Week 4. Manager
TL;DR
This is a Windows 2019 server machine configured as domain controller running a MSSQL database. Using enabled guest sessions on SMB shared resource, we can bruteforce the RID and get a list of domain users, then bruteforce credentials for the MSSQL database. In the database, the xp_dirtree stored procedure is used to locate a backup of the database which contains credentials for a WinRM shell. Regarding escalation, a misconfiguration on the manage CA permissions can be abused with Certipy-AD to create a new certificate for an administrator user.
KEYWORDS
RID bruteforce, MSSQL directory traversal, xp_dirtree, manageCA, certipy-ad, pass the certificate, pass the ticket.
REFERENCES
https://www.thehacker.recipes/a-d/movement/kerberos/pass-the-certificate
ENUMERATION
Port scan.
> nmap $target -p- -T4 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-21 16:51 EDT
Nmap scan report for manager.htb (10.129.142.151)
Host is up, received user-set (0.32s latency).
Not shown: 65515 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
80/tcp open http syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
389/tcp open ldap syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
593/tcp open http-rpc-epmap syn-ack
636/tcp open ldapssl syn-ack
1433/tcp open ms-sql-s syn-ack
3268/tcp open ldap syn-ack
5985/tcp open wsman syn-ack
9389/tcp open adws syn-ack
49667/tcp open unknown syn-ack
49677/tcp open unknown syn-ack
49678/tcp open unknown syn-ack
49679/tcp open unknown syn-ack
50489/tcp open unknown syn-ack
50568/tcp open unknown syn-ack
65495/tcp open unknown syn-ack
Nmap done: 1 IP address (1 host up) scanned in 1379.15 secondsEnumerate the open ports.
SMB enumeration.
The SMB share allows guest sessions; however, there are no shared folders available.
USER
Try an RID bruteforce.
Copy domain users found to a file called output and generate a wordlist for users and passwords.
Next, attempt a credential stuffing attack in the MSSQL database using this wordlist.
Attack is successful for credentials operator:operator
Log in with credentials and start enumerating the database.
It seems xp_cmdshell is not enabled and we don't have permissions to activate, therefore this way is closed. We will try to capture the NTLMv2 hash with responder or smbserver.py + xp_dirtree
The captured hash is.
It is not crackable with Hashcat though.
Since we can at least explore the file system with xp_dirtree, let's list the contents of webroot folder.
It seems someone made a backup of the site on July and forgot a copy of the file in the webroot folder. This can be downloaded using a browser or wget
Inside the .zip file we find an .xml with credentials.
We use them to log in with evil-winrm
This shell allows us to collect the user flag.
SYSTEM
First step is to upgrade the shell to a nishang interactive shell.
Next, enumerate the system.
Enumerate principal rights with certify.exe
It seems user raven has privileges to manage the CA. A walkthrough to exploit this vulnerability can be found here: https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation#attack-2
First step is to grant yourself the Manage Certificates access right by adding your user as a new officer with certipy-ad tool.
The SubCA template can be enabled on the CA with the -enable-template flag. By default, the SubCA template is enabled.
No we request a certificate based on the SubCA template. This request will be denied, but we will save the private key and note down the request ID. Make sure you are running the command from a directory where you have writing rights, otherwise the .key will not be written.
In this case, private key is saved as 21.key. Next, retrieve the issued certificate with the req command and the -retrieve <request ID> flag.
We can use this certificate to obtain a TGT ticket with certipy-ad. This is known as a pass-the-certificate attack (https://www.thehacker.recipes/a-d/movement/kerberos/pass-the-certificate).
In order for this to work, synchronization with DC clock is needed to avoid clock skew too great. This can be done with ntpdate
Now, using the administrator certificate that we have just created, we generate a Kerberos TGT ticket.
At this point, you can have a full interactive system shell by either passing the administrator hash or passing the TGT ticket.
To pass the hash, you can use psexec or similar tool. To pass the ticket, first export the ticket to prepare the attack.
Then login into the DC passing the TGT ticket.
Final note: for some reason the DC clock gets unskewed very easily, for this reason the commands after the ntpdate have to be issued very quickly to avoid clocks get unsynchronized. Have them typed elsewhere to quickly copy-paste them.
Last updated