LinkedInHTB ProfileAbout
Page cover

HTB - Forest

Enumeration

Scope

IP Address: 10.10.10.161

Nmap Scan

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Forest]
└─$ nmap -p- --min-rate 10000 $ip -Pn

PORT    STATE SERVICE
88/tcp  open  kerberos-sec
135/tcp open  msrpc
139/tcp open  netbios-ssn
389/tcp open  ldap
445/tcp open  microsoft-ds
5985/tcp open   wsman

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Forest]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000

PORT    STATE SERVICE
88/udp  open  kerberos-sec
123/udp open  ntp
389/udp open  ldap

PORT     STATE SERVICE      VERSION
88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-08 11:55:21Z)
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
5985/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: FOREST
|   NetBIOS computer name: FOREST\x00
|   Domain name: htb.local
|   Forest name: htb.local
|   FQDN: FOREST.htb.local
|_  System time: 2024-07-08T04:55:24-07:00
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 2h26m50s, deviation: 4h02m30s, median: 6m49s
| smb2-time: 
|   date: 2024-07-08T11:55:26
|_  start_date: 2024-07-08T11:39:10
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required

Enumeration

SMB

smb enumerate didn't give any useful information

RPC

I managed to enumerate the domain users with rpcclient

I have to create users list and attempt further enumeration

Initial Access

Attempting the wordlist, we get from rpc enumeration against kerberos

The next step in my mind that I will attempt ASREP-Roasting against the users we found

I will then fire up hashcat and try to crack this hash

User Flag: c547a655316215e19xxxxxxxxxxxxxxxx

Privilege Escalation

In active directory enumeration, I'm used to run bloodhound.py as soon as possible if I obtain valid credentials but this time it failed, So I uploaded SharpHound.exe to the machine alternatively

I will then start smb server and move the zip file generated to my attack host to upload it to bloodhound GUI

Authenticate the windows box to my kali machine and then move the file

First, I searched for svc-alfresco account and click on Reachable High Value Targets as its value took my attention

svc-alfresco is a member of Service accounts which is a member of PRIVILEGED IT ACCOUNTS which is a member of ACCOUNT OPERATORS. It's a nested group membership :)

So, I can say that svc-alfresco is a member of Account operators group which is high privileged group.

  • Further enumeration about Account operations group in bloodhound showed that It has GenericAll on EXCHANGE WINDOWS PERMISSIONS and that group has WriteDacl on the domain

    • GenericAll: It means a have full control on the object and in our situation, It can be abused by adding ourselves to that group

    • WriteDacl: It means that I can modify the object discretionary Access control list DACL and in our situation It can be abused by granting ourselves DCSync rights to be able to dump ntds database and get the hash of administrator

we can use PowerView.ps1 to abuse GenericAll & WriteDacl but I will use it only on GenericAll and use DCSync tool developed by n00py to make the attack easier

LogoGitHub - n00py/DCSync: DCSync Attack from Outside using ImpacketGitHub

The main reason why I didn't use PowerView to modify DACL is that I struggled solving this machine before as there is a script that reset everything to default settings and even you're fast, you might fail

Clone the repository from github to /opt directory

Use net command to see current group membership

Execute the following commands to add ourselves to EXCHANGE WINDOWS PERMISSIONS Group

Verify

  • DSCync.py need some options we need to get

    • FQDN

    • distinguishedname

We get the FQDN from Nmap Script Scan before => Forest.htb.local

And for distinguishedname, we can get using PowerView

Now, we're ready to Start the attack.

I run the tool and fire-up crackmapexec in one-linear cause there is a script that will reset the settings as I said before

Access the machine as SYSTEM

And finally get the root flag :)

Root Flag: 689637a422c46e0e07xxxxxxxxxxxxxxxxxxx

PreviousHTB - ActiveNextHTB - Timelapse

Last updated