search
LinkedInHTB ProfileAbout
Page cover

HTB - Sauna

hashtag
Enumeration

Scope

IP Address: 10.10.10.175

Nmap Scan

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna]
└─$ nmap -p- --min-rate 10000 $ip -Pn

PORT     STATE SERVICE          REASON
53/tcp   open  domain           syn-ack
80/tcp   open  http             syn-ack
88/tcp   open  kerberos-sec     syn-ack
135/tcp  open  msrpc            syn-ack
139/tcp  open  netbios-ssn      syn-ack
389/tcp  open  ldap             syn-ack
445/tcp  open  microsoft-ds     syn-ack
464/tcp  open  kpasswd5         syn-ack
593/tcp  open  http-rpc-epmap   syn-ack
636/tcp  open  ldapssl          syn-ack
3268/tcp open  globalcatLDAP    syn-ack
3269/tcp open  globalcatLDAPssl syn-ack
5985/tcp open  wsman            syn-ack
9389/tcp open  adws             syn-ack

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000

PORT    STATE SERVICE
53/udp  open  domain
123/udp open  ntp
389/udp open  ldap

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna]
└─$ nmap -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sCV $ip -Pn -oN Nmap/script-scan

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-07-07 17:57:41Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open  mc-nmf        .NET Message Framing
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-07-07T17:57:54
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 7h00m06s

Enumeration

DNS

Tried zone transfer

SMB

RPC

Kerberos

I always try to enumerate usernames if AD exits on the machine

we got two valid users, I will try ASREPRoasting attack against the two users

hashtag
Initial Access

we got a hit with one user, then will try to crack it with hashcat

And successful :)

I will try to connect to SMB & winRM with the credentials found

User Flag: a0865592caf1d5a2d07d1183aa080f0f

hashtag
Privilege Escalation

After obtaining valid credentials, I hurry to bloodhound to enumerate the domain, but before that I updated /etc/hosts to contain the following record

Creating a .zip file to upload to bloodhound GUI

Opening bloodhound with the following commands

Upload the zip file we created before and began to enumerate the domain

When I clicked List all kerberoatable Accounts I found hsmith listed, So I will request its TGS and try to crack it

I've done this attack, but it didn't reveal anything and hsmith had the same password as fsmith and didn't have any privileges we were looking for.

There is another user on that machine called svc_loanmgr and after looking for it in bloodhound, I realized that I could perform DCSync attack if I had this account.

I moved winpeas.exe to the current folder and uploaded it via evil-winrm = to the machine and run it

We got svc_loanmgr passwords, Let's perform DCSync attack from Linux attack box

Login as administrator using impacket-psexec

Root Flag: b9955377f34c4330d2f5xxxxxxxxxxxxxxx

PreviousHTB - HeistNextHTB- Access

Last updated