Optimum – No Metasploit

Lets power up nmap and see what we find:

Okay. Let’s go to 10.10.10.8

Look at the bottom left. We get HttpFileServer 2.3

Let’s poke around on SearchSploit:

RCE always looks fun. Let’s look at that one… specifically the .txt file:

So basically we need to apply a null byte and then {.exec|cmd.} where cmd is whatever command we want. Let’s use burp to try this out. It took me a while to figure this out and I actually had to watch Ippsec’s video but in it he explains the importance of SysNative vs. SysWow64 vs System32.

And in our icmp dump we get:

So we have command execution! Now, let’s copy Invoke-PowerShellTCP.ps1 to working our directory and append the file with the example in the PS1 script

Serve it up on our box:

Now let’s supply the correct argument to burp and remember to URL encode it. Don’t forget to set up your listener.

On our listener, we get a user shell:

Looking around we get some creds that are pretty much useless at this point (but we keep enumerating anyway!)

At this point, I ran sherlock.ps1 to help me out a bit.

Hmm. At first I tried using an off-the-shelf MS16-032.ps1 script but they don’t work because they spawn a new terminal. We don’t have visual access so we can’t use it. Ippsec’s video shows us that there’s a copy in Empire that can be used on the CLI.

Testing it out:

So we can use this modified MS16-032 that accepts commands.

To use this you have to edit the bottom to run the function that you want with the specified argument as the script states:

Create another reverse tcp script with a different port (I called mine rev4445.ps1)

Running it:

And on our other listener that we set up on port 4445, we get a NT AUTHORITY\SYSTEM shell: