Sauna #3 AD
Reconnaissance:
NMAP:
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.175
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-24 11:27:54Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (88%)
Aggressive OS guesses: Microsoft Windows Server 2019 (88%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 6h59m59s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2023-12-24T11:28:36
|_ start_date: N/AThe IIS server version suggests this is a Windows 10 / Server 2016 / Server 2019 machine. The LDAP scripts show a domain name of EGOTISTICAL-BANK.LOCAL0. I’ll explore that more.
Enumeration: Website - TCP 80
The page represents a bank: http://10.10.10.175/
Just scrolling around, nothing interested jumps out. All the pages are static, and the forms don’t work. There isn’t much of value here. On the “About Us” page, there’s a list of the team which could be used to generate a list of users. Here, we used common patterns of account names in order to create a list and perform further attacks.
While this list was created manually, you could use this awesome Python script, namemash.py, which generate a list of possible usernames from a person’s first and last name.
https://gist.github.com/superkojiman/11076951
Also, in a real-world scenario, website like https://hunter.io can help you to find a valid email pattern for a specific target.
Directory Brute Force:
While looking at the site, I also had gobuster running, but it didn’t find anything interesting either:
Enumeration: SMB - TCP 445
I’ll try anonymous connections to the SMB shares, but no love:
Enumeration: LDAP - TCP/UDP 389
The nmap script did some basic enumeration and returned the domain EGOTISTICAL-BANK.LOCAL0. I’ll dig in a bit more with ldapsearch.
First the query to get the domain base is ldapsearch -x -h 10.10.10.175 -s base namingcontexts, where: -x - simple auth -h 10.10.10.175 - host to query -s base - set the scope to base naming contexts - return naming contexts
This gives the domain, EGOTISTICAL-BANK.LOCAL:
There’s a bunch of information there, but I didn’t end up using it.
Enumeration: DNS - TCP/UDP 53
Any time I see DNS, it’s worth trying a Zone-Transfer. Both sauna.htb and egotistical-bank.local failed to return anything:
Enumeration: Kerberos - UDP (and TCP) 88
Without creds, one thing I can check on Kerberos is brute-focing user names. I’ll use Kerbrute to give this a run, and it finds four unique usernames:
I used a list of usernames from Seclists to do the brute to see if anything came out before trying to convert the names from the team page into a format. In a CTF, it makes sense to try a broad list first since it’s easier and noise doesn’t matter. If this were a real company, I’d probably try variations of the names, or look on social media to try to find a corporate email for the employees to get the username format first.
Shell as fsmith
AS-REP Roasting m0chan has a great post on attacking Kerberos that includes AS-REP Roasting. Typically, when you try to request authentication through Kerberos, first the requesting party has to authenticate itself to the DC. But there is an option, DONT_REQ_PREAUTH where the DC will just send the hash to an unauthenticated user. AS-REP Roasting is looking to see if any known users happen to have this option set.
Get Hash: I’ll use the list of users I collected from Kerbrute, and run GetNPUsers.py to look for vulnerable users. Three come back as not vulnerable, but one gives a hash:
Crack Hash: Now I just need to kick this over to hashcat for cracking, and it works:
It returns the password, Thestrokes23
Evil-WinRM: If I didn’t already have Evil-WinRM installed, I could install it with gem install evil-winrm. Now I’ll use it to get a shell:
Priv Esc: fsmith –> svc_loanmgr
First, I grabbed a list of all the domain users with the following command:
Moving on to current user privileges…
Looks like I do not have permission to run systeminfo.exe.
WinPEAS: For Windows enumeration, I’ll run WinPEAS.exe from the Privilege Escalation Awesome Scripts Suite.
PS SHARE:
In looking through the results, AutoLogon credentials jumped out as interesting:
Evil-WinRM: Running net user on the box showed there was no user svc_loanmanager:
Priv Esc: svc_loanmgr –> root
I ran winPEAS.exe again, but nothing new jumped out at me. Since there’s AD stuff going on, I went to Bloodhound.
SharpHound:
Bloodhound:
DCSync: secretsdump My preferred way to do a DCSync attack is using secretsdump.py, which allows me to run DCSync attack from my Kali box, provided I can talk to the DC on TCP 445 and 135 and a high RPC port. This avoids fighting with AV, though it does create network traffic.
I need to give it just a target string in the format [username]:[password]@[ip]:
Mimikatz: I can also use Mimikatz like BloodHound suggested. I’ll download the latest release from the release page, and upload the 64-bit binary to Sauna:
Mimikatz can be super finicky. Ideally I can run it and drop to a Mimikatz shell, but for some reason on Sauna it just started spitting the prompt at my repeatedly and I had to kill my session. It’s always safer to just run mimikatz.exe with the commands you want to run following it from the command line.
This spits out a ton of information. The hash I need (that matches the secretsdump output) is the Hash NTLM in the middle above. I could also use /all instead of /user:administrator to dump the entire user cache, but administrator is all I need here.
Shells:
WMI: I can use the administrator hash to WMI to get a shell as administrator:
PSExec: Or PSExec to get a shell as SYSTEM:
EvilWinRM: Or I can even use EvilWinRM:
Last updated