Active
Today I am going to solve Active box on HackTheBox to prepare myself for the OSCP certificate.
Enumeration:
First we will start with nmap scan to identify what ports are open on the target machine:
To illustrate Nmap options I used:
-sCV: Use nmap default scripts, and scan service versions.
-p-: Scan all TCP ports.
--min-rate: Increase number of packets sent per second.
-vv: Increase verbosity level.
-oN: Output the result to a file.
We can see that we are dealing with an active directory domain controller, and its called DC, and we have multiple ports open, dns on port 53, kerberos on port 88, smb on port 445, ldap on ports (389,636,3268,3269).
I will add the domain: active.htb and the hostname of the target machine DC to the hosts file:
GPP Password Abuse:
Lets enumerate the shares using netexec and will check if we have null session access:
-u: To specify a username.
-p: To specify a password.
--shares: To list out the shares.
We can see that we have read permissions over the Replication share, and via smbclient we can authenticate to that share to view what it contains:
So we have the group policy preference file (Groups.xml) which normally contains a username and an encrypted password that we can easly decrypt it using variaus tools, and I will use gpp-decrypt to decrypt it:
Here we can notice a domain user called SVC_TGS user, and cpassword which has encrypted password that we will pass it to gpp-decrypt tool:
So we have a username and a password, lets check if those credentials are valid using netexec:
That + sign indicate that this is a valid domain user.
Privilege Escalation to Administrator:
Now since we have a valid domain user, we can use bloodhound to find any path that could help us compromise the whole environment.
BloodHound:
I will use rusthound-ce as the ingestor:
Now lets open bloodhound-ce:
I will navigate to file ingest page, and ingest the data rusthound collected:
Kerberoasting:
If we checked kerberoastable users we will find that the administrator is kerberoastable:
Using impacket-GetUserSPNs lets get the administrator TGS:
We will save it to a file and attempt to crack it via hashcat:
We were able to crack the administrator TGS ticket and recover the password.
If we checked netexec with those credentials:
We will see the Pwn3d! which means we are domain admins, lets use impacket-psexec to authenticate to the target machine:
And we can read the flags:
Last updated