Monteverde
AD box on HTB.
Enumeration:
Port Scanning:
As always we are going to start with nmap to scan for open ports:
So we have another active directory box.
I will add the domain and hostname to the hosts file:
I am going to enumerate shares and users with netexec:
No I do not have permissions to enumerate shares.
Username as the Password:
Now I will save those users to a file, and attempt multiple attacks on them, for example use the username as the password:
Now we have valid credentials sabatchjobs:SABatchJobs.
I did not find anything useful on BloodHound data.
Lets try now to enumerate the shares:
We have three not default shares: azure_uploads, E$, users$, but we have read access only on azure_uploads, and users$.
Shell as mhope:
I will use smbclient to interact with those shares:
We have azure.xml file into mhope directory.
Lets see what it contains:
So we have another password in mhope directory, maybe it is for him, but we can also try to spray it on the users we have enumerated earlier:
Indeed it is for mhope domain user.
We can use netexec to check for other services, and we found previously that WinRM is open, lets try it out:
We can see the Pwn3d!, which implies that we can authenticate to the machine since we are member of Remote Management Users.
Privilege Escalation:
Lets check our who we are:
We will see that we are member of Azure Admins, which is odd, also I found there was .Azure folder on mhope directory:
If we check for installed applications on that system:
We will find Microsoft Azure AD Connect which is not installed by default on an active directory machine.
When you play CTF machine and find non-default application installed on that system, it is probably the way to escalate your privileges.
I searched online for how can I abuse this:
And found this medium article stated that we can dump credentials:
He mentioned in the references Vbscrub binary that can dump credentials, lets search for it:
As he stated:
The Azure AD Connect service is essentially responsible for synchronizing things between your local AD domain, and the Azure based domain. However, to do this it needs privileged credentials for your local domain so that it can perform various operations such as syncing passwords etc.
And he provided us with a binary that we can use to abuse this feature:
What this script will do:
It will connect to the mssql database.
It will pull those values instance_id, keyset_id, entropy from mms_server_configuration, because those values will be needed further for decryption.
From mms_management_agent, it will grab private_configuration_xml which contains the username, and encrypted_configuration that contians the encrypted password.
It will try to decrypt the password, and finally print the result to the terminal.
I will download it and unzip it:
As he mentioned we need to upload both the binary and the dll files to the target machine:
Then from within the Bin directory in Microsoft Azure AD Sync as our path we will run the binary with -FullSQL to use the windows authentication:
Here we have the domain admin password.
We can use psexec or evil-winrm to authenticate as the administrator:
And we can read the flags:
Last updated