Last updated
Last updated
Scope
IP Address: 10.10.10.161
Nmap Scan
Enumeration
SMB
smb enumerate didn't give any useful information
RPC
I managed to enumerate the domain users with rpcclient
I have to create users list and attempt further enumeration
Attempting the wordlist, we get from rpc enumeration against kerberos
The next step in my mind that I will attempt ASREP-Roasting against the users we found
I will then fire up hashcat and try to crack this hash
User Flag: c547a655316215e19xxxxxxxxxxxxxxxx
In active directory enumeration, I'm used to run bloodhound.py as soon as possible if I obtain valid credentials but this time it failed, So I uploaded SharpHound.exe to the machine alternatively
I will then start smb server and move the zip file generated to my attack host to upload it to bloodhound GUI
Authenticate the windows box to my kali machine and then move the file
First, I searched for svc-alfresco account and click on Reachable High Value Targets as its value took my attention
svc-alfresco is a member of Service accounts which is a member of PRIVILEGED IT ACCOUNTS which is a member of ACCOUNT OPERATORS. It's a nested group membership :)
So, I can say that svc-alfresco is a member of Account operators group which is high privileged group.
Further enumeration about Account operations group in bloodhound showed that It has GenericAll on EXCHANGE WINDOWS PERMISSIONS and that group has WriteDacl on the domain
GenericAll: It means a have full control on the object and in our situation, It can be abused by adding ourselves to that group
WriteDacl: It means that I can modify the object discretionary Access control list DACL and in our situation It can be abused by granting ourselves DCSync rights to be able to dump ntds database and get the hash of administrator
we can use PowerView.ps1 to abuse GenericAll & WriteDacl but I will use it only on GenericAll and use DCSync tool developed by n00py to make the attack easier
The main reason why I didn't use
PowerViewto modifyDACLis that I struggled solving this machine before as there is a script that reset everything to default settings and even you're fast, you might fail
Clone the repository from github to /opt directory
Use net command to see current group membership
Execute the following commands to add ourselves to EXCHANGE WINDOWS PERMISSIONS Group
Verify
DSCync.py need some options we need to get
FQDN
distinguishedname
We get the FQDN from Nmap Script Scan before => Forest.htb.local
And for distinguishedname, we can get using PowerView
Now, we're ready to Start the attack.
I run the tool and fire-up crackmapexec in one-linear cause there is a script that will reset the settings as I said before
Access the machine as SYSTEM
And finally get the root flag :)
Root Flag: 689637a422c46e0e07xxxxxxxxxxxxxxxxxxx
