search
GitHub
Page cover

windowsWeek 8. Jab

hashtag
TL;DR

This is a Windows Server 2019 machine running as DC. It is hosting an Ignite Openfire server 4.7.5, a Jabber/XMPP application for instant messaging. You can dump a list of all the server IM users using an XMPP client such ad Pidgin, then launch an ASREPRoast attack on this user list to find out users for whom Kerberos pre-auth is disabled. Using these credentials, log in again into the IM server and get access to a restricted chat room where more secrets are disclosed. An user shell is gained by means of remote DCOM execution with Impacket. Regarding privilege escalation, it is achieved by uploading a malicious plugin in the Openfire administration console (CVE-2023-32315).

hashtag
KEYWORDS

Ignite Openfire Server 4.7.5, Jabber/XMPP, ASREPRoast, DCOM execution, MMC20.Application, CVE-2023-32315.

hashtag
REFERENCES

https://www.igniterealtime.org/projects/openfirearrow-up-right

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groupsarrow-up-right

https://github.com/miko550/CVE-2023-32315arrow-up-right

https://www.cvedetails.com/cve/CVE-2023-32315/arrow-up-right

hashtag
ENUMERATION

Port scan.

> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-25 05:50 EST
Nmap scan report for 10.10.11.4
Host is up, received user-set (0.12s latency).
Not shown: 64752 closed tcp ports (conn-refused), 745 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack
88/tcp    open  kerberos-sec     syn-ack
135/tcp   open  msrpc            syn-ack
139/tcp   open  netbios-ssn      syn-ack
389/tcp   open  ldap             syn-ack
445/tcp   open  microsoft-ds     syn-ack
464/tcp   open  kpasswd5         syn-ack
593/tcp   open  http-rpc-epmap   syn-ack
636/tcp   open  ldapssl          syn-ack
3268/tcp  open  globalcatLDAP    syn-ack
3269/tcp  open  globalcatLDAPssl syn-ack
5222/tcp  open  xmpp-client      syn-ack
5223/tcp  open  hpvirtgrp        syn-ack
5262/tcp  open  unknown          syn-ack
5263/tcp  open  unknown          syn-ack
5269/tcp  open  xmpp-server      syn-ack
5270/tcp  open  xmp              syn-ack
5275/tcp  open  unknown          syn-ack
5276/tcp  open  unknown          syn-ack
5985/tcp  open  wsman            syn-ack
7070/tcp  open  realserver       syn-ack
7443/tcp  open  oracleas-https   syn-ack
7777/tcp  open  cbt              syn-ack
9389/tcp  open  adws             syn-ack
47001/tcp open  winrm            syn-ack
49664/tcp open  unknown          syn-ack
49665/tcp open  unknown          syn-ack
49666/tcp open  unknown          syn-ack
49667/tcp open  unknown          syn-ack
49669/tcp open  unknown          syn-ack
49670/tcp open  unknown          syn-ack
49671/tcp open  unknown          syn-ack
49672/tcp open  unknown          syn-ack
49677/tcp open  unknown          syn-ack
49763/tcp open  unknown          syn-ack
64570/tcp open  unknown          syn-ack
65477/tcp open  unknown          syn-ack
65484/tcp open  unknown          syn-ack
 
Nmap done: 1 IP address (1 host up) scanned in 18.19 seconds

Looks like a domain controller, enumerate the open ports.

DNS enumeration.

Looking at the open port list, we conclude the server is running an Ignite Realtime Openfire Jabber service. This is an RTC server (i.e. a chat server) under the open protocol for instant messaging XMPP (more info here: https://www.igniterealtime.org/projects/openfirearrow-up-right).

hashtag
USER

Use a Jabber/XMPP client, such as Pidgin, to connect to the chat server. Add a new account for the XMPP protocol in the jab.htb server. Don't forget to click on "Create a new account on this server".

A registration pop-up appears allowing us to create a new account in the server, enter whatever user data and click "OK".

Registration succeeds.

Navigate to Tools -> Plugins and enable the XMPP console plugin.

Next, navigate to Accounts -> Account name -> Search for users -> search.jab.htb -> Search directory and launch a search for all registered users. A large list is presented, to dump it in a text file you just need to copy and paste it from the XMPP console and a bit of sed-fu/bash-fu.

Once you have the users in a text file, launch an ASREPRoast attack with Impacket to look for users with pre-auth disabled.

After some time, you find a user who does not require pre-auth and his hash, which can be cracked with module 18200.

Go back to the chat and connect with the newly disclosed credentials. If you click on "Find room" you will notice he has access to a room called "pentest2033". Access the room and find additional juicy info.

Looks like a discussion held between several pentesters who have recently found and cracked credentials for a service account called svc_openfire

You can try these credentials to get RCE from Linux with Impacket, but neither psexec.py, smbexec.py nor wmiexec.py will work since the user is not local administrator; however, if you try dcomexec.py it will work since apparently the user is member of the "Distributed COM Users". The members of this group "can launch, activate, and use Distributed COM objects on the computer" (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groupsarrow-up-right).

Let's abuse this configuration with Impacket's dcomexec.py

A reverse shell for user svc_openfire is received on port 1919.

Which can be used to retrieve the user flag.

hashtag
SYSTEM

Start from the svc_openfire shell and enumerate the current user.

We see the user is in fact member of the "Distributed DCOM users" group. Next enumerate the local connections.

There is something listening on port 9090. Forward this port to your machine and browse port 9090 with Firefox, turns out this is the Openfire administration console. You can login using svc_openfire credentials.

Notice the running version is 4.7.5, and we are allowed to upload plugins.

All that's left is find a way of uploading a malicious plugin. Looking for vulnerabilities I came across this PoC https://github.com/miko550/CVE-2023-32315arrow-up-right, which is linked to this CVE https://www.cvedetails.com/cve/CVE-2023-32315/arrow-up-right

Just follow the PoC instructions, download the .jar plugin and upload into the "Plugins" section. Take note of the password 123.

Now navigate to Server -> Server settings -> Management tool, and enter the pass 123. In the dropdown menu select "Program home page" and take the opportunity to enumerate the system.

Move to the "System command" in the dropdown menu, here you can issue commands such as a powershell -e reverse shell or whatever shell you like. After issuing your favorite reverse shell payload, a system prompt is received on the listener.

You are root.

PreviousWeek 7. OfficeNextWeek 9. Perfection

Last updated