HackTheBox - Bastion — Transcript

Full transcript

1. 0:00what's going on YouTube this is a hip
2. 0:01sack and we don't bash them from hack
3. 0:02the box which is set up like a bastion
4. 0:04host some people call them jump boxes
5. 0:06essentially the idea is you create one
6. 0:09super secure box that's absolutely
7. 0:10hacker-proof for all your users to
8. 0:13remote into in order to access things on
9. 0:15the other side so let's say I'm at home
10. 0:17and I want to access things on the
11. 0:18corporate network instead of leaving my
12. 0:21corporate Windows workstation exposed to
13. 0:23the Internet
14. 0:24I'd just leave a bastion host exposed
15. 0:27and then from home I can SSH into the
16. 0:29bastion host which is dual homed and I
17. 0:31can then create a port forward to access
18. 0:34my workstation that's essentially the
19. 0:36idea the main drawback is a bastion host
20. 0:39by definition is one host so if that
21. 0:42host ever gets compromised all the
22. 0:44credentials that access it also get
23. 0:45compromised which often is domain admins
24. 0:47and they normally can get into a lot of
25. 0:50things that technology has kind of been
26. 0:52replaced by the web browser because you
27. 0:54can do almost anything in the web
28. 0:55browser especially with no VNC guacamole
29. 0:57etc you can just create virtual
30. 1:00environments that contain users choose
31. 1:02specific places and don't give them a
32. 1:05whole environment so you're not sharing
33. 1:07credentials if you don't want to do that
34. 1:09you got things like virtual application
35. 1:11streaming so you can just stream them
36. 1:13the app they need and then if you want
37. 1:15to go even more you can do like a Remote
38. 1:17Desktop gateway so when they remote
39. 1:19desktop in they get their own
40. 1:21environment so again if that environment
41. 1:23ever gets compromised it commbuys is
42. 1:26just their credentials it's not sharing
43. 1:28a host for everyone so with all that
44. 1:31being said let's go exploit a bastion
45. 1:33host as always we begin with a and maps
46. 1:37are - SC for default scripts SV
47. 1:39enumerate versions hue output all
48. 1:41formats pin the end map director and
49. 1:42call it bash 10 and then the IP address
50. 1:45which is 10 10 10 134 can take some come
51. 1:48to run so I've already ran it look at
52. 1:50the results we have a few ports open
53. 1:53the first thing is SSH on 422 and that's
54. 1:56running OpenSSH for windows SSH on
55. 1:59Windows is a bit unique but hey it's
56. 2:01there so definitely take note of it then
57. 2:04we have a procedural call on ports 135
58. 2:07and 139 nothing too interesting there
59. 2:09then this mics off - des which is SMB on
60. 2:13point for four or five and interesting
61. 2:16enough there's no web servers so I
62. 2:18believe the biggest attack surface right
63. 2:20now is SMB so that's where we can begin
64. 2:23SSH generally has authentication and
65. 2:26I've never seen like guest access to SSH
66. 2:29or anonymous access but I have seen
67. 2:31anonymous access to SMB so let's go and
68. 2:33try that out first thing I'm going to do
69. 2:36is SMB client - Capra l - where shares
70. 2:40then slash slash ten ten ten one thirty
71. 2:42four and then for the past four I'm just
72. 2:45gonna hit enter and it will list the
73. 2:47shares the admin C and IP C are all
74. 2:51defaults backups is a unique share so
75. 2:54I'm going to mount backups with mount -
76. 2:57t CIFS which is the like Windows
77. 3:01protocol for mounting I think SMB FS may
78. 3:04work as well I honestly don't know the
79. 3:07difference between CIFS and SMB FS but
80. 3:10back to the point but the mount point
81. 3:13which is ten ten ten one thirty four
82. 3:15slash backups and then where do you want
83. 3:17to mount it to so I'm gonna make the
84. 3:19directory /mnt
85. 3:21slash SMB and then we'll mount it there
86. 3:25and then password just hit nothing for a
87. 3:29guest authentication and if we do LS /
88. 3:33mount SMB we see files
89. 3:36there's also SMB map which we could use
90. 3:38if you don't want to use SMB client so
91. 3:41that'd be SMB map - capital H ten ten
92. 3:44ten one thirty four and the first thing
93. 3:48it does I believe is like anonymous
94. 3:50access which we get denied if you
95. 3:52specify any user name it doesn't matter
96. 3:54which one it will try guest access and
97. 3:57we can see files the interesting thing
98. 4:01to note though is I believe it attempted
99. 4:04to write this directory so let's do LS /
100. 4:07mount / SMB and we see that directory
101. 4:11exists because it says the permissions
102. 4:13are readwrite so it tests to write but
103. 4:16it doesn't have mission to delete so
