Mist
Recon
nmap_scan.log
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
😵 https://admin.tryhackme.com
[~] The config file is expected to be at "/home/rustscan/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.17:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.10.11.17
Depending on the complexity of the script, results may take some time to appear.
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
[~] Starting Nmap 7.93 ( https://nmap.org ) at 2024-07-10 19:12 UTC
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 19:12
Completed Parallel DNS resolution of 1 host. at 19:12, 0.04s elapsed
DNS resolution of 1 IPs took 0.04s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 19:12
Scanning 10.10.11.17 [1 port]
Discovered open port 80/tcp on 10.10.11.17
Completed Connect Scan at 19:12, 0.08s elapsed (1 total ports)
Initiating Service scan at 19:12
Scanning 1 service on 10.10.11.17
Completed Service scan at 19:12, 6.21s elapsed (1 service on 1 host)
NSE: Script scanning 10.10.11.17.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 5.11s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.38s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
Nmap scan report for 10.10.11.17
Host is up, received user-set (0.079s latency).
Scanned at 2024-07-10 19:12:45 UTC for 13s
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
| http-title: Mist - Mist
|_Requested resource was http://10.10.11.17/?file=mist
|_http-generator: pluck 4.7.18
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 2 disallowed entries
|_/data/ /docs/
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.92 seconds└─$ grep mist /etc/hosts
10.10.11.17 mist.htb
192.168.100.100 mist.htb DC01.mist.htb
192.168.100.101 ms01.mist.htbHTTP (80)
Pluck CMS
file variable is used to display pages, attempt at LFI results in Hacking Attempt Detected.
We have a login page on highlighted admin:
Pluck version is also shown with login page. Pluck v4.7.18 - Remote Code Execution (RCE)
The exploit was not successful, most probably because the upload feature is enabled to only authenticated users.
[CVE-2023-50564](https://www.cvedetails.com/cve/CVE-2023-50564/ "CVE-2023-50564 security vulnerability details) was also not successful
Pluck CMS 4.7 - Directory Traversal seems probable considering we have access to the modules
This method was not successful because any indication of .. in url results in Blocked Hacking Attempt action.
For CVE-2023-50564 we accessed /data/inc, but /data is not showing index page for folder directory listings.
GitHub repository shows only 1 file in settings and that's langpref.php, but there seems to be more to it!
We are able to find albums module in settings too, but we can't read PHP files...
Leaked Credentials
Note: Inclusion of files without authentication #122 (Adding after writeup)
For some reason we can read files via /data/modules/albums/albums_getimage.php from /data/settings/modules/albums/*
c81dde783f9543114ecd9fa14e8440a2a868bfe0bacdf14d29fce0605c09d5a2 bcd2028d0d7a3fa805573d074faa15d6361f44aec9a6efe18b754b3c265ce81e
sha512
lexypoo97
We are able to login with password into the CMS and we can now utilize previous exploits and gain RCE.
The PoC script for module upload kept failing so I uploaded the p0wny.php shell manually and it worked.
Reverse Shell (ms01\svc_web)
So as always HTB deletes this folder periodically so p0wnly shell can't stay active for more then a minute... I was trying to use PowerShell #3 (Base64) as usual, but it seems like AV is active on box! One way to bypass this would be to upload nc.exe and get connection back.
Might as well update hosts file.
xampp has only Pluck CMS installation and that's about it, otherwise it seems like default everything.
Root directory does contain something unusual:
Privilege Escalation (mist\brandon.keywarp)
Looks like this lnk files are periodically accessed by someone which shouldn't be ms01\svc_web
We also have write permission on the directory!
Using Golang Reverse Shell get connection (make sure to hardcode IP:PORT)
After a minute or so we get a connection back:
Privilege Escalation (MS01 Administrator)
Enumeration
Looks like we are on a computer, not domain controller...
Update /etc/hosts
Use chisel to connect to Mist network:
Note: Background the task to keep shell alive.
*.101 seems to be MS01 Computer, *.100 Domain Controller.
Bloodhound
Gather information about domain users:
I was going to exfiltrate data with nc.exe, but it was now identified as virus?... Odd.
Start Bloodhound community edition (dockerfile) and start analyzing.
Looks like we are dealing with Certificates.
Certify
The antivirus kept deleting the file, insisting it was malicious. It said the same thing about netcat too, but initially we got connection via netcat so what's the problem?
I moved back to modules directory and antivirus seemed chill, this must mean directory in xampp is excluded from antivirus detection and we can go bonkers! (but do mind that it gets periodically deleted...)
Probably our privilege escalation target is Sharon:
Generate Certificate
Get Ticket
For next step run Rubeus and ask for ticket:
Brandon User NTLM
We are able to authenticate with NTLM hash:
PetitPotam
PetitPotam attack is successful!
Crack the hash:
Unsuccessful...
Shadow Credentials
We can perform Shadow Credentials attack via PetitPotam PoC.
