LinkedInHTB ProfileAbout

HTB - Absolute

Description

Absolute is an Insane Windows Active Directory machine that starts with a webpage displaying some images, whose metadata is used to create a wordlist of possible usernames that may exist on the machine. It turns out that one of these users doesn't require Pre-authentication, therefore posing a valuable target for an ASREP roast attack. The discovered credentials are then used to enumerate LDAP and discover credentials for the user svc_smb, who has access to an SMB share containing a Windows binary. Performing dynamic analysis on the binary reveals that it tries to perform an LDAP connection to the Domain Controller with clear text credentials for the m.lovegod user, who owns the Network Audit group, which in turn has Generic Write over the winrm_user. Following this attack path and performing a shadow credential attack on the winrm_user, one can then WinRM and access the machine. Finally, the KrbRelay tool is used to add the winrm_user user to the Administrators group, leading to fully elevated privileges.

Enumeration

Nmap Scan

Summary

hosts file

Service Enumeration

I will start this box differently by enumerating the HTTP service first.

HTTP Enumeration

http://absolute.htb/absolute.htb

I didn't find anything in the webapp, So I tried to fuzz it but nothing interesting here only few common directories.

There are several images here, you can switch between them using the arrows.

If I look at the page code I will see their locations and names.

When I visit the images directory at http://absolute.htb/images/, I get Access denied.

I will switch now to my terminal to download each image

Looking at the image metadata, I see author and arrtist field containing names

I can use these names to create a wordlist and check for valid domain accounts

Then, I will mutate these names to create possible combinations of them

Bruting kerberos to find valid users

Foothold

With this wordlist, I can move to attempt ASREPRoasting an attack

The hash is cracked successfully :))

Now, I will make a To-do list to not forget anything in Enumeration phase

  • Check SMB shares access

  • Collect domain info with bloodhound.py

  • Collect LDAP data with ldapdomaindump

  • Check for winRM access using bloodhound query

  • Check for ADCS existence

  • Check for common CVE GoldenPac, Petitpotam

  • Check for LDAP signing for possible NTLM relay attack

  • Check for password reuse

This error message means NTLM authentication is disabled, So I need to use kerberos authentication instead.

I don't have permission the interesting share folder so that I will move forward.

I can't use ldapdomaindump since the NTLM authentication is disabled but bloodhound.py is smart enough to switch to Kerberos authentication automatically

PKI exists on the domain

The target is not vulnerable to noPac but it's for petitpotam. I will note it down maybe I need it later.

I don't have winRM access to the box, either.

I want to get all the users in the domain, So I will use NetExec to get and luckily I go a user's credentials from the description field

With the two passwords I have, I will try password spraying against the users I just found

Unfortunately, I didn't get any additional account

Checking the shares with the new user credential reveals that I have READ access on Shared folder

There are only 2 files in the share folder: compile.sh and test.exe

Connect to the shared folder and download the files after getting Kerberos ticket for easy access

Lateral Movement

I will switch now to Windows VM to run this program or decompile it with dnSpy

When I run the file and Wireshark captures the network traffic, several DNS traffic comes into play

It tries to resolve _ldap._tcp.dc.absolute.htb

I will try the machine's IP 10.10.11.182 and run the program again

Make sure you connected with HTB Network with .ovpn file. I was using OpenVPN GUI client

It performs ldap binding

Here is the credentials it sends over the network mlovegod:AbsoluteLDAP2022!

There isn't a user with mlovegod name but there is m.lovegod

He Owns the Network Audit groups

Svc_audit user is a member of network audit and has GenericWrite over winrm_user

Only this user winrm_user can access the machine via winRM

So the attack path is:

  1. Abuse Ownership of Network Audit groups to Give me GenericAll rights

  2. Add me to this Group and gain its privileges

  3. Abuse GenericWrite to add shadow credentials or change the password of winrm_user

  4. Access the machine using winrm_user

User Flag: 18dcdc1a7cf18d75167fbebf08f483b5

Privilege Escalation

After getting access to the machine, I want to upgrade my shell to a persistent one. I will use meterpreter because I'm comfortable with it.

Since I found that ldap signing is disabled at the beginning, I can perform relaying against it with my access to the machine.

I will use this repo:

LogoGitHub - cube0x0/KrbRelay: Framework for Kerberos relayingGitHub

Following the repo, I can use several options here

CLSID of Windows 2019

First, we need to get the port number that allows SYSTEM

I need to run the exploit in different logon types: 2 or 9

Root Flag: adce565cxxxxxxxxxxxxxxxxxx

PreviousInsaneNextHTB - Sizzle

Last updated