PivotSmarter
Challenge Lab (Basic) - by Tyler Ramsbey
The following post by 0xb0b is licensed under CC BY 4.0
Scope and Objectives
Objective:
You're a penetration tester on the Hack Smarter Red Team. During the engagement, you have discovered credentials for a web server but your attack machine does not have direct access to the server.
Goal:
You have already compromised a Windows Server providing you access to the internal network. Connect to this machine with evil-winrm. Use this Windows Server as a proxy to access the web server from your attack machine, submit the credentials, and retrieve the final flag.
Windows Server - Credentials
Web Server - Credentials
Initial Setup
We connect to the vpn and test our connection.
Recon
Out of habit, we scan the Windows machine using Rustscan and see that port 5985, which we use for WinRM, is open. We also see that SMB 139/445 is open.
Shell as j.smith
We tested SMB with the provided credentials via NetExec and were able to connect.
Next, we try to connect via evil-winrm.
We are now tasked to pivot and reach the web.app machine (in this case on 10.1.24.130). For this we use Ligolo-ng.
Ligolo-ng setup
For the subsequent phases, we use ligolo to relay traffic between the target machine and our attacker machine to make the internal reachable networks of the target machine accessible to our attacker machine.
Ligolo-ng is a simple, lightweight and fast tool that allows pentesters to establish tunnels from a reverse TCP/TLS connection using a tun interface (without the need of SOCKS).
First, we set up a TUN (network tunnel) interface called ligolo and configuring routes to forward traffic for specific IP ranges (240.0.0.1, 10.1.24.0/24) through the tunnel.
Next, we download the latest release of ligolo-ng.
On our attack machine, we start the proxy server.
Next, we upload and run the agent using evil-winrm to connect to our proxy.
We get a message on our ligolo-ng proxy that an agent has joined. We use session to select the session and then start it. We are now able to access the internal service of ws.lab through 240.0.0.1 and be able to reach out to 10.1.24.0/24.
Access as t.ramsbey
We already know about the target web.app (10.1.24.139). We will now attempt to ping it, and we should be successful.
Now, we scan for the ports using Nmap. Port 22 and 80 are open.
The webserver is a Apache/2.4.52 hosting a default page.
Nothing to see here yet.
We use gobuster to scan for directories and sites. We also include the extension .html. We'll find the login.html page.
We enter the provided credentials...
... and are able to retrieve the flag.
Last updated
Was this helpful?