Administrator
AD box on HTB.
Enumeration:
Port Scanning:
As always we are going to start with nmap:
This time we have port 21 (FTP) open, and nmap could not authenticate as anonymous, because I did not see that in the result, which means we have to find valid username and password.
We will see the clock skew is too great, so I will sync the time with the target machine with nptdate for any further kerberos usage:
Also lets get the domain name and the target machine name, and add it to the hosts file:
We are provided with a username and password to emulate assumed breach scenrios in real world engagements: olivia:ichliebedich.
BloodHound:
As we have domain user, we can start by ingesting the data, and upload it to BloodHound, and I will ingest using both bloodhound-python, and rusthound-ce, because if one misses something the other completes it:
Start BloodHound, and upload the ingested data to it:
Lateral Movememnt:
Mark olivia as owned, and check its outbound object control:
We have GenericAll ACL over michael user, which allows us to do various attacks, such as targetedkerberoast to add an SPN to the target user, and ask for his TGS, and then remove it, or we can perform shadow credentials to dump this user's ntlm hash, or simply what we can do is change this user's password.
I will use bloodyAD to do so:
Confirm the password has been changed successfully:
Move on to michael, and see his outband object control:
So we can change benjamin's password as well.
I will use the same approach:
See this user's groups:
We are part of the share moderators, maybe we can do something with ftp since we are part of this group.
FTP Enumeration:
Try to access ftp with those credentials:
We successfully managed to authenticate as we could not previously do.
Lets enumerate what files or folders there are:
We will find Backup.psafe3 file, and I downloaded it with the ftp get built-in command.
This file is new to us, so we can do some searching to find what is it, and how we can interact or open it:
It is a database.
I searched a little bit and found this htlm web page that tells us about a tool called pwsafe:
And I have it installed on my kali VM.
Lets open that backup file:
I tried multiple default passwords to access the database but could not, so we have to find a way to retrieve the master password.
Search a bit:
We will find that we have hashcat mode that can get the password, or with john using one of its tools pwsafe2john:
Now attempt to crack it:
Here is the password.
Lateral Movement again to emily:
Lets open that database again by specifying that password as the master password:
We can copy the usernames and the passwords, and save them into a file to spray them:
Using netexec:
We find that only emily's password worked for emily's herself.
Check BloodHound again:
We have GenericWrite over ethan.
Domain Privilege Escalation:
This time I will perform targetedkerberoast attack using a tool called targetedkerberoast to set an SPN for ethan, and ask for his TGS, and then remove that SPN:
Attempt to crack his hash with hashcat:
And finally, check ethan's ACLs over other objects:
So ehtan's has replication rights over the domain, so we can perform DCSync on the domain, I will use impacket-secretsdump to do that:
Lets authenticate with the domain administrator ntlm hash:
Get the flags:
Last updated