Resolute #4 AD
Reconnaissance:
NMAP:
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.169
53/tcp open tcpwrapped
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-25 04:13:06Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=12/24%OT=88%CT=1%CU=41520%PV=Y%DS=2%DC=I%G=Y%TM=658
OS:8FFF6%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10B%TI=I%CI=I%II=I%SS=S
OS:%TS=A)SEQ(SP=107%GCD=2%ISR=10B%TI=I%CI=I%II=I%SS=S%TS=A)SEQ(SP=108%GCD=1
OS:%ISR=10B%TI=I%CI=I%II=I%SS=O%TS=A)SEQ(SP=108%GCD=1%ISR=10B%TI=I%CI=I%II=
OS:I%SS=S%TS=A)OPS(O1=M53ANW8ST11%O2=M53ANW8ST11%O3=M53ANW8NNT11%O4=M53ANW8
OS:ST11%O5=M53ANW8ST11%O6=M53AST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2
OS:000%W6=2000)ECN(R=Y%DF=Y%TG=80%W=2000%O=M53ANW8NNS%CC=Y%Q=)ECN(R=Y%DF=Y%
OS:T=80%W=2000%O=M53ANW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=
OS:)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%TG=80%W=0%S=Z%A=S%F=
OS:AR%O=%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T
OS:G=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD
OS:=0%Q=)T4(R=Y%DF=Y%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%
OS:S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T5
OS:(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%TG=80%W=0%S=A%A=
OS:O%F=R%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y
OS:%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O
OS:=%RD=0%Q=)U1(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK
OS:=G%RUD=G)IE(R=Y%DFI=N%TG=80%CD=Z)IE(R=Y%DFI=N%T=80%CD=Z)
Network Distance: 2 hops
Service Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 2h46m56s, deviation: 4h37m09s, median: 6m54s
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: Resolute
| NetBIOS computer name: RESOLUTE\x00
| Domain name: megabank.local
| Forest name: megabank.local
| FQDN: Resolute.megabank.local
|_ System time: 2023-12-24T20:13:49-08:00
| smb2-time:
| date: 2023-12-25T04:13:50
|_ start_date: 2023-12-25T04:10:42
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: requiredThis looks like a Windows host with no firewall up. As we can see, the output reveals an LDAP (TCP/389) port with the megabank.local domain name
Enumeration:
Lets add megabank.local to our /etc/hosts file.
Kicking off enum4linux with:
We find an interesting user description:
Enum4linux also finds a list of users as well
Enumeration: SMB - TCP 445
Without creds, I can’t access any shares with smbmap or smbclient:
Enumeration: LDAP - TCP 389
First, we can try an anonymous bind on the LDAP port using ldapsearch to look for some information. Here, we used the grep command to look for the userPrincipalName attribute that specifies the UPN of the users.
The anonymous bind worked and we got some usernames. Let’s dig a bit further, maybe there are interesting things in the description field of some of them. In real world scenarios, system administrators frequently store passwords for non-personal accounts in the description field of the account. However, this field is readable by all users by default in Active Directory.
Interesting, the marko@megabank.local have a description specifying a cleartext password.
Enumeration: RPC - TCP 445
RPC enumeration is not super common on HTB. I am able to connect to RPC using null authentication:
Now I can list users:
I can get information about the users one by one with queryuser:
I can also get less information about all users with querydispinfo:
This provides not only a list of users, but there’s also an interesting comment for RID 0x457 (marco), Desc: Account created. Password set to Welcome123!.
Shell as User
I’ll use crackmapexec as an easy way to check credentials against SMB. First I try as marko, but it doesn’t work:
No luck. But, maybe another user is configured with this password as password reuse is fairly common.
Password Spraying:
Lets add these to a file called users.txt and try to spray the password we’ve found against this list:
WinRM: I don’t know if malanie is an administrator or in the Remote Management Users group, but it’s worth a shot to see if I can EvilWinRM to get a shell as melanie. It works:
Privilege Escalation: melanie –> ryan
After looking around melanie’s home directory and not finding anything useful, I went to the filesystem root:
In PowerShell, ls is an alias for Get-ChildItem or gci. On windows, it’s often a good idea to run that with -force, kind of like running ls -a
In diving through the various hidden folders, PSTranscripts seemed interesting. It contained one file:
Nice, we found cleartext credentials for ryan in the transcript. Maybe this user has elevated privileges on the domain.
WinRM Shell:
Ryan actually isn’t in Remote Management Users. But he is in Contractors, and Contractors is:
From my Kali box, I can also check the creds with crackmapexec:
crackmapexec can also check WinRM, and ryan can authenticate:
Privilege Escalation: ryan –> SYSTEM
Right away I find note.txt on ryan’s desktop:
So any changes I make to the system will have to be completely used within a minute (or less). Good to keep in mind.
DnsAdmins: Checking Permissions: Running whoami /groups we see that user ryan is in the DnsAdmins group:
The Microsoft Documentation describes this DnsAdmins as:
Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions.
By default the DNSAdmins don’t have the ability to start or stop the DNS service, but it’s not unusual for an admin to give this group that privilege.
dnscmd: Some googling around for this group led me to the lolbas page for dnscmd to load a dll over a UNC path. There’s a command to set a server level plugin dll:
Since ryan is in DnsAdmins, this is promising.
A Note About OPSEC:
The attack here is to tell the DNS service on Resolute to use my dll as a plugin. I’m going to use msfvenom to create a dll that will, on loading, connect back to me. When msfvenom creates this payload, it will connect back, and wait for that session to end before continuing. This will hang the DNS service on Resolute. That’s fine for a CTF, but would make for a bad day in a real pentest.
To get around this, you can create a payload that starts the reverse shell in a new thread, and then continues, so that the DNS server can continue to start. IppSec tells me he’s going to walk through creating this payload in his video today if you are interested to check that out.
Create Payload: I’ll start with a basic msfvenom reverse shell payload as a dll. Defender is running on this host, and if I put the output file there, it does get eaten, but over a UNC path to a share it might be ok.
Now, from that same directory, I’ll run an SMB server:
I’ll need to run three commands:
Set the server level plugin to be rev.dll on my share.
Stop the DNS server.
Start the DNS server. I’ll need to do this all within a minute (or less) because, as note.txt told me, things revert quickly.
With nc listening, I execute the attack:
Msfvenom: Change Administrator Password
Let’s create a simple DLL using msfvenom that changes the administrator account password.
As transferring this to the box would likely trigger Windows Defender or any other security solution, we can use impacket-smbserver to start an SMB server and host the DLL remotely. Note that the DLL was placed in the /tmp directory of the attacking machine.
Now, we can use evil-winrm and the ryan credentials to load our malicious DLL remotely. Next, we need to restart the DNS service in order to load our malicious DLL. Normally, DnsAdmins aren’t able to restart the DNS service by default, but it is likely that they would be given permissions to do this and on this domain and this is indeed the case.
Now, let’s see if the administrator password was changed.
Great, we now have valid credentials for the administrator account.
Last updated