Craft - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed only HTTP port was open.
Web Enumeration
Website had upload functionality.
And it was only allowing odt files.
Exploitation
At first I tried to bypass but only odt was allowed. Then I tried ODT information disclosure and obtained NTLMv2 hash but could not crack it.
LibreOffice (ODT) Macro to RCE
After some reserach I found that libre office can run macros which can be used to obtain RCE. So steps to create and assign a macro is liste below.
- Tools > Macros > Edit Macros to open Macro Menu
- Tools > Select Macro to open Macro Creation Menu
- Create a new Macro
- Edit Macro to run shell commands
- Tools > Customize to open Event menu and assign Macro
- Assign Macro to Open Document Event
- Test it
As seen in above steps we can run commands. So all we need to do is update macro to gain Reverse Shell.
With this update I got the user and flag.
Lateral Movement
Write to C:\xampp\htdocs
User had write access to web folder, so I simply uploaded a reverse php shell.
Privilege Escalation
SeImpersonatePrivilege
Service account had SeImpersonatePrivilege.
I used GodPatato to exploit it and got reverse shell using nc64.exe
And I got the Administrator flag.