Nmap scan report for freelancer.htb (10.10.11.5)
Host is up (0.045s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http nginx 1.25.5
|_http-server-header: nginx/1.25.5
|_http-favicon: Unknown favicon MD5: 582290CAF5F37817946D9C6A04D4AF95
|_http-title: Freelancer - Job Board & Hiring platform
| http-methods:
|_ Supported Methods: GET HEAD OPTIONS
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-06-10 14:07:36Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49671/tcp open msrpc Microsoft Windows RPC
49674/tcp open msrpc Microsoft Windows RPC
63527/tcp open unknown
63531/tcp open unknown
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (89%)
Aggressive OS guesses: Microsoft Windows Server 2019 (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 4h59m59s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-06-10T14:08:34
|_ start_date: N/A
TRACEROUTE (using port 135/tcp)
HOP RTT ADDRESS
1 44.36 ms 10.10.14.1
2 44.32 ms freelancer.htb (10.10.11.5)
NSE: Script Post-scanning.
Initiating NSE at 11:09
Completed NSE at 11:09, 0.00s elapsed
Initiating NSE at 11:09
Completed NSE at 11:09, 0.00s elapsed
Initiating NSE at 11:09
Completed NSE at 11:09, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 220.34 seconds
Raw packets sent: 131218 (5.777MB) | Rcvd: 240 (18.132KB)
Port 80
We find a very feature-rich website and pages to visit:
Blog
The Blog have different posts with comments of other users:
Using BurpSuite we can extract the list of usernames simply using the Grep Extract functionality and selecting the example text JohntheCarter:
And this is the users list:
We note that some users are registered with corporate email so they may be interesting target users:
Employer Register
Note this message informing us that our requests will be reviewed by their team before approving the registration (possible XSS to steal the administrative cookie?):
If we try to log in after registration we get the error that the account needs to be activated by administrators:
However, by trying to take advantage of the Password Reset feature:
we are able to make the account fully active and login:
Exploitation (admin panel)
There is a Login using QR code functionality that seems interesting:
If we scan using zbarimg the QR code saved as PNG image, we obtain the following output:
Using CyberChef and Magic function, we will find that's is a Base64 string encoded. The first part of the string refers to the unique ID of the currently logged in user:
In fact this same ID is easily visualized by going to upload a test image as a profile image and looking in the HTML code after updating the “Profile” page we will have the ID associated with our user:
From the enumeration of users done earlier, we know that the admin has ID=2 so we need to encode it using Base64 and substitute it in place of the user ID we created. Be careful to keep an equal as indicated by CyberChef's output:
We generate a new QR code as a Test employer since the deadline is 5 minutes and simply navigating in the browser the following crafted URL we can exploit successfully the IDOR vulnerability:
Knowing that this is a Django application, we know that, if configured, there is an administrative console reachable at the /admin endpoint:
The administration console of a Django application is a predefined web interface that allows administrators to manage the data of applications registered in the site. It is created if the django.contrib.admin app has been included in the settings.py file under INSTALLED_APPS and python manage.py migrate has been run to create the administration tables in the database.
We can see the different existing users, published articles and comments but there is also a super interesting SQL Terminal!
If we try to run the SQL command show databases; the error gives us useful information about the backend in use:
[Microsoft][ODBC Driver 17 for SQL Server][SQL Server]
This is SQL Server so we need to use the appropriate stored procedure:
List schemas:
SELECT schema_name FROM information_schema.schemata;
Get the version:
SELECT @@VERSION;
The current database in use is the following:
SELECT DB_NAME() AS CurrentDatabase;
Obtain the current user running the SQL Express instance:
select user_name();
If we try to run shell command using stored procedure xp_cmdshell we obtain a permission error:
Also we can't enable it so:
MSSQL Impersonation
The EXECUTE AS statement is a feature within SQL servers that allows a user to impersonate and execute commands as another SQL Server login or database user. This allows database admins to delegate permissions to other users to execute certain stored procedures without necessarily giving them the sysadmin role.
We need to enumerate more, so run BloodHound. But first to avoid the error Kerberos SessionError: KRB_AP_ERR_SKEW (Clock skew too great) we need to syncronize the local time of Kali with the DC:
ntpdate freelancer.htb
From Bloodhound, after collection and importing, we mark user lorra199 as owned and then from Analysis menu we will select "Shortest Path from Owned Principals" and we will see that lorra199 is member of AD RECYCLE BIN group.
TheActive Directory Recycle Bin is used to recover deleted Active Directory objects such as Users, Groups, OUs etc. The objects keep all their properties intact while in the AD Recycle Bin, which allows them to be restored at any point.
Next, we need to set this newly created security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the computer account we’re taking over, again using PowerView in this case:
Then delegate the newly created machine to the DC, allowing the delegated machine to impersonate any user to operate the target machine under certain conditions.
