Last updated
Last updated
IP Address: 10.10.11.24
Zone transfer failed
subdomain enumeration
http://10.10.11.24/
https://10.10.11.24/
http://10.10.11.24:8008/ running Ghost CMS with version 5.78
https://10.10.11.24:8443/login
When I tried to fuzzing directories with feroxbuster, It requests https://10.10.11.24:8443/api/login automatically
This URL & The Login Using AD Federation lead to this page:
https://federation.ghost.htb/adfs/ls/?SAMLRequest=<blob>
Don't forget to add
federationtohostsfiles.
I don't have valid credentials for ADFS, So it's a dead end for now.
http://intranet.ghost.htb:8008/login
Looking at the authentication request, I found that the app use LDAP authentication, So I tried common bypass. username:*, password:*
It responded with invalid credentials message when providing any ones.
Authentication is bypassed with *:*
This is the page after logging-in.
There is important note here which is that I can only login to gitea with gitea_temp_principal account.
There is also users page with a list of usernames and their passwords
Make a wordlist of these users and try to find any valid domain account with them and found that they all are valid.
Under Forum, there are couples of conversations.
The most important conversation is this:
It seems like that user
justin.bradleywants to execute a script but couldn't connect tobitbucket.ghost.htbbecause No DNS Entry is configured.
I went then to try logging in as gitea_temp_principal
I did know that there is a wildcard vulnerability on webapp but couldn't go any further, so with the help of community, I got a script to bruteforce the password by guessing each character one by one.
I used this password along with user gitea_temp_principal to login in gitea
http://gitea.ghost.htb:8008/
After logged-in, I found these two repos.
The first repo. has exciting information
DEV_INTRANET_KEYand it is stored as an environment variable.
posts-public.jsfile, which allows us to extract additional information about the posts.API key:
a5af628828958c976a3b6cc81a
Reading posts-public.js showed me that require() function - which used in js to include files - takes a fs parameter and is passed to filecontent variable without any validation.
I didn't know this is the URL to request, So I searched in Ghost CMS docs and found something.
Contract the URL and try to include /etc/hosts and successfully done: )
I included /proc/self/environ file as the repo. said to get DEV_INTRANET_KEY
The second repo. has also interesting information.
dev API:
http://intranet.ghost.htb/api-dev
under intranet/backend/src/api/dev/scan.rs there is an interesting code.
It sends post request to /scan and executes bash command with argument -c for provided URLs.
So, I can exploit it by adding; and achieve command injection
Requirements:
HTTP Method: POST
Content-Type: application/json
URL parameter in json format
X-DEV-INTRANET-KEY header
Get reverse shell.
I landed inside a docker container and found this file in root directory /
It's something like a configuration to connect to dev-workstation as florence.ramierz with SSH
I tried to ssh with the above command without password and it worked.
I didn't find so much things as florence.ramirez user but I thought as I'm in Linux domain-joined host, maybe there is keytab for ccache files somewhere.
Typing klist showed the path of ccache file.
Get the content of the ccache file and write them to my kali machine.
Export the ticket to KRB5CCNAME variable and try to authenticate to the ghost machine.
Now, I have valid domain account.
I can't log-in to the machine but will continue to enumerate the system remotely.
Looking at bloodhound, I found the following:
There are two domains not one: CORP.GHOST.HTB & GHOST.HTB and they trust each other as corp is child domain and ghost.htb is the parent.
I have credentials now, So I can perform this attack to add dns record to make bitbucket.ghost.htb point to my IP address.
Attack details:
Adding malicious DNS record.
Running responder on another tab, I got a hash for user justin.bradley
I checked the ability to access the machine with that user and I can :).
Access the machine and get user flag.
User Flag: aee843877a5604ebfc309xxxxxxxxxxxxxx
Looking at bloodhound.py, I can ReadGMSAPassword of ADFS_GMSA$ user
So, I can extract GMSA secrets and the easiest way to do this is my NetExec
ADFS_GMSA$ account CanPSRemote to the machine, too.
ADFS account can extract ADFS secrets. Check the following post for details.
With the above juicy info. we can contract Golden SAML attack against core.ghost.htb portal.
For the attack to work we need the following:
The token signing certificate and its private key
The Distributed Key Manager (DKM) key from Active Directory
The list of services for which the AD FS server is configured to be an identity provider
To contract this attack, I need this tool:
Save the private key to file with appropriate format
Save the Encrypted signing token with hex format
Repeating this request in the browser and getting this page.
Intercept the request with burp and begin enumeration. I got there is a database link and the server's name is primary
I could impersonate user sa at PRIMARY server, So I can now enable xp_cmdshell and get RCE
you must execute
EXECUTE AS LOGIN = 'sa'in each time you run commands
I run PowerJoker.py to generate a reverse shell and host it as shell.ps1 on web server.
Executing the following command.
Receive a connection back.
I can confirm that I have SeImpersonatePrivilege that can be abused to elevate to SYSTEM
From the output below, I landed in corp.ghost.htb domain and not in ghost.htb
To escalate to SYSETM account, I used EfsPotato.exe. I also tried different options such as DeadPotato.exe but didn't work because AV.
I downloaded EfsPotato.cs from my kali to C:\programdata folder and compiled it with the following command as the repo. said.
Get a shell as SYSTEM
After getting escalating to SYSTEM I can stop the antivirus.
I'm in corp.ghost.htb, So I can extract trust key and perform SID History Injection attack and to perform it, I need the following.
Trust key in the direction of access: from corp.ghost.htb to ghost.htb
SID of the domain corp.ghost.htb
SID of Enterprise Admins Group
Get the trust key
Get SID of Enterprise Admins Group
Forgue golden ticket.
Request Service ticket to access the file system
Access the File System of the domain Ghost.htb.
It should work but there is timing issue, So you must try until you get
Access granted
Someone suggested this script to make the things work.
Access Granted :).
Get Administrator flag.
Alternative way to perform DCsync attack using the cifs ticket and get administrator hash
I put a reverse shell in C:\programdata\rce.ps1 and trigger it with PsExec.exe
Get Access to the DC
