3

I am doing a capture-the-flag exercise in a Windows scenario.

It uses Windows 2016 server. I was able to find the password and I can access the files with a:

net use z: \\computer\C$  password /user:user

Now, I can read and write on the server. But I need to get code execution on it. This was what I tried:

  • The server has a default IIS installation. Trying to upload .asp, .aspx and .php do not work. As I can see, the default installation is only able to store static pages. Is there a programing language it can run?
  • Commands like net start look like to only start service in the local machine, not in the server I want.
  • Maybe the way is to write in the Startup Folder, but the server will never restart
  • I try to overwrite some .exe but it did not start

In Linux, I could simply overwrite the cron files to start a command. But in Windows I don't see how it can have the same result.

So, my question is: Is there a native way to run code on another Windows computer after you have a valid SMB (net use) password?

3
  • Welcome to the community. What do you mean by the last point that you tried overwriting but it did not start? Nov 9, 2022 at 20:43
  • @SirMuffington, well, I try to overwrite some writable exe program to see if it execute the payload. Maybe the correct way is hijack some .dll.
    – psico_disk
    Nov 9, 2022 at 22:29
  • You mean that it did not get executed?.. Nov 10, 2022 at 18:41

1 Answer 1

1

Modifying the IIS configuration to support ASP, ASP.NET, or some other server-side code (and then uploading a file containing such code and requesting it) would be one approach. It's somewhat surprising that the server is running but isn't already configured thus, but it should be possible to change the behavior if it's in a configuration file.

Windows does not have any file-based equivalent of cron; the equivalent Windows service stores its configuration in the registry. Still, you might be able to overwrite a file that the Scheduled Tasks service will execute periodically (as with cron), or alternatively overwrite the file for a service binary directly (if the service isn't already running but will soon).

Note that, by default, Windows opens files for exclusive access. That means you often can't open (or overwrite, or delete) a file that another process has open, regardless of your privileges. That's especially true for process images (executables and libraries).

There are many, many ways to remotely access a Windows machine if you have a username and password. Hopefully you already tried remote desktop, but did you try SSH? Recent Windows systems have an optional SSH server. Did you try Powershell Remoting?

Alternatively, there are options that don't involve shells. You mentioned that net start doesn't work for remote machines, but did you try sc.exe start? The command-line service control program (sc.exe; note that in powershell sc alone may be an alias to a cmdlet instead) is very powerful and supports remoting. Alternatively, you can use the Windows GUI tools; for example, services.msc - the Windows Service control GUI, a snap-in for mmc.exe (Microsoft Management Console) - can attach to either the local computer or a remote one. For general registry access, both the command-line reg.exe and the graphical regedit.exe support connecting to network machines.

7
  • 1
    Annoying nitpick, but the registry is a hive, which is just a file ;) Nov 10, 2022 at 18:39
  • @SirMuffington No. The registry hives are stored in a file for persistence, but on a running system, it's not really correct to describe it as a file (and there are many, not just one). Leaving aside that raw registry data is a mess, Windows takes exclusive file locks on all the system hive files when the machine boots up, and on the user's hive files whenever any user logs in (unless specifically instructed not to load the per-user registry at all). You can't meaningfully interact with them - certainly not with the SCM data, which is in the system hive - using file I/O on a running host.
    – CBHacking
    Nov 12, 2022 at 8:03
  • I.e. if I boot Linux to extract the hives for Ophcrack or similar you only need a couple of files, hence I still think it is a file, since running on an external OS you CAN use standard file I/O if that's how you want to define it.. Please do correct me if I'm wrong. Nov 12, 2022 at 16:00
  • If the Windows system isn't running, sure, it's "just" a structured file, but so is literally all persistent data storage on the disk, even the allocation table and volume metadata and so on are stored in space that can be mapped to in the file system. But in the context of this question, saying "nitpick but the registry is a file" is like somebody asking "I have a pickaxe, how can I get a car?" and saying "cars are made from metal so use the pick to mine some ore". You can't use a password to gain remote code execution by using file I/O on registry hives on a running Windows system.
    – CBHacking
    Nov 12, 2022 at 23:20
  • Well, as I see it the password is in the SAM and SYSTEM registry hives, so the comparison is apparently not quite valid.. That's exactly what's required for Ophcrack as well.. Please do correct me if I'm wrong. Nov 13, 2022 at 11:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .