HTB - Office | HTB Writeups

Last updated 5 months ago

Machine Info

Office is a hard-difficulty Windows machine featuring various vulnerabilities including Joomla web application abuse, PCAP analysis to identify Kerberos credentials, abusing LibreOffice vulnerability, abusing MSKRP to dump DPAPI credentials and abusing Group Policies due to excessive Active Directory privileges.

Enumeration

Scope

IP Address: 10.10.11.3

Nmap Scan

HTTPS Enumeration

when visiting https://10.10.11.3/, it gives me Forbidden massages

SMB Enumeration

No thing from smb

KERBEROS Enumeration

Found some users from kerbrute with jsmith.txt wordlist

Additional users found when using xato-10-million wordlist

I added all users found in a wordlist and then tried ASREPROASTING attack but it failed

HTTP Enumeration

http://10.10.11.3/

The site is joomla CMS

I visited http://10.10.11.3/readme.txt to get the version and search for CVE for it

I found this version is affected by unauthenticated information disclosure vulnerability

I started Metasploit, searched for exploit with CVE number and found one

We get database credentials:

Since I get username of joomla but still don't know the password, I will reuse the password of the database I found against the web login form and the users we found before

Let's begin to enumerate the domain with these credentials and I will do the following
- Run Bloodhound Ingestors
- Enumerate the Shares
- Searching for kerberoastable accounts

Run bloodhound.py to collect info and feed it into bloodhound GUI

Start crackmapexec to view the shares and permissions on them

I run spider_plus module against the shares to explore their content fast

I found .pcap file located at SOC Analysis share, So I will download and examine it locally

Shell as web_account

Start Wireshark to examine the file

After examining wireshark, Only two packets took my attention:

The second packet has the cipher which is encrypted by the NTLM hash of the user requested kerberos and username: tstark, too.

Following up this post

I can construct the kerberos hash to be able to crack it with hashcat

I tried this password on joomla admin panel as administrator cause the CVE we found showed that the administrator account has Tony Stark name.

From HackTricks

After doing the steps above, I added a webshell and got RCE on the system

I will upgrade the webshell to p0wny.php to become more flexible

I didn't find useful things in the context of web_account as his home directory is empty, So I uploaded RunasCs.exe to get a shell with stark

Shell as tstark

User Flag: fc7d5bd1f9cf6a3c6cxxxxxxxxxxxxxxx

Shell as ppotts

looking for listening ports, there is non-standard port listening

Looking for the process that run this port revealed that its web server running

I uploaded Chisel to the machine and map this port to my kali machine.

On kali run

On windows box run

http://localhost:8083/resume.php

The web app doesn't any file extension except these four Doc, Docx, Docm, Odt.

after I uploaded a file.odt to the webapp, it appeared in applications folder under xampp\htdocs with different name

Note: No file with .odt was there before I upload my file!!!

checking its permissions, the user ppotts has full access on it.

The community said that there is a CVE affected Libreoffice to create .odt file and get RCE from it

Upload the exploit via webapp

Get a shell as ppotts

There is a job_offering.ps1 on music directory that is responsible to trigger the exploit

Shell as hhogan

There are stored credentials for hhogan in user ppotts session

When I tried to execute commands as that user, It asked for a password

Looking at bloodhound, User hhogan is a member of GPO MANAGERS which has the ability to add group policy object that can be abused to do malicious actions.

As we don't know the password of hhogan, We can extract it by decrypting DPAPI. We need the masterkey and credentials files which are located by default in <user>\AppData\Roaming\Microsoft\Credentials & <user>\AppData\Roaming\Microsoft\Protect\<user-sid>\GUID

Credentials files

Master keys

I uploaded mimkatz.exe and began to extract them.

We must provide a password for the command below but the is a post from SpectorOps that says " it can be done without a password, just provide /rpc options to mimikatz"

https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107

Try all the three credential files until you get the password

Checking the validity of the credentials and the ability to remote access the machine

Access the machine as hhogan