syn-ack
1801/tcp open  msmq             syn-ack
2103/tcp open  zephyr-clt       syn-ack
2105/tcp open  eklogin          syn-ack
2107/tcp open  msmq-mgmt        syn-ack
2179/tcp open  vmrdp            syn-ack
3268/tcp open  globalcatLDAP    syn-ack
3269/tcp open  globalcatLDAPssl syn-ack
3389/tcp open  ms-wbt-server    syn-ack
5985/tcp open  wsman            syn-ack
6404/tcp open  boe-filesvr      syn-ack
6406/tcp open  boe-processsvr   syn-ack
6407/tcp open  boe-resssvr1     syn-ack
6409/tcp open  boe-resssvr3     syn-ack
6614/tcp open  unknown          syn-ack
6635/tcp open  mpls-udp         syn-ack
7326/tcp open  icb              syn-ack
8080/tcp open  http-proxy       syn-ack
9389/tcp open  adws             syn-ack
 
Nmap done: 1 IP address (1 host up) scanned in 95.25 seconds

Looks like a domain controller, enumerate the open ports.

Next step is to fuzz the HTTP service on port 8080.

Take note of the folder called uploads

hashtag
USER

Browse the site http://hospital.htbarrow-up-right site, register a new account and sign in. An upload portal appears in Firefox.

Several extensions are filtered. After some trial and error, we find out the extension .phar is not filtered and can be uploaded; however, standard .php shell (such as pentest-monkey-php) are not stable, the only PHP shell which is working is a p0wny shell (https://github.com/flozz/p0wny-shellarrow-up-right).

To upload the shell, select an image file and intercept the message with Burpsuite, then edit the request to add the p0wny shell code instead of the image binary code. The filter in place only checks the extension, and there is no magic bytes check, so there is no need to leave any JPG header and all the image code can be replaced by the PHP code. Finally, change the extension to .phar

The the shell is uploaded in the /uploads folder.

It can be accessed in Firefox in the URL http://hospital.htb:8080/uploads/shell.phararrow-up-right. A p0wny PHP shell spawns, we can use is to get a reverse shell on the host.

From the shell (probably a container), enumerate the system info.

Using the shell we find out nc is installed, so we can use it to get a reverse shell on the Linux container.

Once the reverse shell is received, the container can be rooted with a GameOver(lay) kernel exploit (https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629arrow-up-right).

Since we are now root we can dump the hashes from the /etc/shadow file, unshadow them and crack with john, this way we get credentials for user drwillams in the container.

With this password we log into the web mail server on https://hospital.htbarrow-up-right as drwilliams@hospital.htb and read the doctor's email. Turns out a colleague is waiting for an email containing a Ghostscript .eps file.

Knowing this, we prepare a phishing attack for which we need to look for Ghostscript vulnerabilities. Investigation leads to this exploit https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injectionarrow-up-right, which allows injection of commands in .eps files.

Next step is then to generate a msfvenom payload for windows.

Now, to succeed in the phishing attack, what seems to work is to divide the process in 2 steps.

First, inject a payload in a project.eps file which will download the shell.exe when executed.

File malicious.eps is generated. Rename it to project.epsand start a Python HTTP server. Then reply the email attaching the project.eps file.

Shortly after, a request is received on the Python server to download the shell.exe file.

Next step is to execute the shell in the server. For this we will repeat the procedure but the command to be injected in the .eps file will just execute the shell previously downloaded by the host.

As before, rename the output file to project.eps, then start a listener on port 1919 and reply the email again. Shortly after, a reverse shell is received for user drbrown

In the documents folder of user drbrown we find a file called ghostscript.bat that contains the user's password.

We use this credential to login in the remote desktop service.

And finally we are able to get the user flag.

hashtag
SYSTEM

Enumerate the system.

The web server service running on port 443 (webmail) is running as nt authority\system and also we have write permissions on the web root folder located in c:\xampp\htdocs

Since we have an RDP session, we can just copy another p0wny PHP shell in this location and open it with Firefox. Then, send a reverse shell in Windows with powercat

And a reverse shell running under nt authority\systemis received our listener.

You are root.

PreviousWeek 7. NapperNextWeek 9. Devvortex

Last updated