HTB - Worker
Zweilosec's writeup of the medium-difficulty Windows machine Worker from https://hackthebox.eu
Overview
Short description to include any strange things to be dealt with
TODO: Finish writing and clean up
Useful Skills and Tools
Interactive Windows Command/Tool List
WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
Useful thing 2
description with generic example
Enumeration
Nmap scan
I started my enumeration with an nmap scan of 10.10.10.203. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oA <name> saves the output with a filename of <name>.
3 ports open: 80 - HTTP, 3690 - Subversion, and 5985 - Presumably WinRM
Port 80 - HTTP
nothing but default IIS on port 80, dirbuster revealed nothing of use
Port 3690 - Subversion
http://svnbook.red-bean.com/en/1.7/svn-book.pdf
To get a working copy, you must check out some subtree of the repository. (The term check out may sound like it has something todo with locking or reserving resources, but it doesn't; it simply creates a working copy of the project for you.) For example, if you check out /calc, you will get a working copy like this:
$ svn checkout http://svn.example.com/repos/calcA calc/MakefileA calc/integer.cA calc/button.cChecked out revision 56.
installed subversion sudo apt install subversion
Was not able to connect the to page as HTTP, but after some reading found that there is a SVN:// protocol.
there were quite a few files here, and a subdomain dimension.worker.htb. I added worker.htb and dimension.worker.htb to my hosts file
The file moved.txt contained a message stating that the repo has been moved to another castle devops.worker.htb. I added this one to my hosts file as well
The file index.html contained another list of subdomains; again added to hosts
Worker homepage using dimension theme
Links to other pages
Cartoon character page, possible usernames? The other pages did not contain anything that looked useful, so moved on to the devops domain I found earlier.
The devops page required authentication
Next, I used the log command and found the commit notes that described some of the progress that had been made on the repository.
I checked the changes that had been made in each revision, and found that at one point a username and password had been hardcoded in the file deploy.ps1
This credential set did not work for logging into the devops page, nor for WinRM. After getting no progress for awhile, I reset the box and the login worked for the devops page, still not for WinRM
The Azure DevOps Portal
https://azure.microsoft.com/en-us/resources/videos/smarthotel360-demo-app-overview/
After logging in, I found myself in a Azure DevOps portal as the user named ekenas.
When I clicked on the profile picture, I found the user's name and domain login information.
I checked through the user's settings, but there wasn't anything useful.
Under the ekenas repository, there was a project for something called SmartHotel360
Under the Members section of the project I found icons for 2 other users.
template for a page?
Under SmartHotel360 there was a mostly empty project called w45ty45t.
In all, found 3 usernames, and a possible password w45ty45t
Crafting an .aspx reverse shell
None of the usernames or potential passwords got me anywhere, so I began to look closer at what I was able to do in the SmartHotel360 repository.
lots of screenshots -> description - had to: 1. create new branch 2. upload file to new branch 3. add work item to commit 4. approve commit 5. wait for build to complete 6. merge with master 7. navigate to webshell
Tried to push a file uploaded through the web portal but got the above message
Tried creating a new branch of the project called test.
The build takes so long that the cleanup takes place too quickly to do anything... (I think I must have finished creating my test branch just before the cleanup script or whatever cleared it the first time I did this)
Next I created a new pull request, trying to upload an .aspx file to see if I could get code execution.
The asp.net webshell by Dominic Chell, downloaded from https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmdasp.aspx.
After I submitted the pull request I had to approve it. Luckily this user had the necessary permissions.
Approved the file pull request and completed it. If you have problems, make sure to check the Policies section on the right, as it does checks that have to be met first.
My test branches were deleted multiple times before I figured out the rhythm of the portal and how to do everything.
Tried to access my web shell, but it said it wasn't there...
Next I merged my test branch into the master
After a lot of trial and error, I was able to upload my webshell, and tried to run a reverse shell script from my attack machine.
Put this command into the webshell input as a stager to get my reverse shell powershell script from my waiting python http server
got connection to my waiting webserver which hosted a reverse shell ps1 script
My PowerShell script consisted of a reverse shell one-liner found on https://gist.github.com/egre55/c058744a4240af6515eb32b2d33fbed3#gistcomment-3391254
Initial Foothold
I was able to get a reverse shell after uploading and running my PowerShell script!
I was logged in as the service account iis apppool\defaultapppool. SeImpersonatePrivilege sounded interesting
Road to User
Further enumeration
net user showed a very long list of usernames
however there were only three user folder: robisl, restorer, and Administrator
https://www.thewindowsclub.com/list-drives-using-command-prompt-powershell-windows
There was a second logical disk attached to the machine
It looked like this is where the svn repos were stored
I found the data for the websites in the sites folder,
That passwd file in W:\svnrepos\www\conf\ looked interesting
Finding user creds
In the folder W:\svnrepos\www\conf there was a file passwd that contained a list of usernames and passwords. This looked like a good time to brute force WinRM
Port 5985 - WinRM
https://github.com/mchoji/winrm-brute
used winrm-brute to cycle through the list of usernames and passwords
Retrieved the password for one of the users robisl
Using evil-winrm I was able to login with the password specified for robisl
User.txt
On the user's desktop I found the user.txt flag
Path to Power (Gaining Administrator Access)
Enumeration as robisl
robislAfter searching high and low and enumerating as much as I could, I didn't find anything useful.
I tried to switch users to robisl in the devops portal.
I tried switching users in the devops page I had open, but received an error message saying that this user did not have the permissions needed to view project-level information.
I decided to try robisl's credentials on a fresh devops page after closing it and clearing my cache, and was happy to see that I was logged in to a different project.
Azure Pipelines provides a quick, easy, and safe way to automate building your projects and making them available to users.
This sounds like a good way to try to get code execution...I wonder if there is a way to run it in the context of Administrator? I put some code in the azure-pipelines.yml that I hoped would execute and download my reverse shell script.
Unfortunately this did not work. After doing even more reading, I found that I had to assign an agent from the pool to build the project.
Agetnt pool selection
Assign the job to the agent
Save and run
The build job was started
The job built successfully, but my script failed to run. I checked my syntax on everything and made sure I did all of the proper steps and tried again.
Unfortunately I don't remember exactly what I had done wrong, or how I fixed it (I need to take more detailed notes, I guess!). However, after a lot of trial and error, I was able to get the project to build and also execute my script. No I hoped that it would actually execute the PowerShell script and send me a reverse shell!
New Pipeline - Azure Repos Git - PartsUnlimited - Starter Pipeline
My waiting python HTTP server got a connection request, and I could see that it sent the script.
Getting a shell
I was happy to see that my script worked, and I got a reverse shell as NT Authority/System!
Root.txt
I unfortunately had to recreate my session as some automated process deleted it after a short time, but after so much effort I was able to retrieve my proof!
Thanks to ekenas for... [something interesting or useful about this machine.]
If you like this content and would like to see more, please consider buying me a coffee!
Last updated
Was this helpful?