Personal WebsiteLinkedin

Hospital

Scanning

Nmap

HTTP

http://hospital.htb:8080/login.phphospital.htb

Register a user:

Try to upload something, seem to work:

Fuzz directories:

HTTPS

Fuzz directories:

Nothing relevant...

SMB

Detect SMB version with Metasploit:

Try lo list shares:

DNS

Simple DNS Plus

Info obtained

  • LDAP: domain controller and domain is DC.hospital.htb

  • HTTP:

    • test user exist

    • password at least 6 character

    • Apache 2.4.55

    • Registration open

  • HTTPS:

    • Hospital Webmail roundcube

    • PHP 8.0.28

    • Apache 2.4.56

  • SMB:

    • No anonymous access

    • Signature required

    • Versions 2, 3

    • Authentication domain: HOSPITAL

  • DNS:

    • origin: dc.hospital.htb

Gaining Access

File Upload Vulnerability

Try to search a File Upload Vulnerability. With a registered account we can try to upload a fake image containing a PHP reverse shell. From preceding fuzzing, we know that there is a directory called uploads but images when retrieved are not processed by web server but only stored so we need to force the PHP upload trying different extensions.

We see that .phar extension is allowed so we try to upload a web shell (reverse shell not work due to inability to demonize the process) and trigger it using this path: http://hospital.htb:8080/uploads/powny.phar

Get a reverse Shell

Use the php oneline reverse shell:

  1. Obtain a reverse shell

  2. Spawn a tty python3 -c 'import pty; pty.spawn("/bin/bash")'

Privilege Escalation

Under /var/www/html there are some interesting files:

🗒️From here we can see that .phar extension is not included in $blockedExtensions

More info on .htaccess and his configuration

The .htaccess file is a configuration file primarily used on Apache web servers. It provides a way to set specific directives for specific directories without modifying the main server configuration file.

The "AddType" directive in the specific context, "AddType application/x-httpd-php .phar," is an instruction for the Apache server. This line tells the server to treat files with the ".phar" extension as PHP files. In other words, when the server receives a request for a file with the ".phar" extension, it will interpret it as a PHP file and process it through the PHP engine rather than treating it as a static file.

.phar files are PHP archives containing applications or libraries and can be executed as PHP scripts. The instruction in the .htaccess file allows the server to recognize .phar files as files that should be interpreted and processed through the PHP engine, enabling them to run PHP code when accessed through the Apache web server.

We can try to list current OS users:

Try to connect to mysql database:

And from mysql console we can dump passwords and users info:

MySQL password dump:

Crack MySQL passwords

  1. For each hash create a hashtmp file to use in hashcat.

  2. Identify the type of hash using hashid hashtmp

  3. Find the mode code to use: hashcat -h | grep Blowfish

  4. Crack for each hash: hashcat -m 300 -a 0 tmphash

-m 3200: Mode 3200 | bcrypt Blowflish (Unix) -a 0 : dictionary mode (0)

Exploit OS vulnerability

CVE-2023-2640-CVE-2023-32629 https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629

Upload the exploit shell file using the webshell and sweet UPLOAD feature:

I need to modify the name of /var/tmp/bash file created by exploit due to other users that are running on the same machine and using the same exploit:

And we gain root access to this machine:

Now that we're root, show the /etc/shadow content:

Try to crack the drwilliams hash password:

Connecting using SSH work:

Also work the login on RoundCube mail portal:

Mail received from DrBrown:

Upon exploring the webmail service, it appears to be a platform for sending emails. Upon receiving a mail in the form of an .eps file, it’s worth noting that such files often leverage Ghostscript for execution. This could lead to the identification of a potential exploit.

LogoGitHub - jakabakos/CVE-2023-36664-Ghostscript-command-injection: Ghostscript command injection vulnerability PoC (CVE-2023-36664)GitHub

Having previously identified Active Directory services, it is likely that the victim's computer is a windows machine, so we try to trigger a reverse shell in the Windows environment by going to inject a payload inside the .eps file.

  1. Download first nc.exe from attacker machine at the path /usr/share/windows-resources/binaries

  2. Then execute a reverse shell to connect to attacker machine:

On Desktop we will find the user flag:

Inside Documents folder there is a ghostscript.bat file: type ghostscript.bat

Active Directory Post-Compromise

Run an ldapdomaindump using stolen credentials:

Use crackmapexec to pass-the-password of chris brown:

Exploit RPC

Once connected, utilize the command “querydispinfo” to examine the data. You’ll notice that Administrator Information is shared with the Guest.

We attempt to upload a webshell onto the web service to investigate the permissions it operates with in xampp\htdocs:

And we will become NT AUTHORITY/SYSTEM !

Info stealed

  • MySQL:

    • root : my$qls3rv1c3!

    • dbname : hospital

    • table called users for all users

    • drwilliams : qwe123!@#

    • admin : 123456

  • Ubuntu 23.04 (Lunar Lobster)

  • Active Directory:

    • hospital\drbrown : chr!$br0wn

    • DC$ DC.hospital.htb Windows Server 2019 Standard

    • Chris Brown member of Remote Management Users, Performance Log Users, Remote Desktop Users, Users

PreviousDarkZeroNextVisual

Last updated