Last updated
Last updated
Reel is medium to hard difficulty machine, which requires a client-side attack to bypass the perimeter and highlights a technique for gaining privileges in an Active Directory environment.
Scope
IP Address: 10.10.10.77
Nmap Scan
FTP Enumeration
I downloaded these files but I found nothing interesting inside them. except the email address of the creator of these files nico@megabank.com
RPC Enumeration
No data from rpcclient
SMB Enumeration
I can't list the shares with cme or smbclient
SMTP Enumeration
I always scan for open-relay if I found SMTP server to check for the possibility of sending arbitrary emails that can be used for phishing.
I got a hint from community that there is a CVE affects Microsoft office that allow RCE via phishing emails. CVE-2017–0199
since we can send arbitrary emails as smtp server is Open relay, we can craft a payload and send it via smtp server to get remote code execution
There is a Metasploit module that can generate the malicious payload we want to send
Send email to the user we found with sendEmail command with the attachment generated from Metasploit
At Metasploit, I got a connection back as nico user
Get the flag from user's desktop
User Flag: 4b1fa88985d787becfxxxxxxxxxxxxxx
It's a PowerShell credential file
We can decrypt these credentials with Cli-xml native tool
We don't have any remote access solution to the machine except ssh, Let's try to authenticate with tom with ssh
There are multiple interesting files in the tom's home directory, I will explore them
Note.txt
The other files are PowerView.ps1 which can be used to enumerate AD Environment and exploit misconfiguration, Sharphound.exe is the Ingestor of bloodhound that collect information about the domain.
The most interesting file is acls.csv, I will copy it to my kali machine after starting local smb server
I opened the file and start to explore it manually as I tried to upload it to bloodhound, but it failed for me.
Searching for the user tom, I found the following:
user tom has WriteOwner on user claire
user claire has WriteDacl on group backup_admins
It's a potential path we can take to takeover claire account then authenticate with this account and modify the ACLs of backup_admins group to be able to add ourselves in that group which seems to be high privileges group
Using PowerView.ps1 already exists on the machine can be useful to execute this attack path
Abuse WriteOwner to get ownership of claire user to be able to modify its access control and get the privileges to change its password
Change password of claire user
abuse WriteDacl to add GenericAll right to user cliare on group backup_admins so I have full control on that group
ssh with claire and add me to the target group
you must logout and login in again for the changes to take effect and be fast, too :)
backup_admins group has Full access on Administrator Folder from the output of icacls below
I tried to get the flag but it seems I don't have access to
Exploring administrator home directory shows several .ps1 scripts
I found the admin password on one of these files
And we have a shell as admin
Root Flag: e622958df7390059522xxxxxxxxxxxxxx
