HTB | TheFrizz

This is a Windows box. You can find it here

IP - 10.10.11.60

Nmap

└─$ nmap -sT -p- --min-rate 10000 10.10.11.60 -Pn -oA nmap_ports                                                                                                                                        
Starting Nmap 7.94SVN ( <https://nmap.org> ) at 2025-05-07 14:39 IST
Nmap scan report for 10.10.11.60
Host is up (0.25s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
22/tcp    open  ssh
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
9389/tcp  open  adws
49664/tcp open  unknown
49668/tcp open  unknown
49670/tcp open  unknown
56383/tcp open  unknown
56387/tcp open  unknown
56397/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 54.76 seconds

Port 80

Let’s add frizzdc.frizz.htb to hosts file

website

going through the website, we found the Gibbon LMS staff login page http://frizzdc.frizz.htb/Gibbon-LMS/

Foothold/shell

CVE-2023-34598

We have found a **CVE-2023-34598** on the advisory page, and according to that Gibbon v25.0.0 is vulnerable to a Local File Inclusion

We have found a POC on MaddSec GitHub, and according to that

In order to exploit the vulnerability, an attacker would need to manipulate the "q" parameter to query a local file. This manipulation would cause the file to be included in the server's response. However, it's important to note that this exploit is only effective for files located within the installation folder and under specific conditions, which exclude PHP files, for instance.

Let’s try to exploit this, and for that, we will try gibbon.sql

There was no interesting information in there.

CVE-2023-45878

On looking for other exploits, we found CVE-2023-45878 and this GitHub exploit

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).

Let’s clone the repo and try to exploit CVE-2023-45878

and we are able to run commands on the shell

shell as w.webservice

Now let’s try to get shell

We found the database credentials in config.php

MySql

We have found mysql.exe and we have the credentials. Let’s try to enumerate databases.

list tables in gibbon

Display table Gibbonperson

We have found salt and an encrypted password for Fiona Frizzle

shell as f.frizzle

The password looks like a SHA-256 hash, which GibbonCMS uses by default:

So the logic is:

cracking password

We need to convert the hash and salt to a format that Hashcat understands.

  • Hash function: SHA256(salt + password)

  • Hashcat mode: 1420 → sha256($salt.$pass)

Let’s create a file (e.g., gibbon.hash) with this and run it with rockyou.txt

And we have cracked the password

shell via tgt

not able to validate credentials via netexex smb and evil-winrm

I have checked that the user exists (maybe the password was old?)

I can confirm the credentials using Kerbrute

So that means the credential is correct.

Since we have the valid credentials, we can forge a ticket and login via that ticket

💡Don’t forget to add below in /etc/krb5.conf

Only put the above in the config file and SSH

And we found user.txt

Privilege Escalation

Bloodhound

Since we have valid credentials, we can use BloodHound to collect data and analyse further

After checking privilege for all the user we found m.schoolbus have a lot of privileges

shell as w.schoolbus

Nothing interesting was found via Winpeas and powerup

Let’s look for hidden files

we found some zip files

I tried many ways to copy, but none of them worked, in the end, I had to use Meterpreter.

  • Make a reverse TCP payload via msfvenom

  • Copy it to the Windows box

  • Start Meterpreter handler and execute that payload

  • Once we have Meterpreter shell, we can copy the file

I was able to extract $RE2XMEG.7z

found some credentials

It was base64 encrypted so I could decrypt and get the clear text password

Let’s use Kerbrute to find the correct user name.

But first let’s get the list of username

Now we can copy the list to users.txt and perform passwordspary is Kerbrute

we found a match M.schoolbus

Let’s perform the same tgt stuff we did for f.frizzle

Administrator privilege

From the whoami /groups output, we know we are frizz\\Group Policy Creator Owners

This means we do have permission to create Group Policy Objects (GPOs) in the domain.

By default, members of the Group Policy Creator Owners can:

  • Create new GPOs

  • Edit or delete GPOs they created

GPO Abuse

Now we have to use SharpGPOAbuse to add us to the administrator group, and for that, we need to

  • Create a GPO named pain.

  • Link it to the DOMAIN CONTROLLERS organizational unit in the FRIZZ.HTB domain.

  • Make sure the link is enabled so that the GPO takes effect on all objects within the OU (ie, domain controllers).

Now we have to download SharpGPOAbuse and execute it

Now, ideally, we need to logoff and login again for this to take effect, but in our case (since we are on HTB and it has multiple instances), we cannot do that

So we will use RunasCs because we are getting a permission denied when trying runas

RunasCs is an utility to run specific processes with different permissions than the user's current logon provides using explicit credentials. This tool is an improved and open version of windows builtin runas.exe

And we have root.txt

PreviousHTB | HazeNextHTB | Puppy

Last updated