104. 4:19always keep in mind what your tools do
105. 4:22and if your defender
106. 4:24also know what tools do because you can
107. 4:26create IO cs4 indicators of compromise
108. 4:28but if we try to remove this we get
109. 4:32access to nine and we can verify that it
110. 4:34does indeed create a random file by just
111. 4:37drawing that same command again and if
112. 4:40we do LS la mount SMB will see the
113. 4:45second file it attempted to create so if
114. 4:48I was creating some type of IRC for this
115. 4:50I just like monitor shared drives and
116. 4:53the root directory for things that are
117. 4:56let's see probably 10 characters long so
118. 5:01that couldn't help detect SMB map usage
119. 5:04on your network but it's also a reason
120. 5:08why sometimes I prefer just using like
121. 5:10the dumb tools like SMB client instead
122. 5:12of automated things because typically
123. 5:14those don't make mistakes like that and
124. 5:19that may not be a mistake but always
125. 5:22know what your tools do so let's just
126. 5:25get back on topic and go through this we
127. 5:27have no dot txt so I'm going to see what
128. 5:30that file is if we cat it out it says
129. 5:33sis admins please don't transfer the
130. 5:35entire backup locally while on a VPN or
131. 5:37office is just too slow for that so if
132. 5:40we do like a D u - H s to see the size
133. 5:45and then let's just go into that
134. 5:48directory oh it's 5.1 gigs so they don't
135. 5:51want you copying five gigs over the
136. 5:53network that's fair so let's just go
137. 5:56through this we got the Machine name ll4
138. 5:59m pj e - PE i've got pc if we go do it
139. 6:04nmap scans that will probably say it
140. 6:07here NetBIOS computer name is Bastion so
141. 6:12a little bit different we got a backup
142. 6:15of this PC but the computer name and add
143. 6:18map at least is bashed in so let's keep
144. 6:22going through this we do have a backup
145. 6:25so let's check this l LS la and there
146. 6:31are a few files so right here the
147. 6:34interesting files are probably gonna be
148. 6:35v HD virtual
149. 6:37drive and there's two options we could
150. 6:39do we can do like 7zl to list files and
151. 6:437-zip has the ability to go and view the
152. 6:46files of a VHD file so we can see this
153. 6:49and we can see all the paths given that
154. 6:53it's only got system boot that is
155. 6:55probably the boot partition that's
156. 6:57backed up so let's go to the next one
157. 6:59down and this will be FBC for this one
158. 7:03is FPC 3 so it's just a guin but let's
159. 7:06try the other petition and this one is
160. 7:09probably much bigger if we do DHS stir
161. 7:11this one one is the 5j petition you can
162. 7:15do 7-zip here as well and then you could
163. 7:18do like 7z space X to extract it but
164. 7:23typically it's just a pain working with
165. 7:267-zip and this can be a little bit slow
166. 7:28so I'm gonna pause the video will let
167. 7:30this view all the files and then we're
168. 7:32just gonna mount the VHD soon zip has
169. 7:36finished and we can look at all the
170. 7:38files it shows and it shows us pretty
171. 7:41much a Windows install but there's just
172. 7:43so many files to go through and search
173. 7:45it's a pain
174. 7:47so let's mount this did you mount a VHD
175. 7:50on linux use guest mail and I don't have
176. 7:54that installed so I'm gonna do app to
177. 7:55install Lib guest FS - tools and install
178. 8:00this well that installs there is one
179. 8:04thing I missed that I probably would do
180. 8:06if I was on an engagement if we did SMB
181. 8:08map
182. 8:09- you does not exist and then - H 10 10
183. 8:1510 134 if I saw this readwrite on like
184. 8:21backups or pretty much readwrite
185. 8:23anywhere I probably create a dot SCF
186. 8:26file if you have unfamiliar with that we
187. 8:29showed it in sizzle essentially it's a
188. 8:32method to do steal hashes so when a user
189. 8:36views a directory that has that SCF file
190. 8:38if the SCF file is specifically created
191. 8:42you can force them to try to connect it
192. 8:44back to your machine and when they do so
193. 8:47they may perform an authentication if
194. 8:48they perform an authentication get the
195. 8:50hash
196. 8:50crack it so being on the back abstractor
197. 8:53in particular is super useful because
198. 8:55the people who view backups are probably
199. 8:57admins so if you put an SCF file there
200. 8:59and an admin goes you may get an admin
201. 9:01hash so definitely check out the sizzle
202. 9:04video for that it's not gonna work on
203. 9:06this box because there's no automated
204. 9:07process looking at that directory but I
205. 9:10was hoping the tool would finish by the
