LinkedInHTB ProfileAbout

HTB - Search

Machine Info

Search is a hard difficulty Windows machine that focuses on Active Directory enumeration and exploitation techniques. Foothold is obtained by finding exposed credentials in a web page, enumerating AD users, running a Kerberoast attack to obtain a crackable hash for a service account and spraying the password against a subset of the discovered accounts, obtaining access to a SMB share where a protected XLSX file containing user data is found. Unprotecting the file leads to a second set of credentials, which gives access to another share where PKCS#12 certificates can be downloaded. After importing the certificates into a web browser, Windows PowerShell Web Access can be used to obtain an interactive shell on the system. Due to misconfigured ACLs, the user can retrieve the password of a group managed service account which can change the password of an administrative user, resulting in high-privileged access to the system via wmiexec or psexec.

Enumeration

Scope

IP Address: 10.10.11.129

Nmap Scan

SMB Enumeration

RPC Enumeration

HTTP Enumeration

I found both http & https have the same webapp. The most interesting thing for the first eye is Our Team section that could be use as usernames'

I created a wordlist of their names and run username-anarchy on them to make different combinations

Start to enumerate these users against Kerberos to find if any of them is valid

I found one more user when using xato-net-10-million wordlist

Tried to get ASREP hash from any of these users but also failed

I don't like the following part as it's very like to CTF-Style

Foothold

Auth as hope. Sharp

It says Send Password to Hope Sharp then followed by IsolationIsKey!

Let's do the same thing we did before against that user

One more user found, I will try to authenticate with it

I will then begin to enumerate the domain with the credentials I found and start with smb shares

I have Read access on several shares and Read, Write access on RedirectedFolders$

I will connect to smb server and download the files found

Do the same thing for Group.xmls & Service.xmls. I didn't find anything in them anyway :)

The share RedirectedFolders$ is important and has several folders in it, So I will mount it to my kali machine

The folder sierra.frya contain the flag but I couldn't read it.

When we have Write access on specific share, we could put Shell command file (.scf) on it and if any user explore the share - not necessarily to open the file - it will connect to my smb server

I also tried to put .scf on the share but with no luck :(

Auth with web_svc

Running bloodhound to collect information while attempting get kerberoastable users

Since, I have valid username and password I will try to find if there is any kerberoastable account

I created a wordlist for domain usernames from rpcclient then going to password spray the password of user web_svc since I didn't find anything interesting about that user on bloodhound or in shares.

Auth with Edgar.Jacobs

Got a hit with user Edgar.Jacobs

I looked at bloodhound to see if this user has any high privileges but unlucky, So I will enumerate the shares with that user.

  • On Starting spider_plus module with crackmapexec, I found that:

    • helpdesk share is empty

    • RedirectedFolders$ has an interesting file at edgar.jacobs/Desktop/Phishing_Attempt.xlsx which can contain valid credentials or important data

Privilege Escalation

Shell as sierra.frye

The file is xlsx file and zip compressed, I will view it in MicroSoft Excel

It has two sheets Passwords 01082020 & Captured

Passwords 01082020

Captured

There was no interesting data in the two sheets so I will unzip the file and explore it

sharedStrings.xml file has the content of the sheet two but there is more data than xlsx when I opened it with microsoft Excel.

The new data located between these tags <t>*</t>.

I created a wordlist of these records and start to brute force against user sierra.frye and I got a hit

I mounted the share Redirectedfolders$ as user sierra.frya

  • There are two new files I didn't see before under Backups folder search-RESEARCH-CA.p12 & staff.pfx

These two files can be uploaded to your browser and access the webapp on port 443 that lead to PowerShell Web Access Console, but I took different path :) .

Get the flag

User Flag: 07129b5634467dbxxxxxxxxxxx

Shell as Administrator

  • User sierra.frye can PSRemote to the machine as it's member of BIRMINGHAM-ITSEC which is member of IISEC

  • ITSEC has the privileges to read GMSA password

  • Group BIR-ADFS-GMSA$ has GenericAll rights on user Tristan.davies which is a member of the domain admins group

So, if we can takeover sierra.frye user, we can reach Domain Admins from the attack path above

More about GMSA from bloodhound

Read GMSA password with gMSADumper.py or NetExec

LogoGitHub - micahvandeusen/gMSADumper: Lists who can read any gMSA password blobs and parses them if the current user has access.GitHub
LogoExtract gMSA Secrets | NetExecwww.netexec.wiki

Change password of TRISTAN.DAVIES Account using net rpc tool

Get the flag with NetExec

Or access the machine with wmiexec.py

Root Flag: b2f761828983df3ffxxxxxxxxxxxxx

PreviousHTB - MantisNextHTB - Office

Last updated