LinkedInHTB ProfileAbout

HTB - Reel

Machine Info

Reel is medium to hard difficulty machine, which requires a client-side attack to bypass the perimeter and highlights a technique for gaining privileges in an Active Directory environment.

Enumeration

Scope

IP Address: 10.10.10.77

Nmap Scan

FTP Enumeration

I downloaded these files but I found nothing interesting inside them. except the email address of the creator of these files nico@megabank.com

RPC Enumeration

No data from rpcclient

SMB Enumeration

I can't list the shares with cme or smbclient

SMTP Enumeration

I always scan for open-relay if I found SMTP server to check for the possibility of sending arbitrary emails that can be used for phishing.

Initial Access

Shell as nico

I got a hint from community that there is a CVE affects Microsoft office that allow RCE via phishing emails. CVE-2017–0199

since we can send arbitrary emails as smtp server is Open relay, we can craft a payload and send it via smtp server to get remote code execution

There is a Metasploit module that can generate the malicious payload we want to send

Send email to the user we found with sendEmail command with the attachment generated from Metasploit

At Metasploit, I got a connection back as nico user

Get the flag from user's desktop

User Flag: 4b1fa88985d787becfxxxxxxxxxxxxxx

Privilege Escalation

Shell as Tom

It's a PowerShell credential file

We can decrypt these credentials with Cli-xml native tool

We don't have any remote access solution to the machine except ssh, Let's try to authenticate with tom with ssh

There are multiple interesting files in the tom's home directory, I will explore them

Note.txt

The other files are PowerView.ps1 which can be used to enumerate AD Environment and exploit misconfiguration, Sharphound.exe is the Ingestor of bloodhound that collect information about the domain.

The most interesting file is acls.csv, I will copy it to my kali machine after starting local smb server

I opened the file and start to explore it manually as I tried to upload it to bloodhound, but it failed for me.

  • Searching for the user tom, I found the following:

    • user tom has WriteOwner on user claire

    • user claire has WriteDacl on group backup_admins

  • It's a potential path we can take to takeover claire account then authenticate with this account and modify the ACLs of backup_admins group to be able to add ourselves in that group which seems to be high privileges group

  • Using PowerView.ps1 already exists on the machine can be useful to execute this attack path

Shell as Claire

Abuse WriteOwner to get ownership of claire user to be able to modify its access control and get the privileges to change its password

Change password of claire user

abuse WriteDacl to add GenericAll right to user cliare on group backup_admins so I have full control on that group

ssh with claire and add me to the target group

you must logout and login in again for the changes to take effect and be fast, too :)

backup_admins group has Full access on Administrator Folder from the output of icacls below

I tried to get the flag but it seems I don't have access to

Shell as administrator

Exploring administrator home directory shows several .ps1 scripts

I found the admin password on one of these files

And we have a shell as admin

Root Flag: e622958df7390059522xxxxxxxxxxxxxx

PreviousHardNextHTB - BlackField

Last updated