Butch

Nmap Scan

Foothold

Spraying default credentials on SMB and FTP did not work so I moved to HTTP on port 450

I also tried some generic credentials here with no success, then I did a directory/file bruteforce

nothing was obvious at this point so I tried enumerating user on ESMTP port 25 to find at least a user to work with on authentication for web app but that sill did not work

doing the same manually returned a different result but that would take forever

so back to the web application login page I was wondering what to do next? what else to test? and yes I did not try SQL injection so I just put a single quote for both username and password and that worked like a charm triggering a SQL error , I then tried the single quote on the inputs separately to identify which one is the trigger and obviously it was the username

at this point I would just use sqlmap ,but preparing for OSCP , I would try this manually.

Since I’m running against a windows machine I can assume the database is MSSQL but I will not take that for granted until I have a proof.

I used Postswigger SQL Injection cheatsheet

SQL injection cheat sheet | Web Security Academy

and looking at this page this section’s name resemblance peeks my interest

so I use this method to inject a second query using these to double check the database

and injecting this query got the webpage loading for the injected 10 seconds

this query is MSSQL based so now I can be sure the DB is MSSQL and can start thinking of how to make this exploit useful, first I try to get as much information about the query that is already used by the app starting by enumerating the columns number that are queried

cince the query worked with 2 null but not with 1 this means the original query is getting 2 columns.

Checking the source code of the page I can assume that would be Username and Password columns

now the queries I’m using are getting long and won’t show in the input field so manipulated the css just to make it wider.

Now I will try to find the table name

from these screenshot I can tell the table name in Users, then I move to columns.

my first columns is “username” the second now, even tho It would make sens to be password, that was not the case

testing a few potential column names I eventually found this name worked

So now I have table name and columns names, I can assume the query used by the app should be something of this kind

SELECT username, password_hash from users where username = <input_username> and password_hash = <hashed_input_password>;

the would mean the application is hashing the password input before running the query then passing the generated hash to query for the compare to work. I still do not know what hashing algorithm is used! If I can figure the algorithm I can get closer to injecting a user to DB and even if the user is not admin this would potentially show me the structure of user table or at leas give me an idea if there is a profile like page

Get dj4m’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I try to find how many columns table users have, and I was able to figure that using a time based + condition query injected is username input showing bellow that triggered a wait time of 10 seconds

'; IF (3=(SELECT COUNT(COLUMN_NAME) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = 'users')) WAITFOR DELAY '0:0:10' --

This means the table still have a column that I do not know the name yet so I use the previous method to try and find it

Now row count in table users with this query, again triggering a wait time and confirming just 1 row

'; IF (1=(SELECT COUNT(*) FROM users)) WAITFOR DELAY '0:0:10' -- 

I edited the command a bit to try and find a valid username and yet again the wait time was triggered for username butch

'; IF (1>(SELECT COUNT(*) FROM users where username='butch')) WAITFOR DELAY '0:0:10' -- 

I tried exfiltrating the password for some time by passing the columns value as a column name, without success, It tuned out MSSQL prevents that, so I just changed the password hash in the table to gain access to the web application.

I generated a sha256 hash

then used it in the update SQL command

'; update users set password_hash='48f9460fe0dc9f272e7414963dd2b52287ec07d872d665d2e9364c957f163ab0' where username = 'butch'; --

I then was able to login to web app with butch:butch credentials

Trying this function I uploaded a file, got the upload confirmation but cannot tell where it goes !

I tried the root of the web app and that actually worked !

Initial Access

Now that I know I can upload and open files, also that the application runs .aspx file I just need to create a rev shell aspx file with msfvenom.

the extension was refused and samething wot .asp but I was able to upload a .ashx file so I just looked for a ashx webshell to use

I uploaded the file and open is in the browser and that worked

all i need now is to turn that into a rev shell and as system already this would be very easy but it was somewhat tricky

I was able to run commands as system but I could not directrly trigger a rev shell through commands or even fetch a msfvenom payload on the target, so instead I just created an admin user running these commands

 net user /add dj4m Password1
 net localgroup administrators dj4m /add
 net localgroup "Remote Management Users" dj4m /add

then I was able to login to target with winrm but still did not have much privilege so I could not read flags

so run other commands from the webshell to dump SYSTEM and SAM file

reg save HKLM\SYSTEM C:\\tmp\\SYSTEM
reg save HKLM\SAM C:\\tmp\\SAM

now I just download these files with winrm

and run impacket-secretsdump to get users hashes

I then just used administrator hash to connect on winrm and was able to get both proof.txt and local.txt flag same time