UnChleuHacker

SynthesisTea is an Active Directory chain containing 2 machines to be compromised. Initial access is gained by exploiting a CI/CD runner on a Gitea instance, and full domain compromise is possible through the WSUS connection of the domain controller. Initial enumerationLet’s start with an nmap scan of both machines.It looks like we’ve got a domain controller that isn’t behind a firewall and a machine hosting web services.We can retrieve the names of both machines using NetExec : We add t...

Initial accessThanks to the nmap scan, we quickly discover that one of the servers hosts an xampp server. By listing its directories, we discover a website:After browsing the site, we notice that it is potentially vulnerable to a BIA:This is confirmed by accessing the server log on the following link: http://10.10.162.134/dev/index.html?view=C:/xampp/apache/logs/access.log In this way, you can gain access to the machine by log poisoning. To do this, we send a request with php code to the user...

EnumerationEnumeration of open ports using nmap : Looking at the smb share, we see that it is possible to connect to the share using the guest account : A log1.txt file is then retrieved from the anonymous share, which appears to contain passwords:Listing the web server folders with dirb, we come across a mail server connection page: Mail server accessUsing hydra and the log1.txt file, we find the password for the milesdyson account (name found when enumerating smb shares). This gives us acc...

ObjectiveExploit a buffer overflow vulnerability in an application by taking control of the EIP register and executing shellcode. 1. connect to the target and launch vulnserverRDP connection to target : 1rdesktop -u IEUser -p 'Passw0rd!' 172.16.5.120 Launching vulnserver with : 1vulnserver.exe 9999 Interacting with the server from our machine, we notice that depending on how we type the command and what we send, we get different responses. 2. Fuzzing with SPIKECreate a trun.spk sc...

We start with an nmap scan We can see that the open ports correspond to those of a Windows machine, which is confirmed by visiting the web site on port 80: We start by trying to enumerate smb shares with the guest account: Note that you have read and write rights on a share. Using impacket-smbclient, we discover a password.txt file containing base64 : By decoding it with CyberChef, we obtain Bob’s and Bill’s identifiers: After trying to use these accounts to access other parts of the serve...

We start by enumerating the open ports with an nmap : We notice that the certificate used for https contains several domain names, so we add them to the /etc/hosts file to access them: Most of the domains are useless, but accessing the domain netops-dev.dodge.thm using https will bring up a blank page: By analyzing the source code, we discover a php file that allows us to modify the firewall configuration: By entering the sudo ufw disable command, we can disable the firewall rul...

What is PrinterBug?PrinterBug is the name given to a technique for abusing the Microsoft Remote Procedure Call Print System Remote Protocol (MS-RPRN). This method enables an attacker with a simple user account to force a Windows computer (often a domain controller) with the print spooler enabled, to authenticate to a machine controlled by the attacker.The aim is to exploit this authentication to carry out an NTLM Relay attack. Why does this vulnerability exist?In a Windwos environment, the MS...

This article will be a walkthrough of the ine lab concerning this attack. PowerviewPowerview is a PowerShell tool for reconnaissance in Windows domains. It contains a set of Powershell commands that replace the classic Windows commands of the net * type. We start the lab by opening a powershell command prompt and enabling script execution: Next, we can find the domain machines on which the current user is administrator: You can then launch a powershell session with one of these machines: HF...

What is SPIKESpike is a protocol fuzzer creation kit. It provides an API for creating your own fuzzers for network protocols, using the C++ language. SPike provides a series of basic commands for generating fuzzed messages to be sent to a network service. Scriptiong SPIKEFor TCP-based server applications, we use scrpit .spk with the generic_send_tcp interpreter (preinstalled on Kali Linux). The basic syntax is : 1generic_send_tcp <IP> <port> <script.spk> <SKIPVAR> <...

Step 1: Find the offsetThe first step is to find the offset that will allow us to replace the return address. To do this, there are 2 methods: Manual method:We can see in the source code that the buffer is 140 bytes long, but between the end of this buffer and the return address there are possible fill bytes (memory alignment) and the rbp register (base pointer), which is 8 bytes long on a 64-bit architecture.So, to overwrite the return address, you’ll need at least 148 bytes. To find out the...