Hack the Box

Overview Chamilo LMS 1.11.24, Ubuntu 22.04. Release: 2024-07-06. Retire: 2024-11-02. IP: 10.10.10.x. Chain: unauthenticated file upload to RCE (CVE-2023-4220), a reused Chamilo database password for the mtz system account, then a symlink-following sudo ACL script for root. Reconnaissance Port scan 1 2 nmap -p- --min-rate 10000 10.10.10.x nmap -p 22,80 -sCV 10.10.10.x Open ports: 22/tcp: OpenSSH 8.9p1 (Ubuntu 22.04 jammy) 80/tcp: Apache 2.4.52, redirects to http://permx.htb Subdomain fuzzing The server routes HTTP requests by the Host header, so fuzz subdomains: ...

Overview Machine author: Tr1s0n. IP: 10.10.10.x. Chain: forum token, escalation to admin, XXE (file / source read), Redis (session replacement), access to developers., LFI + PHP filter chain (RCE as www-data), PHP-FPM / FastCGI (pivot to victor), prototype pollution in a Node.js API (RCE as root). Reconnaissance 1 nmap -sV -sC -p- 10.10.10.x Open: 22 (SSH), 80 (HTTP). Redis (6379) is local only / password protected. 1 10.10.10.x collect.htb developers.collect.htb The vhost developers.collect.htb is protected by Basic Auth. ...

Overview Machine author: TheCyberGeek. OS: Ubuntu 18.04.3 LTS (Bionic). 1 2 3 Redis 6379 (no auth) --SAVE authorized_keys to .ssh/--> shell as redis --crack /opt/id_rsa.bak (ssh2john + john) -> computer2008--> su Matt (password reuse) --Webmin 10000, CVE-2019-12840 command injection in `u`--> root Foothold: Redis listens without authentication; abuse SAVE to write an SSH public key to /var/lib/redis/.ssh/authorized_keys, shell as redis. Lateral movement: the encrypted private key /opt/id_rsa.bak is cracked by john (password computer2008); Matt reuses that as his system password; su Matt. Privilege escalation: log into Webmin with Matt’s credentials; CVE-2019-12840 (command injection in the Package Updates module, parameter u); Webmin runs as root, so RCE as root. Reconnaissance 1 2 nmap -p- --min-rate 10000 -oA scans/nmap-alltcp 10.10.10.x nmap -p 22,80,6379,10000 -sC -sV -oA scans/nmap-tcpscripts 10.10.10.x Port Service Version Notes 22 SSH OpenSSH 7.6p1 Ubuntu standard 80 HTTP Apache 2.4.29 (Ubuntu) “under construction” page 6379 Redis Redis 4.0.9 no authentication 10000 HTTP MiniServ 1.910 (Webmin httpd) HTTPS, admin panel Port 6379 (Redis) is the obvious foothold: open to the world, no password. Port 10000 (Webmin 1.910): a specific old version, worth keeping for privesc. Webmin runs as root, so any RCE there is root. Port 80 is a dead end. Gobuster: /images /upload /css /js /fonts, nothing useful. Initial Access Redis, shell as redis Redis 4.0-5.0 with a default, open configuration allows arbitrary disk writes with the privileges of the redis process: ...

Overview Machine author: ompamo. Debian. A maze box with multiple paths at every stage. Key concepts: cookie reuse between subdomains, NSS + PostgreSQL as the backend for system accounts, command injection in a setuid wrapper, and a x64 ROP buffer overflow. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 +- XSS (contact form) --------------+ admin.redcross.htb +- SQLi -> crack charles -----------+-> reuse PHPSESSID +- guest account -> cookie ---------+ | v +- Haraka SMTP RCE ---------------+ shell as penelope + +-> user.txt +- cmd injection (iptctl) -> www-data -> PostgreSQL creds -> add a user gid=1000 | v +- gid=27 (sudo) -> sudo su ------+ (unintended) root +- unixnssroot -> uid=0 -> su ----+ (intended) +- BOF in iptctl (setuid) -> ROP -+ (BOF path) | v root.txt Reconnaissance 1 2 3 22/tcp ssh OpenSSH 7.4p1 Debian 10+deb9u3 (Debian 9 Stretch) 80/tcp http Apache 2.4.25 443/tcp ssl/http Apache 2.4.25 Script scans (-sC) hang, so there is a WAF. Run only -sV. HTTP GET / redirects (301) to https://intra.redcross.htb. Add it to /etc/hosts. Domain and directory enumeration: ...

