Certified Red Team Professional (CRTP) is an Active Directory-based red teaming certification. The course, titled “Attacking and Defending Active Directory: Beginner’s Edition,” serves as an introductory guide to understanding and executing Active Directory attacks and defenses. The course is taught by Nikhil Mittal. In this blog post, I will review the course and share my experience with the course materials, lab environment, and exam.
Welcome to Part 3 of our blog series on Adversarial Machine Learning! In this installment, we will delve into the intricacies of the Projected Gradient Descent (PGD) method—a powerful iterative technique for crafting adversarial examples. We will explore how PGD enhances the Fast Gradient Sign Method (FGSM) by iterating and refining the perturbations, leading to more robust and effective attacks. I will also provide a step-by-step code implementation of PGD using PyTorch and compare the attack success rates of FGSM and PGD.
Machine Name: Manager IP: 10.10.11.236 Difficulty: Medium
Summary
Manager is a medium difficulty machine that starts with enumerating usernames and password spraying them to login to MSSQL shell. The MSSQL shell was used to fetch a configuration file containing user credentials that were used to obtain the user shell. Privilege Escalation consisted of abusing the Active Directory Certificate Services (AD CS) misconfiguration to issue an administrator certificate that was used to obtain the TGT hash and authenticate as administrator.
CozyHosting, an easy machine, initially involves understanding its SpringBoot application, discovered through a generic error page uncovered during directory enumeration. Further exploration revealed sensitive SpringActuator endpoints, leading to the acquisition of a session token belonging to user KAnderson. Leveraging this token facilitated the theft of the user’s session, providing access to the admin’s dashboard featuring an exploitable SSH configuration. Exploiting the SSH configuration vulnerability allowed for remote code execution (RCE) and subsequent acquisition of a shell. The next step involved decompiling a JAR file, uncovering plain-text database credentials that enabled access to the Postgres database. Within the database, user hashes were uncovered and subsequently cracked to unveil the user password, granting entry as Josh. Finally, privilege escalation was achieved through an SSH sudo misconfiguration, facilitating the acquisition of an interactive shell as root via SSH.
Machine Name: AppSanity IP: 10.10.11.238 Difficulty: Hard
Summary
AppSanity is a hard difficulty machine that starts with subdomain enumeration and manipulation of the registration process. Utilizing JWT for session hijacking, the journey led to SSRF and finally gaining a user shell through bypassing file-type restrictions. For privilege escalation, analysis of the ExaminationManagement.dll revealed a registry key, providing user credentials. Reverse port forwarding via Chisel unveiled the service on port 100, enabling exploitation of DLL hijacking to escalate privileges and eventually access administrator shell and root flag.
Keeper is an easy machine which starts with logging into a Request Tracker dashboard using default credentials and discovering SSH user credentials. A KeePass database file is discovered which is then cracked using the CVE-2023-32784. Although the credentials for root are obtained from the exploit, the password needs to be used along with a key to log into SSH. The key found is a putty key which needed to be converted to OpenSSH key format to log in as root.
What once seemed an impossibility a year ago became my reality on the 21st of January, 2024. After a grueling four-month training block involving running and weight training, achieving a half-marathon personal best at 01:52:58 and a sub 03:55:00 on my debut marathon is still something I’m unable to process. In this blog, I aim to reflect on my unfathomable experience of running the Tata Mumbai Marathon 2024.
Machine Name: Sau IP: 10.10.11.224 Difficulty: Easy
Summary
Sau is an easy machine that starts with discovering a port that runs Request Basket. The application is vulnerable to an SSRF which led to discovering the Mailtrail application running on port 8338 was being forwarded. The Mailtrail application was vulnerable to an unauthenticated command injection. The RCE was obtained by chaining the SSRF to redirect us to the vulnerable “/login” page where the payload was injected. Privilege Escalation involved abusing sudo right to run systemctl as root.
Pilgrimage is an easy machine which starts with identifying the ImageMagick tool that the target web application uses to shrink images. The tool is vulnerable to Arbitrary File Reads which enable us to fetch the credentials from a database file. These credentials were used to SSH and gain a user shell. The privilege escalation consists of exploiting Binwalk that runs inside a cron script.
Topology is an easy machine which starts by exploiting LaTeX injection to read files on the server that contain password hashes. After cracking the password hash, it was possible to login via SSH and obtain the user flag. The privilege escalation consisted of enumerating for processes that are run by root. One of the processes being run by root executed “.plt” files in a particular folder to which the user had write permissions. Finally, it was a simple matter of looking up the documentation on running OS commands for that particular extension and use it to gain a shell as root.
Machine Name: Jupiter IP: 10.10.11.216 Difficulty: Medium
Summary
Jupiter is a medium machine that starts with discovering a subdomain that retrieves data from the database using queries sent through the request, making it vulnerable to SQLi. The SQL injection is leveraged to gain a shell as user Postgres. A configuration script writable by Postgres, and run by Juno is used to gain a shell as Juno. Juno is a part of “science” group which uses Jupyter Notebook. The Jupyter service is run by Jovian. The logs of Jupyter can be read by Juno, which are used obtain tokens to login to the Jupyter Hub. The notebook is used to execute commands and gain a shell as Jovian. To escalate privileges as root, a binary which can be run using sudo, uses a configuration file which can be written by Jovian. This misconfiguration is leveraged to gain a shell as root.
