Arkham

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.228.116           
Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-23 02:31 EDT
Nmap scan report for 10.129.228.116
Host is up (0.023s latency).
Not shown: 65528 filtered tcp ports (no-response)
PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
8080/tcp  open  http-proxy
49666/tcp open  unknown
49667/tcp open  unknown

Detailed scan:

$ nmap -p 80,135,139,445,8080 -sC -sV --min-rate 3000 10.129.228.116
Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-23 02:33 EDT
Nmap scan report for 10.129.228.116
Host is up (0.060s latency).

PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods: 
|_  Potentially risky methods: TRACE
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
8080/tcp open  http          Apache Tomcat 8.5.37
|_http-title: Mask Inc.
| http-methods: 
|_  Potentially risky methods: PUT DELETE
|_http-open-proxy: Proxy might be redirecting requests
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

SMB Enum -> LUKS Image

smbmap using guest access returned some stuff:

There were 2 Shares I was interested in, Users and BatShare.

Users didn't have much:

The Guest directory was just a completely normal directory. The BatShare directory did have an interesting file however:

I downloaded the file using get, and unzipped it to find 2 files:

LUKS is the standard for Linux hard disk encryption. bruteforce-luks is a tool that can be used to crack this password. I used rockyou.txt as the wordlist:

However, I soon realised that this method of brute-forcing was extremely slow and also super hard on my computer. Since this entire box was Batman themed, I created a sub-wordlist using grep:

This is much quicker and finds the password quickly.

I can then use the password to decrypt and mount it as per this post:

LogoHow To Linux Hard Disk Encryption With LUKS [ cryptsetup encrypt command ]nixCraft

This appears in my /dev/mapper directory:

I created a directory within /mnt and mounted it there:

Within the Mask directory, there there looked to be some application files for the Tomcat instance:

Web + File Enum -> Deserialisation

Before proceeding into enumerating the Tomcat instance, I should probably find it first.

Port 8080 hosted a website promoting a masking service:

The site was rather static, so I ran a gobuster scan on this, which returned nothing useful.

Taking a look at the page source, I found that there was some userSubscribe.faces endpoint:

This returned me to this page:

I can sign up with any string:

The request that it send was rather interesting. Here are the POST request parameters:

Lots of mentioning of JSP, and the .faces extension means that this uses JavaServer.Faces.

Interesting. Within the Tomcat folder, there was just a bunch of .xml files:

Out of all of these the web.xml.bak file was the most interesting, since it looked like it really didn't belong there. The file contained a lot of settings:

The thing I noted was the mentioning of a SECRET, MAC_SECRET and MAC_ALGORITHM. When searching for exploits for JSF, there were a lot of results that mentioned Deserialisation.

LogoMisconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Alphabot Securitywww.alphabot.com

Based on the above article, it exploits the serialised Java object named the ViewState. In the case for this machine, it is user-controlled since it appeared in the POST parameters for the subscription.

So deserialisation is the RCE vector for the box!

Exploit Deserialistaion -> RCE

For JSF, there is default encryption using DES. Since there were some HMAC parameters given to me, I'm assuming I have to encrypt and sign the payload.

The secret decoded returns this:

Firstly, I had to encrypt and then sign this. I used this repository's helper functions to do so:

LogoGitHub - Keramas/Lord_of_Cereal: Java deserialization tool for creating encrypted and HMAC protected payloads.GitHub

Here's my code:

The output from dump_payload was created like so:

Then, I used the script above to generate the payload required:

Afterwards, I replaced the ViewState parameter within the POST request to get this:

RCE achieved! From here, I just have to use subprocess to retrieve the payload, and then use requests to get a shell.

Here's the final no-click exploit script for a reverse shell:

This gives me a shell to grab the user flag.

Privilege Escalation

Email Backup -> Admin Creds

There was a backups directory within the Downloads folder for alfred:

I downloaded this back to my machine via nc.exe. When unzipped, this contained some kind of Microsoft Outlook file:

I used readpst to read this file:

This created a Drafts.mbox file, and it contained a base64 encoded image:

I decoded this thing and viewed it:

Seems like I now have the password for batman, which is Zx^#QZX+T!123.

Checking batman reveals that this user is an Administrator and part of the Remote Management Group.

Using the credentials, I can attempt to use remote Powershell to execute commands.

Using this, I can get another shell as batman via nc.exe.

Read Flag

For some reason, I was the Administrator but I was unable to read the root flag, and I did not have any administrator privileges:

I was stuck at this part for quite long. For some reason, there is a need to mount the C$ drive (I read a writeup for this):

I can then switch to the Z: drive to retrieve the flag.

I'm not sure why this is required. 0xdf's writeup mentions that this is running in Constrained mode, but I was a bit too lazy to exploit that :>

PreviousAmbassadorNextAtom

Last updated