LinkedInHTB ProfileAbout
Page cover

HTB - Timelapse

Enumeration

Scope

IP Address: 10.10.11.152

Nmap Scan

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Timelapse]
└─$ nmap -p- --min-rate 10000 $ip -P

PORT     STATE SERVICE      REASON
53/tcp   open  domain       syn-ack
88/tcp   open  kerberos-sec syn-ack
135/tcp  open  msrpc        syn-ack
139/tcp  open  netbios-ssn  syn-ack
389/tcp  open  ldap         syn-ack
445/tcp  open  microsoft-ds syn-ack
464/tcp  open  kpasswd5     syn-ack
5986/tcp open  wsmans       syn-ack
9389/tcp open  adws         syn-ack

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Timelapse]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000

PORT    STATE SERVICE
53/udp  open  domain
88/udp  open  kerberos-sec
123/udp open  ntp
389/udp open  ldap

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Timelapse]
└─$ nmap -sCV -p53,88,135,139,389,445,464,5986,9389 $ip -Pn -oN Nmap/script-scan

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-07-08 22:57:28Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
| tls-alpn: 
|_  http/1.1
|_ssl-date: 2024-07-08T22:58:52+00:00; +8h00m03s from scanner time.
| ssl-cert: Subject: commonName=dc01.timelapse.htb
| Not valid before: 2021-10-25T14:05:29
|_Not valid after:  2022-10-25T14:25:29
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open  mc-nmf        .NET Message Framing
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 8h00m02s, deviation: 0s, median: 8h00m02s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-07-08T22:58:13
|_  start_date: N/A

RPC

Nothing from rpc

SMB

I will mount the share locally for easily navigation. Press Enter if prompted

I will explore each file one by one, Let's start with the .zip file

The other files talk about LAPS as a security solutions and how to install it, So we can guess that LAPS is installed on that machine

I tried to unzip it but it was password protected

Then, I will attempt to extract the hash from it and try to crack

Extracting the archive content with 7z

I searched online for more info about that file and got this.

So, I can extract files like private keys or certificates. We can do this with openssl tool. I also searched for the exact command to what we need and ChatGPT was very useful.

Here are examples of what we can use

When I tried to open the file, it failed cause it was password-protected

So, I will do the same thing as the .zip file

I'm ready now to get the content of legacyy_dev_auth.pfx

Showing the extracted files

Shell as Legacyy

Now, I have private key and certificate, but I don't have any valid credentials, So I must continue the enumeration.

I move the .pfx file to my windows machine and open it to get more information. when I click on the file it opened this wizard

I completed the steps, provided the password and the certificate was stored on my machine. Then, I opened User certification manager

Under Certificates - Current User => Personal => Certificates I could see it

So, We now know that Legacyy User issued this certificate.

  • I opened the help menu of evil-winrm to see available options

    • -S to enable SSL

    • -k to provide private key

    • -c for certificate

    • -p for port number

I don't know the password but I think it's not required since we have the private key and the certificate, also we must provide alternative port number other than the default because we saw that Nmap output showed 5985 port number is closed but 5986 is opened which is used for winRM over SSl

User Flag: de885f236945cfd319e4dxxxxxxxxxxxx

Bloodhound

We're on active directory environment, So I will call bloodhound to join us.

I started smb server on my kail machine and authenticate the windows box to my server

On my kali machine I will start bloodhound and upload the zip file

Under C:\Users there are several users. I will enumerate them in bloodhound

Shell as SVC_Deploy

SVC_DEPLOY user is a member of LAPS_READERS which has the ability to read LAPS password, which is the password of the local administrator, So if we get this account, we will be able to take control of admin account

When I list the content of C:\Program Files, I can see that LAPS is installed as I guessed

I searched for password for user svc_deploy everywhere and I found it in powershell history file of user legacyy

I used the credential found to obtain a shell

Shell as Administrator

Now, I can read the password of local admin. I will use LAPSToolkit.ps1

Access the machine with wmisexec.py

The flag wasn't in administrator home directory but was in TRX user home

Root Flag: 63cbfac24c2514d221cxxxxxxxxxxxxx

Optional

Dump ntds database

Dump lsass process

PreviousHTB - ForestNextHTB - Mailing

Last updated