In this post, I would like to share a walkthrough of the Napper Machine from Hack the Box
This room will be considered a Hard machine on Hack the Box
What will you gain from the Napper machine?
For the user flag, you will need to initiate the process by locating a username and password mentioned in a blog post, and leveraging this information to gain entry to an internal blog platform. This platform discusses a legitimate IIS backdoor known as Naplistener, specifying local execution. Utilizing Napper, I will locate Naplistener and develop a tailored .NET binary. This binary will execute upon interaction with the backdoor, facilitating access to a shell.
As for the root flag, you need to locate a preliminary blog post detailing an in-house solution aimed at replacing LAPS, which stores passwords within a local Elastic Search database. I will develop a Go program tasked with retrieving both the seed and the encrypted blob. Subsequently, I will generate the key from the seed and employ it to decrypt the blob, ultimately revealing the password for an admin-level user. Additionally, I will utilize RunasCs.exe to circumvent UAC and secure a shell with administrator privileges.
Information Gathering on Napper Machine
Once we have started the VPN connection which requires a download from Hackthebox, we can start
┌─[darknite@parrot]─[~/Documents/htb/napper]
└──╼ $ nmap -sC -sV 10.10.11.240 -oA initial
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-13 23:09 EST
Nmap scan report for 10.10.11.240
Host is up (0.47s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Did not follow redirect to https://app.napper.htb
443/tcp open ssl/https?
| tls-alpn:
|_ http/1.1
| ssl-cert: Subject: commonName=app.napper.htb/organizationName=MLopsHub/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:app.napper.htb
| Not valid before: 2023-06-07T14:58:55
|_Not valid after: 2033-06-04T14:58:55
|_ssl-date: 2023-11-14T04:10:15+00:00; +1s from scanner time.
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 64.52 seconds
┌─[darknite@parrot]─[~/Documents/htb/napper]
└──╼ $
Let’s access the website interface
However, it doesn’t look as organized as a proper website page
When trying to access the subdomain of app.napper.htb, it looks much better interface
I did notice that the website is been powered by Hugo
Therefore, let’s enumerate the directory on the website but mostly all the output has been directed to app.napper.htb
As a result, let’s enumerate the vhost by using the gobuster but nothing appears on the output
I did notice that port 443 is open so let’s enumerate the subdomain with the HTTPS wildcard
Let’s access the subdomain of internal.napper.htb but it requests a credential to be input
There should be some credentials on the app.napper.htb website interface. Let’s explore the website to find any useful information
Nothing looks interesting on this post.
I noticed some posts on the last page containing PowerShell commands that provide potential credentials.
As a result, let’s enter the credentials that we found earlier.
At last, we have successfully accessed the internal.napper.htb website interface
Naplistener vulnerability
While we analyze the post shown above, I notice there are some web requests which we can investigate further.
Let’s access the page and try to inspect the packet via BurpSuite
Let’s change the request from GET to POST add the sdafwe3ree23= and see the response of the packet. It responds with Found which shows the website is a valid connection
We should compile the cs file into the exe file format
Once we have successfully compiled the file, let’s encode it with the base64 command
We can copy-paste the base64 command and we also need to URL decode which it should trigger the reverse shell connection
The file should be transferred to the Python server
Boom! Finally, we have retrieved the reverse shell connection back to us.
We can read the user flag by typing the “type user.txt” command
Escalate to Root Privileges Access
Let’s explore more on the file stored within the C:\TEMP\www\Internal\content\posts directory
There is an Elastic URI which uses port 9200
Other information can be found inside the no-more-laps.md file which provides some details on Elastic
We can execute the Port Forwarding on our attacker’s machine
As a result, let’s start our chisel client on the victim’s machine
I managed to find the elasticsearch-8.8.0 within the Program Files
From the information above, I notice there’s an extension of seed and user-00001
Let’s access the localhost that uses port 9200 on the browser
I managed to find some information on the elastic page that is shown in the screenshot above
The screenshot above shows how to decrypt the data stored in the ES to retrieve the most recent password of the backup user.
Let’s upload the. RunasCs.exe file into the victim’s machine
We will be using the RunasCs.exe command which will trigger the listener to our machine
After a while, the reverse shell connection back to us
We can read the root flag by typing the “type root.txt” command
Leave a Reply