LinkedInHTB ProfileAbout

HTB - Ghost

Enumeration

Scope

IP Address: 10.10.11.24

Nmap Scan

DNS Enumeration

Zone transfer failed

RPC Enumeration

SMB Enumeration

KERBEROS Enumeration

LDAP Enumeration

HTTP Enumeration

subdomain enumeration

http://10.10.11.24/

https://10.10.11.24/

http://10.10.11.24:8008/ running Ghost CMS with version 5.78

https://10.10.11.24:8443/login

When I tried to fuzzing directories with feroxbuster, It requests https://10.10.11.24:8443/api/login automatically

This URL & The Login Using AD Federation lead to this page:

https://federation.ghost.htb/adfs/ls/?SAMLRequest=<blob>

Don't forget to add federation to hosts files.

I don't have valid credentials for ADFS, So it's a dead end for now.

http://intranet.ghost.htb:8008/login

Looking at the authentication request, I found that the app use LDAP authentication, So I tried common bypass. username:*, password:*

It responded with invalid credentials message when providing any ones.

Authentication is bypassed with *:*

This is the page after logging-in.

There is important note here which is that I can only login to gitea with gitea_temp_principal account.

There is also users page with a list of usernames and their passwords

Make a wordlist of these users and try to find any valid domain account with them and found that they all are valid.

Under Forum, there are couples of conversations.

The most important conversation is this:

It seems like that user justin.bradley wants to execute a script but couldn't connect to bitbucket.ghost.htb because No DNS Entry is configured.

I went then to try logging in as gitea_temp_principal

I did know that there is a wildcard vulnerability on webapp but couldn't go any further, so with the help of community, I got a script to bruteforce the password by guessing each character one by one.

I used this password along with user gitea_temp_principal to login in gitea

http://gitea.ghost.htb:8008/

After logged-in, I found these two repos.

The first repo. has exciting information

DEV_INTRANET_KEY and it is stored as an environment variable.

posts-public.js file, which allows us to extract additional information about the posts.

API key: a5af628828958c976a3b6cc81a

Reading posts-public.js showed me that require() function - which used in js to include files - takes a fs parameter and is passed to filecontent variable without any validation.

I didn't know this is the URL to request, So I searched in Ghost CMS docs and found something.

LogoOverview - Ghost Developer DocsGhost Developer Docs

Contract the URL and try to include /etc/hosts and successfully done: )

I included /proc/self/environ file as the repo. said to get DEV_INTRANET_KEY

The second repo. has also interesting information.

dev API: http://intranet.ghost.htb/api-dev

under intranet/backend/src/api/dev/scan.rs there is an interesting code.

It sends post request to /scan and executes bash command with argument -c for provided URLs.

So, I can exploit it by adding; and achieve command injection

Requirements:

  1. HTTP Method: POST

  2. Content-Type: application/json

  3. URL parameter in json format

  4. X-DEV-INTRANET-KEY header

Shell as Root

Get reverse shell.

I landed inside a docker container and found this file in root directory /

It's something like a configuration to connect to dev-workstation as florence.ramierz with SSH

I tried to ssh with the above command without password and it worked.

I didn't find so much things as florence.ramirez user but I thought as I'm in Linux domain-joined host, maybe there is keytab for ccache files somewhere.

Shell as florence.ramirez

Typing klist showed the path of ccache file.

Get the content of the ccache file and write them to my kali machine.

Export the ticket to KRB5CCNAME variable and try to authenticate to the ghost machine.

Now, I have valid domain account.

I can't log-in to the machine but will continue to enumerate the system remotely.

Looking at bloodhound, I found the following:

There are two domains not one: CORP.GHOST.HTB & GHOST.HTB and they trust each other as corp is child domain and ghost.htb is the parent.

Shell as justin.bradley

I have credentials now, So I can perform this attack to add dns record to make bitbucket.ghost.htb point to my IP address.

Attack details:

LogoADIDNS poisoning | The Hacker Recipeswww.thehacker.recipes

Adding malicious DNS record.

Running responder on another tab, I got a hash for user justin.bradley

I checked the ability to access the machine with that user and I can :).

Access the machine and get user flag.

User Flag: aee843877a5604ebfc309xxxxxxxxxxxxxx

Shell as ADFS_CMSA$

Looking at bloodhound.py, I can ReadGMSAPassword of ADFS_GMSA$ user

So, I can extract GMSA secrets and the easiest way to do this is my NetExec

ADFS_GMSA$ account CanPSRemote to the machine, too.

ADFS account can extract ADFS secrets. Check the following post for details.

LogoActive Directory - Federation Services - Internal All The Thingsswisskyrepo.github.io

With the above juicy info. we can contract Golden SAML attack against core.ghost.htb portal.

  • For the attack to work we need the following:

    • The token signing certificate and its private key

    • The Distributed Key Manager (DKM) key from Active Directory

    • The list of services for which the AD FS server is configured to be an identity provider

Shell as mssql-service

To contract this attack, I need this tool:

LogoGitHub - szymex73/ADFSpoofGitHub

  1. Save the private key to file with appropriate format

  1. Save the Encrypted signing token with hex format

Repeating this request in the browser and getting this page.

Intercept the request with burp and begin enumeration. I got there is a database link and the server's name is primary

I could impersonate user sa at PRIMARY server, So I can now enable xp_cmdshell and get RCE

you must execute EXECUTE AS LOGIN = 'sa' in each time you run commands

Get a Shell

I run PowerJoker.py to generate a reverse shell and host it as shell.ps1 on web server.

Executing the following command.

Receive a connection back.

I can confirm that I have SeImpersonatePrivilege that can be abused to elevate to SYSTEM

From the output below, I landed in corp.ghost.htb domain and not in ghost.htb

Shell as SYSTEM

To escalate to SYSETM account, I used EfsPotato.exe. I also tried different options such as DeadPotato.exe but didn't work because AV.

LogoGitHub - zcgonvh/EfsPotato: Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability).GitHub

I downloaded EfsPotato.cs from my kali to C:\programdata folder and compiled it with the following command as the repo. said.

Get a shell as SYSTEM

After getting escalating to SYSTEM I can stop the antivirus.

Parent Domain Compromise

I'm in corp.ghost.htb, So I can extract trust key and perform SID History Injection attack and to perform it, I need the following.

  1. Trust key in the direction of access: from corp.ghost.htb to ghost.htb

  2. SID of the domain corp.ghost.htb

  3. SID of Enterprise Admins Group

Get the trust key

Get SID of Enterprise Admins Group

Forgue golden ticket.

Request Service ticket to access the file system

Access the File System of the domain Ghost.htb.

It should work but there is timing issue, So you must try until you get Access granted

Get Administrator flag.

Alternative way to perform DCsync attack using the cifs ticket and get administrator hash

Shell as Ghost Administrator

I put a reverse shell in C:\programdata\rce.ps1 and trigger it with PsExec.exe

Get Access to the DC

PreviousHTB - SizzleNextHTB - Rebound

Last updated