Personal WebsiteLinkedin

Freelancer

Enumeration

nmap -v -A -O -p- -Pn freelancer.htb -oN nmap

Port 80

We find a very feature-rich website and pages to visit:

Blog

The Blog have different posts with comments of other users:

There is the endpoint http://freelancer.htb/accounts/profile/visit/0/ that allow to list all users registered in the platform. For example, admin have the id=2 as showed below:

Using BurpSuite we can extract the list of usernames simply using the Grep Extract functionality and selecting the example text JohntheCarter:

And this is the users list:

We note that some users are registered with corporate email so they may be interesting target users:

Employer Register

Note this message informing us that our requests will be reviewed by their team before approving the registration (possible XSS to steal the administrative cookie?):

If we try to log in after registration we get the error that the account needs to be activated by administrators:

However, by trying to take advantage of the Password Reset feature:

we are able to make the account fully active and login:

Exploitation (admin panel)

There is a Login using QR code functionality that seems interesting:

If we scan using zbarimg the QR code saved as PNG image, we obtain the following output:

Using CyberChef and Magic function, we will find that's is a Base64 string encoded. The first part of the string refers to the unique ID of the currently logged in user:

In fact this same ID is easily visualized by going to upload a test image as a profile image and looking in the HTML code after updating the “Profile” page we will have the ID associated with our user:

From the enumeration of users done earlier, we know that the admin has ID=2 so we need to encode it using Base64 and substitute it in place of the user ID we created. Be careful to keep an equal as indicated by CyberChef's output:

We generate a new QR code as a Test employer since the deadline is 5 minutes and simply navigating in the browser the following crafted URL we can exploit successfully the IDOR vulnerability:

And tada! We obtain admin access! 🎉

Seems to be a Django app written in Python:

Knowing that this is a Django application, we know that, if configured, there is an administrative console reachable at the /admin endpoint:

The administration console of a Django application is a predefined web interface that allows administrators to manage the data of applications registered in the site. It is created if the django.contrib.admin app has been included in the settings.py file under INSTALLED_APPS and python manage.py migrate has been run to create the administration tables in the database.

We can see the different existing users, published articles and comments but there is also a super interesting SQL Terminal!

If we try to run the SQL command show databases; the error gives us useful information about the backend in use:

This is SQL Server so we need to use the appropriate stored procedure:

List schemas:

Get the version:

The current database in use is the following:

Obtain the current user running the SQL Express instance:

If we try to run shell command using stored procedure xp_cmdshell we obtain a permission error:

Also we can't enable it so:

So we have to go a different way.... 🛣️

MSSQL Impersonation

The EXECUTE AS statement is a feature within SQL servers that allows a user to impersonate and execute commands as another SQL Server login or database user. This allows database admins to delegate permissions to other users to execute certain stored procedures without necessarily giving them the sysadmin role.

Find SQL Server Logins that can be impersonated:

Impersonate sysadmin user:

Now we are SYSADMIN user sa 🎉

As syadmin user we can now enable xp_cmdshell:

Now that we are executing command as sa, we try to exec xp_cmdshell stored procedure and it works like a charm!

We've obtained another info: the service account that run the MSSQL is sql_svc.

Go futher with enumeration:

The very interesting file is under C:\Users\sql_svc\DOwnloads\SQLEXPR-2019_x64_ENU:

FREELANCER\sql_svc <--> IL0v3ErenY3ager

If we try to evil-winrm we got a fail:

Now to obtain a reverse shell as sql_svc, dowload netcat on victim machine:

Now run rlwrap nc -lnvp 4444 on Kali and spawn a reverse shell as sql_svc:

If now we run a Password spray attack using crackmapexec against SMB service we obtain this result:

freelancer.htb\mikasaAckerman<-->IL0v3ErenY3ager

The WinRM for these users is disabled, so we need to change user in reverse shell using runascs.exe:

Running rlwrap nc -lnvp 5555 on another tab allow us to login as mikasaAckerman and got the user flag:

Privilege Escalation (lorra199)

There are strange files like mail.txt and test.txt:

The creator of the CTF is telling us that we need to analyze the dump of the server.... machine and so be it!

We download the MEMORY.7z dump locally using python as web server:

We need to analyze this dump in order to find juicy infos...

First extract the 7z archive using 7za:

Mount the dump using memprocfs:

We can see the list of process that were running when the dump was made:

also the list of sockets:

The password obtained from the dump is: PWN3D#l0rr@Armessa199

We need to find the username for which this password works, so again password spray attacks using crackmapexec:

We find that these credentials are for user lorra199:

If we try to WinRM, we are in as lorra199:

Privilege Escalation (Administrator)

If we try to download WinPeas on the machine, we will obtain this error during execution, blocked by antivirus:

The following screenshots are from Powershell in Windows machine because I was having stability problems with evil-winrm

List just for confirmation the AD users:

We need to enumerate more, so run BloodHound. But first to avoid the error Kerberos SessionError: KRB_AP_ERR_SKEW (Clock skew too great) we need to syncronize the local time of Kali with the DC:

From Bloodhound, after collection and importing, we mark user lorra199 as owned and then from Analysis menu we will select "Shortest Path from Owned Principals" and we will see that lorra199 is member of AD RECYCLE BIN group.

The Active Directory Recycle Bin is used to recover deleted Active Directory objects such as Users, Groups, OUs etc. The objects keep all their properties intact while in the AD Recycle Bin, which allows them to be restored at any point.

First import the Active Directory module:

This is the output formatted using this one-line Posh code:

If we also mark AD Recycle Bin as Owned and then we ask Bloodhound to show us the shortest path to Administrator user, we will obtain this kill chain:

AD RECYCLE BIN has GenericWrite permissions on the DC machine.

Create a machine account using Powermad:

Next, we need to set this newly created security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the computer account we’re taking over, again using PowerView in this case:

First create a new machine (grab the computer name and password output):

Then delegate the newly created machine to the DC, allowing the delegated machine to impersonate any user to operate the target machine under certain conditions.

Then obtain the ticket, which is the ticket of the new machine:

Finally import the ticket and log in to the DC directly using the wmiexec tool and rooting the machine 🎉🎉

PreviousBoardLightNextBlurry

Last updated