The attack should take place like:
Verify connection:
Without WebDAV this was not working, enable script can be found here: HOW TO START A “TRIGGER START” WINDOWS SERVICE WITH POWERSHELL WITHOUT ELEVATION / ADMIN RIGHTS
The script is like a steroid for PetitPotam and should be ran before any PetitPotam command.
impacket yet doesn't have support for shadow credentials in interactive mode, it can be added via this pull request: Add Shadow Credentials Commands to Ntlmrelayx's Interactive LDAP Shell #1402
Connect to ldap and perform Shadow Credentials attack:
To check if the .pfx file is readable and the password is correct, we can try extracting the certificate and key using OpenSSL to verify:
The result tells us it's a a self-signed certificate, as the subject and issuer being the same as MS01$. Rather than the one from Brandon that indicates CN and DC attributes.
Now we have a new PFX certificate, which we can also use Openssl to verify it without the password this time. Then we just authenticate the new PFX just like what we have done before for the Pass the Certificate attack, only now we are targeting the user MS01$.
After this we retrieve the NTLM hash for the computer account MS01$, which is typically the account associated with a domain controller or server in an AD environment.
This hash can be used to authenticate to services that accept NTLM challenge/response authentication.
Enumerate SIDs
The 0 at the end is typically used to specify the RID (Relative Identifier) for enumeration.
With the NTLM hash & SID, we can then use impacket-ticketer to create a fake or forged Kerberos ticket (TGT).
Finally, with the TGT for Administrator, we can use impacket-secretsdump to dump credentials:
Using Pass-The-Hash authenticate with evil-winrm as Administrator on MS01 machine.
Privilege Escalation (DC01 op_Sharon.Mullard)
KeePass
cats.png is literally cats, but datetime image is a screenshot:
We can see partial password: UA7cpa[#1!_*ZX
Generate hash from kdbx which is KeePass database file.
For hashcat to work delete sharon: prefix, check hash type and start cracking with known password:
Keepass password: UA7cpa[#1!_*ZX@
Use KeePassXC for Linux.
The password for operative account is ImTiredOfThisJob:(
Sharon.Mullard username fails to authenticate
There was another user with same name in net user /domain which had op_ prefix to current user:
Creds: op_Sharon.Mullard:ImTiredOfThisJob:(
Privilege Escalation (DC01 Administrator)
op_Sharon.Mullard has nothing in home directory. Users:
Get information about domain:
ReadGMSAPassword (svc_ca$)
Get Outbound Object Control of user:
Looks like we are dealing with certificates again, but we have ReadGMSAPassword on svc_ca$
AddKeyCredentialLink (svc_backup)
We can Abuse the AddKeyCredentialLink permission on svc_cabackup user
Hmm... Still can't authenticate with evil-winrm
Tried enumerating for vulnerable certificates, but nothing right off the bat.
ESC13 Abuse
In our case, the template ManagerAuthentication meets these requirements. We can check the conditions manually or use some scan tools like a patched branch for Certipy to verify this vulnerability.First, we use the account svc_cabackup along with its NTLM hash to request a new certificate of template ManagerAuthentication against mist-DC01-CA
We get an error when requesting a certificate:
Default key length by certipy is 2048: -key-size RSA key length > Length of RSA key. Default: 2048
Now as user svc_cabackup, who just enrolled to ManagerAuthentication, we have become the Certificate Managers of the server. And we are now able to use template BackupSvcAuthentication which grants enrollment rights to MIST\CA Backup, which we figured it out through the adPEAS enumeration and BloodHound.
Keep climbing up the tower, we pivot to request a certificate using the template BackupSvcAuthentication as the Certificate Manager:
Note: For some reason 192.168.100.101 didn't work instead of dc01.mist.htb even tho it resolves to same thing..
We will receive a new PFX certificate using the template BackupSvcAuthentication, which we can later use this private key to execute backup operations:
Repeat the attack, authenticate the new PFX certificate against DC01:
We will retrieve a new TGT providing backup privilege (same NTLM hash for the same user).
Registry Dump
With this TGT we can perform backup operation for the system. Simply use impacket-reg to dump the registry hives (SAM, SYSTEM, SECURITY):
SAM Dump From Registry
Dump the hashes from registry hives:
However, the hashes extracted from the local SAM (Security Accounts Manager) database can generally be used to authenticate locally but may not be sufficient for remote logons, especially they do not provide domain-level credentials or permissions. And Microsoft has a policy of Blocking Remote Use of Local Accounts.
But we can always use the hashes for the domain users in such cases, because they're dumped by the cached domain logon information. And the machine account hash (e.g., DC01$) is more powerful as it can authenticate with the domain controller, allowing access to domain resources.
SAM Dump From Local Account NTLM
Therefore, after extracting the machine account hash, we can use it to generate a Kerberos ticket, or re-dump the secrets with the DC01$ hash:
Admin Auth On DC01
Root.txt
Admin Scripts
References
Resources:
Admin Hash:
b46782b9365344abdff1a925601e0385
Last updated