Forest
Another HackTheBox AD box.
Enumeration:
Port Scanning:
First we will start with nmap to scan for open ports:
The same open ports that indicate we are dealing with AD domain controller, dns on port 53, kerberos on port 88, smb on port 445, ldap ports, and we have winrm on port 5985, and the host name of the target machine is FOREST.
I will add the domain and the host name to the hosts file:
We can see at the bottom of the nmap scan that the clock-skew is too great, so I will use ntpdate to sync it with the target host:
If we tried smb null session/guest session:
Guest account is disabled.
Lets enumerate the users via netexec but we can use other various tools such as impacket-lookupsid or even rpcclient:
I will add those users to a text file.
AS-REP Roasting:
Now I can try multiple attacks, such as password spraying, use the username as the password, or AS-REP Roasting:
Here we can see that svc-alfresco user has do not require preauth option enabled.
Lets save this ticket into a file and attempt to crack it using hashcat:
Now we have valid domain user credentials htb.local/svc-alfresco:s3rvice.
BloodHound:
No interesting shares or user descriptions. So I will use netexec as the ingestor this time to collect the domain data:
And I will open up bloodhound:
I will unzip the collected .zip file, and upload ingested data to bloodhound:
Mark svc-alfresco as owned:
Privilege Escalation:
I will navigate to cypher and try some queries to try to find any interesting attack paths.
We will find that svc-alfresco is member of the Remote Management Users which implies that we can WinRm to the target machine and read the user flag.
Abuse ACLs:
I clicked on shortest paths from owned objects, and saw this:
We can see that we are member of the account operators group, and interestingly account operators group has GenericAll over multiple objects in the domain, including the Exchange Windows Permissions group:
And that group has WriteDacl over the domain, which if I added svc-alfresco to that group, I can grant him DCSync rights.
Add svc-alfresco to that group using the command provided by bloodhound itself:
Check if the user has been added:
We can see that we are member of that group, lets now grant ourselves DCSync rights using impacket-dacledit:
And now with secretsdump we can perform the DCSync (Domain Controller Syncrhonization) attack:
Here we have the ntlm hash of the domain administrator, lets authenticate via winrm:
Here also we can read the flags:
Last updated