Last updated
Last updated
Mantis can definitely be one of the more challenging machines for some users. For successful exploitation, a fair bit of knowledge or research of Windows Servers and the domain controller system is required.
Scope
IP Address: 10.10.10.52
Nmap Scan
DNS Enumeration
RPC Enumeration
SMB Enumeration
Kerberos Enumeration
No username found when enumerating with kerbrute
HTTP Enumeration
http://10.10.10.52:8080
http://10.10.10.52:8080/archive
http://10.10.10.52:1337
ffuf found one directory after fuzzing
http://10.10.10.52:1337/secure_notes/
[dev_notes_NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx.txt.txt]
I decoded this weird string in the dev_notes file and the output seems to be a hash but we I checked for its type with hashid it told me it's known hash.
I checked the string length, It has chars that a regular hash (34 or 32) , So it might be hex
Decode the string from hex format gave me a password
I didn't have usernames list yet to test the password I found with as kerbrute didn't show me any user when using jsmith.txt wordlist, So I will try bigger list
We got three users, I will test them immediately
In the notes we found, it tells us that the username of mssql is admin and orcharddb database name
We don't have admin privileges on the instance
I got the password of James user, Let's test it against smb and mssql services
I fire up bloodhound.py to enumerate the domain and feed its data to bloodhound GUI
I found that user James CanRDP to the machine but when check RDP port I found it closed
I couldn't go further anymore, So I got a hint from community that there is a CVE affected kerberos which allow us to get golden ticket without being an admin (MS14-068).
Useful post to configure our kali to work properly:
POC for the vulnerability:
Follow up the post above to get system access but It didn't work for me cause it's an old vulnerability and I couldn't run this python script, So I used unintended path using noPac exploit to get system account.
User Flag: 35d8d3e946138xxxxxxxxxxxxx
Root Flag: 77e6fa689d3c89352xxxxxxxxxxxxxxx
