Personal WebsiteLinkedin

SolarLab

Enumeration

nmap -v -A -p- -Pn solarlab.htb -oN nmap

Port 80

These could be users of the domain:

I initially assumed that the contact form was vulnerable to XSS so I tried listening and sending such a payload but got no results:

Also the newsletter form return 405 Not allowed:

Port 6791

Since nmap sees an nginx on port 6791, if we try to visit http://solarlab.htb:6791 there would appear to be a redirect to the endpoint http://report.solarlab.htb:6791. Therefore we also add this FQDN to the /etc/hosts file.

http://report.solarlab.htb:6791

After running a directory listing with gobuster and getting these 3 pages the web server starts returning HTTP response code 502:

Port 445

From Nmap we know that: "Message signing enabled but not required"

Having no further information from port 80 we try to get something from SMB. If we try to RID Cycle usernames we obtain an interesting result:

Note how the attack in this case works only by using usernames such as guest or anonymous

Note this 2 users:

Access SMB share using anonymous user we find Documents share:

Accessing it there are different files and folders:

The details-file.xlsx is the most interesting:

Foothold (user blakeb)

We know that there is a user called Blake (from RID brute force attack and webpage analysis) so try these credentials to login at http://report.solarlab.htb:6791:

blake.byte : ThisCanB3typedeasily1@

We get an error. This is very strange 🤷

Try using the username blake previously enumerated and excel file password. Again there is an error saying that user is not found...

Since the format of the usernames is know “Firstname” followed by initial of last name the username for Blake would be “BlakeB” as "AlexanderK" or "ClaudiaS" listed in the file:

So finally BlakeB:ThisCanB3typedeasily1@ it's a WIN! 🎉

Each section allows a request to be made to management automatically, and the form for each request always has as a required field the upload of the signature image, which is then inserted within the automatically generated PDF.

Analyzing the traffic with BurpSuite we note that the backend uses the ReportLab library to generate the PDF:

LogoReportLab Docsdocs.reportlab.com

Trying to search for a vulnerability regarding ReportLab one comes across the following: https://github.com/c53elyas/CVE-2023-33733

Going to modify the POST request and adding the payload present inside the poc.py:

The payload to be used is as follows:

we get feedback in the terminal as shown in the figure:

This means that there is RCE and we can exploit it to get a reverse shell:

pwncat-cs in this case does not seem to work properly and fails to establish a connection with the reverse shell. Instead, using netcat wrapped with rlwrap we will have a shell and blake's user flag 🍷

Full payload:

We get the first shell as blakeB users and the corresponding Flag:

To have a more stabilezed and functional shell we can use metasploit as follow:

Upgrade Normal Shell To Meterpreter Shell

Background the current (Normal Shell) session, we can do this by pressing CTRL+Z:

Now Run the following command search shell_to_meterpreter:

Now we have to configure which session shell to upgrade. We can see the session by running the following command i.e sessions -l.

Configure the session to upgrade using set SESSION <ID> and then run:

Now finally list the sessions running and interact with meterpreter session created session -i <ID>:

Enumeration (privesc)

Inside the C:\Users\blake\Documents\app directory we find some interesting code like:

The users.db file is unreadable so let's download it locally using meterpreter session:

We can open it using sqlite3 client then listing tables and finally obtain username:passwords

Upload WinPeas and scan for PE possibilities. There is an interesting LISTENING port (9090) that is OpenFire service:

If we list the local users we can verify that only openfire, blakeb and Administrator accounts exists locally:

Privilege Escalation (openfire)

I am going to try escalating to this user using RunasCs.exe. and the knowing credentials found (uploading executable using meterpreter upload feature).

In fact, alexanderk's password contains the string fireguard is this might make us think of a reuse of the password for the openfire account.

Also we need netcat to spawn a bind powershell, so create a temporary folder under C:\ that must be readable to all users in particular blakeb and openfire in order to escalate correctly:

Enumeration (Administrator)

Listing the active services we see that Openfire is present and the path is as shown in the image. Let's go and see what is inside that path:

The embedded-db folder makes us think of a database used in Openfire; inside are several files:

If we analyze the openfire.script:

Throughout this script, the interesting parts are those related to the passwordKey needed to do user password encryption:

And the part about the admin user record:

Unfortunately, the PLAINPASSWORD is not stored within the script. However, searching on Google for a way to decrypt the OpenFire database password we find this interesting GitHub repo:

LogoGitHub - c0rdis/openfire_decrypt: Little java tool to decrypt passwords from Openfire embedded-dbGitHub

After compiling the Java class we can run the command and get the Administrator user password for the Openfire server:

Now try to spawn a shell as Administrator trusting that the Administrator user's Openfire password is the same as on the windows machine:

And finally we pwned the machine:

PreviousPerfectionNextRunner

Last updated