LinkedInHTB ProfileAbout

HTB - Mist

Description

Mist is an Insane-difficulty machine that provides a comprehensive scenario for exploiting various misconfigurations and vulnerabilities in an Active Directory (AD) environment. The machine has multiple layers, starting with a public-facing CMS running on Apache with a path traversal vulnerability, allowing us to retrieve a backup file containing hashed credentials. Cracking this hash grants initial access as a low-privileged web user. Exploiting file-write permissions on a shared directory further elevates our access by allowing a reverse shell connection as another domain user. From there, enumeration reveals several AD misconfigurations, including LDAP signing disabled, WebDAV exploitation, and misconfigurations in ADCS templates, each step designed to escalate privileges through different AD entities. The final exploit involves creating shadow credentials to acquire the machine account’s NTLM hash, enabling a DCSync attack to obtain the Domain Administrator hash.

Enumeration

Nmap Scan

HTTP

http://10.10.11.17?file=mist

When clicking admin word, I was redirected to this login page

The version of pluck is 4.7.18. A quick search of the version in exploit-db the site leads to this CVE, but I don't have the admin password yet.

After deep searching for other pluck CVEs, I found unauthenticated LFI

Vulnerability Details

Following this post , I have to look under /data/settings/modules/albums folder, and I found admin_backup.php

When I included admin_backup.php, I got a hash, so I will try to crack it

On https://crackstation.net/, I was able to crack it

Initial Access

When I used the cracked password to log in as admin, I was redirected to the admin portal

Now with the admin password, I can get RCE via the CVE we found before

I read the exploit and decided to perform it manually rather than using the poc.

First, Go to http://10.10.11.17/admin.php?action=installmodule

Second, create a zip file containing php a shell. I will use P0wny Shell and upload it

Finally, access the webshell at http://10.10.11.17/data/modules/module/p0wny.php

I will upgrade my shell with PowerJoker to get more flexibility because the installed modules don't persist. Maybe there is a script in the background removing them.

Lateral Movement

Looking for internal ports, there are RPC, SMB, and WinRM. That confirms there is firewall rules that prevent most inbound connections to MS01

Looking at IP configuration, I found that MS01 has a different IP 192.168.100.101 with hostname of ms01.mist.htb

I also wanted to check AV status, So I executed this command Get-MpComputerStatus and found that it's already running on the box

I want to find possible escalation path on ms01, so I uploaded winpeas.ps1 and PowerUp.ps1 to the box but since AV is enabled, I had to bypass AMSI first.

I created a bypass.ps1 containing common AMSI bypass (patching amsiScanBuffer), Then load the PowerUp.ps1 script

Unfortunately, I didn't find any exploitation path with PowerUp tool but under C:\ There is an uncommon folder

They are .lnk files to execute common programs on the system.

What if I can overwrite one of them and add a path to execute a reverse shell when one uses it??. First, I need to check my permission over this folder

From the output above, The BUILTIN\Users has write access on the folder(RX,W).

On my Windows host, I create a new shortcut

On the target field, I put this payload, and inside rev.ps1 It is an encoded reverse shell

Also, I changed the icon to match Calculator icon from C:\Windows\System32\calc.exe to make things as real and tricky as possible

Now, I will upload it to the box

After a short time (1-2 mins), I got a shell as brandon.keywarp

The user is indeed a domain user and it has a profile folder beside other users, too

I can guess that Sharon.Mullard is a domain user, too.

At this point, with a domain user, I have to pivot to enumerate the domain controller with ligolo-ng

In a Windows box (MS01), Run:

Make sure you're in C:\xampp\htdocs because it's excluded from defender

After pivoting, I can run Nmap and see the results:

Looking for Remote management ports, I found WinRM is running on the two hosts

Script scan for the DC

I will add the two machines to my /etc/hosts file

My next move is to enumerate both the shared folders and the domain acls With Bloodhound, so I will upload SharpHound.exe to the host and begin the collection

I still couldn't access shared folders with no credentials

Privilege Escalation (MS01)

I didn't find anything that can be useful till now, So there is an attack I have to try (NTLM Relay over LDAP using WebDav) And this post is useful for performing the attacks: Post

  • I already know what to do, So I will proceed directly with these steps:

    1. check if webdav is running

    2. If webdav is not running, try to enable it

    3. Using any coercion method (printerbug, PetitPotam, coercer, etc) to force the machine to authenticate to my host

    4. Set up a relay agent on my host to relay the authentication coming from HTTP (WebDav) to LDAP and perform RBCD or Shadow Credential Attack

Performing RBCD depending on having account with SPN or ability to create a machine account, but Shadow Credentials depends on PKINIT authentication (usually when ADCS is installed)

When I enumerated the domain to see if I can add computer account or not, I found the value of ms-ds-machineaccountquota zero, So I can't do it.

