search
LinkedinGithubTryHackMeMedium

🦸‍♂️TryHackMe - Avenger Walk through / Write-up

Shortest Path to Admin! No reverse shell needed, no fiddling with AV, no need to use mimikatz, no need to do privilege escalation.

LogoAVengerTryHackMechevron-right
Be an avenger!
triangle-exclamation

Disclaimer : This no longer works, because the vulnerability was so bad they had to patch it

But if you wanna learn about it, feel free to read it. Else check out one my friend's write-up

LogoAVenger | Writeups0xb0b.gitbook.iochevron-right

Table of contents

hashtag
Recon

We first, start off with port scanning, with rust scan, you may use nmap if you like!

As we can see, there is just too many ports open, but our taget is the web port!, I am gonna try to make this writeup as short as possible.

Visiting the default port 80, we get this page!

Xampp server running

Now visiting the dashboard we can only get the phpinfo page from there, but it's not much of a help, so we can try to get the gift endpoint.

It does not load at first instance! gives of an error that its unable to load the page, however look at the url tab.

check the url tab

Now edit your host file so that you can access the site, for example edit your host file as the following

Now you should be able to access the site. It will take some time to load, since it's a windows machine.

Once loaded, it gives us a wordpress powered site. Use wpscan for enumerating vulnerabilites in the wordpress!

A simple googling will lead us to the following exploit against forminator

LogoWordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command ExecutionExploit Databasechevron-right
forminator exploit

As per the notes in expoit db, we can upload any kind of file on the server, lets try something, use the following training request form to upload your batch file, since we are targeting windows, and it is already mentioned that Antivirus is enabled, we need to be carefull about it.

form for requesting training

So we will not be using any reverse shell for this case, but rather a simple webshell, best webshell is powny shell

LogoGitHub - flozz/p0wny-shell: Single-file PHP shellGitHubchevron-right
Powny shell

Download the shell.php in your current directory, and prepare your setup.

I have already enumerated the forminator plugin, and I could not find any valid endpoint where the file gets stored, so don't worry about a reverse shell. Since the backend process will check each message carefully we can expect this attack vector as a simple phishing attack, where we upload a malacious file and it gets executed.

hashtag
Weaponization

Since we know that the target server is likely using xampp, we can think of its absolute default path as the following:

Now we will craft a simple batch file which will check if the user/process that will execute our program is running as "nt /authourity" or not, if its not then download a webshell in htdocs directory, else get the SAM files. Do change the ATTACKER_IP in the script, modify it as per your needs.

hashtag
Delivery

Now start the python server in your directory.

Upload the batch file!

Upload the batch file

Look for the web request in your python server.

Wait for the server to send the file!

And you have your shell on the server!

shell.php in htdocs

hashtag
Exploitation

VIsit the shell.php, and you will have a powny shell ready for you.

check out the shell!

As you can see, if we type whoami, we are admin!

That means we can do whatever we want, like disabling Anti-Virus as well, but we dont need to that. Just get the SAM files, and we will get the admin hashes, later use them to gain access to the system.

Now check the root directory, it should have those registry backups

Get the files now.

Since you have the most sensitive files of the server, now use impacket to get the admin hashes

admin hash

Now since you have admin hash, use evil-winrm to login using pass the hash technique!

get access!
Look Ma! no privesc 😂

hashtag
Get User Flag

Get user flag!

hashtag
Get the Root flag

Get root flag!

Thank you for reading my article ❤️ Happy Hunting 😎, feel free to connect with me on Linkedinarrow-up-right

Last updated