StreamIO

Completed on Sept 22, 2022

Overview

When I decided to work on this machine, I was looking for more options to practice for the OSCP. This machine was to me like hitting the jackpot as you can practice webapp attacks, lateral movement, Active Directory, and most importantly to do a thorough enumeration. With this you can take the fact that it shows you how you can move inwards from a web application to become a Domain Admin in Active Directory.

References

Enumeration

Finding Open Ports

Just like we normally do, we need to enumerate the available services to then continue our enumeration process.

From the service enumeration, we get the following hosts which will be added to our hosts file:

  • streamIO.htb

  • watch.streamIO.htb

LDAP Enumeration

Moving forward with the service enumeration, we would like to see what's available to us through LDAP, but chances are you need to authenticate first.

Not much without credentials, but we can still get some basic information without credentials:

HTTP(S) Enumeration

This part of the enumeration is self-explanatory. We basically need to know what the applications are about and then try to find our way in.

While enumerating we find an email address with a domain we also got to see in our nmap scan and then while enumerating LDAP:

We also have Barry and Samantha as potential users of the environment as they are employees of StreamIO:

While enumerating pages and directories, we found a login pages on /login.php:

Which also leads to a /register.php page which we used to create one but when testing, it did not work. So we need to enumerate the applications' pages and directories from both URLs to get to know more of them.

  • stream.io:

  • watch.streamio.htb:

These pages don't lead to much, and we do have an admin directory, so let's fuzz it and see what's inside if anything:

When accessing this page:

We will get to see later this is sort of a clue of what we will have to do or use.

SQL Injection:

Given what we have, we tried to do some injection on https://streamio.htb/login.php. It is a Time-based SQLi that takes hours to run. Some data was retrieved but not completely. One thing to point out is that through our enumeration for SQLi, we determined this machine is using SQL Server which is important to know.

Through https://watch.streamio.htb/search.php

  • Performing a basic test using: summer' OR 1=1--

  • Union-based SQLi Test: summer' UNION SELECT 1--

Even though it did not throw an error and was not redirected, we retrieved no data. It is possible this is a true positive Union-based SQLi.

  • Attempting to get the number of columns in the table:

From the multiple tests we performed, we were able to determine the table has 6 columns and we can retrieve data through the second one which is possibly a VARCHAR type column.

Query: summer' UNION SELECT 1,(SELECT @@version),1,1,1,1--

  • Retrieving the system user the database is running as:

Query: summer' UNION SELECT 1,(SELECT system_user),1,1,1,1--

  • Retrieving list of databases:

Query: summer' UNION SELECT 1,(SELECT db_name(N)),1,1,1,1--

  • Retrieving list of tables in STREAMIO database: using STRING_AGG to retrieve the list as a one liner:

  • Retrieving list of columns in STREAMIO..users table: using STRING_AGG to retrieve the list as a one liner from the table in the current database (STREAMIO)

  • Retrieving username,password,is_staff content from STREAMIO..users table: using STRING_AGG and CONCAT to retrieve the list as a one liner

Cracking MD5 hashes in database:

Here, we try to crack the MD5 hashes we found in the database using JohnTheRipper:

Some passwords were missed so we had to use crackstation.

Since we have a login page and database credentials, we need to know which one we can use, so we will test with Hydra:

Testing login with yoshihide redirects to /login.php and then you need to browse to /admin manually which will reuse the session cookie:

The /admin page:

From these links, we only see the following, but we can also attempt to fuzz it and see what else:

Using WFuzz:

This did not find ‘message’ which we know exist, but we found ‘debug’:

Local File Inclusion:

Through this parameter, we can attempt to access files through Local File Inclusion if vulnerable:

Using the first as an example shows this parameter can be used for Local File Inclusion

Let's attempt to find php or other files in the current directory of the application:

It returns an error message most probably as the webserver is not able to interpret the file or is restricted. We can encode this and try to retrieve the content:

Using -> php://filter/convert.base64-decode/resource=

Even though we truncated the output, in line 11 you can see the database connection string with hardcoded credentials: db_admin:B1@hx31234567890

Retrieving the contents of /admin/master.php accessed previously:

This basically tell us at the end that through the ‘includes’ POST parameter, we can potentially use it for RFI and execute commands against the system.

Gaining Access

Remote File Inclusion

This user was found in the database but the same credentials don't allow access to the system, but we can use RFI to get a reverse shell.

shell.php:

Execution:

Reverse Shell:

Local Enumeration

Attempting to use the db_admin credentials found after we upgrade to Powershell:

With Crackstation we get the following:

Let's continue by gathering user information:

Lateral Movement

This means we should go for nikk37 and escalate privileges to Martin.

And we finally got the user flag!! Let's proceed to escalate privileges.

Privilege Escalation

In our local enumeration, while running winpeas (not included in the writeup), we found out Firefox is installed and the user nikk37 has a key4.db file which is where passwords could be stored. We will download it to our host and use firepwd to decrypt it:

C:\Users\nikk37\AppData\Roaming\Mozilla\Firefox\Profiles\br53rxeg.default-release\key4.db also need logins.json

With these, we can test them with a user list from the ones found on the machine and test them:

Found valid user/passwd pair: JDgodd:JDg0dd1s@d0p3cr3@t0r

Since we now can access another user that is not Martin, we should probably retrieve data for Bloodhound. In this case, we will use bloodhound-python.

Found Principals with DCSync rights: makes sense as Martin is a Domain Admin

More importantly, JDGodd can read LAPS Password through the CORE STAFF group membership:

But this user is not a member of this group:

We need to add this user to the CORE STAFF group:

But we cannot until we make JDGodd owner of the group and apply the domain object ACLs. For this we will use Add-DomainObjectAcl from PowerView.

Reading LAPS:

Accessing the system as Administrator:

And we got the root flag!!

PreviousSearchNextObject

Last updated

Was this helpful?