HackTheBox — Eloquia

00:00 - Introduction 00:50 - Start of nmap 01:48 - Adding eloquia.htb to our hosts file and looking at the website, the newsletter form is getting blocked by Content Security Policy 03:16 - Wappalyzer shows AngularJS 1.8.2 and Django, the login page offers OAuth with Facebook and Qooqle, adding qooqle.htb to our hosts file 04:23 - Registering an account, Django's common password block list and the csrfmiddlewaretoken name are good ways to fingerprint the framework 05:59 - Testing template injection in our profile, 7*7 shows 49 but Django payloads fail because it's client side (AngularJS). The constructor payload is blocked by CSP (no unsafe-eval) 10:08 - Looking for a way to hit another user, Connected Accounts shows OAuth. Creating an article and seeing Report Article means a bot will view it 12:11 - Testing XSS in the article body with Burp Repeater, img onerror gets stripped but basic HTML like bold tags is allowed 15:11 - Researching AngularJS directives, ng-click with $event.view isn't on the deny list and gets around the CSP to pop an alert 20:30 - Leaking cookies through the comment form (formData.comment and submitForm) using ng-focus, autofocus and tabindex so the bot triggers it. This is unintended, the bot's session cookie isn't HttpOnly so we log in as admin 24:49 - Intended path: explaining the OAuth account linking flaw, intercepting the Qooqle authorize request and manually linking our Qooqle account to a second user with the callback code 29:18 - The code expires quickly so we script it. Building a Python script with requests and BeautifulSoup to log into Eloquia and Qooqle, then grab the OAuth callback code without following the redirect 41:55 - Turning the script into a Flask server that redirects whoever visits it to a freshly generated callback URL 43:46 - Using ng-focus to change document.location to our server, reporting the article and waiting for the bot to link our Qooqle account to admin 49:23 - Logging in with Qooqle as admin, looking at the Django admin panel and using SQL Explorer to identify SQLite (sqlite_version) and dump the schema from sqlite_master 52:46 - load_extension is enabled, pointing it at a UNC path to our box and catching web's NetNTLMv2 hash with Responder (it doesn't crack) 54:13 - Building a DLL with mingw and hosting it with impacket-smbserver. Guest access is blocked, patching smbserver.py to accept the login still fails on SMB signing since we don't know web's password 59:40 - Finding the Manage Article upload in the admin panel has no filter, uploading our DLL and loading it with load_extension for a shell as web (msfvenom gets caught by Defender) 1:01:59 - AppLocker blocks most binaries, enumerating the policy with reg query, then poking around web's home directory and finding Microsoft Edge Login Data 1:05:18 - Copying Login Data to the web root so we can download it, a .db extension doesn't get served but no extension does 1:09:22 - Explaining DPAPI, AppLocker blocks SharpDPAPI and PowerShell but Python is installed, so having Claude write a ctypes script to decrypt Edge's saved passwords 1:14:05 - Logging in with evil-winrm as olivia.kat, then talking about converting SharpDPAPI into a DLL as another way to do this 1:16:14 - Olivia's desktop has Todo.txt (a service gets restarted), a Failure2Ban shortcut and Logfile.PML, downloading the PML through the web server 1:19:15 - Opening Logfile.PML in Process Monitor, filtering out successes shows VERSION.dll is NAME NOT FOUND in bin\Debug and is loaded from SysWOW64, so it needs to be 32-bit 1:22:19 - Compiling a 32-bit DLL, uploading it as VERSION.dll in bin\Debug and getting a shell as SYSTEM when the service restarts 1:25:20 - Talking about why my first DLL didn't work and other paths, racing the restart to overwrite the exe or hijacking the .NET runtime with Failure2Ban.exe.config 1:28:03 - Attempting a .NET AppDomainManager hijack, building the manager DLL with csc and editing Failure2Ban.exe.config 1:37:31 - Troubleshooting the hijack, fixing the namespace/class mismatch from mixing AI outputs, then checking the Failure2Ban logs and discovering the service stopped running 1:45:40 - Since the service isn't running the exe isn't locked, so compiling a reverse shell exe and overwriting Failure2Ban.exe to get SYSTEM again