Hospital

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.133.177                  
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-19 02:38 EST
Nmap scan report for 10.129.133.177
Host is up (0.0091s latency).
Not shown: 65507 filtered tcp ports (no-response)
PORT     STATE  SERVICE
22/tcp   open   ssh
53/tcp   open   domain
88/tcp   open   kerberos-sec
135/tcp  open   msrpc
139/tcp  open   netbios-ssn
389/tcp  open   ldap
443/tcp  open   https
445/tcp  open   microsoft-ds
464/tcp  open   kpasswd5
593/tcp  open   http-rpc-epmap
636/tcp  open   ldapssl
1801/tcp open   msmq
2103/tcp open   zephyr-clt
2105/tcp open   eklogin
2107/tcp open   msmq-mgmt
2179/tcp open   vmrdp
3268/tcp open   globalcatLDAP
3269/tcp open   globalcatLDAPssl
3389/tcp open   ms-wbt-server
5985/tcp open   wsman
6404/tcp open   boe-filesvr
6406/tcp open   boe-processsvr
6407/tcp open   boe-resssvr1
6409/tcp open   boe-resssvr3
6613/tcp open   unknown
6636/tcp open   mpls-udp-dtls
8080/tcp closed http-proxy
9389/tcp open   adws

Seems like this is an AD machine. I did a detailed scan as well as there were quite a few ports i didn't recognise. Noted that port 3389 for RDP was open.

Lots of output, but basically the domain is hospital.htb and DC.hospital.htb, which I added to the /etc/hosts file.

Web Enum -> PHP File Execution

Port 443 just shows a Webmail login, of which I had no credentials yet:

Default credentials don't work, so I moved on. Port 8080 shows another service with a login, but this time I could make an account:

Based on the background, it looks like a management service for a health provider (hence the box name). It also ran on PHP.

After logging in, there is just a file upload feature:

Based on the fact that this runs on PHP, I tried to upload a PHP webshell using various methods. The upload feature only accepts image files by default.

First, I did a gobuster scan to find where the files went:

So it is in the uploads directory. Doing some basic null byte injection followed by changing the extension to .phar seems to work, as it redirects me to success.php:

I actually forgot this was a Windows machine and tried to upload the basic PHP reverse shell, which resulted in this error:

At least I know that .phar execution works, allowing me to upload a file to execute phpinfo to find the functions that might be banned:

Interestingly, the web server is running on a Linux instance despite the machine being labelled as Windows.

When checking all the functions, it seems that popen and fread are not disabled, allowing me to upload this:

The above allows some basic form of commands to be run:

Using this, I replaced the shell with a basic rm mkfifo shell and it worked!

To Windows

Basic Enum -> Ubuntu Escalation

I found some credentials for an SQL service within some configuration files:

There was also another user present:

Since this was an AD machine, this user might be present on the DC. When checking uname -a, I found that this machine was running an Ubuntu instance vulnerable to CVE-2023-2640 & CVE-2023-32629:

This PoC was similar to another machine on HTB, and to become root, just run these two commands in a writeable directory:

Replace id with /bin/bash -i to get a root shell:

Shadow Hash -> Webmail Login

As root, I could read the /etc/shadow file:

To crack this, I used unshadow:

I tried to login as drwilliams@hospital.htb on the webmail instance on port 443, and it worked.

There was one email, and it contained this:

.eps and GhostScript signifies that I might have to send a phishing email to gain RCE as another user.

Searching for 'Ghostscript exploit' returns this as the first result:

LogoGitHub - jakabakos/CVE-2023-36664-Ghostscript-command-injection: Ghostscript command injection vulnerability PoC (CVE-2023-36664)GitHub

Since we already accessed the Linux part, I assumed that now was time for the Windows portion, hence I used a powershell reverse shell:

Firstly, generate the file.eps payload:

Then, construct an email to drbrown with the file as an attachment:

After sending, I immediately got a shell as drbrown:

Privilege Escalation

RDP Privileges -> Admin Creds

The user was part of numerous remote management groups:

At the start, I took note that RDP was open, and this user happaned to have RDP privileges. It's highly probable that the creator did this on purpose.

In the directory the shell was spawned in, there was a .bat file that contained credentials:

Using this, I could RDP in as the user, which showed the login page for the Webmail instance.

There's a program running to execute the login of the Administrator, and it periodically types in the password. While it was typing I could view its contents by clicking on the 'view password' button, which I took a picture of using my phone:

Using this, I could evil-winrm in as the administrator:

Rooted!

PreviousDriveNextManager

Last updated