Week 7. Freelancer
TL;DR
This is a Windows Server 2019 machine acting as a domain controller and hosting a job search web site. User IDs are Base64 encoded in the URLs, so we can just sign up an account and escalate to web administrator just manipulating the URL. Once in the administrator dashboard, we use a MSSQL console to escalate to sa user and enable xp_cmdshell commands, that we use to get a reverse shell and collect the user flag.
Regarding escalation, first we find a memory dump in the file system from where, once opened with a forensics tool, we can extract several hashes. One of the hashes can be cracked and enables a lateral movement to another user with permissions to restore AD objects from the recycle bin. We recover a deleted AD user account that in turn has SeBackupPrivilege enabled. We abuse this to backup SAM, SYSTEM and NTDS.dit files, from where we can extract domain administrator hash.
KEYWORDS
MSSQL escalation, xp_cmdshell, MemProcFS, Pypykatz, AD recycle bin, SeBackupPrivilege, Impacket, changepassword.py, SAM, SYSTEM, NTDS.dit, secretsdump.py.
REFERENCES
https://github.com/martinsohn/PowerShell-reverse-shell/blob/main/powershell-reverse-shell.ps1
https://github.com/ufrisk/MemProcFS
https://github.com/skelsec/pypykatz
https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960#ac58
ENUMERATION
Port scan.
Looks like a domain controller, add to hosts file and enumerate the web site with Firefox. A job search comes into view, where you can register a new employer account.
Fuzz for hidden content.
There is and /admin path for which we still do not have access.
USER
When you try to log in with your created new account it says the "Account is not activated and cannot be authenticated". To bypass this just fill in a "Forgot password" form and reset your password, you'll need your personal answers.
Reset the password and access your user dashboard, then click on "QR-Code".
Scan your QR code and inspect the URL.
It should be something like this: http://freelancer.htb/accounts/login/otp/MTAwMTA=/7e043d891429e7366518e939c521364d
Decode the Base64 part, it returns a 5-digit number.
This looks like an user ID; also, in the blog we can find several IDs of users we could impersonate.
For example, this user has ID=10.
To impersonate him, just encode the ID=10 in Base64.
Then forge a URL similar to the previous one. Just substitute the Base64 part with the new code: http://freelancer.htb/accounts/login/otp/MTAK/7e043d891429e7366518e939c521364d
Enter the URL and you are in the user's dashboard.
We can try several other IDs, till you find out ID=2 is the admin account. Base64 for "2" is "Mgo=".
Enter URL: http://freelancer.htb/accounts/login/otp/Mgo=/7e043d891429e7366518e939c521364d and you are in the admin dashboard.
Now we can access to the /admin path we found with ffuf before. Here we find an admin dashboard where we can issue MSSQL statements.
Let's try enabling code execution.
No luck, let's try to enable xp_cmdshell manually.
The application returns a permissions error, so it seems we will need to escalate privileges in MSSQL.
Check if we can impersonate user sa
It seems we can. Now we abuse this to add ourselves to the sysadmin group, for which we need first to know our current username.
Add ourselves to the sysadmin group.
The query returns "No results", but is executed successfully.
Now we can enable command execution and test if we can issue commands.
Seems it works, next step is to send a Powershell reverse shell.
Once inside, make bit of enumeration. In C:\users we see several usernames.
And in C:\users\sql_svc\downloads\sqlexpr-2019_x64_enu there is the configuration file sql-configuration.ini
That contains password IL0v3ErenY3ager
Let's spray this password all over the user list.
Nothing is found in the SMB share.
But we can use credentials to move laterally to user mikasaackerman with runascs.exe
And from here collect the user flag.
SYSTEM
Begin from the mikasaackerman shell and take the opportunity to enumerate the system.
In the desktop there is a text file. It says someone has created a memory dump for troubleshooting purposes.
Bring the dump to your Kali machine and extract the DMP file. Open it with MemProcFS forensics tool.
In the /mnt/memdump/py/regsecrets directory there is a file called regsecrets-install.txt. It contains instructions to install the regsecrets plugin. Apart from this plugin, also Pypypkatz package is needed, so it may be needed to install it with pip3.
After installing both things, run again the memprocfs command and navigate again to the /mnt/memdump/py/regsecrets directory. This time the tool is able to extract secrets from the dump and copy them to TXT files.
The DCC2 hashes are cached domain credentials, one of them can be cracked with module 2100. Save the password as it will be needed later.
On the other hand, the extracted LSA secret turns to be valid for a WinRM session as lorra199
Start by enumerating lorra199 permissions and groups.
There is a group called FREELANCER\AD Recycle Bin. It seems members of this group can read or deleted active directory objects.
To abuse this privileged group, first we enumerate the deleted objects currently being stored in the recycle bin.
Notice for one of the deleted objects (liza.kazanof) we have already cracked the pass. So we will restore this user from the recycle bin and have a WinRM shell as her.
First we need the ObjectGUID of the deleted account.
And now we can restore the user in the AD.
However, if we try to connect with evil-winrm we receive an authentication error. This can be explained with crackmapexec: the password is expired.
Use Impacket's changepasswd.py to update the password.
Now it is possible to have a shell as liza.kazanof
Enumerating her permissions, we see she has SeBackupPrivilege and SeRestorePrivilege. This means she has complete access to the file system, even SAM and SYSTEM registry hives and the Active Directory database, that is stored in the file NTDS.dit in domain controllers.
We will abuse this with Diskshadow and Robocopy.
In the liza.kazanoff shell, create an script file for Diskshadow.
Then convert to ASCII, otherwise Diskshadow will not be able to read it.
Now we can run the tool passing the ASCII script as an argument.
Then copy the NTDS.dit file with Robocopy to the temporal file created in the C: drive.
Now extract the SAM and SYSTEM hives.
Transfer the three files to your Kali machine, then process them and extract all the domain hashes with Impacket's secretsdump.py
And with the domain administrator hash you can read the flag.
You are root.
Last updated