HTB - Multimaster
Overview
Hold on to your seats, because this Insane Windows machine is a wild ride. TODO:Finish this writeup, there are more notes and stuff in the notes app if anything is missing...
Useful Skills and Tools
description with generic example
description with generic example
Enumeration
Nmap scan
I started my enumeration with an nmap scan of 10.10.10.179. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN <name> saves the output with a filename of <name>.
At first my scan wouldn't go through until I added the -Pn flag to stop nmap from sending ICMP probes. After that it proceeded normally.
lots of ports open
Capturing the burp request to the /api/get/Colleagues
This is the unicode escaped equivilent of a' or 1=1; -- And the response:
next attempted to enumerate the valid users who have active accounts on this machine through Kerberos.
used wafw00f to detect if there was a WAF, but none was detected https://trustfoundry.net/bypassing-wafs-with-json-unicode-escape-sequences/ https://github.com/0xInfection/Awesome-WAF#testing-methodology https://github.com/sqlmapproject/sqlmap/blob/master/tamper/charunicodeescape.py
mine https://stackoverflow.com/questions/40628603/sqlmap-post-json-data-as-body https://www.yg.ht/blog/blog/archives/361/getting-sqlmap-to-detect-injection-points-through-json sqlmap -r burppost —tamper charunicodetamper.py —dbs -delay 5 sqlmap -r burppost —tamper charunicodetamper.py —D Hub_DB -tables -delay 5 sqlmap will automatically detect that there is JSON data in your POST and will ask if you would like for it to process it. sqlmap called hash sha384_generic_passwd https://www.tunnelsup.com/hash-analyzer/ verified that the hash was sha2-384 There were duplicates of each hash, only four unique;
hashcat -m 10800 -a 0 -o hash.cracked hash /usr/share/wordlists/rockyou.txt Possible algorithms: Keccak-384
Hashcat was able to crack 3 out of 4 of the hashes
Just because the usernames I got were in the database does not mean they can login to this machine. Maybe need to enumerate users from the the domain in another way since ldap and rpc were not helpful https://kalilinuxtutorials.com/mssql-injection https://github.com/Keramas/mssqli-duet https://blog.netspi.com/hacking-sql-server-procedures-part-4-enumerating-domain-accounts/
https://www.sqlservercentral.com/forums/topic/how-to-retrieve-active-directory-user-information-through-sql-server`' -- exec xp_cmdshell 'net group /domain'` returns same list as earlier user enumeration
from enum4linux
https://devblogs.microsoft.com/oldnewthing/20040315-00/?p=40253 https://froosh.wordpress.com/2005/10/21/hex-sid-to-decimal-sid-translation/ SID in HEX 0x0105000000000005150000001C00D1BCD181F1492BDFC23600020000
https://securityonline.info/mssqli-duet-sql-injection-script-for-mssql/ https://github.com/Keramas/mssqli-duet
Initial Foothold
Road to User
Further enumeration
Finding user creds
User.txt
Path to Power (Gaining Administrator Access)
Enumeration as User tushikikatomo
tushikikatomoUser folders on this box include:
text
https://activedirectorypro.com/powershell-commands/
text
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1414
An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer. A local attacker who successfully exploited the vulnerability could inject arbitrary code to run in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, a local attacker would need to determine which port Visual Studio Code is listening on for a targeted user.
Moving to user2
each site leads to next : https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-1414 https://github.com/qazbnm456/awesome-cve-poc https://github.com/nu11secur1ty/Exp101tsArchiv30thers https://iwantmore.pizza/posts/cve-2019-1414.html
Exploitation There are two main limitations to the exploitability, that are: 1. the debug port binds to 127.0.0.1 2. a random TCP port is used every execution
Due to these limitations, the issue cannot be remotely exploited. If instead a fixed TCP port was used, the issue could have been exploited via the browser using a DNS Rebinding attack to bypass the Same Origin Policy. To be able to execute arbitary JavaScript code, we need first to retrieve the WebSocket link using a HTTP GET request to /json URL and then connect to it using the WebSocket protocol.
https://github.com/phra/inspector-exploiter
text
text
text
had to keep starting over again as the CEF debug server kept changing
Moving laterally to user - cyork
cyorkwhile searching around I cound that I had access to a folder I didn't before...the wwwroot\ folder in C:\inetpub\
We're sorry but multimaster doesn't work properly without JavaScript enabled. Please enable it to continue.
https://superuser.com/questions/815527/way-to-list-and-cat-all-files-that-contain-string-x-in-powershell ls -R|?{$_|Select-String 'dummy'}|%{$_.FullName;gc $_}
Running the command *Evil-WinRM* PS C:\inetpub\wwwroot\bin> type MultimasterAPI.dll results in:
ls -R -EA SilentlyContinue|?{$_|Select-String 'password'}|%{$_.FullName;}
Moving laterally to user3 - sbauer
sbauerI found a password for yet again another user: this time sbauer. Accordeing to my searches with Bloodhoud earlier, jorden should be next, then Administrator. we will see if my projected path from this user was correct.
GenericWrite Generic Write access grants you the ability to write to any non-protected attribute on the target object, including “members” for a group, and “serviceprincipalnames” for a user Abuse Info Users With GenericWrite over a user, perform a targeted kerberoasting attack. See the abuse section under the GenericAll edge for more information
The following video explains how to exploit this: https://www.youtube.com/watch?v=z8thoG7gPd0
http://www.harmj0y.net/blog/activedirectory/targeted-kerberoasting/
we can change a victim’s userAccountControl to not require Kerberos preauthentication, grab the user’s crackable AS-REP, and then change the setting back:
Set-ADAccountControl -DoesNotRequirePreAuth
-DoesNotRequirePreAuth Indicates whether Kerberos pre-authentication is required to logon using the user or computer account. This parameter sets the ADS_UF_DONT_REQUIRE_PREAUTH flag of the Active Directory UAC attribute. The acceptable values for this parameter are:
$False or 0
$True or 1
Then we can use Impacket's GETSPNUSers.py
Moving from sbauer to jorden
sbauer to jorden*Evil-WinRM* PS C:\inetpub> Set-ADAccountControl -DoesNotRequirePreAuth $True jorden
the password cracked very quickly
the user jorden's password was rainforest786
This user has backup and restore privileges, which if I remember correctly is a quick and easy path to escalate privileges "This privilege causes the system to grant all read access control to any file (only read)."
If you have SeBackup& SeRestoreprivileges(Backup Operators group) you can set permissio nand ownership on each file & folder =WIN!
Make sure not to have any spaces between words in your command!
Root.txt
Getting Administrator Shell
So now I have successfully exfiltrated the secret documents...but I want to own the system. Time to practice some more privilege escalation.
I'm sure there is a way I can backup ntds.dit From https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers: But it seems like I need an admin prompt for this to work
https://decoder.cloud/2018/02/12/the-power-of-backup-operatos/
Upload nc.exe, then start the service with sc.exe start <service>.
I had to try many services until I found one that would work. Even then, it said it failed to start the service, but I got my shell!
The process of replicating changes in one master copy of the account database to all other master copies is called a multimaster operation.
limbernie
Finale
MinatoTW & egre55 Thanks to <box_creator> for .
If you like this content and would like to see more, please consider buying me a coffee!
Last updated
Was this helpful?