search

windowsJacko

hashtag
Enumeration:

hashtag
Port Scanning:

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Jacko]
└─$ sudo nmap -sCV -p- --min-rate 4000 -oA nmap/services -vv 192.168.137.66
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-11 21:04 EST
Nmap scan report for 192.168.137.66
Host is up, received echo-reply ttl 125 (0.26s latency).
Scanned at 2025-11-11 21:04:04 EST for 208s 
Not shown: 65521 closed tcp ports (reset)
PORT      STATE SERVICE       REASON          VERSION
80/tcp    open  http          syn-ack ttl 125 Microsoft IIS httpd 10.0
|_http-title: H2 Database Engine (redirect) 
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
135/tcp   open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 125
5040/tcp  open  unknown       syn-ack ttl 125
7680/tcp  open  pando-pub?    syn-ack ttl 125
8082/tcp  open  http          syn-ack ttl 125 H2 database http console
| http-methods: 
|_  Supported Methods: GET POST
|_http-title: H2 Console
|_http-favicon: Unknown favicon MD5: D2FBC2E4FB758DC8672CDEFB4D924540
9092/tcp  open  XmlIpcRegSvc? syn-ack ttl 125
49664/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
<snipped>
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

<snipped>

hashtag
HTTP (80):

If we opened that with firefox:

Only a static web page with html endpoints indicating this is an H2 database.

hashtag
HTTP (8082):

Lets browse to that port:

We can see here is the dbms itself, and it is misconfigured that is why we can view it.

If we clicked on connect:

We will be able to connect successfully.

From here we can do various things, read files, write files, execute system commands depending on some conditions.

Read win.ini file with read_file function:

Now I searched for ways to execute system commands and found many blogs talking about creating an alias of the exec method then execute commands, but non of those worked for me:

It throws an error talking about it can not run the java compiler.

I searched with searchsploit again:

The first 2 have the same queries I mentioned above.

hashtag
Exploitation:

Lets mirror the fourth one:

LogoH2 Database 1.4.199 - JNI Code ExecutionExploit Databasechevron-right

Read it:

Those queries as mentioned will write native library, then load it, and finally we can execute system commands.

Lets do that:

Load the library:

Try to execute whoami:

Here we have command execution.

Now lets get a reverse shell, but first I need to figure out what ports it can reach:

It seems to be it can reach not only the open ports that we discovered with nmap.

Copy nc.exe to our directory and run a python3 web server again to host the binary:

Upload it to the target:

We got an error, but if we went back to our web server:

Now using that binary get a reverse shell:

I will add more paths to the path variable so we can use tools such as the one I used above:

That is the path I followed to elevate my privileges to system by upload godpotato as I did in previous boxes:

We are the machine account which is system.

After I finished the box, I found that there is another path to elevate our privileges.

hashtag
Post-Exploitation:

See what programs are installed on our target:

The vulnerable program is paperstream.

We can get its version by reading the readme file under twain folder:

Search for public exploits for that specific version:

LogoPaperStream IP (TWAIN) 1.42.0.5685 - Local Privilege EscalationExploit Databasechevron-right

It is vulnerable to dll hijacking.

Lets generate teh dll file with msfvenom:

Also copy the powershell script and paste it to a file to transfer it to the target machine to trigger the exploitation:

Upload both the dll file, and the script:

As shown in the script our dll file should be placed under windows\temp folder.

Before we launch the exploit I will start a nc listener:

Run it:

And we escalated our privileges to system:

Get the flags:

PreviousAlgernonNextCraft

Last updated