GitHub
Page cover

Administrator

SUMMARY

This is a Windows Server 2022 machine. Starting from provided credentials we are able to enumerate the domain with BloodHound CE and move laterally abusing GenericAll and ForceChangePassword edges. Eventually, we end up in an account that has access to an FTP server where we find a Password Safe backup that, once cracked, provides credentials that allow collecting the user flag.

Regarding escalation, the process is the same. We move laterally by enumerating with BloodHound CE and taking advantage of GenericWrite and GetChangesAll edges. We abuse them by means of a targeted kerberoasting and a DCSync attack respectively, and finally we are able to find administrator's hash.

KEYWORDS

BloodHound CE enumeration, GenericAll, ForceChangePassword, bloodyAD, net rpc, Password Safe, GenericWrite, targeted kerberoasting, GetChangesAll, DCSync attack.

REFERENCES

https://www.pwsafe.org

https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting#targeted-kerberoasting

https://github.com/ShutdownRepo/targetedKerberoast

https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync

ENUMERATION

Port scan.

> for ports in $(nmap $target -p- --min-rate=5000 -Pn --open --reason | grep open | awk -F "/" '{print $1}' | tr '\n' ',' | sed s/,$//); do nmap $target -p$ports -sV -sC -Pn -vv -n && echo "\nList of open ports: $ports";done
 
Starting Nmap 7.93 ( https://nmap.org ) at 2025-01-25 19:01 GMT
Nmap scan report for 10.10.11.42
Host is up, received user-set (0.053s latency).
Scanned at 2025-01-25 19:01:22 GMT for 66s
PORT      STATE SERVICE       REASON  VERSION
21/tcp    open  ftp           syn-ack Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
53/tcp    open  domain        syn-ack Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2025-01-26 02:06:35Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
49666/tcp open  msrpc         syn-ack Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
63633/tcp open  msrpc         syn-ack Microsoft Windows RPC
63636/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
63645/tcp open  msrpc         syn-ack Microsoft Windows RPC
63652/tcp open  msrpc         syn-ack Microsoft Windows RPC
63655/tcp open  msrpc         syn-ack Microsoft Windows RPC
63668/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
 
Host script results:
|_clock-skew: 7h05m07s
| smb2-security-mode:
|   311:
|_    Message signing enabled and required
| p2p-conficker:
|   Checking for Conficker.C or higher...
|   Check 1 (port 35406/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 20522/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 52572/udp): CLEAN (Timeout)
|   Check 4 (port 52617/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time:
|   date: 2025-01-26T02:07:27
|_  start_date: N/A
 
Nmap done: 1 IP address (1 host up) scanned in 66.53 seconds
 
List of open ports: 21,53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49666,49667,63633,63636,63645,63652,63655,63668

Looks like a domain controller. We have credentials for olivia:ichliebedich, update hosts file and enumerate SMB.

Nothing useful here. Use credentials to dump additional domain usernames.

And to remotely collect domain data with BloodHound-CE-Python.

In BloodHound CE we inspect outbound edges from olivia@administrator.htb and notice she has GenericAll over michael@administrator.htb

USER

We will start by moving laterally to michael. Having GenericAll over him, there two ways to do it.

First option is with net user. Notice olivia is member of the Remote Management Users group, meaning we can have an Evil-WinRM session using her credentials.

Just open a shell and change michael password with net user

A second option would be to use bloodyAD, as in Certified.

Whatever the chosen option, now we can mark michael as "Owned" in BloodHound CE, and continue enumerating from there.

As michael it seems we have ForceChangePassword over benjamin

Although we can open a WinRM shell as michael, in this case we cannot change benjamin password with net user since ForceChangePassword does not allow it.

However, we still can do it remotely with bloodyAD.

Or with net rpc

Back in BloodHound CE, mark benjamin as "Owned" and start enumerating from there.

He is member of Share Moderators, which suggests he may have specific permissions on the SMB or FTP server.

Let's try enumerating SMB with benjamin credentials.

Nothing useful here. However, credentials work for the FTP server, and from there we can download the Backup.psafe3 file.

This file is associated to the Password Safe password manager and can be cracked with module 5200.

With this password we can open the vault with Password Safe and dump another 3 credentials for usernames alexander@administrator.htb, emily@administrator.htb and emma@administrator.htb

And after a quick BloodHound CE enumeration of the three users, we see only emily@administrator.htb belongs to Remote Management Users

Just use her credentials to open a WinRM session.

An collect the user flag.

SYSTEM

Start from the emily shell and take the opportunity to enumerate the system.

Enumerate the emily account in BloodHound CE, she has GenericWrite over ethan

BloodHound suggests either a targeted kerberoast or a shadow credentials attack.

We can try a shadow credentials attack with Certipy, as we did in Week 1. EscapeTwo; however, it fails.

So let's try a targeted kerberoasting attack.

In a nutshell, in this attack we set a Service Principal Name in a target account, for which we have GenericWrite, converting it into a service account. Then we request an ST for the new service account and crack it offline with module 13100.

We will use the targetedKerberoast.py tool suggested by BloodHound CE. It automatically logs in using provided credentials and enumerate usernames over which the SPN can be overwritten, then an ST is requested. Finally, SPN is cleared so it is left in its original state.

Now crack the ST with module 13100.

Back again in BloodHound CE, we see ethan has GetChangesAll over administrator

Which essentially allows a DCSync attack with Impacket's secretsdump.py

The only thing that's left is to use administrator's hash to open a shell.

You are root.

PreviousRelease ArenaNextAuthority

Last updated