Escape
AD box on HTB.
Enumeration:
Port Scanning:
We will start with nmap:
I will sync the time with the target using ntpdate:
Lets get the FQDN of the target:
I will add it to the hosts file with its corresponding IP address:
Shares:
First we will enumerate the shares with guest session via netexec:
We have one non-default share called Public, we also have read persmissions over it.
I will use smbclient to interact with this share:
We have one pdf file.
Lets open it up:
We will find credentials for the new hired employee: PublicUser:GuestUserCanWrite1, and with those credentials we can authenticate to the database.
Exploitation:
Check if those credentials are still valid using netexec:
Nice, we can see the + sign which indicate they are still valid.
I will use the impacket-mssqlclient to authenticate to the database, and try to paly with it:
Enumerate the database:
Nothing useful, all those databases are default ones.
MSSQL dbms has interesting feature that if misconfigured, we can view the internal system directories using the xp_dirtree command.
But we can not do anything even if we can view the directories, but what we can take advantage of is since we are in the same network, we can abuse LLMNR poisoning again.
Before executing the command above we will run responder to listen to any net ntlm hashes:
Run the command:
Here we received the hash of the user running this service, if we could not crack his password, we can attempt to try to relay it to other services.
Shell as sql_svc:
Save the hash into a file and crack it using hashcat:
Cool, we were able to crack it, and now we have another valid username, and password.
We can check if we can use those username, and password to authenticate to the machine via WinRM:
We authenticated as sql_svc user.
Lateral Movement to ryan.cooper:
After doing some enumeration, we will find an appealing folder in the root of the file system:
We can navigate to that folder, and view what it contains:
Another interesting folder (Logs):
We have errorlog backup file, lets read it:
We will notice some entries has some juicy information, lets test those out using netexec:
Indeed they are valid, and still valid.
BloodHound:
It is time for bloodhound:
Also run bloodhound:
Upload the ingested data to bloodhound.
After some exploration, we will find this attack path to get domain admins on the domain by abusing ADCS ESC1.
Post-Exploitation:
Lets collect the ADCS data with certipy-ad, and add -vulnerable to the command, to only show the vulnerable templates:
ADCS Abuse:
Read the output:
By looking at the template we can confirm that this is not false positive by certipy-ad, because we as domain users can enroll in that template, also anotehr key aspect is EKU (extended key usage) has the value of client authentication, and finally we can notice the EnrolleeSuppliesSubject value in the certificate name flag which allows us to specify any UPN when requesting a certificate.
We will request a certificate for the administrator using the same tool:
We recieved the pfx file of the administrator, we can use this pfx file to authenticate using certipy-ad, and it will get the TGT of the administrator, and dump his ntlm hash:
We can now authenticate using the administrator ntlm hash:
Here we can get the flags:
Last updated