Personal WebsiteLinkedin

Jab

Enumeration

nmap -v -A -p- -Pn -sV -sC jab.htb -oN nmap

DNS 53

SMB 445

Try to enumerate shares using crackmapexec:

JABBER/XMPP 5222/5223/5262/5263/5269/5270/5275/5276

Logojabber.org - the original XMPP instant messaging servicewww.jabber.org

XMPP Extensions (XEP)

XEPs provide additional features on a Jabber server, such as Multi-User Chat (chatrooms), the ability to exchange vCards, VoIP, and much more. Hundreds of XEPs have been published over the years, providing a variety of functionality that may be of interest from a security perspective.

Here seems to be a XEP installed on Jabber server:

LogoHTTP Bindingxmpp.org

Pidgin client allow to list the rooms configured on XMPP server:

Trying to join the room "test" return an error:

Instead if we enter the room test2 we can see previous messages in the chat sent by bdavis:

We can confirm that the user bdavis exists by using the Search for Users functionality using wildcard:

With some file tampering and cleaning we can get an xml file:

To make it easier to extract the data with powershell, I modify the header resulting in an xml like this:

After some corrections still of errors present during export (a kick in the butt this part!), finally extract usernames using Powershell:

Finally enumerates against Kerberos.

KERBEROS 88

Try to enumerate users without Kerberos PRE-AUTH required:

Lateral Movement as jmontgomery

SMB 445

Try to lateral move against SMB without success:

XMPP

Login as jmontgomery with Pidgin and list available rooms:

There is a pentest2003 room, entering we can see some interesting infos:

We have obtained another valid password for svc_openfire service account!

LDAPS 636

Try to enumerate users against LDAP (plain) over 389 seems to not work:

Against LDAPS (encrypted SSL) over 636 we dump the infrastructure (that's seems to be very complex):

Use Bloodhound to enumerate with graphic support:

Confirm the AS-REP Roastable users finding in precedence:

Lateral Movement as svc_openfire

If we try to search for an attack path using Bloodhound from SVC_OPENFIRE to [email protected] we are offered ExecuteDCOM. Let's go!

svc_openfire is part of group DISTRIBUTED COM USERS:

Enumeration Info

  • domain: JAB

  • domain controller: DC01.jab.htb

  • SMB signing enabled and required

  • XMPP exposed

  • domain users list exported

  • jmontgomery -> Midnight_121

    • No SMB access

    • access to pentest2003

  • svc_openfire -> !@#$%^&*(1qazxsw

Exploitation (user)

First on attacker machine run pwncat to obtain a reverse shell:

Run the following command to trigger the execution of remote DCOM MMC20.Application method ExecuteShellCommand under Document.ActiveView:

We will obtain a remote shell on DC01:

And the user flag:

Privilege Escalation

Download from attacker machine the WinPeas script using a Python Web Server and certutil:

But seems to not run correctl probably due to RemoteSigned ExecutionPolicy:

So try to obtain a more stabilized shell, using nc.exe:

Now start a listener on attacker machine:

Start a reverse shell spawning a CMD:

And run again WinPeas...

Also we find some strange ports (OpenFire):

Confirm that is a WebApp by requesting the page:

Port Forwarding

Use Chisel to port-forward and bind attacker machine local port 9090 and 9091 to victim's 9090 and 9091.

On victim's machine, run chisel as client:

On attacker machine run chisel as server:

Now we can access OpenFire console from Kali:

Logon using svc_openfire credentials:

Exploitation (root)

This version of OpenFire is vulnerable to RCE as explained here:

LogoCVE-2023-32315 - Path Traversal in Openfire leads to RCE - vsocietywww.vicarius.io

svc_openfire user is already Administrator:

Digging in log history we can see that admin have created the user svc_openfire as admin

Now we can upload a malicious web shell plugin by going to Plugins -> Browse -> Upload Plugin:

LogoGitHub - miko550/CVE-2023-32315: Openfire Console Authentication Bypass Vulnerability with RCE pluginGitHub
The malicious plugin uploaded

And finally using the File System mode of plugin we can navigate and find the root flag:

References

PreviousSurveillanceNextHeadless

Last updated