HTB - Active
Enumeration
Scope
IP Address: 10.10.10.100
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Active]
└─$ nmap -p- --min-rate 10000 $ip -Pn -oN Nmap/all-port-scan
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49157/tcp open unknown
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Active]
└─$ sudo nmap -p- -sU --min-rate 10000 $ip -Pn -oN Nmap/all-port-scan
PORT STATE SERVICE
53/udp open domain
88/udp open kerberos-sec
123/udp open ntp
389/udp open ldap
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Active]
└─$ nmap -p53,88,135,139,389,445 $ip -sCV -oN Nmap/script-scan
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-08 10:27:39Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-07-08T10:27:50
|_ start_date: 2024-07-08T10:23:10
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled and requiredEnumeration
DNS
I always try zone transfer if DNS exists on the machine
RPC
No much information from rpcclient
SMB
smbclinet & crackmapexec got some useful information and I can see that I have read access on Replication share
Looking at the share content and one file took my attention
I hurried to Download the file
Exploring the content of Groups.xml there is a username called SVC_TGS and cpassword field
I think this encrypted blob is GPP password stands for Group Policy Prefrences
I can decrypt this with gpp-decrypt
So, We got credentials active.htb\SVC_TGS:GPPstillStandingStrong2k18, Let's verify with crackmapexec
Initial Access
we don't have any remote access to the machine, So I will do two things
Exploring the shares with the credentials we found
fire up
bloodhound-pythonand enumerate the domain with the credentials we found
First: Listing all the shares to see if we have Read or Write access to any of them and Exploring the shares with crackmapexec and spider_plus module which will save us a lot of time
After exploring the json file that crackmap produced, I didn't file anythind except the user flag
User Flag: f709db3ff2f43edafbbbe37523313a6f
Privilege Escalation
Before we run bloodhound, Let's update /etc/hosts for bloodhound.py to run without issues
Collecting information about the domain
Prepare zip file to upload to bloodhound
Start neo4j database and run bloodhoud GUI
When a looking for kerberostable accounts query, I found that the administrator account can be obtained by kerberoasting attack only if his password is weak enough to be cracked
Verify with GetUserSPN.py from impacket toolkit
you can use -o to output to file but I didn't
We can now access the machine with psexec.py
Root Flag: 1457083f7ac23289ea1098e5d56b170a
Optional
We can dump ntds database and lsass secrets
Last updated