Week 3. Mailing
TL;DR
This is a Windows 10 Pro machine running a mail server (POP3, SMTP and IMAP). We can get mail administrator credentials exploiting a path traversal vulnerability in the web site. To retrieve the user flag we exploit a MonikerLink (CVE-2024-21413) vulnerability in Outlook which allows us to gain a NTLMv2 hash that, once cracked, enables a low-privileged session in the host. Regarding escalation, we exploit a vulnerable version of LibreOffice (CVE-2023-2255) to add ourselves into the local administrators group.
KEYWORDS
hMailServer, SMTP, IMAP, OpenSSL, STARTTLS, MonikerLink, CVE-2024-21413, NTLMv2, LibreOffice, CVE-2023-2255, pass-the-hash.
REFERENCES
https://www.hmailserver.com/forum/viewtopic.php?t=29069
https://www.cvedetails.com/cve/cve-2024-21413
https://www.samlogic.net/articles/smtp-commands-reference.htm
https://mailtrap.io/blog/telnet-send-email
https://www.cvedetails.com/cve/CVE-2023-2255/
https://github.com/elweth-sec/CVE-2023-2255
ENUMERATION
Port scan.
Enumerate the open ports.
We have disclosed a domain username ruy@mailing.htb. Add to hosts file and inspect the site with Firefox.
Looks like there is a mail server "Powered by hMailServer". Also, we have a list of team members. Since have already disclosed an username we can figure out the pattern used to create the accounts. We will assume the other accounts are maya@mailing.htb and gregory@mailing.htb
Click on "Download instructions", a request to http://mailing.htb/download.php?file=instructions.pdf is sent. This looks like a candidate for path traversal.
Let's try a path traversal in Windows. Using this payload ../../../windows/win.ini the vulnerability is confirmed.
USER
Once the vulnerability has been confirmed, let's imagine ways to exploit it. Normally, path traversal can be exploited to make the application render a local file (this case is called LFI), or to read sensitive files in the file system. We know the host is running hMailServer, so we'll use path traversal to read the configuration file.
In support forums (https://www.hmailserver.com/forum/viewtopic.php?t=29069) they say configuration file is located here c:\program files (x86)\hmailserver\bin\hmailserver.ini
To browse the file we use this payload ../../../program+files+(x86)/hmailserver/bin/hmailserver.ini
Crack the MD5 administrator hash (module 0).
You surely have heard about this MonikerLink critical vulnerability, discovered this year, affecting Outlook (https://www.cvedetails.com/cve/cve-2024-21413/). Basically, Outlook does not manage correctly links to SMB shared files in the body of HTML messages when a "!" character is inserted in the middle of the link. Details on the vulnerability here: https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture
Normally, Outlook should block these SMB requests for security reasons since NTLMv2 hashes can be captured, but the insertion of the exclamation mark "!" changes Outlook's behavior.
Let's exploit this by sending a malicious email to maya@mailing.htb. One option is to do it using one of the multiple PoCs linked to this vulnerability in Github (just follow the instructions provided by the exploit creator).
However, since we already have mail server administrator credentials, we will exploit it manually, interacting directly with the server via Telnet/Netcat commands. Here more info on how to interact with an SMTP server from command line: https://www.samlogic.net/articles/smtp-commands-reference.htm
In this case we can use both SMTP or IMAP (secure SMTP) since both ports 25 and 587 are open. In the first option, SMTP (25), information is sent unencrypted, whereas in the second option, IMAP (587), the information is sent encrypted, therefore we need to establish a TLS connection first. The sequence of commands for the SMTP case is the following.
Connect to the server using Netcat.
Identify yourself in the server.
Log in using administrator credentials, this has to be done in base64 encoding.
Enter the sender and the receipt address.
Now you can send the body of the email, it will have a plain text part and an HTML part, containing the malicious link. I found here how to create HTML emails using SMTP command line: https://mailtrap.io/blog/telnet-send-email/
The body of the email could something like this.
Remember that to finish the email data and add to queue for sending you need to press "enter" + "." + "enter".
Now start an Impacket SMB server. If everything goes well, in a couple of minutes Maya will click on the email link and we will be able to capture her NTLMv2 hash.
Other option is to use the IMAP protocol, the TLS encrypted version of SMTP. For this, we need to connect to port 587 using the STARTTLS protocols extension and initiate a TLS handshake. We cannot do this with Telnet/Netcat because TLS is binary and involves cryptography, and you cannot do this by hand. Instead, we can use the openssl s_client command.
Start a secure TLS connection to port 587 (the flag -crlf is used to automatically send a "CRLF" character after each line).
Once the secure session is established, the sequence of commands is the same as the previous case.
And the NTLMv2 hash is received on the SMB server as well.
NTLMv2 hashes cannot be passed, but we can always crack them (module 5600).
Use the credentials to open a WinRM session on the host as user maya
Which can be used to retrieve the user flag.
ROOT
Start from the low-privileged WinRM session an take the opportunity to enumerate the user and the system.
Enumerate the installed software.
Enumerate the installed LibreOffice version.
There is a CVE affecting this LibreOffice version (https://www.cvedetails.com/cve/CVE-2023-2255/), and an exploit in GitHub (https://github.com/elweth-sec/CVE-2023-2255).
Clone the repository and create a malicious .odt file containing a payload to make user maya administrator.
Transfer the file important.od to folder c:\important documents and wait till someone opens it. When that happens, user mailing\maya is added into administrators group.
Now we can dump the SAM file remotely using Maya's credentials.
And open a shell with Impacket for user localadmin
You are root.
NOTE: before closing remove user maya from administrators group to leave the house cleaned.
Last updated