Hospital HTB Walkthrough

Oct 3, 2024    #box   #htb   #medium   #windows   #ldap   #ghostscript   #selenium   #roundcube  

Hospital Hack The Box Walkthrough/Writeup:

How I use variables & wordlists:

1. Enumeration:

NMAP:

LDAP 389:

SMB 445:

DNS 53:

HTTPS 443:

Web Mail Service Discovery:

Enumerating the Tech Stack of the Web-Mail Server:

Directory Busting HTTPS Using Feroxbuster:

Attempting to Login:

HTTP-PROXY 8080:

Enumerating the Tech Stack of the proxy server:

Directory Busting Web Proxy Using Feroxbuster:

http://10.129.229.189:8080/
http://10.129.229.189:8080/images/
http://10.129.229.189:8080/css/
http://10.129.229.189:8080/uploads/
http://10.129.229.189:8080/fonts/
http://10.129.229.189:8080/js/
http://10.129.229.189:8080/vendor/
http://10.129.229.189:8080/vendor/jquery/
http://10.129.229.189:8080/images/icons/
http://10.129.229.189:8080/vendor/animate/

Web Mail Service Discovery on 8080:

Creating an account:

Discovering An Upload Portal:

Fuzzing for valid extensions:

Trying to get a web-shell by bypassing file-upload restrictions:

Enumerating the PHP Server Some More:

2. Foothold:

Using Weevley To Get A Web Shell:

Getting around the timeout Using Weevely’s built in reverse shell:

Detailed Breakdown Of The Reverse Shell:

Finding Mysql Creds in config.php:

Understanding the Upload Mechansim:

Trying to connect to the mysql instance:

Discovering another User:

Discovering a Tmux Session:

3. VM Privilege Escalation:

Discovering the Kernel is vulnerable to exploitation:

Building the & transferring the exploit:

Using the CVE-2023-35001 exploit to privesc to root:

Enumerating as Root:

Connecting to the mysql instance as root!

  1. Connect:

    • mysql -u root -p'<Redacted>'

  2. List the databases:

    • show databases;

  3. Select the hospital Database:

    • use hospital;

  4. Show the tables in the hospital database:

    • show tables;
      • It has a users table so we could get a some creds!

  5. Show columns from the users tables

    • show columns from users;

  6. Show the contents of the columns:

    • select * from users;

Cracking the hashes admin hash:

Dumping Shadow Hashes:

Cracking Dr Williams Hashed Password:

Accessing Dr Williams Email:

4. Host Foothold:

Gaining Access to the host via Malicious .eps GhostScript Exploit:

Looking at the readme for the GhostScript public exploit CVE_2023_36664, we have alot of options. We cannot use the standard --revshell command as that is for when executed on a unix host only. However we can generate our own payload and have this placed in an eps file.

  1. I use https://revhells.com to generate a powershell reverse shell and base64 encode it:

  2. I use the exploit to generate the malicious .eps file:

    • python3 CVE_2023_36664_exploit.py -g -p "<payload>" -x eps

  3. I start my nc listener:

    • nc -nvlp 53

  4. Respond in the email client & attach the malicious.eps file:

  5. Within seconds I have a reverse shell:

+Note+: This is one of the coolest boxes I have done. The creativity is amazing.

Finding Hard-Coded Creds In ghostscript.bat file:

3. Privilege Escalation:

Connecting Via RDP to the target:

Capturing Credentials from the Selenium WebDriver:

4. Ownership:

Lessons Learned:

What did I learn?

  1. I learned about using the GhostScript eps exploit, I was not even aware that existed so that was cool.
  2. I learned that you can re-direct selenium output (this is important as I have used selenium in previous projects, never to enter anything sensitive but this interesting none-the less)
  3. I learned not to do boxes when I get sleepy. I got caught for a long time looking for the correct foothold.
  4. I also learned that you can be really creative when making these boxes, this one was honestly amazing.

What silly mistakes did I make?

  1. I was sleepy when I started so overlooked a pretty obvious foothold/entrypoint even though it was staring me in the face.

Sign off:

Remember, folks as always: with great power comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

– Bloodstiller

– Get in touch bloodstiller at proton dot me


Next: Intelligence HTB Walkthrough