AS-REP Roasting でユーザを取得後、 WriteDacl で DCSync し SYSTEM を取得

Searchor の CMDi 脆弱性で user を取得し、sudo スクリプトの相対パス参照を利用して root を取得

I have just owned machine Takeoff from Hack The Box

1回目は侵入すらできずに撃沈。2回目、ヘラりながら10日間粘って受かった CPTS の体験記

Tomcat に既定の資格情報 tomcat:s3cret で入り、Webシェル機能を詰めた WAR をデプロイすることで、 SYSTEM のリバースシェルを獲得

I have just owned challenge Detour from Hack The Box

Garfield is an assume breach Active Directory box with a read-only domain controller hidden on an internal network behind the main DC. I’ll find I can write the logon script path for other users as well as files in the SYSVOL scripts folder, and use that to get a shell as the next user. That user can reset the password on their admin account, which has control over the RODC’s computer object. I’ll get administrator access on the RODC two ways, by setting myself as its delegated administrator through a writable managedBy attribute, and with resource-based constrained delegation. Then I’ll rewrite the RODC’s password replication policy so the domain Administrator can be cached there, and show multiple ways to get Administrator, including forcing replication and forging an RODC golden ticket from both Windows and Linux.

I have just owned machine DutyBound from Hack The Box

The post requests assistance in finding a Discord server where users discuss Sherlock HackTheBox (HTB) machines. The author mentions that Insane difficulty machines are challenging and seeks a community for learning purposes. No specific Discord server or additional details are provided in the post.

MakeSense starts with a WordPress site for a web agency, with a voice call widget that transcribes recordings in the browser. I’ll find an audio file in a listable uploads directory where a user reads their password aloud, and use it to log in. That user can view contact submissions, so I’ll reverse engineer the encrypted voice channel to submit arbitrary transcriptions, using it for XSS against an administrator bot to create my own admin account and get a shell through the plugin editor. A password in the WordPress config gets me the next user. For root, I’ll abuse an OCR web app running as root that saves recognized text to any filename, drawing PHP into an image to get execution. In Beyond Root I’ll look at the bot that didn’t care about mixed content, and how exactly a backdoored WordPress plugin gets triggered.

I have just owned challenge Dark Embargo from Hack The Box

I have just owned challenge Halfmask from Hack The Box

Checkpoint is an assume breach Active Directory box where the starting account has unusual rights over the AD Recycle Bin. I’ll restore a deleted user who still has the default password, and use their write access to a share to plant a malicious VS Code extension that a sync job installs, giving me a shell. BadSuccessor is patched on this domain controller, but I’ll show that the BetterSuccessor technique still works when I can write to the target account, which gets me its NTLM hash. That account can read a share of VMware backups, where I’ll use vmkatz to pull an administrator hash from a memory snapshot, which turns out to be reused by the domain Administrator.

I have just owned machine Autopilot from Hack The Box

Chuletas de pentesting en español: comandos listos para HTB, OSCP y eJPT - chuletaroot-cmd/chuletas

I have just owned challenge Last Call from Hack The Box

Exploited vulnerable PHP version

はじめに この記事は、Hack The Box の MonitorsFour を攻略した際の手順を、再現しやすい形で整理したものです。 大まかな流れは以下です。 ポートスキャンとWeb列挙 APIの情報漏えいからユーザー情報とハッシュを取得 平文パスワードを復元して ...

Eloquia is a Windows box hosting a Django blogging platform that supports OAuth login through a Google clone. I’ll find an AngularJS template injection in article bodies and use AngularJS directives to bypass the content security policy. With that, I’ll get admin access to the site two ways, by stealing the admin bot’s cookie and by abusing the OAuth flow to link the admin’s account to an account I control. As admin, I’ll upload a malicious SQLite extension through the Django admin panel and load it from the SQL Explorer to get a shell. I’ll use Python to decrypt saved Edge passwords with DPAPI and pivot to the next user. That user can write to the folder of a prototype .NET service that runs as SYSTEM, which I’ll abuse three ways, with an AppDomainManager injection in its config file, a DLL hijack, and breaking the service so I can overwrite its executable.