{"uuid": "c08f4d76-6ff9-4b20-b4f0-6322d62d53bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-26923", "type": "exploited", "source": "https://t.me/snatch_info/129", "content": "CyberSnatch, part 1\n\ud83c\udfafReport on the search for vulnerabilities in the local network of ixperta.com, further called \u201ccompany\u201d\n\nInformation:\u00a0\nSlovakia,\u00a0Consumer\u00a0Services\nRevenue:\u00a0$63\u00a0Million\u00a0\nhttps://www.zoominfo.com/c/ixperta-company/369154620\u00a0\nPhone\u00a0Number:\u00a0\n+421\u00a02/322\u00a0927\u00a011\u00a0\nWebsite:\u00a0\nwww.ixperta.com\u00a0\n\u00a0\n\u265fWe found the company's domain on the Internet. By enumerating sub-domains, we found a VPN access point with an address vpn1.ixperta.com. It was a VPN router from Cisco. After conducting reconnaissance of the company in the open network, we were able to find the mailing addresses of their employees. Removed the domain from the address and got a valid login for the Active directory service. By spraying passwords on the logins we found, we gained access to this account \n\nlogin:\u00a0tomas.daniel\u00a0\npassword:\u00a0#JohnvonNeumann7800\u00a0\n\n\ud83c\udfb3 The company uses default settings in the remote VPN access point, and any user from the \"domain users\" group has the right to connect to the VPN point, in addition, no user is in the DMZ zone and by default sees all machines and all open ports on the network.\n\n\ud83c\udfb0 Having found the primary domain controller at the address 172.16.55.100 with the name brndc02.ixperta.local (with the help of the same user tomas.daniel), we completely polled the LDAP server and received all the information about the domain and its objects. \n\nNext step we requested information about the certification authority located at 10.10.10.2 PRGDC01.ixperta.local.\nThe server turned out to be vulnerable to CVE-2022-26923, and having received a certificate with elevated privileges, and we obtained a copy of the ntds database using impacket\nsecretsdump 'ixperta.local/administrator@PRGDC01.ixperta.local' - hashes :a1qw5e8d11e619a41b38fbb938yiy6fb\nWe managed to hack 3 domain administrators account passwords from that database. Got hash for 'administrator@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden \u2013 R@mm$te1n\nGot hash for 'a_nikodem@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden \u2013 R@mm$te1n\nGot hash for 'a_admin@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden - Duben2021 First of all we began to gain a foothold in the system, we hung the first backdoor on their exchange server and web shells were installed at the following addresses https://owa.ixperta.com/owa/auth/exchangeServerErrorSvc.aspx.aspx https://owa.ixperta.com/owa/auth/forgotpassword2.aspx.aspx\n\nOn server 10.20.10.22: brnex03.ixperta.local Cobalt beacon was thrown. At the end we installed hidden AnyDesk on brqb084a.ixperta.local and Money3s.ixperta.local servers.", "creation_timestamp": "2023-08-18T11:00:39.000000Z"}