Last updated
Last updated
Resolute is a medium difficulty Windows machine that features Active Directory. The Active Directory anonymous bind is used to obtain a password that the sysadmins set for new user accounts, although it seems that the password for that account has since changed. A password spray reveals that this password is still in use for another domain user account, which gives us access to the system over WinRM. A PowerShell transcript log is discovered, which has captured credentials passed on the command-line. This is used to move laterally to a user that is a member of the DnsAdmins group. This group has the ability to specify that the DNS Server service loads a plugin DLL. After restarting the DNS service, we achieve command execution on the domain controller in the context of NT_AUTHORITY\SYSTEM.
Scope
IP Address: 10.10.10.169
Nmap Scan
DNS Enumeration
Zone transfer failed
RPC Enumeration
I got a username list from rpcclient and filtered them.
SMB Enumeration
I didn't get anything as anonymous login failed
I also try password spraying with the same usernames as passwords but failed
KERBEROS Enumeration
I tried ASREP-Roasting attack but no thing
When I run out all the options I know to get a foothold, I decided to query the users info I got from rpccclient, maybe a password exists in description field or something
we found the password Welcome123!, Let's confirm access with user marko
It seems like this password doesn't belong to him, So I will spray it to the list of users we have
So, we have now valid credentials melanie:Welcome123!, Let's see if we have remote access to that box
Yes, we have :)
User Flag: f65ae23b0313053bb9xxxxxxxxxxxxxxxx
When I landed on windows box joined to Active Directory, I run bloodhound.py to collect info about the domain and provide it to bloodhound GUI
Start neo4j database and then run bloodhound to open GUI
provide the data collected as zip file to bloodhound
user ryan has a profile on the box, Let's enumerate him in bloodhound
Click on unrolled group membership to see nested group membership
ryan is a member of DNSADMINS group via nested group membership, So If I could takeover this account, the path to Domain Admins is clear
I found no database, PowerShell history file, no stored credentials or scripts located somewhere however, I learned a trick before that I always make on windows machine which is looking for hidden files as I do in Linux
PSTranscripts is not a standard directory, Let's explore it
That .txt file looks very interesting, Let's see
Let's check if these credential are valid
And successfully got the ryan account.
we can then abuse our membership in DNS Admins group, we can alter the .dll of dns service running as SYSTEM to add ourselves in Domain Admins group or get a reverse shell as SYSTEM
Before we start the attack, Let's first confirm we have control on dns service
The object SID that has control of dns service is S-1-5-21-1392959593-3013219662-3596683436-1105 I look at bloodhound to get the SID of user ryan and see if the two SIDs match each other
So, we have control of DNS service, Let's start the attack.
Generate malicious dll to add ryan to domain admins
upload the malicious dll to the box via winrm
Load our dll
Start meterpreter listener
Stop and start dns service to get the dll executed
My exploit failed for some reason but after few moments, I realized that there was a script that revert everything and delete my payload, So I created a one-linear command to get my payload executed before it was deleted
Root Flag: 2ef8121d16eb0fabebxxxxxxxxxxxxxxxx
This the script which was preventing us as it does the following:
Reset ryan, melanie and administrator password
Reset dns settings
We can see the plaintext password of administrator
Access the machine as admin with plaintext password.
