As the Resolute root flag is proving rather difficult for my nooby skill level at the moment, I decided to take a breather and rooted Legacy tonight.

I must say it’s restored my faith in myself a bit- I’ve discovered that I’m only so slow momentarily due to a lack of knowledge (e.g. Sauna took me longer due to not being aware of how to properly enumerate a Domain Controller.)

I think Legacy took me an hour if that all together; it’s honestly not a bragging point as you simply have to utilize ms08-067 (a buffer overflow vulnerability triggered by specially crafted RPC requests, exploited by the Conficker worm detected in late 2008) which grants you the ability of arbitrary code execution on the machine.

I started off with my enum script which revealed 3 interesting ports:

We have netbios-ssn (netbios session service), microsoft ds (directory service) and ms wbt server (windows-based terminal); as the wbt server is closed, our focus will be on netbios and ds.

Googling microsoft ds brings up an obvious clue:

Obviously this is going to be our target, meaning scripts such as enum4linux, nmblookup and smbclient will come to our aid (https://www.hackingarticles.in/a-little-guide-to-smb-enumeration/ for more on this.)

Using these scripts, however, doesn’t really reveal anything- attempts to connect to the ds through smbclient time out, the same for using RPC client to connect to netbios-ssn.

Our obvious next check will be against public exploits out for Windows XP SP3 that utilize SMB or RPC. I simply Googled this; upon reflection I could have instead utilized nmap nse scripts to check for this issue:

   smb-vuln-conficker    smb-vuln-cve2009-3103    smb-vuln-ms06-025    smb-vuln-ms07-029    smb-vuln-regsvc-dos    smb-vuln-ms08-067

By simply appending --script smb-vuln* to the standard nmap scan, all of these scripts would have been executed during the port scan of Legacy. This would have saved me 10-20 minutes of time.

Upon this discovery, there are two ways to proceed- you can either use exploit/windows/smb/ms08_067_netapi through Metasploit or you can utilize a script out for exploiting this vulnerability.

In the spirit of both OSCP and not being a complete script kiddy, I opted for the use of a publicly available Python script exploiting this b/o vulnerability (https://github.com/jivoi/pentest/blob/master/exploit_win/ms08-067.py)

root@kali:~/penetesting/legacy# nc -vlp 6969 listening on [any] 6969 ... connect to [10.10.14.47] from legacy.htb [10.10.10.4] 1031 Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp.

You simply have to replace the example shellcode with shellcode of your choosing and fire away. I chose to stick to a simple reverse shell due to the need to investigate the system after the initial foothold.

Some simple enumeration reveals we are user Network Service:

For some reason, NetworkService has the near equivalent to system privileges- with this you can grab both the root and user flags.

So Legacy was quick and sweet. Challenging? No. An achievement? No. However, I’m still glad I took the hour to do it as it’s my first time successfully using a public exploit and I also know that the vulnerable service is microsoft Directory Service, not SMB (that’s the protocol goddamnit. xD)

[Affects pre-2008 Microsoft Windows machines without a MS08-067 patch]

Today, if you look up MS08-067, you can find a reliable exploit for it in Metasploit's archive. Executing the exploit on a vulnerable machine will result in an administrative shell one out of every two to three tries.

How can MS08-067 be found?

Thank goodness for Portcullis Labs.

They created a vulnerability check which would run through an open 445 port, usually open for MSRPC (Microsoft Remote Procedure Calls) over the SMB protocol. This system is regularly leveraged by machines communicating over LAN to share files, and call other services. The check creates a DCE/RPC bind over the SRVSVC (Server Service) Protocol and then builds and sends a malicious NetprPathCompare Packet (http://msdn.microsoft.com/en-us/library/cc247259.aspx) asking the server to compare two paths.

The first path is: \\\AAAAA\\\..\\\p

The second path is: \\\p\\\

Where p is a variable that represents 3 random letters joined together.

If the server responds with a "WERR_OK" or 0x00000000 in the Windows Error value field, then it is vulnerable.

You can find the  checking code in detailed python here: https://labs.portcullis.co.uk/tools/ms08-067-check/

This code uses its own set of functions to construct the NDR Network Data Representation (implementation of the presentation layer) around the check. And its code has some amusing comments at the top.

Checks run for this vulnerability on Windows XP SP2 and SP3 machines could lead to a race condition and heap corruption that can crash the service at any time (either immediately or later in any of the shared services within the svchost.exe container).

Nmap's script "smb-check-vulns.nse" also checks whether this exploit exists, but this script also runs the risk of crashing the machine.