{"uuid": "96cfbac8-3777-4037-846c-9c83c433d2e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28252", "type": "seen", "source": "https://t.me/timcore_hacking/2834", "content": "#hackthebox \n#htb \n#hacking\n\n\nHackTheBox - Aero\n\n00:00 - Introduction\n00:56 - Start of nmap\n04:20 - Looking for Windows Exploits around Themes and discovering ThemeBleed (CVE-2023-38146)\n06:30 - Creating a DLL that exports VerifyThemeVersion and then compiling from Linux\n10:50 - Showing the exports of the DLL to confirm it is there, then hiding the ReverseShell export\n12:30 - Testing our DLL from our windows computer\n13:30 - Creating the malicious Windows Theme\n17:20 - Setting up a SOCAT forward to send port 445 from our linux box to our Windows Box\n19:20 - Updating the IP Address in our DLL and then getting a shell\n22:10 - Downloading the PDF by converting it to base64 and then copy and pasting it to our box\n23:45 - Researching CVE-2023-28252, which is a Windows Local Privesc in the Common Log File System (CLFS) and patched back in April 2023\n26:30 - Opening the CLFS Exploit up in Visual Studio and placing a Powershell Web Cradle to send a reverse shell and getting Root\n32:30 - Beyond root: Changing up the DLL we used for the foothold to just execute code upon DLL Attach and not export anything.\n\nhttps://www.youtube.com/watch?v=g01cZciFI9o", "creation_timestamp": "2023-10-07T09:33:24.000000Z"}