Timelapse
AD box on HTB.
Enumeration:
Nmap:
As always we are going to start with port scanning:
We are dealing with another active directory machine, but this time we can see WinRM running on port 5986 which is WinRM over SSL.
Also we can find the FQDN, so I will add to the hosts file:
Enumerate the shares:
First we will start by enumeration the shares with netexec:
We will see the guest user is enabled, and we have read permission over IPC$, and Shares shares.
This time I will use impacket-smbclient to authenticate and view those shares:
We have two folders, the first one containing winrm_backup.zip file, and the other has LAPS word files and LAPS installer.
I opened the word files, and did not find anything useful, but maybe this is a hint just like the box name (timelapse), so maybe we will deal with laps to get some info.
If we tried to unzip the winrm_backup.zip:
We will see that it is protected with a password.
Now the time for john the ripper to try to get the password of that zip file:
We retrieved the password, I will use it to unzip the winrm_backup.zip file:
We will find that it contains only one file, called legaccy_dev_auth.pfx, which is a flie that can be used to establish secure communication, and it contains private key and a certificate and other stuff.
We can get more information off of it using openssl:
It is password-protected, so we will need to use john again to attempt get retrieve the password:
We can see the certificate, the private key, and for whom this pfx was issued for (legacyy).
Now we can use multiple tools to see if this pfx is still valid pfx, and we can authenticate using it or not.
I will try evil-winrm first:
It does not support pfx files, but it support public (certificate) and private keys, so using openssl again we can dump the certificate to a file and the private key to a file:
Authenticate as legacyy:
We can now use evil-winrm to try if those (certificate, private key) are still valid:
Shell as svc_deploy:
After doing some local enumeration we will find stored username and password in the (consolehost_history.txt file) powershell history (winPEAS can find this):
Lets check if those credentials are valid:
Privilege Escalation:
BloodHound:
I will upload SharpHound.exe this time:
Read LAPS:
After uploading the .zip file to bloodhound, we will see that svc_deploy can read laps passwords:
And we can use multiple tools to accomplish reading the laps passwords:
Here we have the password for the administrator, we can now authenticate as him:
And we can read the flags:
Last updated