Overview Ubuntu 20.04. IP: 10.10.10.x. Topics: SSTI (Spring Boot), log poisoning, path traversal, XXE, source code review. Chain: SSTI in the search box, shell as woodenk, credentials in the source, SSH, analysis of a root cron job (a Java jar), a four-vulnerability chain (log poisoning + path traversal + metadata-driven path injection + XXE), the root SSH key, root. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV 10.10.10.x 22/tcp: OpenSSH 8.2p1 (Ubuntu) 8080/tcp: HTTP (http-proxy) HTTP (port 8080): ...

Overview Windows Server 2019 (Build 10.0.17763). Attacker IP (tun0): 10.10.14.x. Key techniques: LFI/RFI, PHP session poisoning, blacklist bypass, PSCredential lateral movement, malicious CHM, Net-NTLMv2 capture and crack. 1 2 3 4 5 6 7 8 9 10 11 12 nmap -> IIS + PHP +- LFI in ?lang= (blog) +- read the PHP session file (C:\Windows\TEMP\sess_<PHPSESSID>) +- PHP session poisoning: PHP code in the "username" field +- RCE as NT AUTHORITY\IUSR +- download nc64.exe -> reverse shell (IUSR) +- db.php -> MySQL password 36mEAhz/B8xQ~2VM +- password reuse -> PSCredential -> shell as SNIPER\chris (user flag) +- malicious .chm in C:\Docs (opened by the admin) +- Responder captures the admin Net-NTLMv2 +- hashcat -m 5600 -> butterfly!#1 +- PSCredential -> shell as Administrator (root flag) Reconnaissance 1 2 3 4 5 # 1) fast sweep of all ports ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) # 2) service/script scan on open ports only nmap -p$ports -sC -sV 10.10.10.x Result: Windows, IIS, a PHP server. The “Sniper Co.” site has a login page and a blog. ...

Overview Machine author: irogir. Main skills: side-channel enumeration (timing attack), mass assignment, LFI + PHP wrappers, arbitrary file upload (timestamp brute force), git history leak, Axel .axelrc misconfiguration for arbitrary file write as root. Chain: timing attack, user enumeration, password guess, mass assignment (role=1), LFI (image.php), php://filter (source disclosure), arbitrary upload + MD5(time()) brute force, RCE, git log in a backup, password reuse, SSH as aaron, sudo netutils (axel), .axelrc default_filename, overwrite /root/.ssh/authorized_keys, SSH as root. ...

Overview Windows Server Domain Controller. Domain: tombwatcher.htb. DC: DC01.tombwatcher.htb (10.10.10.x). A chain of AD ACL/ACE abuses ending in ADCS ESC15 (CVE-2024-49019). 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 henry (starting credentials) | WriteSPN v alfred -- targeted Kerberoast -> hashcat -> password "basketball" | AddSelf v INFRASTRUCTURE -- group with ReadGMSAPassword | ReadGMSAPassword v ansible_dev$ -- gMSA, read msDS-ManagedPassword -> NTLM hash | ForceChangePassword v sam -- password reset | WriteOwner -> set owner -> add GenericAll -> reset password v john -- member of Remote Management Users -> WinRM -> user flag | GenericAll over OU=ADCS v === ADCS / ESC15 === 1. Certipy find -> the WebServer template has an orphaned SID in Enrollment Rights 2. AD Recycle Bin -> 3x cert_admin; SID ...-1111 = GUID 938182c3... 3. Restore-ADObject -> cert_admin returns to OU=ADCS and regains the template right 4. dacledit (inheritance) -> john gets FullControl over cert_admin -> password reset 5. ESC15: request with an injected "Enrollment Agent" Application Policy 6. request on-behalf-of Administrator -> administrator.pfx 7. certipy auth -> Administrator NT hash -> PtH -> root flag Each step is one ACE/permission in AD that lets you take over the next object. The final stage combines AD Recycle Bin with an ADCS misconfiguration. ...