LinkedInHTB ProfileAbout

HTB - Vintage

Enumeration

As is common in real life Windows pentests, you will start the Vintage box with credentials for the following account: P.Rosa / Rosaisbest123

Nmap Scan

Summary

hosts file

Update the hosts file to avoid encountering any issues when authenticating to the domain

DNS Enumeration

Zone transfer failed

RPC & SMB Enumeration

Every time I connect to rpc With invalid credentials, it gives me Access_denied But this weird error message is unique this time:

The same thing with SMB using netexec

Kerberos & LDAP Enumeration

NT_STATUS_NOT_SUPPORTED flag means NTLM authentication is disabled, so I have to use kerberos authentication instead.

I will note L.Bianchi_adm The user is a high-value target in my notes, then continue enumerating.

Getting all users in the domain and their description field

Checking for PKI, LDAP signing and Machine Account Qouta

Password Reuse failed

Foothold

With a domain user credential, I can use bloodhound.py and dump ldap data for further enumeration, then ingesting the zip file into bloodhoud CE

`FS01` is a member of PRE-WINDOWS 2000 COMPATIBLE ACCESS@VINTAGE.HTB

Attack Explain (Pre-Windows 2000 computers | The Hacker Recipes) Reference: TrustedSec | Diving into Pre-Created Computer Accounts

From the post, computer assigned with pre-windows 2000 attribute has the password of its lowercase name

Confirming it with netexec

With fs01$ computer account, I can extract GMSA secret hash due to ReadGMSAPassword privilege

First, get a Kerberos ticket for fs01$ and then provide it to KRB5CCNAME variable to extract the GMSA secrets with bloodyAD

Get a Kerberos ticket for GMSA01$ the account.

GMSA01$ can add itself or any user to Service Managers group, so I will add P.Rosa to that group because I have his password and it's easy to move when you have a password :))

Membership in service managers Group grants me the ability to change the password of three service users or assign a fake SPN to them

Trying to perform targetkerberos against svc_sql account and enable it because I can't request Service Ticket (ST) for disabled accounts

Using PowerView.py I can enable the account, then assign a SPN for it

Perform a kerberoasting attack

Crack the hash

Spraying the password reveals that C.Neri has the same one

Since C.Neri is in Remote Management UsersI will access the machine with evil-winrm but first get kerberos ticket for him.

To perform kerberos authentication from Linux, you must configure /etc/krb5.conf first

Access the machine via winRM using Kerberos authentication

User Flag: 35cb0ccde18da32e0366xxxxxxxxxxxxxxxxx

Lateral Movement

Inside C.Neri folder, there are DPAPI-encrypted credentials

DPAPI stands for Data Protected API which is Microsoft encryption mechanism. It can be decrypted by the user's password who encrypt it and his masterkey

  • Normal Location of DPAPI:

    • %USERPROFILE%\AppData\Roaming\Microsoft\Credentials

    • %USERPROFILE%\AppData\LOCAL\Microsoft\Credentials

  • The master key Location:

    • %USERPROFILE%\AppData\Roaming\Microsoft\Protect\SID\

We can either encode this encrypted credential by base64 encoding, then transfer to our windows VM along with the master keys to decrypt it locally.

After doing so, we can use mimikatz.exe with dpapi::masterkey first to get the master key, then with dpapi::cred to extract the credential with the obtained master key.

Privilege Escalation

  • Attack Explain:

    1. With GenericWrite on DELEGATEDADMINS, I can add any user to this group

    2. With DELEGATEDADMINS privileges, I can perform Constrained Delegation and request a ticket for CIFS

    3. With this ticket, I can dump NTDS.DIT database with secretdump.py

This is a script running on the box resetting any change made by players, So I will put the steps we did before here to make things fast.

Adding P.Rosa to SERVICEMANAGERS groups (Previous Step)

Set SPN to svc_sql With proper syntax Service/FQDN and enable the account if it's disabled again

Abuse GenericWriteprivileges

Perform Constrained Delegation attack

Export the ticket to KRB5CCNAME and dump ntds using netexec

Note: I will use L.BIANCHI_ADM DA user instead of normal Administrator user.

Root Flag: a35039cb0106fdd70bcxxxxxxxxxxxxxx

PreviousHTB -AcuteNextHTB - Certificate

Last updated