Sauna
AD box on HTB.
Enumeration:
As always we are going to start with nmap to scan for open ports:
We have the default open ports on a domain controller, and this time we have http running on port 80, and the domain name mentioned in the ldap banner result, and the host name of the machine is SAUNA.
Also we can see that the clock-skew is too great so I will use ntpdate to synchronize with the target machine if we wanted to interact with Kerberos.
And I will add the IP and the corresponding domain name to the hosts file:
User Enumeration:
Now I will start with the web application, lets open it up with Firefox:
If we went to about us page, we will find some potential usernames:
I will save those names into a file and use a tool called username-wordlist-generator.py to create a list of different variation of naming forms:
If we take a look at the output.txt file:
We can also convert all entries in this output file to lowercase, so we can then try them as passwords for example.
Now I will use kerbrute to enumerate those users to try to find any valid domain users:
We only have one valid domain user out of the output.txt file.
Lets save it into a file.
AS-REP Roasting:
Here we can perform several attacks such as password spraying, AS-REP Roasting, etc.
I tried AS-REP Roasting using impacket-GetNPUsers to perform it:
And indeed fsmith is AS-REP Rostable user.
Now I will try to crack it using hashcat:
Now we have valid credentials.
No interesting shares.
BloodHound:
Since we have valid credentials that is the time for BloodHound, lets collect the domain data using netexec, and upload the output to BloodHound:
Start BloodHound:
I did not find anything interesting, but the fsmith is a Remote Management User which means we can WinRM to the machine.
Privilege Escalation:
AutoLogon Credentials:
And I will upload winPEAS.exe to the target machine to find any attack vector that we can take advantage to get to domain admins.
Now lets run winPEAS.exe:
After going through and analyzing the results I found those autologon credentials for svc_loanmgr:
DCSync Attack:
Now if we went back to BloodHound to find any interesting ACLs this user has over any other objects by clicking on Outbound Object Control:
We can see that the user svc_loanmgr has GetChangesAll and GetChanges (DS-Replication-Get-Changes-All & DS-Replication-Get-Changes), which means we have DCSync rights.
Lets perform the DCSync via impacket-secretsdump:
Now we can authenticate to the target with WinRM or via psexec:
And we can read the flags:
Last updated