Machine Name: Format IP: 10.10.11.213 Difficulty: Medium
Summary
Format is a medium machine that starts with discovering two ports that run Gitea and a Microblog respectively. First, an LFI is discovered on the Microblog after reviewing the source code. Further analysing the source code, one could bypass the mechanism to become Pro user and upload image files. One of the parameters that causes LFI creates a new if it doesn’t already exist. This allowed writing a PHP shell through which a shell was obtained as www-data. A redis server running on a socket was discovered and used to obtain credentials for the user “cooper”. Privilege escalation involved exploiting a python format string vulnerability for a script that could be run using sudo.
Machine Name: Snoopy IP: 10.10.11.212 Difficulty: Hard
Summary
Snoopy is a hard machine that starts with discovering subdomains through DNS zone transfer, and exploiting an LFI to obtain site configuration files that revealed mailserver secret key. The key was used to update the mail server’s DNS records to receive mails on my local SMTP server. The mattermost subdomain discovered had an “email password reset link” page. The password was received on the SMTP server for user cbrown. Authenticated session of mattermost provided an option to interact with the server through SSH which was intercepted to perform a man-in-the-middle attack to fetch the SSH credentials of cbrown. The user cbrown could run “git apply” command as user sbrown which was exploited by using a known vulnerability that uses symbolic links to access files of the user running Git. This was used to write the SSH public key into sbrown and gain a SSH shell. Privilege escalation involved exploiting ClamAV’s XXE vulnerability to fetch the private key of root.
MonitorsTwo is an easy machine that starts with exploiting the Cacti monitoring software to gain a shell. The shell obtained is a container host where we find hashes of user in a database file. After cracking the hashes, we obtain the user shell through SSH. Privilege escalation consists of leveraging insufficient permissions on the Docker overlay2 filesystem which allows host users to run privileged binaries on the container. To create a setuid bash binary on the docker container, capsh’s capabilities were misused to gain privileges as root. Finally, the binary was executed on the host machine to obtain a root shell.
Machine Name: OnlyForYou IP: 10.10.11.210 Difficulty: Medium
Summary
OnlyForYou is a medium machine that starts with discovering a subdomain that is vulnerable to LFI. The LFI is used to read the source code of the application. Improper sanitization of user data in the a part of code that executes shell commands was leveraged to gain a shell as www-data. From this shell, two active ports were found, one of which hosted a login page that used default credentials. The dashboard revealed that the application uses Neo4j database. This information was used to test for Cipher injection. The cipher injection was successful and was used to gain password hashes from the database. The cracked hashes were used to login as user John. Privilege escalation involved abusing the “pip3 download” command that could be run as root by the user.
Folklore has always occupied a sacred corner of my heart, a realm where stories traverse cultures, touching lives with its timeless tales, is nothing short of being magical. It never ceases to fascinate me. More so, when folklore is told in other forms of expression like music, than in writings. Paar Chanaa De is one of my all time favorites from Coke Studio that references the Sohni Mahiwal tale and expresses the pain of separation and longing for one’s beloved. In the spirit of preserving this tradition of retelling folklore, this is an attempt to relive the tragic Sohni Mahiwal and touch the very ache of separation. Delicately sieving through myriad accounts, skimming over a few, I present to you, in fleeting elegance, the essence I could glean from this timeless tale:
Busqueda is an easy machine that challenges you to read code, find the vulnerability, and craft syntactically correct payloads that suit the code when injected. The privilege escalation is straight forward and explores relative path hijacking through SUID scripts to get root.
Forest is a easy machine that starts with enumerating usernames through LDAP and performing Kerberoasting on that user. After cracking the TGT hash, we obtain the user shell. The privilege escalation involved mapping the Active Directory domain and understanding the group memberships and permissions that could be exploited. WriteDACL permissions were discovered for one of the groups which was abused to perform the DCSync attack to dump the hashes and finally pass them to gain the administrator shell.
Machine Name: Agile IP: 10.10.11.203 Difficulty: Medium
Summary
Agile is a medium machine that starts with discovering a LFI which was leveraged to gain information required to crack the Werkzeug pin. The werkzeug pin allowed console access which allowed us to gain a shell as www-data. A config file revealed MySQL database credentials. The credentials for user corum were found which were used to SSH into the box. Enumerating further, it was found that chrome was running a remote-debugging-port at 41829 which was port forwarded to attacker machine which allowed us access to an existing session of the application. The credentials for user edwards was found here and were used to SSH into the box. Privilege escalation to root involved exploiting the sudo version 1.9.9 which was used to execute a writeable script running as root.
In a dimly lit bar amidst the soft haze of smoke and melancholic tunes of jazz, a girl enters. The door swings open, and a gentle breeze carries the fragrance of damp earth and raindrops, creating an ambience that embraces people midst the cold season. She wears a crimson coat that stands out beautifully against the muted colors of the interior. The tinkling of a bell above the door announces her arrival, momentarily breaking the spell of the piano’s melody. Her steps are graceful, barely audible over the lilting jazz. Making her way to the counter, she settles onto a barstool, capturing the attention of everyone around. The bartender, skilled in reading people, senses the woman’s unspoken longing as he pours her a cup of coffee.
