HTB - Sauna
Enumeration
Scope
IP Address: 10.10.10.175
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna]
└─$ nmap -p- --min-rate 10000 $ip -Pn
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
80/tcp open http syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
389/tcp open ldap syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
593/tcp open http-rpc-epmap syn-ack
636/tcp open ldapssl syn-ack
3268/tcp open globalcatLDAP syn-ack
3269/tcp open globalcatLDAPssl syn-ack
5985/tcp open wsman syn-ack
9389/tcp open adws syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000
PORT STATE SERVICE
53/udp open domain
123/udp open ntp
389/udp open ldap
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/sauna]
└─$ nmap -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sCV $ip -Pn -oN Nmap/script-scan
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-07 17:57:41Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-07-07T17:57:54
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 7h00m06sEnumeration
DNS
Tried zone transfer
SMB
RPC
Kerberos
I always try to enumerate usernames if AD exits on the machine
we got two valid users, I will try ASREPRoasting attack against the two users
Initial Access
we got a hit with one user, then will try to crack it with hashcat
And successful :)
I will try to connect to SMB & winRM with the credentials found
User Flag: a0865592caf1d5a2d07d1183aa080f0f
Privilege Escalation
After obtaining valid credentials, I hurry to bloodhound to enumerate the domain, but before that I updated /etc/hosts to contain the following record
Creating a .zip file to upload to bloodhound GUI
Opening bloodhound with the following commands
Upload the zip file we created before and began to enumerate the domain
When I clicked List all kerberoatable Accounts I found hsmith listed, So I will request its TGS and try to crack it
I've done this attack, but it didn't reveal anything and
hsmithhad the same password as fsmith and didn't have any privileges we were looking for.
There is another user on that machine called svc_loanmgr and after looking for it in bloodhound, I realized that I could perform DCSync attack if I had this account.
I moved winpeas.exe to the current folder and uploaded it via evil-winrm = to the machine and run it
We got svc_loanmgr passwords, Let's perform DCSync attack from Linux attack box
Login as administrator using impacket-psexec
Root Flag: b9955377f34c4330d2f5xxxxxxxxxxxxxxx
Last updated