Jacko

nmap

mkdir nmap
sudo rustscan -a 192.168.225.66 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan

An interesting port is open on ports 80, and 8082

Enumeration

Looking at port 80, and checking the source code. Looks like it has H2 Database installed with version around 2019

And checking port 8082 on the browser, it was an H2 Database web client.

Use searchsploit to find vulnerabilities.

H2 Database 1.4.199 - JNI Code Execution is the way to go since the exploit was discovered in 2019 which is related to what we discovered in the source code of the web page.

Exploitation

Create a reverse shell using msfvenom

Set a reverse shell listener

Open your browser, visit the page on port 8082, and log in to the server

Paste the following SQL Statement in the textbox to get a proof of concept.

You should see at the bottom of the page that we have a Remote Code Execution on user tony

Now let's upload our shell to the server, but first set up a temporary HTTP server on your directory.

Execute the following SQL Statement to download the file to C:/Users/Public/reverse.exe

Run the exploit

And you should receive your initial shell.

Post Exploitation

Initially the PATH environment variable is messed up so some commands don't work. Let's fix that first.

There are two ways to gain NT\SYSTEM privilege

Privilege Escalation #1

You can see that there's a non-builtin windows program on C:\Program Files (x86) called PaperStream IP

And there's a privilege escalation vulnerability on this program and we can try our luck.

Mirror the exploit to your local machine.

Create a reverse shell, but take note we should create a reverse shell with 32-bit binary since the program is also running on 32 bit.

Edit the script and set set $PayloadFile to our target path.

Set up an SMB server

Transfer the shell and the exploit to a writable directory.

Set up a reverse shell listener on port 80

Invoke the powershell script.

After that, you should receive your NT\SYSTEM shell.

Privilege Escalation #2

if you run whoami /piv, you will notice SeImpersonatePrivilege is set on the current user and, the machine is running on Windows 10. It means we can try Token Impersonation. There are a bunch of potato exploits out there but I like to start with the newly discovered exploit (at the time of this writeup being written) which is printspoofer. You can get a copy on this link.

Transfer the executable to the machine.

Invoke the executable to gain an Administrator shell.

Thanks for reading!

PreviousAuthByNextUT99

Last updated

Was this helpful?