Week 12. Blazorized
TL;DR
This is a Windows Server 2019 machine hosting a web site made with Blazor, an ASP.NET framework for building WebAssembly-based sites. Enumerating the application we are able to retrieve vulnerable binary files and, after reversing them, find out how to create super admin access JWT tokens. Once inside the admin dashboard we use MSSQL injection to gain our first low-priv shell. Regarding escalation, we discover several permissive ACE's with Bloodhond and abuse them with PowerView to move laterally between domain users. Finally we land in a user account holding DCSync permissions, and we use it to root the domain.
KEYWORDS
Blazor, .NET, reversing, dnSpy, Unix time, JWT forging, MSSQL injection, Active Directory, Bloodhound enumeration, PowerView, WriteSPN, targeted kerberoasting, ACL enumeration, script path abuse, DCSync attack, Invoke-Mimikatz.
REFERENCES
ENUMERATION
Port scan.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-10-10 14:50 EDT
Nmap scan report for 10.10.11.22
Host is up, received user-set (0.060s latency).
Not shown: 43083 filtered tcp ports (no-response), 22440 closed tcp ports (conn-refused)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
80/tcp open http syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
3268/tcp open globalcatLDAP syn-ack
5985/tcp open wsman syn-ack
49664/tcp open unknown syn-ack
49673/tcp open unknown syn-ack
49692/tcp open unknown syn-ack
49776/tcp open unknown syn-ack
Nmap done: 1 IP address (1 host up) scanned in 54.88 seconds
Enumerate the open ports.
Add to hosts file and enumerate the site with Firefox.
Fuzz for subdomains.
Add the subdomain to hosts file and enumerate with Firefox.
There is also a "Check for updates" section, if we click and inspect the traffic with Burpsuite, we capture a JWT token.
Decode the token to get an idea how they are formed. We discover they are signed using HS512 symmetric algorithm and also disclose super admin username.
USER
Let's continue inspecting the traffic with Burpsuite. There is a request for a blazor.boot.json that contains information about the application.
It can also be downloaded with Firefox, right click on the tab, click on "Inspect code" and add the path to the JSON file.
In the JSON there is a reference to a DLL called blazorized.helpers.dll. Download it (just enter URL http://blazorized.htb/_framework/blazorized.helpers.dll) and decompile with dnspy, here we see several things.
First, JWT tokens are signed with a symmetric key (HS512 algorithm), as we had seen before.
A bit further in the code we see the HS512 key hardcoded in the source code, along with other claims and a new subdomain http://api.blazorized.htb
And we find out how the tokens are generated.
The application is using Unix time to calculate token expiration times.
All in all, we have all we need to forge our own super admin ticket. To calculate Unix time I made a short Python script.
And used it to calculate expiration time (600 seconds from current time).
Entered this data in https://jwt.io, along with the wanted role and super admin email, so we calculate our forged token.
To use this token we load it in a Firefox tab using the console (F12). First we declare the token variable.
And assign it to a cookie called jwt
Reload the site http://admin.blazorized.htb site and you are logged in as super admin.
They say the application talks to the database directly, so we can try an MSSQL injection. The point of entry is the "Check duplicate category names".
For the payload, I used a powershell -e base64-encoded payload.
This provides a reverse shell for user nu_1055
That can be used to retrieve the user flag.
SYSTEM
Start from the low-priv shell and take the opportunity to enumerate the user and the system.
Transfer a sharphound.exe ingestor to the host and enumerate the domain with Bloodhound. Use the previously list of usernames we have just enumerated and the Bloodhound path finding tool.
There is an interesting edge from nu_1055 to rsa_4810. There is info about WriteSPN edges here:https://support.bloodhoundenterprise.io/hc/en-us/articles/17222775975195-WriteSPN
Basically, we have permission to add an SPN to rsa_4810 account, thus making it vulnerable to targeted kerberoasting (https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting).
Let's modify account's SPN with powerview.ps1
Now request a Kerberos ticket for the SPN we have just created.
This ticket can be cracked (module 13100), and the password is valid to Evil-WinRM into the host as user rsa_4810
Now we can mark rsa_4810 as "Owned" in Bloodhound and continue enumerating. It seems both rsa_4810 and nu_1055 are members of the Remote Management Users group, along with another one called ssa_6010
If we continue enumerating this user we see he is one of the principals with DCSync rights, meaning he is candidate to our next lateral movement.
Enumerate the user's ACL from rsa_4810 shell using PowerView's Get-ObjectAcl cmdlet.
We see current user has write permissions over ssa_6010 script path, meaning we can add scripts that will be automatically executed when the user logs in.
Info about how to exploit this is provided here:https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse#genericwrite-on-user
First add a reverse shell in the file shell.bat and save in the SYSVOL folder.
Now modify the script path for user ssa_6010
Shortly after the user logs in again, the script is executed and a shell is received on port 1919.
From here we can launch a DCSync attack.
We do not know clear text password or hash of user ssa_6010 so cannot do it remotely with Impacket. So we will use a Mimikatz copy stored locally. Download a copy of invoke-mimikatz.ps1 with certutil and dot source the script.
Issue the DCSync attack, the administrator hash is dumped.
The only thing that's left is to open an administrator shell with Impacket.
You are root.
Last updated