DarkCorp
Detailed Walkthrough
Initial foothold
Upon establishing a connection to the VPN, the tester initiated the assessment by performing a service enumeration. This process revealed and HTTP service running on 80/TCP port, which is redirected to drip.htb .
Additionally, The ffuf tool was executed which successfully discovered a subdomain associated with the host.
Adding the subdomain mail.drip.htb to the hosts file and navigated to it, it was discovered an RoundCube instance running under the subdomain.
The tester created a new user account and successfully authenticated to the Dripmail application.
Once authenticated, it was identified drip.darkcorp.htb as an additional subdomain, an email account support@drip.htb, Roundcube version 1.6.7, and confirmed the presence of two Roundcube plugins: filesystem_attachments and jqueryui installed on the application.
Contact Form Misconfiguration
Further enumeration on http://drip.htb revealed a /contact endpoint that was improperly misconfigured. The tester intercepted requests using Burp Suite and confirmed that the recipient parameter is fully user-controllable, allowing messages to be sent to arbitrary addresses without proper validation.
To confirm this behavior, the tester sent a post request to /contact to the account previously created as recipient and retrieved a confidential note which revealed a new user account bcase@drip.htb.
Stored Cross-Site Scripting (XSS) in Roundcube Webmail
Later during the enumeration phase, a stored cross-site scripting (XSS) vulnerability was discovered in the Roundcube webmail instance, affecting version 1.6.7. This vulnerability allows an attacker to inject a malicious payload into the webmail system, which is triggered when the target opens the affected email, resulting in the exfiltration of the entire webmail content.
Using this information, it was downloaded the exploit associated to the vulnerability CVE-2024-42009 and executed. Which successfully exfiltrated private emails for bcase@drip.htb
and revealed a new subdomain, dev-a3f1-01.drip.htb, exposing additional avenues for further exploitation.
Abusing the Forgot Password funcionality and CVE-2024-42009
While navigating dev-a3f1-01.drip.htb, a password-reset function was identified and chained with the Roundcube stored XSS (CVE-2024-42009), allowing the bcase@drip.htb password to be reset.
Using the credentials, the tester successfully authenticated on dev-a3f1-01.drip.htb.
Discovering SQL vulnerability
During assessment of dev-a3f1-01.drip.htb, it was identified a SQL injection vulnerability associated to Psycopg2 within the query (search) parameter along with a web application firewall (WAF) implemented.
Exploiting SQLi Injection
To bypass the WAF and gain access to the system, the tester crafted an obfuscated payload and sent it, resulting in the compromise of the server.
Access internal Network
Decrypting GPG files
During server enumeration, it was a retrieved the application configuration file containing database credentials for the dripmail_dba account:
Along with a SQL database dump located at /var/backups/postgres/dev-dripmail.old.sql.gpg and GPG keys for the postgres user.
The tester used the credentials obtained from the environment file to successfully decrypt the backup:
The decrypted backup contained sensitive application data, including entries from the Admins table. Several credential hashes were extracted from the dump and subsequently cracked using hashcat, retrieving plaintext credentials for multiple users.
Credentials found:
victor.r:<SNIF>
ebelford::<SNIF>
Setting up tunneling with sshuttle
After obtaining ebelford’s credentials, it was discovered an internal network route for 172.16.20.0/24.
A quick ping sweep confirmed multiple live hosts on the subnet, indicating an internal networ worth pivoting into.
To access to the internal network from the tester’s machine, the tester established a SSH-based tunnel using sshuttle:
Compromise WEB-01
Once the tunnel was established, Internal Active Directory enumeration was performed to map domain objects and identify escalation paths. The tester used dnschef to spoof internal DNS responses and bloodhound-python to collect LDAP data and build an attack graph, which revealed domain users, groups, GPOs and computers for further analysis.
Executing Certipy
Additionally, certipy-ad was used to enumerated Certificate Authority configuration which identified a potential ESC8-related vulnerability on DARKCORP-DC-01-CA.
NTLM relay, reverse tunnelling & ESC8 abuse
During internal enumeration, it was also identified that WEB-01 (172.16.20.2) was susceptible to NTLM relay attacks because SMB signing was not enforced.
An attempt to add a DNS record directly via LDAP (to support ESC8) failed due to insufficient privileges for victor.r:
The 172.16.20.2 server was running an application on WEB-01 which apparently made a HTTP authentication that could be used to relay an HTTP authentication to DC-01 via ntlmrelayx tool to create the fake DNS and abuse of ESC8 by requesting a Machine certificate to finally request a Service Ticket as Administrator and compromise the WEB-01.
Setting an Reverse PortForwarding
To abuse the NTLM relay authentication, the tester had to set up an Reverse Port Forwarding using chisel to redirect all the incoming connections from drip.dark.htb to tester's machine which in turn relay the authentication to add the fake DNS.
Once configuration was completed, the tester proceeded to run impacket-ntlmrelayx and perform the authentication request by triggering through Real Time Status Monitor application, successfully adding the fake domain.
Abusing ESC8
After the DNS record was added, it was utilized krbrelayx and PetitPotam to coerce the authentication and abuse of ESC8 to generate a WEB-01 machine certificate.
Using certipy-ad tool, it was possible to extracted the web-01$ NTLM hash computer account.
Requesting Ticket Service as administrator on WEB
By utilizing the web-01$ computer account, the tester request a TGT using S4u2self to impersonate administrator and generate a TGS for CIFS service and compromise the server via impacket-wmiexec.
Compromise domain controller
By reviewing the BloodHound output, it was identified that the user taylor.b.adm was a member of GPO_manager. That group had delegated permissions (WriteOwner, GenericWrite, WriteDacl) over the SECURITYUPDATES GPO. These privileges created a plausible path to escalate privileges by modifying the GPO to execute code on domaim controller.
Extracted administrator credentials
With no leads on how to compromise taylor.b.adm, the tester performed a brute‑force attack against the account using kerbrute.
Bypassing AV
After authenticating as taylor.b.adm, the presence of antivirus software on the system was identified. To bypass it, a loader was crafted in C++ using a combination of techniques, including Early Bird Injection, Function Call Obfuscation, Sandbox Evasion, and shellcode encryption.
Based on discovered GPO privileges and acquired credentials, SharpGPOAbuse was used to add a computer scheduled task to the SECURITYUPDATES GPO, which in turn executed a custom Cobalt Strike beacon, resulting in the compromise of the domain controller.
Credentials
tester
<SNIF>
User registration
DripMail webmail
dripmail_dba
<SNIF>
SQLi
postgresql
victor.r
<SNIF>
PostgreSQL backup
ebelford
<SNIF>
PostgreSQL backup
DRIP Local User (SSH)
taylor.b.adm
<SNIF>
Brute Force
GPO_Mananger
👤 Users wordlist
🔑 Password wordlist
Subdomains / Hosts
drip.htb
10.10.11.54
nmap scan.
mail.drip.htb
10.10.11.54
Discovered via VHost enumeration
drip.darkcorp.htb
10.10.11.54
Extracted from Message headers
DC-01.darkcorp.htb
172.16.20.1
Domain Controller
Host Discovered
drip
10.10.11.54
DC-01
172.16.20.1
WEB-01
172.16.20.2
Scans
Scripts / Automation
Flag Discovered
Root
10.10.11.54
Administrator
GPO Abuse
<SNIF>
d
Last updated