search

Puppet - Advance Lab

https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527

1st

sudo nmap -sV -T3 -vvv -sC 10.13.38.33
Scanning 10.13.38.33 [1000 ports]
Discovered open port 22/tcp on 10.13.38.33
Discovered open port 21/tcp on 10.13.38.33
Discovered open port 31337/tcp on 10.13.38.33
Discovered open port 8443/tcp on 10.13.38.33
Completed SYN Stealth Scan at 19:06, 2.01s elaps

2nd

do anonymous login in ftp and download the files via mget (turn on passive mode as well)

ftp 10.13.38.33              
Connected to 10.13.38.33.
220 (vsFTPd 3.0.5)
Name (10.13.38.33:sher): Anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw----r--    1 0        0            2119 Oct 11  2024 red_127.0.0.1.cfg
-rwxr-xr-x    1 0        0        36515304 Oct 12  2024 sliver-client_linux

ftp> passive
Passive mode on.
ftp> get sliver-client_linux
227 Entering Passive Mode (10,13,38,33,50,76).
150 Opening BINARY mode data connection for sliver-client_linux (36515304 bytes).
226 Transfer complete.
36515304 bytes received in 22.7073 seconds (1.5336 Mbytes/s)

-rw----r--    1 0        0            2119 Oct 11  2024 red_127.0.0.1.cfg
-rwxr-xr-x    1 0        0        36515304 Oct 12  2024 sliver-client_linux

3rd

now examine the downloded files before running the linux client file change the certificate lhost ip to terget ip then import it into the linux-client file

4th

https://sliver.sh/docs?name=Configuration+Files - Read Documentation

now check which one is active and use the particular one

now you are logged into the user now check

5th ;

from here the next clue you get is the name : Nightmare which is a type of CVE in which we become an local admin i.e we get privillage execute commands that a local user cant use

This is a remote code execution vulnerability that can be used to obtain SYSTEM level privileges by an authenticated remote user against Windows machines running the print spooler service. An attacker could then use that access to create new accounts, attempt to install programs; view, change, or delete data; or create new accounts with full user rights.

This vulnerability exists due to an authorisation bypass bug in the Print Spooler service spoolsv.exe on Windows systems, which allows authenticated remote users to install print drivers using the RPC call RpcAddPrinterDriver and specify a driver file located on a remote location. A malicious user exploiting this could obtain SYSTEM level privileges on a Windows system running this service by injecting malicious DLLs as part of installing a print driver.

6th :

after importing the CVE ,we

now your local admin acc is ready = kaddu : Password123

7th :

now after running sharpsh you have created the user and now we will use it to create a beacon using our local admin account using “runas” tool

8th :

RawLdap queries

https://github.com/Flangvik/SharpCollection/blob/master/NetFramework_4.7_x64/ADSearch.exe

from here you’ll get ADsearch.exe file and then you can execute your query which will be executed and (0-0) nobodys gonna know .

  • The concept here is called “Living off the Land” in which the attacker uses tools are present in the windows already and no external tool is used by attacker.

9th :

after getting into session

10th ;

we will need to know whos the domain controller for that we we command

  • Reflective loading - Reflective loading is a fileless code execution technique used in offensive security (and red teaming) to load a binary (usually a DLL or PE) directly into memory without writing it to disk.

here you get the domain controller name DC01.

11th :

here after search and download the private and public key in public key you will get the user ID.

Now unzip the downloaded file :

12th :

here the private key is in DOS format so for ssh login we need to convert it into the unix format so we will do and give it permisson as well

13th :

now here we will also have to crack the password with the private key file which ultimately lands to the password “puppet’ and now you can ssh login and find the password in root

14th :

now we will need to know what sudo execution perm we have so we do this

15th :

16th :

from here we put a payload from https://gtfobins.github.io/gtfobins/puppet/ which is a sudo payload and get the root

17th :

BECONS KO FIL01 KE SHARE MAI DAL DIYA SO THAT HAM USKI DCO1 SE ACCESS KAR SAKE AND HAMAY WAHASE CONNECTION MIL JAYE

18th :

AB HAM SSH LOGIN KARENGE WITH ID PASSWORD JOKI DC01 DIRECTORY MAI THA

ISS DIRECTORY MAI JAKAR

NEXT COMMAND TO CREATE DIRECTORY FOR THE MANIFEST FILE .(file joki batayega system ko ki kya karna hai ) uske pehle aapko root ban na hai uske liye bhi code hai

AB US DIRECTORY MAI HAM APNI FILE BANAYENGE amal.pp naam ki jisme ham vo manifest ka data save karenge :

AND NOW AB HAM USSE RUN KARENE KE LIYE PUPPET MAI APPLY KARENGE AUR HAMAY WAHA BEACON MIL JAYEGA LOCAL ADMIN KE COMMAND SHELL PE

NOW YOUR WORK IS DONE HERE…GO ON THE LOCAL ADMIN TERMINAl and wait for some some you’ll get the BEACON.

19th :

Now use the beacon -

now use this command to check ki tum admin bane ya nahi

NOW WE WILL USE sharodpai tool TO GET THE PASSWORD DUMP

AND YOU GET THE PASSWORD HERE

PEL DIYA PUPPET KO BC …

PreviousExpressway - EasyNextGiveBack - Medium

Last updated

Was this helpful?