206. 9:13time I explained that it didn't so I'm
207. 9:16gonna pause the video again and we'll
208. 9:17just resume when this is done once Lib
209. 9:21guest FS tools is done we can mount the
210. 9:23drive so we'll do guest mount and then -
211. 9:27- ad specify the VHD file do - -
212. 9:33inspector - - read-only and you could do
213. 9:38- beef of a bose just to make sure it's
214. 9:41doing something
215. 9:42oh we had specify a directory so let's
216. 9:45do make to mount a VHD and we'll mount
217. 9:49it there so it's going to take probably
218. 9:54a minute to two minutes to mount and
219. 9:57just spew a bunch of stuff to tech the
220. 10:01screen so we'll just let that mount and
221. 10:04resume the video when this is done when
222. 10:07the command finishes you'll be back at a
223. 10:09command prompt so now we can go into
224. 10:11slash mount VHD where we mounted it and
225. 10:13doing LS here shows we're at the C Drive
226. 10:17so the very first thing I'm going to do
227. 10:18is go into the users do an LS and we got
228. 10:23the l4m pje user and we can look at what
229. 10:28files are here so we can do like find
230. 10:31desktop documents downloads and then do
231. 10:37like - LS to list all the files and we
232. 10:40see really nothing too interesting so
233. 10:46one thing we could try to do is extract
234. 10:49maybe the administrator password to this
235. 10:51guy so if we go into Windows then
236. 10:56system32
237. 10:59and then config we have a few files
238. 11:03important ones are I believe Sam and
239. 11:06system and these are the registry hives
240. 11:10if you like H key local machine whatnot
241. 11:13I think the user database is in the Sam
242. 11:18but the boot key which the user database
243. 11:21is encrypted is in the system so that's
244. 11:23why you need that one and if you're only
245. 11:25the main control you'd also want to grab
246. 11:26like NTDs did and if you have all three
247. 11:30files NTDs Sam and system you can
248. 11:32extract the Active Directory database
249. 11:34but for now we're just on the box so
250. 11:37we'll do that root H GB boxes and then
251. 11:42bash them so let's go into that
252. 11:47directory and we can make a directory
253. 11:53backup doll and move those files there
254. 11:58go in here and we can do I think it's
255. 12:03secrets dump or in packet - secrets dump
256. 12:07- Sam the file name system the file name
257. 12:12and then local and here we go we have a
258. 12:17few hashes the first thing I notice is
259. 12:19the administrator hash is blank 31 d6
260. 12:22means nothing
261. 12:23same with aad 3 B as a LM hash LM is it
262. 12:27used a more so that's why you see it
263. 12:28always blanked out but this being
264. 12:31blanked out means administrator account
265. 12:33is probably disabled so we do have a
266. 12:36hash for a user and we can check if he
267. 12:44has write access over the sieve all or C
268. 12:46dollar sign if he does then we can
269. 12:49probably use PS exec and get
270. 12:51administrator if he doesn't then want to
271. 12:53find another way so I'm doing - H - test
272. 12:57as a hash flow again and this does pass
273. 13:00the hash so a paste the whole hash in
274. 13:03and then - capital H is the host name 10
275. 13:0510 10 134 maybe it's just - P and that
276. 13:10uses some regular expression there we go
277. 13:12hash to tack
278. 13:13so we see we authenticated but the admin
279. 13:17has no access si has no access backup
280. 13:19still has the same so we didn't get
281. 13:21anything there was that SSH login so
282. 13:24let's try to decrypt this hash and see
283. 13:27if we can log in via SSH so I'm just
284. 13:29gonna go to hashes org we can do hash
285. 13:33search and then search hashes org for
286. 13:37this so ki 2 D 9 u 0 and we see the
287. 13:44password is something so V dot creds l
288. 13:514m p je i think is the username what did
289. 13:57I use here l4m pje yep so we got a
290. 14:02password so let's try ssh l 4m p je @ 10
291. 14:0810 10 134 to see if they allow SSH to
292. 14:11log in yes ok creds copy this paste and
293. 14:22there we go
294. 14:24we are now on the box so the first thing
295. 14:27I'm gonna do is net local group
296. 14:30administrator administrators and we see
297. 14:36the members of the administrators group
298. 14:38is administrator which is odd because it
299. 14:42looked like this account was disabled so
300. 14:45we can do net local group or not net
301. 14:48local group net user l 4m p je to see
302. 14:51what groups were a member of I believe
303. 14:54it says there we go local group
304. 14:56membership users so let's check net user
305. 15:01administrator and we can see he has
