TryHackMe — Steel Mountain Write Up
Steel Mountain is a room on TryHackMe with Easy difficulty.
Summary — On port 8080 there is a web server running. It is serving a vulnerable version of Jetta HTTP File Server. The version of that file server is vulnerable to a remote code execution. By exploiting the RCE you can get a low privilege shell on the box. Privilege Escalation to the SYSTEM user has been done by exploiting an unquoted service path vulnerability.
Starting with an Nmap scan we can see that on port 80 an HTTP server is running.
The landing page will show that Bill Harper is the employee of the month
Running another scan with the following command, we can see that on port 8080 another web server is running.
sudo nmap -p- -sV -sC 10.10.227.199 -oN nmap/all.nmap
Opening the web page on the HTTP server on port 8080 will show us a HTTP file server. The page contains a link to the vendor. From there, we know this is the Rejetto file server.
On ExploitDB there is a exploit for the HttpFileServer 2.3. The file server has an RCE flaw, with
CVE-2014-6287 (CVE Number: 2014–6287).
Metasploit has a module for this vulnerability
Before running the exploit we have to configure the parameters of the module. Set the RHOST to the target IP Adress. Also set the RPORT to 8080, because the HTTP File Server is running on that port. Keep in mind to also set the LHOST to your attacker machine’s tun0 IP.
After that run the exploit. If get a session you can abort with CTRL+C
List your sessions and then interact with the created session
Go to Bill’s desktop and you will be able to read the first flag
To enumerate for privilege escalation vectors, upload the PowerUp.ps1 Script from PowerSploit to the target machin
Next load the powershell extension to your meterpreter session and start powershell by typing
Next start enumeration with PowerUp.ps1:
After the script has run we can see that Bill user has permission to restart AdvancedSystemCareService9. An alternative way to get a list of all services is by running: powershell -c “Get-Service”
That service was configured without quotes. If we have write permissions in one of the other folders, then we could use that to elevate our privileges.
Also we have write permissions to C:\Program Files (x86)\IObit
Quit out of Powershell and navigate to IObit directory in your meterpreter shell
Next create a reverse shell with msfvenom
Next upload the reverse shell to that directory
Next background your current metasploit session with the bg command and use multi/handler
Set LHOST and LPORT the values specified in msfvenom and run the job in the background
Next switch to your the low privilege session as Bill and restart the service
Don’t hesitate if you get this error as long as you get a new session afterwards
Interact with the newly created sessions and you should have SYSTEM rights. You can read the root flag now.
First of all the HTTP File Server on port 8080 should be updated. Furthermore the service should be configured with quotes.