When I enumerated the domain to see if I can add computer account or not, I found msds-keycredentiallink contains a value, So Shadow Credential attack is possible.

Now, Let's deal with WebDav, I downloaded SharpWebClientScanner.exe to query the its status but I didn't find it to be running on any host, So I have to enable it manually.

I will use this Tool to enable it from Windows

Verify with SharpWebScanner

Then, execute the tool windows

Now, I need to use the coerce method, but I need credentials for it. I only have a shell with a domain user brandon.keywarp But with no password or hash.

There is one way to get the hash of the user using ADCS templates to request a certificate for the user and get their NT hash from it.

First, Upload Certify to the machine and request a certificate for the current user

Copy the cert.pem (private key & Certificate) , then use this command

With Certipy, I can authenticate to the domain and get the hash

For WebDav to function, It needs the hostname to connect to, but my host isn't accessible from the internal network, so I will add a port forwarding rule so that any connection that comes to ms01 . 8888 is forwarded to me at 80

Since we found before that MS01$ has keyCredentialLink value, we need a tool to clear it and add a new one, and this is included in this version of ntlmrelayx.py After adding a new feature in this pull request.

Execute the attack

Get a sutiable cert to be used with certipy

Authenticate to the DC using the certificate and get NT hash of the computer account.

With the computer account hash, I can create a Silver ticket to access the file system as an administrator

Access the machine as an administrator

I will dump SAM to save my progress

Connect to the box with a local admin account:

User Flag: 0c63be3b856709838ec62a926dbad528

Privilege Escalation (DC01)

Inside Sharon.Mullard folder, there are several files

The file .kdbx is certainly keepass password manager, So it will be protected by a password.

Cats.png has nothing rather than cats images

image_200222024.png has something interesting:

A string that's been partially hidden and encoded using base64

I will attempt it against keepass hash to crack it but I think I will need to do a brute force attack using hashcat. First, get the hash of keepass the database

The input in the image was 15 chars and the string I have is 14 chars, So I can only append one ?a , which means all possible chars in hashcat

To open keepass file from Linux, I used keepassxc

Trying the password for all users I don't have yet, and got one user

Looking At bloodhound CE, User Op_sharon.mullard is a member of operatives group which can ReadGMSAPassword of Svc_CA$

SVC_CA$ can add KeyCredentialLink (Shadow Credential) to svc_cabackup

ESC13: If a principal (user or computer) has enrollment rights on a certificate template configured with an issuance policy that has an OID group link, then this principal can enroll a certificate that allows obtaining access to the environment as a member of the group specified in the OID group link.

Source post.

From bloodhounoI can see that being a member of Certificate Services group, I can abuse ESC13 and add myself or anyone I want to Certificate Managers group

Certificate Managers group is a member of CA Backup group

CA Backup A group's member can perform ESC13, too, and get a membership in Services acountsthe group that is a member of Backup Operators group.

To summarize the attack path:

  1. Perform ESC13 to inherit the privileges of Certificate Managers group

  2. Perform ESC13 inherit the privileges of Services acounts group

  3. Inherit Backup Operators privileges being in Services acounts group

Request a certificate for the vulnerable template managerauthentication

Authenticate as svc_cabackup to Inherit the new privileges

Request a certificate for the vulnerable template backupsvcauthentication

Authenticate as svc_cabackup to Inherit the new privileges

Abuse Backup Operator to backup Registry hives

Access the DC to download the files via winRM

Dump the hives' secrets and perform DCSync with dc01$ account hash

Access the machine as Administrator

Root Flag: f5dcf7a3f2377ef6759aa413c768303f

PreviousHTB - ReboundNextEasy

Last updated