Axxle
Recon
On http webapp we see accounts@axlle.htb email, add it to /etc/hosts
DNS (53)
SMB
We are not able to enumerate the smb via null or default usernames.
HTTP (80)
Backend is IIS webserver.
Excel
Reading:
It looks like we can only send Excel documents but they may not contain macros.
I was first using https://github.com/0xflagplz/Xll-Payload-Generator tool to generate
Testing stage:
The testing stage worked, yay! Then I experimented on connection and it worked!
But when I was sending the email to the user I was getting nothing back!
After some trial and error other tool was suggested to use https://github.com/moohax/xllpoc. Clone the project, download shit ton of c++ stuff, with sdk, edit XLL_POC.cpp
The project generates XLL_POC.dll which you should rename to XLL_POC.xll, since xll files are essentially dll files...
Reverse Shell (gideon.hamill)
Upgrade shell with ConPtyShell for more stability and run winpeas to enumerate the system.
winpeas showed useful information for us to explore. First I visited hMailServer. Password may come in handy for something?
Command to list the shares:
Couldn't get passwor via dpapi cache
Enumerate groups:
We are parts of Accounts and Employees group, accounts seems to be Managers.
List connections and process names:
Still nothing eye catching....
Privilege Escalation (dallon.matrix)
OSINT Testing
Okay, finally I decided to view where the xll were stored and surprise surprise!
Save usernames for later just in case.
Create the file
Meanwhile start responder:
User.txt
Well hash couldn't be cracked with rockyou. Turns out you can also open files with file:// protocol, so let's get a reverse shell:
Privilege Escalation (jacob.greeny)
The user is part of Web Devs which means we should have access to some development features.
Access to C:\App Development is still denied to us.
Checking the powershell history reveals the password of user:
Creds:
dallon.matrix:PJsO1du$CVJ#D
Since we got credentials we can harvest information about DC with bloodhound
Refer to: [[Bloodhound]]
Show all groups permissions: Select Group -> First Degree Object Control
Looks like we can reset password of 2 users. jacob.greeny and baz.humphries
TheHackerRecipies: ForceChangePassword Docs: https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainUserPassword/ Scripts https://github.com/PowerShellMafia/PowerSploit
We are part of App Devs and finally have access to C:\App Development:
We have a README.md so let's check what project does:
Zip the directory and download:
The source has nothing interesting, but the comment which developer left is. automated task = cronjob!
It looks like we have 777 permission on the directory where binary lives, so since its a cronjob we can replace it with reverse shell and get system.
Privilege Escalation (Administrator)
So for whatever reason the msfvenom payload was not triggering, so I just decided to use Golang reverse shell.
Refer to [[Golang Reverse Shell]]
Root.txt
Last updated