search
GitHub
Page cover

windowsWeek 4. Manager

hashtag
TL;DR

This is a Windows 2019 server machine configured as domain controller running a MSSQL database. Using enabled guest sessions on SMB shared resource, we can bruteforce the RID and get a list of domain users, then bruteforce credentials for the MSSQL database. In the database, the xp_dirtree stored procedure is used to locate a backup of the database which contains credentials for a WinRM shell. Regarding escalation, a misconfiguration on the manage CA permissions can be abused with Certipy-AD to create a new certificate for an administrator user.

hashtag
KEYWORDS

RID bruteforce, MSSQL directory traversal, xp_dirtree, manageCA, certipy-ad, pass the certificate, pass the ticket.

hashtag
REFERENCES

https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation#attack-2arrow-up-right

https://www.thehacker.recipes/a-d/movement/kerberos/pass-the-certificatearrow-up-right

hashtag
ENUMERATION

Port scan.

> nmap $target -p- -T4 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-21 16:51 EDT
Nmap scan report for manager.htb (10.129.142.151)
Host is up, received user-set (0.32s latency).
Not shown: 65515 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE        REASON
53/tcp    open  domain         syn-ack
80/tcp    open  http           syn-ack
88/tcp    open  kerberos-sec   syn-ack
135/tcp   open  msrpc          syn-ack
139/tcp   open  netbios-ssn    syn-ack
389/tcp   open  ldap           syn-ack
445/tcp   open  microsoft-ds   syn-ack
464/tcp   open  kpasswd5       syn-ack
593/tcp   open  http-rpc-epmap syn-ack
636/tcp   open  ldapssl        syn-ack
1433/tcp  open  ms-sql-s       syn-ack
3268/tcp  open  ldap           syn-ack
5985/tcp  open  wsman          syn-ack
9389/tcp  open  adws           syn-ack
49667/tcp open  unknown        syn-ack
49677/tcp open  unknown        syn-ack
49678/tcp open  unknown        syn-ack
49679/tcp open  unknown        syn-ack
50489/tcp open  unknown        syn-ack
50568/tcp open  unknown        syn-ack
65495/tcp open  unknown        syn-ack
 
Nmap done: 1 IP address (1 host up) scanned in 1379.15 seconds

Enumerate the open ports.

SMB enumeration.

The SMB share allows guest sessions; however, there are no shared folders available.

hashtag
USER

Try an RID bruteforce.

Copy domain users found to a file called output and generate a wordlist for users and passwords.

Next, attempt a credential stuffing attack in the MSSQL database using this wordlist.

Attack is successful for credentials operator:operator

Log in with credentials and start enumerating the database.

It seems xp_cmdshell is not enabled and we don't have permissions to activate, therefore this way is closed. We will try to capture the NTLMv2 hash with responder or smbserver.py + xp_dirtree

The captured hash is.

It is not crackable with Hashcat though.

Since we can at least explore the file system with xp_dirtree, let's list the contents of webroot folder.

It seems someone made a backup of the site on July and forgot a copy of the file in the webroot folder. This can be downloaded using a browser or wget

Inside the .zip file we find an .xml with credentials.

We use them to log in with evil-winrm

This shell allows us to collect the user flag.

hashtag
SYSTEM

First step is to upgrade the shell to a nishang interactive shell.

Next, enumerate the system.

Enumerate principal rights with certify.exe

It seems user raven has privileges to manage the CA. A walkthrough to exploit this vulnerability can be found here: https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation#attack-2arrow-up-right

First step is to grant yourself the Manage Certificates access right by adding your user as a new officer with certipy-ad tool.

The SubCA template can be enabled on the CA with the -enable-template flag. By default, the SubCA template is enabled.

No we request a certificate based on the SubCA template. This request will be denied, but we will save the private key and note down the request ID. Make sure you are running the command from a directory where you have writing rights, otherwise the .key will not be written.

In this case, private key is saved as 21.key. Next, retrieve the issued certificate with the req command and the -retrieve <request ID> flag.

We can use this certificate to obtain a TGT ticket with certipy-ad. This is known as a pass-the-certificate attack (https://www.thehacker.recipes/a-d/movement/kerberos/pass-the-certificatearrow-up-right).

In order for this to work, synchronization with DC clock is needed to avoid clock skew too great. This can be done with ntpdate

Now, using the administrator certificate that we have just created, we generate a Kerberos TGT ticket.

At this point, you can have a full interactive system shell by either passing the administrator hash or passing the TGT ticket.

To pass the hash, you can use psexec or similar tool. To pass the ticket, first export the ticket to prepare the attack.

Then login into the DC passing the TGT ticket.

Final note: for some reason the DC clock gets unskewed very easily, for this reason the commands after the ntpdate have to be issued very quickly to avoid clocks get unsynchronized. Have them typed elsewhere to quickly copy-paste them.

PreviousWeek 3. DriveNextWeek 5. Appsanity

Last updated