HackMDHello hackers today i wanted to share with a simple writeup of one of seasonal 5 machines.Actually season 5 is very sweet so far because this time am getting better in windows machines especially AD and some most diffucts linux machines.
Description:
SolarLab is a medium easy from season 5 (windows machine) by LazyTitan23, which were required to hack it and get access to the administrator.What i love from this box is that it has one of the exploit I did from one of the machine we hacked during season 4 (savage land) if not mistaken the box was JAB.
Let the hack begin.
SCANNING
I started by scanning the whole network with nmap.
ENUMERATION
After nmap with all port done because i didn't want to make sure that am skipping anything i waited the all port scanning is done here.
Then i decided to do some enumeration one port after another.
ENUMERATING PORT 80
With port 80 we can see that we got a subdomain but also a http-server-header, what was so important for me was a domain. So i Decided to add it to the hosts file and browser to the domain name.
I didn't get much info, so i decide to brute force directories and subdomains at the same time and see what i will get.
Bad enought i ended up with a subdomain report.solarlab.htb,I didn't get any directory that was usufully.
ENUMERATING SMB
Since I saw a smb port running i decide to enumerate it also hoping i will get something cool info.
From we can see that other share needs password access but the only one we can login/access with anonymous was 'Documents' share.
I decided to download some of the few decuments and see if is usufully for me.
From the documents that gave me some juice info was the 'details-file.xlsx' file.
from the excel we can see we got some of the info such as username,password and emails(lets record them somewhere and continue with our enumeration). I decided to forcus with the username and password first here.
I wasn't done with smb LOL,So i went again and try with crackmapexec, crackmapexec is nice tool for enumeration, instead of using smbclient we can also use crackmapexec to do all those stuffs.
I decided to check for users but go nothing and decided to check for RIDs
N/B: After analyzing my data i decided to connect some dots, initially from smbclient i got a excel file with some username and one of them was user 'blake' also here now after using crackmapexec I get the same user, so this means we need to find somewhere where we can login with this user. Now my next guess here was that from the crackmapexec i can see a user 'openfire', what i know is that once you see user openfire probably you should know that there is either a service under port 9090 or 9091 internal on the server or inside the machine you have to do some pivoting and access this service which is also vulnerable.
And this user openfire gives me a clue that once i get access inside the machine my next step will be doing some pivoting(that was my general overview once i saw this user), Now lets see how this goes.
ENUMERATING PORT 6791
from here we find a subdomain and a port number, I added this one into my hosts file and decided to give it a try.
Now we have a reportHub interface, but we need valid credentials to login here.
I tried the creds from the excel but they didn't work but, And i decide to try harder to make a small twist on the username instead of "blake" to "blakeb"
Creds
Now we can login
ReportHub is used to generate a pdf file by either uploadind a image or even a html file.
A little google such about reportHub vulnerability i found this one from github.cve.
After some analysis about each endpoint with burp i found that we have two endpoint which can give us the same goal which was RCE.
With 'leaverequest' there is a file upload vulnlability, I will go with a simple method here, Actually the endpoint that was easy exploitable was 'travelRequest'.
After checking the burp-suite history i decided to forward this request to repeater
Now from the CVE above at the bottom there is a PoC, i decide to edit it and use it
The PoC say we can create a malicious file.html and add our malicious html code inside that will try to exploit the python libary. So instead of creating a payload am going to just put my powershell payload there, no time to upload.
payload:
EXPLOITATION
EXPLOITING reportHub
I went and glab the base64 encoded powershell script and added to the payload .
Finally my payload looked like this after beutifying it like a noob LOL. There is a simple technique you need to use while encoding unless otherwise you wont get a shell("Thanks to @blackninja23 took his time those days to teach me this and and he made sure i understand this method of encoding powershell script because i was struggling with this for a long time"), just do a simple google.
Now lets get a shell.
On the blake home directory you can glab your user flag.
LATERAL MOVEMENT
With lateral movement i started checking for interesting users and localgroup, But nothing was usufull here apart from openfire user.
Now here the only user who was interesting was "openfire", What we were supposed to do here was first get a shell as user "openfire" by doing some pivoting technique and then find a way to get to administrator.
Now here i didn't even want to google because i know openfire service is running internal under port "9090 and 9091", i decided to confim this by using the command below.
I knew directly that In order to access this ports "9090 and 9091" I need to do some portforwading and there is where pivoting is comming into hands.We can't access this port because is running in an internal network so the only path for me to access was this computer I had access on("blake computer").
PIVOTING
uploading chisel
Am going to use chisel on both local machine and on the target machine.
I decided to get multiple shells because once one crush, i will use the others.
I will do forwarding on my localmachine on both port 9090 and 9091.
Lets decode to access these ports and see if is there really running openfire service.
Exploiting openfire
So far we have openfire service at our local machine, but good enough is that the openfire version is vulnerable to Authentication Bypass which leds to remote code execution by uploading a vulnerable plugin and we get RCE simple as that, all this I learned from seosanal 4, from JAB machine.
Google-fu and found this CVE-2023-32315 and i decided to clone it.
Now i decided to run the exploit in order to create a valid administrator username and password.
use the credential being generate to login in to the openfire.
N/B: something to note down is that the python CVE or script generates a random username and password but also if you can understand what the python script does inside it, you can try to modify it and make it generate the username and password of your choise.
Getting a shell as openfire.
First of all we need to upload a vulnerable plugin which will give us a password which we will use to acces the console. You may find it diffucult but it is very easy if you had done the JAB machine.
upload a vulnerable plugin
Then i decided to upload the plugin, its a java plugin because openfire is using java programming language.
After uploading now i was good to go.
The plugin show you the location(Management Tool) where you can find it but also it give you the pass i.e ("123").
Easiest way to find a plugin location is clicking server –-> server_setting–> Management tools
Now lets find a console, click find home page and then system command.
Now from here i was able to executing command as openfire.
getting a reverse shell
Lets get a shell because the environment is limited to us, As usually i beautified my powershell paylod and at the same time i initiated the listerner on my local machine.
payload:
How sweet this machine it was , It was really fun and interesting.
PRIVILEGE ESCALATION
Also privilege escalation was interesting, I don't know whether I did in an intendend way or what i will have to find "LazyTitan23" himself and ask him after the machine expires.
privilege escalation and runas script
I didn't find much info about user openfire after reaching here.
But while i was in the "program files" looking for any juice program file to exploit I got an idea of trying runasCs script. And decided to give it a try.
My idea was like this,since because i have blake password,which means i can user this password with the runasCs scipt to try to execute command and see which user will the system respond with.
i.e
As you can see i have successful executed commands as administrator, now lets a shell as administrator.
uploading nc binary
And then listern on port 1234 on my local machine
