We start by fuzzing the virtual host of the web server, revealing a hidden portal virtual host. portal.variatype.htb exposed the .git directory, thus, we are able to retrieve credentials from the git history. In order to achieve remote code execution, we take advantage of a arbitrary file write vulnerability in variatype.htb to get a web shell as www-data. There is a backup file that reveals that fontforge is in use. This version of fontforge is vulnerable a remote code execution vulnerability. By placing a malicious crafted file in the target directory, we get a reverse shell as steve. steve has sudo permissions to execute a python file as root. Unfortunately, the setuptools module in use is vulnerable to arbitrary file write, which we use to write a SSH key into the /root/.ssh directory. We can now SSH into the machine as root.
I recently had to research a bit about DevSecOps in GitHub, so no better time than now to revisit GitHub Advanced Security and related security tools.
With the provided credentials, access the file share. In the Logs share, we can view many log files, one of which contains additional credentials. However, we need to change the password a bit and cannot use it straight away. From there, we perform targeted kerberoasting on a service user and retrieve its TGT. We can use it to winrm into the machine. Moving on, we notice a scheduled task. We retrieve the executable to examine it. This allows us to hijack one of their DLLs to get a reverse shell instead. Finally, we combine WSUS, certipy and a method to dynamically update the DNS on a Windows server to get a SYSTEM shell. Yep, it ain't easy.
An exploration about malware based on VSC Extensions
An explainer of something I learnt in Cisco's SDSI course