306. 15:07logged on he does have a password last
307. 15:11set date of April 16th so what I'm going
308. 15:15to do is go back into the VHD and we're
309. 15:20going to see the dates of those files so
310. 15:23LS la and we can see
311. 15:27grab Sam the Sam was last modified
312. 15:31February 22nd and the system was
313. 15:37modified February 22nd as well the
314. 15:40password was updated in April so this is
315. 15:43an old backup and that's why the
316. 15:45administrator account was blank now but
317. 15:48now it definitely looks like there is
318. 15:49one so we have to figure out how to
319. 15:52reverse things I'm gonna do is run a
320. 15:56tool called jaws and just another
321. 15:57Windows enumeration script that's on
322. 16:00PowerShell so we'll get hub to find it
323. 16:03and install it I had installed Kali
324. 16:07again so I don't have all my tools
325. 16:09we can't opt you can see it's rather
326. 16:12bare so go into drawers we can do python
327. 16:18m simple HTTP server and then look at
328. 16:23our IP address which is probably ten ten
329. 16:25fourteen three it is so we can do
330. 16:32powershell and then IX new object net
331. 16:39web client download string HTTP ten ten
332. 16:45fourteen three four eight thousand jaws
333. 16:50a new mess one I think that's the name
334. 16:53of the script there we go now it's
335. 16:56running well that runs let's just see if
336. 16:59we can get another session to this box
337. 17:02because it can take a while and you
338. 17:05should always be doing recon in the
339. 17:07background and working while you do
340. 17:09recon it's getting a lot of permission
341. 17:15denied but we don't care about that
342. 17:16right now we are enumerated box so going
343. 17:21to go into the root of C actually let's
344. 17:24just check users we got the
345. 17:28administrator user and l4 m p je we
346. 17:33didn't have a flag I think and the
347. 17:35desktop of the background
348. 17:36of the background
349. 17:40back up so let's check if we have a flag
350. 17:43here so l4m pje CD desktop dir
351. 17:50you got user text there says it's 32
352. 17:52bytes so chances are that is the flag
353. 17:56let's look at what is in documents
354. 18:02nothing you can check all the
355. 18:04directories I don't think you'll find
356. 18:05anything so let's go to the root of C
357. 18:07and see what's here
358. 18:08we got backups for you look in backups
359. 18:11this is the share so nothing too
360. 18:14interesting there you got logs looking
361. 18:17in quite a few of that logs and things
362. 18:21but I'm going to ignore these because
363. 18:24look at the date September 12 2016
364. 18:30wasn't it like February something and
365. 18:33recent so chances are these logs are old
366. 18:36so I could care less about them because
367. 18:40we know the administrator change his
368. 18:41password after then at least I think it
369. 18:44was 2018 let's check net users
370. 18:47administrator yeah that'll last at 2019
371. 18:52so looking at file dates is generally a
372. 18:56good thing to do so I'm gonna go into
373. 18:58Program Files do I dir and see what's
374. 19:01here we have the OpenSSH directory
375. 19:04powershell nothing too interesting
376. 19:07we can check Program Files x86
377. 19:14dir and there's an application that
378. 19:18looks unique M remote ng and this is
379. 19:22just a like I think it's imagine a tool
380. 19:27that manages a bunch of putties it's
381. 19:29just a remote desktop management tool or
382. 19:32something I've used it before a long
383. 19:35time ago don't exactly remember but
384. 19:37going on the theme of bashed in it's a
385. 19:40remote management tool and generally
386. 19:43people use Bastion host as a jump box
387. 19:45and you load remote management tools on
388. 19:48it so they can access other equipment
389. 19:50Bastien doesn't really serve any purpose
390. 19:51other than getting into other places so
391. 19:56let's go and google em remote ng extract
392. 20:02password so we got this view M remote
393. 20:08passwords M remote password recover so
394. 20:13let's see is there anything here recover
395. 20:20easy I don't want to download something
396. 20:23off some guys Dropbox account so let's
397. 20:26do instead of extract password decrypt
398. 20:29password and going down we get a blog
399. 20:34post that says M remote ng password is
400. 20:36insecure and then links to this post and
401. 20:39if we go over it we can see there is a
402. 20:43specific version of something where it's
403. 20:46saying you can reverse the encryption
404. 20:51this blog post has something different
405. 20:53and installs M remote ng and here you go
406. 20:56you can see the connection
