Blackfield
AD box on HTB.
Enumeration:
Port Scanning:
We will start with nmap scanning:
This time we have less ports, but still those open ports are enough to know that this is a domain controller.
We can identify the FQDN (Fully qualified domain name) from that nmap scan, but we can also use for example netexec to view it:
So I will add the hostname and domain and their corresponding IP address to the hosts file:
We do not have any interesting shares permissions with guest user:
But since we have read permissions over IPC$ share which is enough to perform some RPC queries/enumeration, including users on that system.
AS-REP Roasting:
We can use multiple tools such as netexec or impacket-lookupsid to get the users:
Every domain has its own SID, so how this works, it obtains the SID of the target domain, and then incrementally try to reverse lookup (SID + RID), for example the administrator has the RID of 500, it checks if S-1-5-21-4194615774-2175524697-3563712290-500 exist, and then resolve that SID to an account user.
We can save this result and using some tools to extract the users only:
I will try to check if one of those users has no preauth required enabled using impacket-GetNPUsers, and get his asrep ticket:
We have one of the users is as-rep roastable, lets grab his hash and attempt to crack it with hashcat:
BloodHound:
Now the time for bloodhound:
Lets ingest bloodhound data with netexec, and then upload it to bloodhound:
Start bloodhound:
Abuse ACL:
We will find the support user that we have owned, has force change password acl over audit2020 user, I will use bloodyAD this time to change this user's password:
See if the password has been changed correctly:
Now if we enumerated the shares again:
We have read permissions over an interesting share that we have not before (forensics), lets see what it has:
It seems some forensics investigation happened, because we can see some txt files have not useful information to us, and the tools directory has some memory forensics tools, but the third directory, we will explore an interesting zip file that is the lsass process dump which normally has some secrets we can dump and use for lateral movement for example.
Lateral Movement to svc_backup:
We can use mimikatz on our own desktop or any variations of mimiktaz, I will use pypykatz to analyze the dump the secrets contained inside lsass.dmp:
I used lsa module, and specified minidump argument to tell pypykatz to use lsass.dmp dump.
Here we have svc_backup nt hash, and DC01$ nt hashes but non of them worked, also non of them was the machine itself nt hash.
We can confirm if svc_backup nt hash is still valid using netexec:
Also bloodhound shows that svc_backup is member of the Remote Management Users, so we can WinRM to the target machine:
Also:
We are member of the Backup Operators, and have SeBackupPrivilege, and SeRestorePrivilege privileges, which will help us create a backup of the whole system including the ntds.dit file, and then download it with the system registry hive, and finally extract the secrets inside of it:
Privilege Escalation:
Diskshadow & robocopy:
Diskshadow creates copies of a currently used drive, while Robocopy copies files and directories from one location to another.
We will use this script alongside with diskshadow utility:
With this script, we will create meta.cab file to store the metadata such as creation date, time, copy size, etc.
Next we will set the context of our backup to be clientaccessible, so we can access it after the script ran, and persistent which means it will persist even if the machine was rebooted.
Then we will intiate our back with begin backup, and we will include the whole C: drive.
Lastly create to start creating our backup, and expose our backup as a network drive with the letter, and finalize the backup operation with end backup.
So lets upload that script to the target machine:
I will pass that script to the diskshadow utility to create the shadow copy that will create a snapshot of the drive while the files are in use.
We will notice that it did not complete, and one of the set verbose on characters was missing, this is because linux uses LF line ending, whereas windows uses crlf, so we first need to replace lf with crlf, and to do that I will use unix2dos command:
And we will upload it again, and try to perform the backup again:
This time it worked.
Now we can use robocopy windows utility, to copy the ntds.dit file from newly created drive O:
We will also save the system registry hive to our current working directory:
Then download both to our kali vm:
Using impacket-secretsdump we can dump the hashes:
Here we have the domain administrator ntlm hash, which we can use to authenticate, I will use impacket-wmiexec this time:
And we can read the flags:
Last updated