Butch_Exploitation

Arbitrary File Upload

---

Validating the cracked password hash of the butch user revealed an endpoint, repo.aspx, that supports file upload. Uploaded files are accessible at the web root directory. This appears to be the entrypoint for initial foothold.

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/butch]
└─$ cp /usr/share/webshells/aspx/cmdasp.aspx .

Attempting to upload a ASPX webshell fails due to the presence of an extension filter

Extension Filter Bypass

---

Attempting various techniques to bypass the extension filter present at the file upload feature of the repo.aspx endpoint

Case Sensitivity

---

Negative on case sensitivity

Content-Type Manipulation

---

Negative on the Content-Type manipulation

Double Extension

---

False-positive on the double extension technique as the server interprets the file as with the .png extension

Null-byte Injection

---

False-positive on the null-byte injection technique

Alternative Extensions

---

False-positive on the alternative extensions technique

.config

---

However, the .config extension returns the IIS 404 page. This suggests that RCE via overwriting the eweb.config file might be possible.

Trailing Characters

---

Both whitespace and . trailing-character techniques work Webshell uploaded successfully

The current process is running as SYSTEM System level compromise