Return
AD box on HTB.
Enumeration:
Port Scanning:
We have multiple open ports that indicate active directory domain controller, we have also http on port 80.
We can get the machine name and the domain using netexec as well:
So I will add the machine IP and the FQDN to the hosts file:
Lets open up return.local with firefox:
Pages other than settings redirect us to the same page.
Exploitation:
What do we have on the settings page:
We can launch burpsuite, and click on the update button to see how the request will go to the web server:
Its post request, and other parameters were not specified.
Lets send this request to repeater, and try to play with that ip parameter:
I tried to see if it connects back to us with python web server on port 80, but nothing happened, going back to the settings.php page, we will find the server port is 389 which is ldap.
We can start responder to listen for any ldap traffic:
Here we got ldap credentials.
We can capture it via netcat as well:
Shell as svc-printer:
We can check if svc-printer has any remote access:
We will see that we have remote access using WinRM.
Post-Exploitation:
Abuse Server Operators group:
Lets check our privileges:
We are members of the Print Operators group, combined with SeLoadDriverPrivilege, this can allow us to load a vulnerable driver and exploit it.
We can see that we are member of Server Operators group, which will grant us with SeBackupPrivilege, and SeRestorePrivilege privileges.
Also this group grants us with some server modification capabilities.
So we can for example change binpath of a service running with high privileged user to add svc-printer user to the local administrators group:
We can for example chnage the binpath of vmtools, we can see besides it under privileges column it says true as well:
Before restarting the service lets check the administrators local group:
Stop and start that service:
It throwed an error, but if we checked the administrators local group:
We will see that we are now part of that group.
Dump the secrets:
What we can do now is to dump secrets for example, sam, lsa, etc.
I will use netexec to help us with this:
We can now use that administrator ntlm hash to authenticate to the target machine as him:
We can also read the flags:
Last updated