search

Resolute #4 AD

hashtag
Reconnaissance:

NMAP:

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.169 

53/tcp   open  tcpwrapped
88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-25 04:13:06Z)
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK)
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap         Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=12/24%OT=88%CT=1%CU=41520%PV=Y%DS=2%DC=I%G=Y%TM=658
OS:8FFF6%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10B%TI=I%CI=I%II=I%SS=S
OS:%TS=A)SEQ(SP=107%GCD=2%ISR=10B%TI=I%CI=I%II=I%SS=S%TS=A)SEQ(SP=108%GCD=1
OS:%ISR=10B%TI=I%CI=I%II=I%SS=O%TS=A)SEQ(SP=108%GCD=1%ISR=10B%TI=I%CI=I%II=
OS:I%SS=S%TS=A)OPS(O1=M53ANW8ST11%O2=M53ANW8ST11%O3=M53ANW8NNT11%O4=M53ANW8
OS:ST11%O5=M53ANW8ST11%O6=M53AST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2
OS:000%W6=2000)ECN(R=Y%DF=Y%TG=80%W=2000%O=M53ANW8NNS%CC=Y%Q=)ECN(R=Y%DF=Y%
OS:T=80%W=2000%O=M53ANW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=
OS:)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%TG=80%W=0%S=Z%A=S%F=
OS:AR%O=%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T
OS:G=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD
OS:=0%Q=)T4(R=Y%DF=Y%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%
OS:S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T5
OS:(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%TG=80%W=0%S=A%A=
OS:O%F=R%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y
OS:%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O
OS:=%RD=0%Q=)U1(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK
OS:=G%RUD=G)IE(R=Y%DFI=N%TG=80%CD=Z)IE(R=Y%DFI=N%T=80%CD=Z)

Network Distance: 2 hops
Service Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 2h46m56s, deviation: 4h37m09s, median: 6m54s
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: Resolute
|   NetBIOS computer name: RESOLUTE\x00
|   Domain name: megabank.local
|   Forest name: megabank.local
|   FQDN: Resolute.megabank.local
|_  System time: 2023-12-24T20:13:49-08:00
| smb2-time: 
|   date: 2023-12-25T04:13:50
|_  start_date: 2023-12-25T04:10:42
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required

This looks like a Windows host with no firewall up. As we can see, the output reveals an LDAP (TCP/389) port with the megabank.local domain name

hashtag
Enumeration:

Lets add megabank.local to our /etc/hosts file.

Kicking off enum4linux with:

We find an interesting user description:

Enum4linux also finds a list of users as well

hashtag
Enumeration: SMB - TCP 445

Without creds, I can’t access any shares with smbmap or smbclient:

hashtag
Enumeration: LDAP - TCP 389

First, we can try an anonymous bind on the LDAP port using ldapsearch to look for some information. Here, we used the grep command to look for the userPrincipalName attribute that specifies the UPN of the users.

Logoldapsearch(1): LDAP search tool - Linux man pagelinux.die.netchevron-right

The anonymous bind worked and we got some usernames. Let’s dig a bit further, maybe there are interesting things in the description field of some of them. In real world scenarios, system administrators frequently store passwords for non-personal accounts in the description field of the account. However, this field is readable by all users by default in Active Directory.

Interesting, the marko@megabank.local have a description specifying a cleartext password.

hashtag
Enumeration: RPC - TCP 445

RPC enumeration is not super common on HTB. I am able to connect to RPC using null authentication:

Now I can list users:

I can get information about the users one by one with queryuser:

I can also get less information about all users with querydispinfo:

This provides not only a list of users, but there’s also an interesting comment for RID 0x457 (marco), Desc: Account created. Password set to Welcome123!.

hashtag
Shell as User

I’ll use crackmapexec as an easy way to check credentials against SMB. First I try as marko, but it doesn’t work:

No luck. But, maybe another user is configured with this password as password reuse is fairly common.

Password Spraying:

Lets add these to a file called users.txt and try to spray the password we’ve found against this list:

WinRM: I don’t know if malanie is an administrator or in the Remote Management Users group, but it’s worth a shot to see if I can EvilWinRM to get a shell as melanie. It works:

hashtag
Privilege Escalation: melanie –> ryan

After looking around melanie’s home directory and not finding anything useful, I went to the filesystem root:

In PowerShell, ls is an alias for Get-ChildItem or gci. On windows, it’s often a good idea to run that with -force, kind of like running ls -a

In diving through the various hidden folders, PSTranscripts seemed interesting. It contained one file:

Nice, we found cleartext credentials for ryan in the transcript. Maybe this user has elevated privileges on the domain.

WinRM Shell:

Ryan actually isn’t in Remote Management Users. But he is in Contractors, and Contractors is:

From my Kali box, I can also check the creds with crackmapexec:

crackmapexec can also check WinRM, and ryan can authenticate:

hashtag
Privilege Escalation: ryan –> SYSTEM

Right away I find note.txt on ryan’s desktop:

So any changes I make to the system will have to be completely used within a minute (or less). Good to keep in mind.

DnsAdmins: Checking Permissions: Running whoami /groups we see that user ryan is in the DnsAdmins group:

The Microsoft Documentation describes this DnsAdmins as:

LogoActive Directory Security GroupsMicrosoftLearnchevron-right

Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions.

By default the DNSAdmins don’t have the ability to start or stop the DNS service, but it’s not unusual for an admin to give this group that privilege.

dnscmd: Some googling around for this group led me to the lolbas page for dnscmd to load a dll over a UNC path. There’s a command to set a server level plugin dll:

LogoDnscmd on LOLBASLOLBASchevron-right

Since ryan is in DnsAdmins, this is promising.

A Note About OPSEC:

The attack here is to tell the DNS service on Resolute to use my dll as a plugin. I’m going to use msfvenom to create a dll that will, on loading, connect back to me. When msfvenom creates this payload, it will connect back, and wait for that session to end before continuing. This will hang the DNS service on Resolute. That’s fine for a CTF, but would make for a bad day in a real pentest.

To get around this, you can create a payload that starts the reverse shell in a new thread, and then continues, so that the DNS server can continue to start. IppSec tells me he’s going to walk through creating this payload in his video today if you are interested to check that out.

Create Payload: I’ll start with a basic msfvenom reverse shell payload as a dll. Defender is running on this host, and if I put the output file there, it does get eaten, but over a UNC path to a share it might be ok.

Now, from that same directory, I’ll run an SMB server:

I’ll need to run three commands:

  1. Set the server level plugin to be rev.dll on my share.

  2. Stop the DNS server.

  3. Start the DNS server. I’ll need to do this all within a minute (or less) because, as note.txt told me, things revert quickly.

With nc listening, I execute the attack:

hashtag
Msfvenom: Change Administrator Password

Let’s create a simple DLL using msfvenom that changes the administrator account password.

As transferring this to the box would likely trigger Windows Defender or any other security solution, we can use impacket-smbserver to start an SMB server and host the DLL remotely. Note that the DLL was placed in the /tmp directory of the attacking machine.

Now, we can use evil-winrm and the ryan credentials to load our malicious DLL remotely. Next, we need to restart the DNS service in order to load our malicious DLL. Normally, DnsAdmins aren’t able to restart the DNS service by default, but it is likely that they would be given permissions to do this and on this domain and this is indeed the case.

Now, let’s see if the administrator password was changed.

Great, we now have valid credentials for the administrator account.

PreviousSauna #3 ADNextCascade #5 AD

Last updated