search

VulnNet: Active [THM]

TryHackMe - VulnNet: Activearrow-up-right - Write-Up

hashtag
Port scan

Let's start off by performing a port scan against the target system.

┌──(n㉿kali)-[~]
└─$ nmap -sT -sC -sV -vvv -p- -T4 -Pn -oA nmapscan 10.10.188.12
# Nmap 7.91 scan initiated Sun Aug  1 15:06:30 2021 as: nmap -sT -sC -sV -vvv -p- -T4 -Pn -oA nmapscan 10.10.188.12
Nmap scan report for 10.10.188.12
Host is up, received user-set (0.055s latency).
Scanned at 2021-08-01 15:06:30 CEST for 187s
Not shown: 65523 filtered ports
Reason: 65523 no-responses
PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack
6379/tcp  open  redis         syn-ack Redis key-value store 2.8.2402
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
49665/tcp open  msrpc         syn-ack Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack Microsoft Windows RPC
49675/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49676/tcp open  msrpc         syn-ack Microsoft Windows RPC
49695/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 0s
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 9176/tcp): CLEAN (Timeout)
|   Check 2 (port 50061/tcp): CLEAN (Timeout)
|   Check 3 (port 54977/udp): CLEAN (Timeout)
|   Check 4 (port 50181/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2021-08-01T13:08:59
|_  start_date: N/A

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Aug  1 15:09:37 2021 -- 1 IP address (1 host up) scanned in 187.42 seconds

Interesting ports... 139, 445, 6379

hashtag
SMB enumeration

Maybe SMB will disclose any useful information. Simply connecting to the target machine using smbclient doesn't help much.

However, we are able to at least identify a hostname and domain name using crackmapexec.

hashtag
Redis enumeration

A quick google search revealed that Redis is an in-memory data structure store, used as a database, cache, and message broker.

Using redis-cli, we are able to query the system for information.

Scrolling through the output of different commands, we stumble across the "dir" path which contains a username.

hashtag
Obtaining the user flag

After hours of research, it turns out that Redis can execute sandboxed Lua scripts through the “EVAL” command. dofile() is a command that can be used to enumerate files and directories. dofile() is allowed by the sandbox in older Redis versions.

circle-exclamation

If the Lua script is syntactically invalid or tries to set global variables, some content of the target file will be leaked through the error messages.

Why not try reading the user.txt file?

Source: Red Team Diary, Entry #2: Stealthily Backdooring CMS Through Redis’ Memory Spacearrow-up-right

hashtag
Capturing NTLMv2 hash

Maybe there is a way to capture an NTLM hash? Let's give that a try by running Responder.

Using the "EVAL" command, we can instruct the target system to connect back to our target machine.

We captured a hash!

hashtag
Cracking NTLMv2 hash

Let's get cracking!

hashtag
More SMB enumeration

Using the username and password we found earlier, we can try enumerating SMB again.

Let's check out the Enterprise-Share share.

The PurgeIrrelevantData_1826.ps1 script seems to be a part of some scheduled task.

hashtag
Setting up a Netcat listener

I wonder if we can spawn a shell by overwriting the contents of this ps1 file.

hashtag
Command Injection - Powershell

Let's modify the contents of PurgeIrrelevantData_1826.ps1 so that it will spawn a shell for us.

Source: PayloadsAllTheThings Cheatsheet Reverse Shell Powershell arrow-up-right

We can overwrite the file with our edited version of the script on the target machine.

triangle-exclamation

I also uploaded the Netcat executable since I didn't receive any STDERR / STDOUT while enumerating the machine using Powershell.

hashtag
Receiving a shell

WE GOT A SHELL!

hashtag
A more stable shell

Necesarry? No. But definitely helpful when you accidentally exit out of your shell.

hashtag
PowerView - enumeration

After hours of enumeration, I found something interesting.

Two GPOs: security-pol-vn and Default Domain Controllers Policy.

hashtag
BloodHound - enumeration

Let's get graphical!

hashtag
Shortest Path to Domain Admin

Querying BloodHound, we find that our enterprise-security user has GenericWrite access on the security-pol-vn GPO which is being applied to essentially all objects within the vulnnet.local domain.

circle-info

Since we have GenericWrite privileges on the SECURITY-POL-VN GPO, SharpGPOAbuse arrow-up-rightor PowerView arrow-up-rightcan be used to abuse these privileges and create a malicious scheduled task.

Maybe we can exploit this misconfiguration.... Let's find out!

hashtag
Abusing GPO permissions

Let's see what we can do to escalate our privileges.

We may try adding the enterprise-security user to the local Administrators group leveraging a tool called SharpGPOAbusearrow-up-right.

Let's review our group memberships after we forced the policies to be updated on the target machine.

There we go! The enterprise-security account is now a local administrator.

hashtag
Obtaining the system flag

Now that we have more privileges, let's access the C$ share and grab the system.txt file.

Pwned!

PreviousIntroductionNextCyberCrafted [THM] (UNFINISHED)

Last updated