search

windowsCraft

hashtag
Enumeration:

hashtag
Port Scanning:

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Craft]
└─$ sudo nmap -sCV -p- --min-rate 4000 -oA nmap/services -vv 192.168.137.169
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-11 23:27 EST
<snipped>
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 2.29 seconds
           Raw packets sent: 8 (304B) | Rcvd: 0 (0B
           
┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Craft]
└─$ sudo nmap -sCV -p- --min-rate 4000 -oA nmap/services -vv 192.168.137.169 -Pn
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-11 23:27 EST
Nmap scan report for 192.168.137.169
Host is up, received user-set (0.26s latency).
Scanned at 2025-11-11 23:28:00 EST for 47s
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE REASON          VERSION
80/tcp open  http    syn-ack ttl 125 Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
|_http-server-header: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
|_http-title: Craft

<snipped>

Interestingly we have only one port open which is 80.

Open it with Firefox:

We have an upload form:

Also the domain name has been written at the bottom of the page, we could add it to the hosts file, and enumerate subdomains for example:

I did not find any subdomain to this application.

Directory fuzzing:

We have the upload.php as we have seen in the photo above the upload form, and uploads directory that has nothing.

Lets try to upload text file:

It accepts only odt files, we can bypass this and upload a php file for example, but the uploaded files will not go to the uploads directory but somewhere else we do not know.

I searched online for ODT files:

LogoGitHub - jotyGill/macro-generator: Generate malicious macros for MS Office and Libreoffice, created during OSCP prepGitHubchevron-right

As mentioned in the readme.md file, this script provide 3 ways we can take advantage of macros on ms office, and one for libreoffice odt, so I will use the last one but modify it a bit:

Start Libreoffice to create our odt file with macro in it:

We will be presented by the welcoming libreoffice page.

Click on writer document to create a new one:

It will open us a new document:

Click on tools in the toolbar then on macros, organize macros and finally basic to create a new macro:

We will select our document that has no name at the moment (untitiled 1) then press new, and name our macro, then click OK:

It will open up the macro editor:

I will place my own one-liner reverse shell command:

Finally close it up.

Now we need to setup the trigger that will execute our macro which is opening the document.

Tools again, the customize:

We will select the open document even, the under assign on the right hand of the prompt click on macro, select our macro, after that click OK:

We can see in the photo below, that our macro has been assigned on the open document event.

Now save the file as odt:

hashtag
Exploitation:

I will upload the odt file, but before that start a nc listener and a web server to host our shell.ps1 file:

Wait a minute:

Here we have a reverse shell as thecybergeek.

hashtag
Post-Exploitation:

Doing some local enumeration.

I found another user on the target called apache:

And we have our xampp that is used to run the application we exploited earlier:

Here we will have the files we discovered previously via gobuster.

Search for services the Apache user is running:

We can confirm that the Apache user is the one running the httpd service.

So if we uploaded another reverse shell file to that directory we can get code execution.

Lets check the permissions we have on that directory:

We have write permissions, we can also check this by using icacls or Get-Acl on that directory as well.

I wrote a simple php script to execute the same cradle I used within the macro:

Start the python3 web server again and upload the shell.php to the target:

Open that file up with Firefox:

We got a hit to our webserver.

Now we are the user apache.

Check our privileges:

We have seimpersonateprivilege privilege.

Upload nc and godpotato:

Start another nc listener:

Execute godpotato:

We will have access as the machine account.

Get the flags

PreviousJackoNextNickel

Last updated