GitHub
Page cover

Week 3. Analysis

TL;DR

This is a Windows Server 2019 machine that hosts a web application used by a group of SOC analysts for network and incident monitoring purposes. Access to the web application is gained using ASREPRoast bruteforce and LDAP blind injection attacks. Once inside the analysts web dashboard, the report upload feature is abused to transfer a PHP reverse shell in the server, since no upload filters are in place. For the system escalation part, a DLL hijacking vulnerability affecting the Snort IT monitoring tool is exploited.

KEYWORDS

ASREPRoast, Kerbrute, blind LDAP injection, Python scripting, Snort, CVE-2016-1417, PHP shell file upload, DLL hijacking.

REFERENCES

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/LDAP%20Injection/README.md

https://github.com/SamJoan/ldap-brute/blob/master/wordlists/attribute_names

https://book.hacktricks.xyz/pentesting-web/ldap-injection#blind-ldap-injection

https://www.cvedetails.com/cve/CVE-2016-1417

https://packetstormsecurity.com/files/138915/Snort-2.9.7.0-WIN32-DLL-Hijacking.html

ENUMERATION

Port scan.

> nmap $target -p- -T4 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-20 17:24 EST
Host is up, received user-set (0.055s latency).
Not shown: 65083 closed tcp ports (conn-refused), 423 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack
80/tcp    open  http             syn-ack
88/tcp    open  kerberos-sec     syn-ack
135/tcp   open  msrpc            syn-ack
139/tcp   open  netbios-ssn      syn-ack
389/tcp   open  ldap             syn-ack
445/tcp   open  microsoft-ds     syn-ack
464/tcp   open  kpasswd5         syn-ack
593/tcp   open  http-rpc-epmap   syn-ack
636/tcp   open  ldapssl          syn-ack
3268/tcp  open  globalcatLDAP    syn-ack
3269/tcp  open  globalcatLDAPssl syn-ack
3306/tcp  open  mysql            syn-ack
5985/tcp  open  wsman            syn-ack
9389/tcp  open  adws             syn-ack
33060/tcp open  mysqlx           syn-ack
47001/tcp open  winrm            syn-ack
49664/tcp open  unknown          syn-ack
49665/tcp open  unknown          syn-ack
49666/tcp open  unknown          syn-ack
49667/tcp open  unknown          syn-ack
49669/tcp open  unknown          syn-ack
49670/tcp open  unknown          syn-ack
49671/tcp open  unknown          syn-ack
49674/tcp open  unknown          syn-ack
49675/tcp open  unknown          syn-ack
49692/tcp open  unknown          syn-ack
49705/tcp open  unknown          syn-ack
52650/tcp open  unknown          syn-ack
 
Nmap done: 1 IP address (1 host up) scanned in 615.43 seconds

Looks like a Windows domain controller. Enumerate the open ports.

DNS enumeration.

LDAP enumeration.

Continue fuzzing for subdomains.

A subdomain is found. Continue fuzzing it at: http://internal.analysis.htb

We have found 2 hidden paths at http://internal.analysis.htb/employees and http://internal.analysis.htb/users

We will fuzz both of them. Start fuzzing http://internal.analysis.htb/employees

Looks like we have found a login portal. Check it with Firefox.

Take note of this finding and fuzz the other site at http://internal.analysis.htb/users

If we browse this site with Firefox we receive an error: "Missing parameter".

Let's find out which is that missing parameter the application is expecting. Capture the request with Burpsuite, right-click and save to file request.txt, then edit the text file marking the fields to fuzz with ffuf

Launch ffuf with the text file as argument to find the parameter.

So it seems the application is expecting parameter called name. Check it with Firefox.

It seems the application is taking user input in the parameter name and using it to launch a query against a database to fetch user data. Then the retrieved data is presented in the web page.

At this point we can consider enumeration finished as we have found everything we need to begin exploitation. Wrapping up, this is what we have found:

USER

The employees login portal could be an entry point, but we need at least a list of valid usernames. Two options that come to mind to bruteforce usernames are an ASREPRoast attack or an RID bruteforce. Since we do not have SMB credentials, we will opt for ASREPRoast.

Two tools we can use to bruteforce usernames are GetNPUsers.py or Kerbrute. In summary, both of send a TGT request with no pre-authentication and check the KDC reply. If the user exists, the KDC will prompt pre-authentication; if not, it will reply with an user not found message. Therefore, we can find out which usernames exist and which ones not.

With GetNPUsers.py, launch an ASREPRoast attack and grep the results.

It is able to dump the usernames but takes a lot of time. There is a faster tool for this purpose called Kerbrute which essentially does the same: initiate a no-preauth TGT request and checks what the KDC replies.

