Json

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.227.191
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-30 12:18 +08
Nmap scan report for 10.129.227.191
Host is up (0.0072s latency).
Not shown: 65521 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5985/tcp  open  wsman
47001/tcp open  winrm
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown

Lots of ports open. WinRM is open, so if we get creds we can use evil-winrm.

FTP Anonymous Fail

As usual, when I see FTP open I always attempt an anonymous login, which fails for this machine:

Port 80 -> Enumeration

Port 80 just shows us a login for HackTheBox:

When the traffic is viewed in Burpsuite, we can see a lot of different JS files being loaded as well:

The POST request to /api/token was my first login attempt:

I noticed that in the requests proxied, there wasn't any request to /. When I visit it, the dashboard loads for a brief second before redirecting me to the login page. Weird. Anyways we can take a look at some of these JS files since we don't have any credentials yet.

One of them was particularly interesting:

The app.min.js file was obfuscated JS code. We can deobfuscate it here:

LogoJavaScript Deobfuscatordeobfuscate.io

This bit of code reveals a bit more about how the POST requests to /api/token are processed. We can try to send a POST request with admin:admin as the fields. This returns a request with the OAuth2 cookie set to a JWT looking token:

When decoded, we get this:

Interesting. I tried to login via the normal method and it worked! We can see the dashboard:

The dashboard was static, so there wasn't much to do here.

Deseralisation -> RCE

As per the deobfuscated JS code, there's an /api/Account endpoint within the site. When I logged in the normal way above, I saw one request sent to there.

The response was the same as the decoded cookie value! This means that either the OAuth2 cookie or the Bearer HTTP header value was being deserialised and decoded via base64 or something. If we remove a few characters from the Bearer header, we get an error:

If we remove more characters, we get this error:

There definitely is an insecure deserialisation exploit here, because the values of the Bearer header are likely unsanitised since it still attempts to process it. As such, we can use ysoserial.exe to generate a payload to give us a reverse shell.

LogoGitHub - pwntester/ysoserial.net: Deserialization payload generator for a variety of .NET formattersGitHub

ysoserial.exe has a lot of different gadgets, of which we should be using those that have the Json.Net formatters since we were being returned JSON in the request. This also matches the website, since it is hosted using ASP.NET. We can try to get a reverse shell using smbserver.py to execute nc64.exe.

I tried using this gadget, but it didn't work:

So I tried different gadgets, and eventually the ObjectDataProvider one worked. In my testing, it threw a lot of Powershell errors, so I thought it would be better if we used a Powershell shell instead.

First, let's get the encoded Powershell command:

Afterwards, we can pass this into ysoserial.exe.

Then, we can send the encoded payload as the value of the Bearer header.

This would still return 500, but we would get a GET request for shell.ps1 on a HTTP server and a reverse shell on our listener port!

We can then grab the user flag.

Privilege Escalation

Method 1: Privilege Abuse

We had the SeImpersonatePrivilege enabled for this user:

We can either abuse JuicyPotato.exe or just use PrintSpoofer.exe. Both work. Before doing those, make sure to download nc.exe to get a cmd.exe shell instead of a Powershell one.

We can find the root.txt flag in the superadmin user's desktop.

Method 2: FTP

In the C:\Program Files directory, there's a non-default application present as Sync2Ftp:

The config files contained some encoded stuff:

This uses .NET, so we can download it back to our Windows machine and use DnSpy.exe on it. When loaded, the binary contains some interesting functions:

It appears that it can Decrypt the password that we found in the config file. Here's the decrypt function:

This uses 3DES to decrypt, and since we have the correct files, we can create a Python script that does the same.

With this, we can try to access the FTP server again.

We now have access to the entire file system via FTP and can download the flag via this method.

PreviousJeevesNextJupiter

Last updated