Coder
Had great help from @Ruycraft1514 for PE.
Gaining Access
Nmap scan:
AD machine! Port 80 reveals a default IIS server, so let's not start from there.
SMB Shares
We can find some null shares that are readable with smbmap:
The most interesting one was the Development one which contained some files. We can connect via smbclient:
We can download these files for further analysis. Probably need to decode this encrypted file for a password somehow.
Weak PRNG + Keepass
The file is a Windows executable:
So we can port this to a Windows VM for analysis via DnSpy. Here, we can see that the file uses AES for something:
We can take a look at the main function:
Right, so this uses the time. On paper, this is secure, if they didn't reveal the time it was encrypted. Refer to the SMB directory listing and we can see the time the file was uploaded was Fri Nov 11 17:17:08 2022. This becomes 1668187028 when we convert it to the UnixTimeSeconds.
This uses an insecure PRNG generator. With the timestamp as the seed, we can quickly find the correct key and IV needed by just printing it out using some online C# compiler:
Then, we can take these values and upload the file to CyberChef to decrypt it and download it as a 7z file. When extracted, we get a kdbx file, which is a KeePass database and a .key file, presumably for the database.
We can use kpcli without any master password to access this:
It seems we have a URL now. Here's the data from the other fields:
We can now head to that URL.
TeamCity
We would see a login page, and we already have credentials for it:
Then, we would see a 2FA Mechanism in place:
I wasn't sure how to go about finding this, so I just brute forced it because it doesn't seem to have any account lockout. I used Burp Intruder to do this:
This works, but is hella slow.
Better Brute Force
Use this to generate all possible codes:
Capture a request from Burpsuite for the POST request and then feed it to ffuf:
Then just monitor the output file for any entries that end up inside. This would be the correct code used. This takes around 10-20 minutes, which is a lot faster.
Then we can login!
AMSI Bypass + PS Shell
TeamCity is a CI/CD dashboard, and I'm 99% sure we can gain access by building some kind of project that executes code on the computer. Just need to find out how.
When checking the build that we have, we can upload a file here:
I read more here:
In short, a unified diff file would allow us to append more stuff to the end of the current build, which is obviously not good. Some further enumeration revealed that this uses Powershell.
The answer is simple. Include some small Powershell code that would execute some commands to download a reverse shell. So I created a quick diff file like this to test:
Uploading it and running gives me this:
Success! I tried to download and run Invoke-PowerShellTcp but it didn't work. Probably is some kind of firewall or security features present on the site. As such, we need to include another Powershell script to bypass it.
On my research, I found this super useful repository:
Using their bamsi.txt, we can bypass the AMSI that is (probably) present on the server via unload amsi.dll.
Then just upload this file with a basic Powershell reverse shell, and it would work!
User Access
I should note that this is a rather unstable shell...and it quits on you VERY frequently due to the operation timing out on TeamCity.
TeamCity Administrator Fail
Now that we have access as the service user, we don't have access to anything special. Reading more about administrators in TeamCity, I came across this:
Based on this, we just need to head to C:\TeamCity\logs and run type * | Select-String "Super user authentication token".
Following the instructions, we would gain access as the administrator of TeamCity rather easily.
As the administrator, we see some additional stuff like this thing:
ADCS? Might need this for later. Anyways as this user, we can add new build steps on the builds. I simply added a new step whereby it would execute the same powershell as above.
But running just seems to give me a shell as the service user still. But at least the shell never times out unless I want it to.
Finding Credentials
Reading online tells me that there's a Data Directory present within TeamCity, and we can view that through Administration > Global Settings. Because we upload .diff files, there is likely a folder that stores all the changes made. We can find the file here:
This is a Powershell Secure String encoding using a key. We can decode this here if you're lazy after some formatting:
Decrypting this would give us the user's credentials as remote Powershell was being used here. It also tells us that evil-winrm can be used to login since the user is part of the Remote Management Group.
This would decrypt to give ypOSJXPqlDOxxbQSfEERy300, which we can easily use to evil-winrm in as the user and capture the user flag.
AD Privilege Escalation
PKI Admins
The user had access to these groups viewable from net user e.black:
PKI Admins sounds like the next step in the exploit chain. Also, earlier we found some kind of ADCS thing we had to use.
Active Directory Certificate Services provides customizable services for issuing and managing digital certificates used in software security systems that employ public key technologies.
If you're unfamiliar with what this does, you can read more here:
The first thing we need to do is to enumerate all possible certificates to find what is vulnerable within this machine. This can be done using certipy.
Unfortunately, there won't be any vulnerable templates that we can exploit because none of the templates present give us any enrollment permissions. Since the user is part of PKI Admins, we can take a closer look at the role and infer what permissions we have. I used Bloodhound to map the permissions, and didn't find much apart from this:
So e.black can manage templates for the ADCS instance. Since we could not find any templates to abuse, perhaps we can add one. We just need to find a template for a certificate, add it and give PKI Admins enrollment rights to abuse this and request an administrator TGT.
We can use this tool to do so:
Next, we need to find a JSON certificate template. Since we are adding a new certificate template with custom permissions and name based on our own implementation, we can use an ESC1 template. This one here works for the machine:
Download the Powershell and JSON files to the machine and perform the following:
What these commands do is:
First generate a blank template file, then copy over the contents of the ESC1 JSON to create a certificate template file
default.jsonthat would be compatible with the machineCreate a new ADCSTemplate file using
default.jsonand allow the PKI Admins group to have enrol permissions.
Afterwards, we can run certipy to get a PFX file for the administrator. Keep in mind to do these steps fast because there's a scheduled task resetting the certificates.
This would retrieve the administrator PFX for us to use. We can then use this to retrieve the NT Hash for the administrator and login using evil-winrm:
Rooted!
Last updated
