GitHub
Page cover

Week 7. Office

TL;DR

This is a Windows Server 2022 machine running as DC. It is hosting a web site made with vulnerable Joomla 4.2.7 CMS (CVE-2023-23752). Exploiting this vulnerability we are able to dump a password from the MySQL database, and running a Kerbrute attack we can retrieve a list of domain usernames. Spraying these credentials we get access to an SMB share that stores a Wireshark capture file which contains a Kerberos AS-REQ frame. Inside the frame there is hash that can be cracked to find the Joomla administrator password. A low-priv shell is gained by uploading a PHP shell in Joomla templates. Finally, user flag is retrieved by moving laterally to user tstark. Regarding escalation, first we need to move laterally to user ppotts by uploading a malicious ODT that exploits a Libre Office vulnerability (CVE-2023-2255). Then move laterally to user hhogan by decrypting DPAPI vault credentials with Mimikatz. Finally, system privileges are gained abusing a permissive GPO.

KEYWORDS

Joomla CMS 4.2.7, CVE-2023-23752, Kerbrute, Wireshark, AS-REQ, Libre Office, CVE-2023-2255, , Active Directory, lateral movement, Mimikatz, DPAPI, GPO abuse.

REFERENCES

https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/joomla

https://www.cvedetails.com/cve/CVE-2023-23752

https://github.com/0xNahim/CVE-2023-23752

https://github.com/elweth-sec/CVE-2023-2255

https://github.com/gentilkiwi/mimikatz/wiki/howto-~-scheduled-tasks-credentials

https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials

https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

https://github.com/byronkg/SharpGPOAbuse

https://github.com/FSecureLABS/SharpGPOAbuse

ENUMERATION

Port scan.

Looks like a domain controller, enumerate the open ports.

DNS enumeration.

Add to /etc/hosts and enumerate the robots.txt file (http://office.htb/robots.txt).

Navigate to http://office.htb/administrator, a Joomla CMS login page comes into view.

Investigate ways to pentest Joomla here: https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/joomla

They explain how to enumerate the current Joomla version. By navigating to http://office.htb/administrator/manifests/files/joomla.xml you can verify the running version is 4.2.7.

At this point we have everything we need to start the exploitation phase. In summary, we have found an Active Directory domain controller running a website made with Joomla CMS 4.2.7.

USER

Searching for Joomla 4.2.7 vulnerabilities, we come across this one: https://www.cvedetails.com/cve/CVE-2023-23752. And this PoC allows to dump MySQL secrets from Joomla websites: https://github.com/0xNahim/CVE-2023-23752

Run the exploit against the host and retrieve MySQL root credentials.

We have a password, now we need a list of usernames to spray it. For this, launch an attack with kerbrute

After a while, a list of usernames is dumped by the tool.

Let's spray the password we previously found in SMB with the username list.

Log into the share as user dwolfe using credentials, there is a capture .pcap file, download it.

Open the capture with Wireshark and filter by Kerberos protocol, turns out an AS-REQ packet has been captured.

If you remember Kerberos theory, the user sends a timestamp encoded with the NTLM hash when a TGT is requested (this is an AS-REQ request) . In this case, Wireshark provides the encoded timestamp (padata-value) and the cipher used to encode it, this is the user's NTLM hash. Wireshark also indicates the timestamp has been encoded using AES-256.

The cipher (i.e. the user NTLM hash) can be cracked it with module 19900. For this, prepare the hash in a readable format according to https://hashcat.net/wiki/doku.php?id=example_hashes

After crafting and testing a hash for any username previously disclosed, we find out the only crackable hash belongs to user tstark

Credential is cracked with module 19900.

Which can be used to log into the Joomla (user administrator) login portal.

Once inside the dashboard, follow the same procedure as in the Devvortex machine (Week 9. Devvortex). Navigate to System -> Site templates, move to the "Cassiopeia" template and overwrite the error.php file with a PHP reverse shell.

In this case, we chose a "PHP Simon Sincek" reverse shell from http://www.revshells.com (PHP PentestMonkey did not work).

Save and close, then trigger the reverse shell by navigating to http://office.htb/templates/cassiopeia/error.php

A reverse shell is received on port 1919.

This shell cannot be used to get the user flag, but since we have tstark credentials, we can just move laterally to this user with runascs

A shell for user tstarkis received on port 9999.

Which can be used to retrieve the user flag.

SYSTEM

Start from the tstark shell, and take the opportunity to enumerate the system.

Find the file c:\xampp\htdocs\internal\resume.php and enumerate the source code. It seems it is an internal service allowing the employees to upload their resumes in DOC, DOCX, DOCM or ODT (which explains the box's name).

Looking for ways to to generate a malicious .odt files, we come across this PoC https://github.com/elweth-sec/CVE-2023-2255

Prepare a shell.exe payload with msfvenom, then transfer it to the folder c:\users\public\music in the victim.

Now use the PoC to create a malicious .odt

Start a listener and copy the file present.odt into c:\xampp\htdocs\internal\applications, which is the folder where the uploaded resumes land.

NOTE: for this I used the web_account shell, since the user tshark does not have write permissions in the applications folder. Alternatively, you can forward internal port to Kali and copy the file using the resume upload application.

Wait a while until someone opens the file. Shortly after a reverse shell is received on the listener for user ppotts

Enumerate stored credentials.

It seems credential for user hhogan is stored in the vault; however, you will not be able to use it with runas since it is protected by DPAPI.

Before trying to decrypt the DPAPI secret, it's good to read a couple of useful links:

https://github.com/gentilkiwi/mimikatz/wiki/howto-~-scheduled-tasks-credentials

https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials

Now that we understand what is happening, let's follow GentilKiwi's procedure. First, look for the Windows credential files in the system.

And the masterkey files.

Transfer a copy of Mimikatz to the host and enumerate the credentials files. We will focus on this file in particular.

We see this file uses the masterkey GUID {191d3f9d-7959-4b4d-a520-a444853c47eb}, so let's decrypt this masterkey with Mimikatz.

Now that we have the key, we can decrypt the credentials file and get hhogan password.

Use these credentials to log in with evil-winrm

Enumerate the domain.

Enumerate the user hhogan, pay attention to group memberships.

So the user is member of a group called GPO Managers, which suggests he may be able to write GPOs.

Enumerate all the domain GPOs.

Notice the Default Domain Controllers Policy GPO and take note of its Id: 6AC1786C-016F-11D2-945F-00C04fB984F9

Upload a PowerView copy (https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) and continue enumerating the GPO Managers group.

Take note of the ojectsid: S-1-5-21-1199398058-4196589450-691661856-1117 and move forward.

Next step is to enumerate all the permissions for all GPO in the current domain with PowerView.

The ouput is very large but, if you analyze it carefully, you'll see group GPO Managers (S-1-5-21-1199398058-4196589450-691661856-1117) than can write on the Default Domain Controllers Policy (6AC1786C-016F-11D2-945F-00C04fB984F9).

To exploit this misconfiguration we will use a tool called SharpGPOAbuse (https://github.com/byronkg/SharpGPOAbuse), so we can modify the GPO and execute any command as administrator. A list of the tool capabilities is available here: https://github.com/FSecureLABS/SharpGPOAbuse

In this case, we will abuse the GPO to send a base-64 encoded reverse shell under the administrator context.

The task is added as a new immediate tasks, to force execution just update the GPO policy.

A system reverse shell is received on the listener.

You are root.

PreviousWeek 6. CraftyNextWeek 8. Jab

Last updated