> For the complete documentation index, see [llms.txt](https://hackzzz.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackzzz.gitbook.io/welcome/welcome/writeups/hackthebox/windows/bart.md).
# Bart
**Difficulty: ****HARD**
## Reconaissance
### Nmap
```java
Nmap scan report for bart.htb (10.10.10.81)
Host is up (0.071s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Did not follow redirect to http://forum.bart.htb/
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
```
### HTTP - Port 80
Trying to load the page we see that we cannot resolve the address why? because we don't have it in the **/etc/hosts** file.
So, once we pass the domain and subdomains to the **/etc/hosts**, let's start enumerating the page.
There is nothing too much interesting but, we have some emails, users and names that can be useful.
I just put it all in a file and continue making recon on the machine.
Using **ffuf** to **brute-force** for subdomains we can see that there is a subdomain called monitor.
We see this login page, we can try to validate users that we found in the previous page, before start **bruteforcing** the login with any other users let's try a little of password guessing.
Using the user ***harvey***, and passing the password ***potter (his last name)*** we get access to his account.
Once you get in you can see that there's another subdomain inside of it so, pass it to the **/etc/hosts**.
In the **internal-01** subdomain we can see this login page, you can try to do a *SQL Injection* but, in the URL, we can see and pretend that we are in front of an open-source project so, you can look up for it on google to see if there is any coincidence.
You can see that there is a project that is similar to our URL path/directories.
Analyzing the code, you can register a user by doing a **POST** request with the parameters **`uname`** and **`passwd`** and pointing to the **register.php**, you can try to register a new user with **cURL**.
Run the command with **cURL** and try to get in with the created user.
So, we get in successfuly, now let's continue making recon.
Viewing the source code on the page we see that there is a strange URL path so, let's play with it.
## Exploitation
### Log Poisoning
We get a number one, we can pretend that is because the user is valid.
Ok, here we're getting a 0 because the user is not valid on the machine, looking a little the URL we can see the directories that are called log, we can try to see if we can make a log using the name of ***harvey*** and try to open it.
Now knowing that using a valid user we can create a log and displayed let's see if we can do it with other file format like **php** so, we can upload our web shell and the reverse shell to get access.
Perfect, now I will use **python3** to create the request and continue to poison the logs using the *`User-agent`*.
You can see there that by passing php code on the User-agent parameter and changing the file format that we want in this case php we can upload a web shell.
Now once we can execute commands using our web shell, let's continue to upload and execute our reverse shell using **nishang powershell** script and listening with a **netcat** session with **rlwrap**.
## Privilege Escalation
Enumerating our way to get admin privileges, we can see that the **SeImpersonatePrivilege** is enable in this machine, let's continue to upload the **JuicyPotato** program to exploit it.
Remember to use the correct **CLSID** for the machine to exploit this correctly.
Now, why I am uploading a **netcat** binary to the windows machine? Well, it is to get a shell more easily once we execute the command as administrator.
We Perfectly get in as the administrator user.
You can see the flag on the admin desktop directory.
## Persistence
Now let's say that we as an attacker want to get a persistence on the windows machine, to keep it simple what I'm doing is opening the port **445** to **outside** and **inside** but, for what? We will create a user with administrative privileges, and we will be able to get in with that user using **psexec.py**.
I will use crackmeapexec to dump the **SAM** to further attacks like pass the hash using xfreerdp, if we was on a active directory enviorment we want to dump the password policy too so let's do it too.
We perfectly get the info we want by using our persistent user.
The other way we can dump the SAM of windows is by using the windows registry, we can see it in the image above.
Now, finally using a samba server we can download it.