407. 20:57this is saying Remote Desktop so it's
408. 21:00going to open up Remote Desktop and
409. 21:01probably put the password on your
410. 21:03clipboard so you can paste it in so what
411. 21:07they did is they say hey instead of
412. 21:10opening remote desktop which is M stsc
413. 21:13open up CMD and then echo me the
414. 21:16password variable which is what I would
415. 21:18put in your clipboard or paste in or
416. 21:19whatnot we're going to do this box a
417. 21:21little bit differently because I don't
418. 21:22want to load up windows I'm going to do
419. 21:24a offline decoder so I'm just going to
420. 21:26search github M remote ng decrypt and
421. 21:32we'll go to the first one and use this
422. 21:34guys Python script so let's go back to
423. 21:38this pane we can stop posting jaws I
424. 21:42guess and do get clone Emmert ng decrypt
425. 21:50and yes I know that I already have not
426. 21:53wanted to download a Dropbox thing and
427. 21:55then immediately get cloning something
428. 21:57from github and just executing without
429. 21:59reading the source
430. 22:00irony's not lost on me there but we can
431. 22:05look at this and it needs this string of
432. 22:07the password so that's what we have to
433. 22:08find we have to find the string of the
434. 22:11password and if you read the blog post
435. 22:14it's in the config file so generally in
436. 22:19Windows config files for users or stored
437. 22:22an app data which is in the user
438. 22:24directory so CD / users l4m pje I think
439. 22:29dir slash a will list all files
440. 22:31including hidden so that's where you can
441. 22:33see app data if you don't have the slash
442. 22:36a you don't see it but we go into app
443. 22:39data and then normally it's in roaming
444. 22:42and we can go em remote and G dir and
445. 22:47here we go we got a bunch of configs
446. 22:49with some backups so I'm just gonna do
447. 22:51type to cat the file
448. 22:55there's the XML I'm going to search for
449. 22:58password so username l4m pje here's this
450. 23:05password and let's try decrypting it so
451. 23:08we'll do Python 3mm remote ng string
452. 23:11paste this this credential looks similar
453. 23:15we already had that so let's go see if
454. 23:18there's another one that's just my bad
455. 23:25search for password hit and to do next
456. 23:30and just keep going up until we see
457. 23:31something interesting and right here I
458. 23:34see a different base 64 string this use
459. 23:37name is administrator so let's copy this
460. 23:41and do the same exact thing so python 3
461. 23:45- s paste and then we get a different
462. 23:50password so i'm going to do
463. 23:52SMB matt - you administrator - p for
464. 23:57password - h for host 10 10 10 134 and
465. 24:01we see
466. 24:03now we can read and write to admin a see
467. 24:06dollar sign so we should be able to do
468. 24:08like in packet - PS exact do I don't
469. 24:13have that impact it I guess I don't have
470. 24:17it installed locate PS exec PI user
471. 24:25share is it here not on my path
472. 24:32use a shared dock pass on
473. 24:35- and packet we could also just SSH in
474. 24:40but I wanted to use in packet so PS
475. 24:44exact up PI okay administrator at 10 10
476. 24:4910 134 paste the password request in the
477. 24:53shares uploading the file and as long as
478. 24:56antivirus or something doesn't stop this
479. 24:58we should get a shell well that goes we
480. 25:01can just SSH administrator at 10 10 10
481. 25:04134 and now we're rushing to who get the
482. 25:09shell first PS exact or my SSH session
483. 25:13come on let's go down ping 10 10 10 134
484. 25:23nope
485. 25:23just going slow paste it in can only
486. 25:27imagine would be like downloading that 5
487. 25:29gigabyte file come on
488. 25:32eventually something will let me in as
489. 25:35that PS exact or this SSH there we go so
490. 25:40Who am I
491. 25:41administrator at Bastion Desktop dir
492. 25:47root dot txt and then we can also CD
493. 25:52users administrator desktop and we see
494. 26:04root
495. 26:05texts it should be important to note
496. 26:08that willing to do PS exact we're
497. 26:10running a system when I do SSH we're
498. 26:12running as the administrator user just
499. 26:16something to keep note of if you use the
500. 26:18I think Windows version of PS exact you
501. 26:21can use remain as the user I don't think
502. 26:24there's a flag in in packets to not
503. 26:27impersonate or yeah not impersonate the
504. 26:30user so let's see maybe there's a help
505. 26:36if there is we can see if there's not
506. 26:41impersonate don't see it so yep but
507. 26:46that'll be the video hope you guys
508. 26:47enjoyed it take care and I will see you
509. 26:49all next week