Outdated

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 -Pn 10.129.193.194
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-10 13:54 EDT
Nmap scan report for 10.129.193.194
Host is up (0.012s latency).
Not shown: 65512 filtered tcp ports (no-response)
PORT      STATE SERVICE
25/tcp    open  smtp
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
8530/tcp  open  unknown
8531/tcp  open  unknown
9389/tcp  open  adws
49667/tcp open  unknown
49689/tcp open  unknown
49691/tcp open  unknown
49693/tcp open  unknown
49950/tcp open  unknown
49961/tcp open  unknown
59064/tcp open  unknown

SMB Enumeration

Using guest credentials, we can find some shares:

Also, we know that this is a WSUS machine. The Shares share has a single PDF:

When we view the PDF, it talks about how the systems are vulnerable to some CVEs, and that we have to send an email to itsupport@outdated.htb for it.

We have to sent a link to web applications, meaning someone will click on our links. We can start with researching the vulnerabilities listed in the PDF. The first CVE (also known as Follina) is an RCE vulnerability that makes use of a HTML file that the user has to click to execute arbitrary code.

This looks like the one that we need. I used this PoC below:

LogoGitHub - chvancooten/follina.py: POC to replicate the full 'Follina' Office RCE vulnerability for testing purposesGitHub

All we have to do is create a docs file that runs a command to give us a reverse shell:

Then, we need to send an email to the user:

After waiting for a little bit, we should get a hit on both HTTP servers (one for exploit, one for

nc.exe) and get a reverse shell:

Privilege Escalation

We can't grab the user flag yet, so let's look around.

Shadow Credentials

We didn't have much privileges or access to files on the machine, so let's use Bloodhound to map the domain out and view the privileges that we have. In this case, we have to download SharpHound.exe onto the machine and get the files:

Then we just need to transfer this file over to our machine via copy. Afterwards, start neo4j and bloodhound, then upload the data. We can find the privilege escalation vector here:

The AddKeyCredentialLink is exploitable using Shadow Credentials.

LogoShadow Credentials | Red Team Noteswww.ired.team

We have to download whisker.exe onto the machine. First, we can compile it in VS Code 2022 using a Windows machine. Then we can download this back to our Kali machine and put it on the machine.

Then run this:

This should output a huge command for Rubeus.exe.

Download and run Rubeus.exe with that command, and we should get a hash to use:

Using that NTLM hash, we can PTH and evil-winrm in.

Grab the user flag.

WSUS Admins

When we enumerate the groups we are in, we find that we are within the WSUS Admins group:

For this, we can use SharpWSUS to enumerate and exploit anything:

LogoIntroducing SharpWSUSLRQA

Also, rather interestingly, we have PsExec64.exe within the user's desktop:

I use HTB VIP, so this is not placed by another player. We might need to use this later. Anyways, we can download SharpWSUS.exe using these commands:

We can run an inspect command to enumerate:

Then, we can run this command that uses PsExec.exe to add ourselves into the administrator group.

Then we need to wait for a while until the update installs. We can check when it installs using this command:

Once installed, we will see that we are the part of the Administrators group.

Then, all we need to do is relog in using evil-winrm and we can access the root flag:

Alternatively, we can dump the hashes from the entire domain:

PreviousOphiuchiNextPassage