Week 10. Axlle
TL;DR
This is a Windows 22 Server machine that hosts a web site under development. The developers have opened an email account where the users can send their suggestions in Excel format. We leverage this to send a malicious XLL phishing email, that enables us to get a first shell in the system. To get the user flag we move laterally to another user by means of another client side attack: placing a malicious URL shortcut in a folder used by the web developers team and waiting for someone to click on it. Regarding escalation, first we move laterally to another domain user abusing a misconfiguration in the Active Directory ForceChangePassword object permission. Final escalation step to administrator is made by abusing the Windows binary standalonerunner.exe
KEYWORDS
XLL Excel, swaks, phishing, URL shortcuts, Active Directory, Bloodhound enumeration, ForceChangePassword, standalonerunner.exe.
REFERENCES
https://threatresearch.ext.hp.com/how-attackers-use-xll-malware-to-infect-systems/
https://whichbuffer.medium.com/macro-4-0-is-dead-long-live-the-xll-ae3c3a0fa697
https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#xll-exec
https://support.bloodhoundenterprise.io/hc/en-us/articles/17223286750747-ForceChangePassword
https://github.com/nasbench/Misc-Research/blob/main/LOLBINs/StandaloneRunner.md
ENUMERATION
Port scan.
Enumerate the open ports.
Looks like a domain controller, add to hosts file and enumerate the web site with Firefox
They provide an email address to send email in Excel format, but they warn macros will be disabled, so we have to investigate ways to send payloads in Excel without using macros.
The answer is to use XLL payloads as explained in the following links.
https://threatresearch.ext.hp.com/how-attackers-use-xll-malware-to-infect-systems/
https://whichbuffer.medium.com/macro-4-0-is-dead-long-live-the-xll-ae3c3a0fa697
USER
Let's create an XLL payload as explained here:https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#xll-exec
In the command line we will include a base64 Powershell payload. The final C code is the following.
Compile as XLL file.
And send the resulting file to the email address accounts@axlle.htb attaching the XLL payload. For this we use the swaks tool included with Kali.
As reverse shell for user axlle\gideon.hamill is received on port 1919.
Use this shell to enumerate the file system contents. In the location C:\Program Files (x86)\hMailServer\Data\axlle.htb\dallon.matrix\2F, we find an email .eml file.
Let's browse its contents.
We have discovered the Web Dev group is expecting .url web shortcut files in the C:\inetpub\testing location.
Let's create an EXE payload with msfvenom and transfer it to C:\inetpub\testing
Now create a malicious .url shortcut pointing to this payload so we receive a reverse shell every time someone from the Web Dev team opens it. We transfer the shortcut to the same location.
Shortly after, a reverse shell for another Web Dev user axlle\dallon.matrix is received on port 9000.
You can use it to retrieve the user flag
SYSTEM
Start from the low-priv shell and take the opportunity to enumerate the system and the current user.
There is nothing we can use for the moment. Let's do a domain enumeration with Bloodhound.
First transfer the sharphound.exe collector and gather the data.
Transfer the resulting .zip file to Kali and ingest the data into the graph database. We see current user is member of web.devs group, which can in turn change password of user jacob.greeny
This ACL misconfiguration is explained here: https://support.bloodhoundenterprise.io/hc/en-us/articles/17223286750747-ForceChangePassword
To change the password use the procedure indicted here: https://blog.techinline.com/2018/12/20/how-to-change-windows-password-using-command-line-or-powershell/
Open a Powershell and change Jacob's password with this.
Then move laterally to user jacob.greeny with the recently changed password and evil-winrm
Now we can move to the C:\App Development\kbfiltr folder and inspect the README.md file.
The author says:
This standalonerunner.exe binary is a tool for testing and debugging drivers on Windows systems.
Doing a search in Internet we find an article published by a researcher who explains how to get command execution abusing this binary.
https://github.com/nasbench/Misc-Research/blob/main/LOLBINs/StandaloneRunner.md
Let's follow the procedure explained in the last part of the article. First, create an EXE payload and transfer to the host.
Upload it with evil-winrm in the location C:\Users\jacob.greeny\Documents\shell2.exe
Now enter the sequence of commands indicated by the researcher.
The only thing that's left is to wait till someone opens the standalonerunner.exe binary. When that happens, a shell is received on port 9001
You are root.
Last updated