HTB: ServMon
ServMon starts with anonymous FTP and an LFI in the NVMS-1000 app on port 80. We read a passwords file off Nathan's desktop through the LFI, spray the creds over SSH and log in as Nadine for the user flag. NSClient++ is listening on 8443 behind the firewall, so we tunnel in over SSH, pull the admin password from the config, upload a script through the REST API and execute it to land a SYSTEM shell and grab root.
Looking at our nmap scan we see we have anonymous FTP on 21, SSH on 22, and an app on port 80.
Let's go straight to port 80 and check out what's being served there.
It's NVMS-1000 and its login page. Looking this up shows us there's an LFI (local file inclusion) vulnerability in this app (exploit-db.com/exploits/47774). Let's try and hit it. We'll launch Burp and capture a request.
We have LFI, great. Let's enumerate and see what we can find. We'll run this through Burp Intruder with a list of directories to check.
We get a few hits but checking through them we don't find much. Let's note this vulnerability down and go ahead and check out the FTP.
Looking into the FTP we find two users, Nadine and Nathan. Let's note them down, enumerate, and download whatever they have in their directories.
One of the notes suggests that Nathan has a Passwords.txt file on his desktop. Let's try to hit that through our LFI.
/../../../../../../../../../../../../Users/Nathan/Desktop/Passwords.txt
We get a hit! Let's note these down in a passwords list and spray them on the system. We'll use netexec over SSH and see what we get.
nxc ssh 10.129.227.77 -u users.txt -p passwords.txt --continue-on-success
We get a hit! Alright, let's log in as Nadine.
Great, let's search the desktop and see if we find the user.txt flag.
We got it. Now let's check our privileges and what's running on the system. Looking back at our nmap scan we saw that NSClient++ is running on 8443, but we aren't able to hit it from the outside.
Let's create a tunnel since we have SSH access.
ssh -L 8443:127.0.0.1:8443 nadine@10.129.227.77
Seems a little broken but at least we can still navigate through it. Clicking around does absolutely nothing, so doing a little research we find out that this app has a REST API, maybe we can control it that way.
OK, we can upload a payload and get a reverse shell if we have the admin password for the app, so let's go check the config files for it.
type "C:\Program Files\NSClient++\nsclient.ini"
Great, we have the password. Now let's build that payload and ship it over. Looking up the vulnerability, we need to make sure external scripts are enabled.
Which we apparently do.
Alright, let's hit it. Our evil.bat just kicks back a reverse shell to a netcat listener we've got waiting, and we upload it through the API.
curl -s -k -u admin:ew2x6SsGTxjRwXOT -X PUT \
"https://127.0.0.1:8443/api/v1/scripts/ext/evil.bat" \
--data-binary @evil.bat
It uploaded! Now let's try to execute it.
curl -s -k -u admin:ew2x6SsGTxjRwXOT \
"https://127.0.0.1:8443/api/v1/queries/evil/commands/execute?time=30s"
We are in, and our listener catches a shell running as nt authority\system. Heading over to the administrator's desktop we can go ahead and grab the root.txt flag.
And that's ServMon. Anonymous FTP leaking notes, an LFI to read a password file off a user's desktop, those creds reused on SSH for the user flag, and a firewalled NSClient++ that we tunneled into and abused through its REST API to go from a low-priv user straight to SYSTEM.
