HTB - Sauna | HTB Writeups

Last updated 6 months ago

Enumeration

Scope

IP Address: 10.10.10.175

Nmap Scan

Enumeration

DNS

Tried zone transfer

SMB

RPC

Kerberos

I always try to enumerate usernames if AD exits on the machine

we got two valid users, I will try ASREPRoasting attack against the two users

Initial Access

we got a hit with one user, then will try to crack it with hashcat

And successful :)

I will try to connect to SMB & winRM with the credentials found

User Flag: a0865592caf1d5a2d07d1183aa080f0f

Privilege Escalation

After obtaining valid credentials, I hurry to bloodhound to enumerate the domain, but before that I updated /etc/hosts to contain the following record

Creating a .zip file to upload to bloodhound GUI

Opening bloodhound with the following commands

Upload the zip file we created before and began to enumerate the domain

When I clicked List all kerberoatable Accounts I found hsmith listed, So I will request its TGS and try to crack it

I've done this attack, but it didn't reveal anything and hsmith had the same password as fsmith and didn't have any privileges we were looking for.

There is another user on that machine called svc_loanmgr and after looking for it in bloodhound, I realized that I could perform DCSync attack if I had this account.

I moved winpeas.exe to the current folder and uploaded it via evil-winrm = to the machine and run it

We got svc_loanmgr passwords, Let's perform DCSync attack from Linux attack box

Root Flag: b9955377f34c4330d2f5xxxxxxxxxxxxxxx

Last updated 6 months ago

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna] └─$ nmap -p- --min-rate 10000 $ip -Pn PORT STATE SERVICE REASON 53/tcp open domain syn-ack 80/tcp open http syn-ack 88/tcp open kerberos-sec syn-ack 135/tcp open msrpc syn-ack 139/tcp open netbios-ssn syn-ack 389/tcp open ldap syn-ack 445/tcp open microsoft-ds syn-ack 464/tcp open kpasswd5 syn-ack 593/tcp open http-rpc-epmap syn-ack 636/tcp open ldapssl syn-ack 3268/tcp open globalcatLDAP syn-ack 3269/tcp open globalcatLDAPssl syn-ack 5985/tcp open wsman syn-ack 9389/tcp open adws syn-ack ┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna] └─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000 PORT STATE SERVICE 53/udp open domain 123/udp open ntp 389/udp open ldap ┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna] └─$ nmap -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sCV $ip -Pn -oN Nmap/script-scan PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Egotistical Bank :: Home |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-07 17:57:41Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2024-07-07T17:57:54 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: 7h00m06s