HTB - Timelapse | HTB Writeups

Last updated 6 months ago

Enumeration

Scope

IP Address: 10.10.11.152

Nmap Scan

RPC

Nothing from rpc

SMB

I will mount the share locally for easily navigation. Press Enter if prompted

I will explore each file one by one, Let's start with the .zip file

The other files talk about LAPS as a security solutions and how to install it, So we can guess that LAPS is installed on that machine

I tried to unzip it but it was password protected

Then, I will attempt to extract the hash from it and try to crack

Extracting the archive content with 7z

I searched online for more info about that file and got this.

So, I can extract files like private keys or certificates. We can do this with openssl tool. I also searched for the exact command to what we need and ChatGPT was very useful.

Here are examples of what we can use

When I tried to open the file, it failed cause it was password-protected

So, I will do the same thing as the .zip file

I'm ready now to get the content of legacyy_dev_auth.pfx

Showing the extracted files

Shell as Legacyy

Now, I have private key and certificate, but I don't have any valid credentials, So I must continue the enumeration.

I move the .pfx file to my windows machine and open it to get more information. when I click on the file it opened this wizard

I completed the steps, provided the password and the certificate was stored on my machine. Then, I opened User certification manager

Under Certificates - Current User => Personal => Certificates I could see it

So, We now know that Legacyy User issued this certificate.

I opened the help menu of evil-winrm to see available options
- -S to enable SSL
- -k to provide private key
- -c for certificate
- -p for port number

I don't know the password but I think it's not required since we have the private key and the certificate, also we must provide alternative port number other than the default because we saw that Nmap output showed 5985 port number is closed but 5986 is opened which is used for winRM over SSl

User Flag: de885f236945cfd319e4dxxxxxxxxxxxx

Bloodhound

We're on active directory environment, So I will call bloodhound to join us.

I started smb server on my kail machine and authenticate the windows box to my server

On my kali machine I will start bloodhound and upload the zip file

Under C:\Users there are several users. I will enumerate them in bloodhound

Shell as SVC_Deploy

SVC_DEPLOY user is a member of LAPS_READERS which has the ability to read LAPS password, which is the password of the local administrator, So if we get this account, we will be able to take control of admin account

When I list the content of C:\Program Files, I can see that LAPS is installed as I guessed

I searched for password for user svc_deploy everywhere and I found it in powershell history file of user legacyy

I used the credential found to obtain a shell

Shell as Administrator

Now, I can read the password of local admin. I will use LAPSToolkit.ps1

Access the machine with wmisexec.py

The flag wasn't in administrator home directory but was in TRX user home

Root Flag: 63cbfac24c2514d221cxxxxxxxxxxxxx

Optional

Dump ntds database

Dump lsass process

Last updated 6 months ago

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Timelapse] └─$ nmap -p- --min-rate 10000 $ip -P PORT STATE SERVICE REASON 53/tcp open domain syn-ack 88/tcp open kerberos-sec syn-ack 135/tcp open msrpc syn-ack 139/tcp open netbios-ssn syn-ack 389/tcp open ldap syn-ack 445/tcp open microsoft-ds syn-ack 464/tcp open kpasswd5 syn-ack 5986/tcp open wsmans syn-ack 9389/tcp open adws syn-ack ┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Timelapse] └─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000 PORT STATE SERVICE 53/udp open domain 88/udp open kerberos-sec 123/udp open ntp 389/udp open ldap ┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Timelapse] └─$ nmap -sCV -p53,88,135,139,389,445,464,5986,9389 $ip -Pn -oN Nmap/script-scan PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-08 22:57:28Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found | tls-alpn: |_ http/1.1 |_ssl-date: 2024-07-08T22:58:52+00:00; +8h00m03s from scanner time. | ssl-cert: Subject: commonName=dc01.timelapse.htb | Not valid before: 2021-10-25T14:05:29 |_Not valid after: 2022-10-25T14:25:29 |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 8h00m02s, deviation: 0s, median: 8h00m02s | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2024-07-08T22:58:13 |_ start_date: N/A