Edge
Challenge Lab (Medium) - by Ryan Yager
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
Vantara is a private company formed in 2024 by Billionaire Blairo Maggi's nephew, Ênio Rezende, under the Hut 8 / private equity umbrella. It operates as a hyperscale data center and AI infrastructure company.
Vantara is positioning itself as a vertically integrated AI infrastructure provider owning the physical layer (land, power, buildings) through to the compute layer competing in the same space as CoreWeave, DataBank, and similar operators.
You have been asked to conduct a Penetration Test against the organization.
Initial Access
The client wants you to do an "assumed breach" pentest, so they have provided you with starting credentials.
Summary
Summary
In Edge, we begin with assumed-breach credentials jmorris:Fabricat!on2024 against the Windows host VantaraOps at 10.1.21.36. Initial enumeration via rustscan piped into Nmap reveals SMB on 445, RDP on 3389, WinRM on 5985, and MSRPC endpoints on 135 and 49670. Authenticating through evil-winrm as jmorris yields an interactive session but no special privileges, so we pivot to a process inspection that confirms Microsoft Edge is running and recall the recently discovered behavior on Edge about that it loads all saved passwords into memory in cleartext.
We cross-compile Dkob's edgeSnapper.cpp against a locally staged processsnapshot.h header, upload the resulting edgeSnapper.exe to the host, and execute it to dump the in-memory credential store. Validation with NetExec confirms a working set for svc_vdi, and while WinRM is denied, RDP succeeds. This brings us into a kiosk-mode control center rather than a standard desktop. On the support tab we identify a hyperlink advertised as browser-handled; clicking it spawns a browser window, where entering C:\windows\system32\cmd.exe into the address bar triggers a download of the binary that we then launch, escaping the kiosk into a full cmd shell as svc_vdi.
Inspecting svc_vdi's Documents folder surfaces a putty.conf containing plaintext credentials for svc_vdi_mgmt. NetExec flags the account as (Pwn3d!) against SMB, and we authenticate through evil-winrm to read C:\Users\Administrator\Desktop\root.txt.
Recon
We use rustscan -b 500 -a 10.1.21.36 --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
The target 10.1.21.36 is a Windows host VantaraOps. SMB is exposed via port 445 with message signing enabled but not required. Remote management and access are available through RDP on port 3389 and WinRM on port 5985. The host also exposes MSRPC endpoints on ports 135 and 49670
Access as svc_vdi
We test to get access to the target with the provided credentials and are able to successfully authenticate and get an interactive session with evil-winrm. As that user we do not have any special permissions.
The scenario is called Edge and with the recent behavior discovered by Tom Jøran Sønstebyseter Rønning we want to check for that. Tom Jøran Sønstebyseter Rønning discovered that Microsoft Edge loads all saved passwords into memory in cleartext at startup and keeps them there for the entire session, even for sites the user never visits.
We check for running processes and find Edge running.
To take advantage of this behavior, we use EdgeSnapper, a tool developed by community member Dkob, which abuses the issue to extract the in-memory credentials.
We compile it as shown in the repository. In my case it failed because my cross-compiler did not have the processsnapshot.h header available.
This is not a big issue, a quick workarround can be to download that header and place it in the same directory as the source file.
We try to compile it again and are successful.
We'll upload the executable and run it. We are able to retrieve several credentials.
We test the credentials using NetExec. We successfully authenticated as svc_vdi.
We are also trying to connect via evil-winrm and RDP and are successful with RDP.
Here we are greeted with a custom login after getting a session. Seems like we are in a kiosk mode.
Access as svc_vdi_mgmt
We re-enter the credentials of svc_vdi...
... and are inside a control center.
On the support tab we find something interesting. There is a link and the description says it will be opened by a browser.
We click on the link and might be asked to enter the credentials again. After some tries we get browser window opened.
Now we can enter something like file:///C:\windows\system32\cmd.exe or C:\windows\system32\cmd.exe in the address bar...
...we see the executable being download. From there we can actually access it.
We click on it and get a terminal as svc_vdi.
In the Documents folder of that user we find a putty.conf...
This contains the credentials of the user svc_vdi_mgmt.
We test the credentials using NetExec and see that we are admin.
Next, we try to get a session using evil-winrm, and reach out the the Administrators folder to fetch the final flag at C:\Users\Administrator\Desktop\root.txt.
Last updated