In any case, both methods return the same list of usernames. Testing them in the web site we discover the only username which is returning data in the name parameter is technician

Now let's analyze what could be happening in the backend. It seems it is taking user input in the parameter name and using it to query a database which must be either MySQL or LDAP. Therefore, this parameter could be vulnerable to injections.

Let's verify first if the parameter is injectable in MySQL with sqlmap

The tool reports the parameter does not seem to be injectable in MySQL.

The other option to try is LDAP injection. For this we need to find out which LDAP attributes are present in the database for user technician. This can be done fuzzing LDAP with Burpsuite.

You can find LDAP fuzzing payloads here:

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/LDAP%20Injection/README.md

https://book.hacktricks.xyz/pentesting-web/ldap-injection

To fuzz the application, choose a payload and capture the request with Burpsuite, then send the request to intruder. In this case, the payload used is this one:

Once captured and sent to intruder, we add the section marks around the attribute to fuzz.

Then load a wordlist of possible LDAP attributes. In this case, the wordlist used is this: https://github.com/SamJoan/ldap-brute/blob/master/wordlists/attribute_names

Finally, according to our enumeration findings, we know the LDAP query is successful when the technician data is showed in the web site. Therefore, we will know if an LDAP attribute exists when the word "technician" is in the HTTP response. Configure the Burpsuite grep match to mark HTTP responses containing this word.

Run the attack and verify the responses containing the word "technician" in the results.

We notice all the attributes found are common in Active Directory except for the attribute description. This is optional and sometimes is used by system admins to add additional information such as passwords.

To dump the contents of the technician attribute description we will use a blind LDAP injection attack (https://book.hacktricks.xyz/pentesting-web/ldap-injection#blind-ldap-injection). Iterating over ASCII characters, and knowing the OK/NOK criteria (in this case, whether the response contains the text "technician" or not), we can dump the field contents. The method is similar to the process of a blind SQL injection.

The proposed blind LDAP injection script in Python to bruteforce the technician description field is the following:

There are 2 things to remark:

  • Since we are using wildcards in the pattern URL, we have to take into account the case an asterisk (*) is used in the middle of the password.

  • Because of the same reason, there will always be an asterisk at the end of the password found (a trailing character). Bear in mind trailing characters must be removed at the end of the password before finishing the process.

The description field looks like a password. Let's try credential technician@analysis.htb:97NTtl*4QP96Bv in the employees portal to login into the SOC dashboard.

Once inside the web application, we can upload a PHP reverse shell by abusing the SOC report feature, since there is no upload filter in place. The shell used is this one:

Which can be found in Kali location /usr/share/webshells/php/simple-backdoor.php. Just upload the file and inspect the traffic with Burpsuite. The HTTP response contains the upload path.

In fact, the upload path is /dashboard/uploads/simple.php

Use this PHP shell to send a reverse shell to our Kali machine with powercat. Serve powercat.ps1 with a Python HTTP server, then download and execute from memory using Powershell's downloadstrings. The payload to use is:

Remember to URL encode to avoid problematic characters in the URL.

A reverse shell is received on port 1919. Although it is not valid to dump user flag, we can enumerate the system from it.

After enumeration, we find out the password of user jdoe is configured in the winlogon registry key. We retrieve it by means of a registry query.

Additionally, the MySQL credentials are found in the file c:\inetpub\internal\employees\login.php

Use jdoe:7y4Z4^*y9Zzj credential to login with `, and retrieve the user flag.

SYSTEM

Start from the evil-winrm shell and run winpeas64.exe. The tool reports a possible DLL hijacking issue related to the Snort service.

Searching for Snort vulnerabilities we find a CVE (https://www.cvedetails.com/cve/CVE-2016-1417) and an associated PoC here: https://packetstormsecurity.com/files/138915/Snort-2.9.7.0-WIN32-DLL-Hijacking.html

According to them, to exploit the vulnerability we are supposed to place in a remote shared folder a malicious tcapi.dll along with a .pcap capture file in the same folder. Then run Snort and let the application load the malicious DLL. Unfortunately, this procedure was tested and did not work.

Enumerating further in the Snort folder, we find a configuration file at C:\Snort\bin\snort.conf containing information about pre-processor libraries.

In summary, it seems Snort load first dynamic DLL's located at the pre-processor path c:\Snort\lib\snort_dynamicpreprocessor

Create an msfvenom payload for a malicious DLL called sf_engine.dll and copy to c:\snort\lib\snort_dynamicpreprocessor

Now start a meterpreter handler and configure as needed.

Shortly after the DLL file is copied into the Snort pre-processor folder, a meterpreter session 1 is opened under the analysis\administrateur context.

You are root.

PreviousWeek 2. MonitoredNextWeek 4. POV

Last updated