Kringlecon23 writeup
07 Jan 2024
Below are a couple of SANS Kringlecon challenges I thought were interesting and wanted to share notes on.
Linux privesc
Just wanted to write-up one of the more interesting challenges; A Linux privesc;
We don't have the sudo binary so sudo -l fails;
We list suid binaries with:
$find / -type f -writable -user root 2>/dev/null
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/mount
/usr/bin/expiry
/usr/bin/newgrp
/usr/bin/su
/usr/bin/wall
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/umount
/usr/bin/passwd
/usr/bin/simplecopy
/usr/sbin/pam_extrausers_chkpwd
/usr/sbin/unix_chkpwdQuickly we see the simplecopy binary which isn't usually there.
simplecopy -h tells us how it works.
We run:
And we're now root!
In /root we can now run the ./runmetoanswer binary
Certificate shenaningans
So the Azure app generates a signed public certificate if we pass it our public key (skipping the rsa command to generate it).
Once on the host, we use the azure metadata api to get a token (I tried a lot of privesc stuff first but nothing worked)
With the token now working, we list subscriptions and resource groups we have access to:
No results... No worries, curl -v to the rescue!
Looks like I was using the wrong api version. Changing this to 2023:
We get a github link.
The python code shows that if we don't pass a principal in the post request, it uses the default one (elf); if we pass it one, it will use the new principal we gave it.
Ok alabaster is using admin as a principal. Quick edit in Firefox:
And we're good to roll! We can now use the admin ssh cert we got to authenticate as alabaster.
And we see our flag "Gingerbread".
Active directory
For the AD challenge, we learn from one of the elves that we're supposed to use alabaster's account to audit the AD environment the box is on.
Alabaster has impacket installed.
This helped me change the script they have to work on our box and get wireserver.key and payload.pfx
Turns out, this was a red herring and completely the wrong direction. I kept digging and enumerated azure apis I could access. Looks like we have 2 subscriptions.
Digging into the subscriptisions, I had access to azure certificates vault.
With the above we can now list what's in these certificate vaults.
Looks like a powershell script used for boot config. There's credentials in there and dc name and ip.
Nice! Now we have: UserDomain, a username and password, DC IP etc.
We can list all AD Users using impacket GetAdUsers
We find the CA with:
Trying to access the share with elfy doesn't work so we need to try something else.
We list vulns and templates:
So NorthPoleUsers is vulnerable to ESC1
We use the below to generate a cert for wombleycube
We now get the wombleycube hash with a pass the certificate attack:
I couldn't find the smb share so I ended up writing a bash script to bruteforce the ip:
Then I noticed my smbclient was missing a username:
Pass the hash to authenticate to the smbshare:
Boom we're in and have the flag for the challenge inside the super_secret_research folder:
InstructionsForEnteringSatelliteGroundStation.txt
This challenge was super fun and really put my AD and Azure skills to the test. Probably my favorite so far