Forest
Personal Rating: Medium
This box was rather easy at first as I just recently completed the HTBA Attacking AD and Windows privilege escalation modules. However, the ACL abuse to Domain Admin was tedious and hard to get to work.
Enumeration
Running an nmap scan:
sudo nmap -p- -sV -sC <IP>
Note that this scan is extensive and not stealthy, which might not be feasible in a real pentesting engagement.
This looks like a DC from the open ports. There is no webserver.
SMB Null Authentication
Null Authentication seems to work:
But I could not enumerate shares with this method.
LDAP Enumeration
Running a scan against ldap was successful:
The lockout threshold is 0, so running bruteforces against users would be viable.
I could enumerate some groups, but that is not interesting at the moment.
Using windapsearch I could fetch more information:
The resulting file was massive with nearly 8000 lines.
I could enumerate the users and groups though:
Before I try a password brute or spray, I want to try to enumerate for Kerberoasting and AS-REPRoasting.
I did not find kerberoastable users with GetUserSPNs.py.
AS-REP Roasting
An AS-REPRoast did work with GetNPUsers.py -dc-ip 10.10.10.161 -request htb.local/
With
hashcat -a 0 -m 18200 <SNIP> rockyou.txtI could crack the password for the user svc-alfresco:s3rviceWith these creds I could access the host with
evil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice
AMSI bypassing, which evil-winrm has an integrated module for, was not required here.
Bloodhound Investigations
Now, since this is a DC and I can authenticate with a domain user, Bloodhound came to mind. The goal is to compromise the Administrator on the local machine, but in this case, this can be accomplished by gaining domain admin privileges. I like to run the SharpHound collector when there is no antivirus blocking it. Otherwise you might use the Powershell version and take further steps to evade AV with Powershell, like an AMSI bypass, heavy obfuscation, stealth options when running it etc.
I exfiltrated the collected zip file using smbserver.py on my machine and 'net use' on the target.
Checking Bloodhound, this path is the first one I looked into:
This can not be abused right now as I would need system privileges on the host to use mimikatz for example. But this one works unprivileged:
'svc-alfresco' is an indirect member of 'ACCOUNT OPERATORS'. We have to set ourselves as a member of "EXCHANGE WINDOWS PERMISSIONS" and then abuse WriteDacl to the domain.
ACL Abuse Path
I could add svc-alfresco to the target group with:
Add-ADGroupMember -Identity "EXCHANGE WINDOWS PERMISSIONS" -Members svc-alfresco
The easier versions of the group adding is this:
The Powershell version, possibly with a Powershell downgrade attack or encoded after an AMSI bypass, would usually be the preferred way here for stealth.
I tried abusing the ACLs for hours, but could not find a solution. This was it in the end, after adding the user john to the Exchange group:
I did not know the script DCSync.py and the other scripts I tried did not work. I also tried to do it LoL-style with pure Powershell, but that failed too. The above command yielded what I wanted though:
Pass the Hash
With evil-winrm and pass-the-hash (-H) I could then access the machine as Admin.
evil-winrm -u Administrator -i <IP> -H '32693b11e6aa90eb43d32c72a07ceea6'
NOTE: The latter part of the NTLM hash is the NT part, which is used for authentication. The former hash is the LM part and is the same for all accounts because it is the default hash for deactivated LM authetication.
Since this machine is a DC, you could now use the krbtgt hash for the 'golden ticket' technique to obtain further persistence.
Last updated
