Week 8. Hospital
TL;DR
This is a Windows Server 2019 domain controller running 2 web servers, one on port 443 (XAMPP webmail) and another on port 8080 (Apache). It is supposedly used by doctors in a hospital and a feature is enabled to upload medical records. This can be abused to upload a p0wny PHP shell and get access to a Linux container running Ubuntu 22.04. Subsequently, this is rooted using a kernel exploit. Once we have rooted the container, we get credentials for an email account from which we can launch a phishing attack to get access to the Windows machine. Write permissions on the 443 service web root folder allows us to upload a PHP reverse shell and get a system shell, since this web service is being run under high privilege.
KEYWORDS
Insecure file upload, p0wny PHP shell, GameOver(lay), phishing, Ghostscript.
REFERENCE
https://github.com/flozz/p0wny-shell
https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629
https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection
ENUMERATION
Port scan.
> nmap $target -p- -T4 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-18 15:35 EST
Nmap scan report for 10.129.70.232
Host is up, received user-set (0.041s latency).
Not shown: 65506 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
53/tcp open domain syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
389/tcp open ldap syn-ack
443/tcp open https syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
593/tcp open http-rpc-epmap syn-ack
636/tcp open ldapssl syn-ack
1801/tcp open msmq syn-ack
2103/tcp open zephyr-clt syn-ack
2105/tcp open eklogin syn-ack
2107/tcp open msmq-mgmt syn-ack
2179/tcp open vmrdp syn-ack
3268/tcp open globalcatLDAP syn-ack
3269/tcp open globalcatLDAPssl syn-ack
3389/tcp open ms-wbt-server syn-ack
5985/tcp open wsman syn-ack
6404/tcp open boe-filesvr syn-ack
6406/tcp open boe-processsvr syn-ack
6407/tcp open boe-resssvr1 syn-ack
6409/tcp open boe-resssvr3 syn-ack
6614/tcp open unknown syn-ack
6635/tcp open mpls-udp syn-ack
7326/tcp open icb syn-ack
8080/tcp open http-proxy syn-ack
9389/tcp open adws syn-ack
Nmap done: 1 IP address (1 host up) scanned in 95.25 secondsLooks like a domain controller, enumerate the open ports.
Next step is to fuzz the HTTP service on port 8080.
Take note of the folder called uploads
USER
Browse the site http://hospital.htb site, register a new account and sign in. An upload portal appears in Firefox.
Several extensions are filtered. After some trial and error, we find out the extension .phar is not filtered and can be uploaded; however, standard .php shell (such as pentest-monkey-php) are not stable, the only PHP shell which is working is a p0wny shell (https://github.com/flozz/p0wny-shell).
To upload the shell, select an image file and intercept the message with Burpsuite, then edit the request to add the p0wny shell code instead of the image binary code. The filter in place only checks the extension, and there is no magic bytes check, so there is no need to leave any JPG header and all the image code can be replaced by the PHP code. Finally, change the extension to .phar
The the shell is uploaded in the /uploads folder.
It can be accessed in Firefox in the URL http://hospital.htb:8080/uploads/shell.phar. A p0wny PHP shell spawns, we can use is to get a reverse shell on the host.
From the shell (probably a container), enumerate the system info.
Using the shell we find out nc is installed, so we can use it to get a reverse shell on the Linux container.
Once the reverse shell is received, the container can be rooted with a GameOver(lay) kernel exploit (https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629).
Since we are now root we can dump the hashes from the /etc/shadow file, unshadow them and crack with john, this way we get credentials for user drwillams in the container.
With this password we log into the web mail server on https://hospital.htb as drwilliams@hospital.htb and read the doctor's email. Turns out a colleague is waiting for an email containing a Ghostscript .eps file.
Knowing this, we prepare a phishing attack for which we need to look for Ghostscript vulnerabilities. Investigation leads to this exploit https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection, which allows injection of commands in .eps files.
Next step is then to generate a msfvenom payload for windows.
Now, to succeed in the phishing attack, what seems to work is to divide the process in 2 steps.
First, inject a payload in a project.eps file which will download the shell.exe when executed.
File malicious.eps is generated. Rename it to project.epsand start a Python HTTP server. Then reply the email attaching the project.eps file.
Shortly after, a request is received on the Python server to download the shell.exe file.
Next step is to execute the shell in the server. For this we will repeat the procedure but the command to be injected in the .eps file will just execute the shell previously downloaded by the host.
As before, rename the output file to project.eps, then start a listener on port 1919 and reply the email again. Shortly after, a reverse shell is received for user drbrown
In the documents folder of user drbrown we find a file called ghostscript.bat that contains the user's password.
We use this credential to login in the remote desktop service.
And finally we are able to get the user flag.
SYSTEM
Enumerate the system.
The web server service running on port 443 (webmail) is running as nt authority\system and also we have write permissions on the web root folder located in c:\xampp\htdocs
Since we have an RDP session, we can just copy another p0wny PHP shell in this location and open it with Firefox. Then, send a reverse shell in Windows with powercat
And a reverse shell running under nt authority\systemis received our listener.
You are root.
Last updated