search
GitHub
Page cover

windowsWeek 12. Blazorized

hashtag
TL;DR

This is a Windows Server 2019 machine hosting a web site made with Blazor, an ASP.NET framework for building WebAssembly-based sites. Enumerating the application we are able to retrieve vulnerable binary files and, after reversing them, find out how to create super admin access JWT tokens. Once inside the admin dashboard we use MSSQL injection to gain our first low-priv shell. Regarding escalation, we discover several permissive ACE's with Bloodhond and abuse them with PowerView to move laterally between domain users. Finally we land in a user account holding DCSync permissions, and we use it to root the domain.

hashtag
KEYWORDS

Blazor, .NET, reversing, dnSpy, Unix time, JWT forging, MSSQL injection, Active Directory, Bloodhound enumeration, PowerView, WriteSPN, targeted kerberoasting, ACL enumeration, script path abuse, DCSync attack, Invoke-Mimikatz.

hashtag
REFERENCES

https://support.bloodhoundenterprise.io/hc/en-us/articles/17222775975195-WriteSPN https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse#genericwrite-on-userarrow-up-right

hashtag
ENUMERATION

Port scan.

> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-10-10 14:50 EDT
Nmap scan report for 10.10.11.22
Host is up, received user-set (0.060s latency).
Not shown: 43083 filtered tcp ports (no-response), 22440 closed tcp ports (conn-refused)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON
53/tcp    open  domain        syn-ack
80/tcp    open  http          syn-ack
135/tcp   open  msrpc         syn-ack
139/tcp   open  netbios-ssn   syn-ack
445/tcp   open  microsoft-ds  syn-ack
464/tcp   open  kpasswd5      syn-ack
3268/tcp  open  globalcatLDAP syn-ack
5985/tcp  open  wsman         syn-ack
49664/tcp open  unknown       syn-ack
49673/tcp open  unknown       syn-ack
49692/tcp open  unknown       syn-ack
49776/tcp open  unknown       syn-ack

Nmap done: 1 IP address (1 host up) scanned in 54.88 seconds

Enumerate the open ports.

Add to hosts file and enumerate the site with Firefox.

Fuzz for subdomains.

Add the subdomain to hosts file and enumerate with Firefox.

There is also a "Check for updates" section, if we click and inspect the traffic with Burpsuite, we capture a JWT token.

Decode the token to get an idea how they are formed. We discover they are signed using HS512 symmetric algorithm and also disclose super admin username.

hashtag
USER

Let's continue inspecting the traffic with Burpsuite. There is a request for a blazor.boot.json that contains information about the application.

It can also be downloaded with Firefox, right click on the tab, click on "Inspect code" and add the path to the JSON file.

In the JSON there is a reference to a DLL called blazorized.helpers.dll. Download it (just enter URL http://blazorized.htb/_framework/blazorized.helpers.dllarrow-up-right) and decompile with dnspy, here we see several things.

First, JWT tokens are signed with a symmetric key (HS512 algorithm), as we had seen before.

A bit further in the code we see the HS512 key hardcoded in the source code, along with other claims and a new subdomain http://api.blazorized.htbarrow-up-right

And we find out how the tokens are generated.

The application is using Unix time to calculate token expiration times.

All in all, we have all we need to forge our own super admin ticket. To calculate Unix time I made a short Python script.

And used it to calculate expiration time (600 seconds from current time).

Entered this data in https://jwt.ioarrow-up-right, along with the wanted role and super admin email, so we calculate our forged token.

To use this token we load it in a Firefox tab using the console (F12). First we declare the token variable.

And assign it to a cookie called jwt

Reload the site http://admin.blazorized.htbarrow-up-right site and you are logged in as super admin.

They say the application talks to the database directly, so we can try an MSSQL injection. The point of entry is the "Check duplicate category names".

For the payload, I used a powershell -e base64-encoded payload.

This provides a reverse shell for user nu_1055

That can be used to retrieve the user flag.

hashtag
SYSTEM

Start from the low-priv shell and take the opportunity to enumerate the user and the system.

Transfer a sharphound.exe ingestor to the host and enumerate the domain with Bloodhound. Use the previously list of usernames we have just enumerated and the Bloodhound path finding tool.

There is an interesting edge from nu_1055 to rsa_4810. There is info about WriteSPN edges here:https://support.bloodhoundenterprise.io/hc/en-us/articles/17222775975195-WriteSPNarrow-up-right

Basically, we have permission to add an SPN to rsa_4810 account, thus making it vulnerable to targeted kerberoasting (https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoastingarrow-up-right).

Let's modify account's SPN with powerview.ps1

Now request a Kerberos ticket for the SPN we have just created.

This ticket can be cracked (module 13100), and the password is valid to Evil-WinRM into the host as user rsa_4810

Now we can mark rsa_4810 as "Owned" in Bloodhound and continue enumerating. It seems both rsa_4810 and nu_1055 are members of the Remote Management Users group, along with another one called ssa_6010

If we continue enumerating this user we see he is one of the principals with DCSync rights, meaning he is candidate to our next lateral movement.

Enumerate the user's ACL from rsa_4810 shell using PowerView's Get-ObjectAcl cmdlet.

We see current user has write permissions over ssa_6010 script path, meaning we can add scripts that will be automatically executed when the user logs in.

Info about how to exploit this is provided here:https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse#genericwrite-on-userarrow-up-right

First add a reverse shell in the file shell.bat and save in the SYSVOL folder.

Now modify the script path for user ssa_6010

Shortly after the user logs in again, the script is executed and a shell is received on port 1919.

From here we can launch a DCSync attack.

We do not know clear text password or hash of user ssa_6010 so cannot do it remotely with Impacket. So we will use a Mimikatz copy stored locally. Download a copy of invoke-mimikatz.ps1 with certutil and dot source the script.

Issue the DCSync attack, the administrator hash is dumped.

The only thing that's left is to open an administrator shell with Impacket.

You are root.

PreviousWeek 11. PermXNextSeason 6

Last updated