HTB - EscapeTwo
Enumeration
Nmap Scan
Summary
hosts file
Foothold
As is common in real life Windows pentests, you will start this box with credentials for the following account: rose / KxEPkKe6R8su
With the provided credentials, I will try to connect to services (SMB, MSSQL, LDAP, ..etc)
MSSQL
I tried to steal NTLMv2 credentials using xp_dirtree function with SMBServer running on my attacking machine, Then I got the hash but couldn't crack it, So I decided to look for different things.
I moved then to dump LDAP data and begin to enumerate the domain with bloodhound.py
Also, I tried to get kerberoastable accounts, and I got two of them, but I couldn't crack their hashes, either.
It's worth nothing to Check for ADCS existence as it opens many avenues of we to find any misconfiguration associated with the templates
I looked for SMB shares using my credentials and found I have access to two shared folders:
InAccounting Department, there is account.xlsx file. First, I tried to open it with Microsoft Excel or any xlsx viewer but it said the file is corrupted.
Since xlsx can be treated as zip file, I unzipped it and began to look for any interesting info.
Inside xl/SharedStrings.xml, there are several credentials
Lateral Movement
Using sa account, I can log in to the MSSQL instance as an admin
Impacket version v0.12.0 has built-in commands to automate some attacks, I will use enable_xp_cmdshell
I will host PowerShell reverse shell on my web server and download it to the machine
To generate a reverse shell:
Download and Execute the shell
Receive Connection
Under C:\, there is SQL019 folder
I found sql configuration file, let's see its content
I found the credentials of sql_svc as which I'm running my shell
With that password, I will try to spray other users in the system
User Flag: 87443ae9f1bdec35xxxxxxxxxxxxxxxx
Privilege Escalation
I will use powerview.py to manually enumerate user's privileges
Ryan has WriteOwner on Ca_svc
With these privileges, I will Add Ownership to Ryan, then give him fullcontrol and after that, I can perform Shadow Credentials, Reset Password or targeted Kerberosasting
Get NT hash of ca_svc using shadow credential attack
With ca_svc hash, I can authenticate to the domain and begin to enumerate ADCS
So, there is a template vulnerable to ESC4. That means I have permission to change the attribute associated with that template and make it vulnerable to ESC1
ESC1is an escalation of misconfigured template is allowed to supplysubject alternative nameand can be abused to add any user of the domain (Administrator) to the template and get certificate for them.
Get administrator hash
Root Flag: eff768f0b89d396c3xxxxxxxxxxxxxxxxxx
Last updated