Blazorized Discussion Discussion [HTB] [HINTS]

HackTheBox
1

Let’s discuss Blazorized

2

I’ll try to solve soon

3

Very interesting web framework. I decompiled DLLs and found the JWT Secret. Now I’ll use it to forge new admin tokens.

4

Os command injection is possible on the admin panel. Now looking a way to root.

5

logged into the user RSA_4810?

6

Yes, use BloodHound to enumerate the users. It will take about 2 minutes once you open BloodHound. I’ll write more hints soon. I am preparing them.

7

I have completed all the active ones :slight_smile:

8

Nice, and did you complete all challenges as well?

9

not yet, i have too many pwn, gamepwn and reversing left :laughing: and few other hard ones as well

10

It’d be great if you open a thread when you started a new challenge

11

Yeah sure, will do that

1 Like
12

Here are general hints for Blazorized

  1. Decompile .dll files on the webserver: Use tools like dnSpy to peek into .NET assemblies and find the JWT secret.

  2. Forge an admin token: Use the JWT secret to create a token with admin privileges and access the admin page.

  3. Access the admin page: Set the token in local storage and navigate to the admin page.

  4. Inject OS Command on the Admin Panel: Obtain a shell on the server and read the user flag.

  5. Escalate to RSA_4810: Use BloodHound to find escalation paths, then crack the krb5 hash to get the password.

  6. From RSA_4810 to SSA_601: Set the scriptPath of SSA_601 to a reverse shell script and execute it. Refer here if issues arise.

  7. From SSA_601 to root: Use BloodHound again to find escalation paths to root. It’s just one command away.