LinkedInHTB ProfileAbout
Page cover

HTB - Resolute

Machine Info

Resolute is a medium difficulty Windows machine that features Active Directory. The Active Directory anonymous bind is used to obtain a password that the sysadmins set for new user accounts, although it seems that the password for that account has since changed. A password spray reveals that this password is still in use for another domain user account, which gives us access to the system over WinRM. A PowerShell transcript log is discovered, which has captured credentials passed on the command-line. This is used to move laterally to a user that is a member of the DnsAdmins group. This group has the ability to specify that the DNS Server service loads a plugin DLL. After restarting the DNS service, we achieve command execution on the domain controller in the context of NT_AUTHORITY\SYSTEM.

Enumeration

Scope

IP Address: 10.10.10.169

Nmap Scan

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p- --min-rate 10000 $ip -Pn 

PORT    STATE SERVICE      REASON
53/tcp  open  domain       syn-ack
135/tcp open  msrpc        syn-ack
139/tcp open  netbios-ssn  syn-ack
445/tcp open  microsoft-ds syn-ack
5985/tcp open   wsman      syn-ack

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000

PORT    STATE SERVICE
53/udp  open  domain
88/udp  open  kerberos-sec
123/udp open  ntp
389/udp open  ldap

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p -sCV $ip -Pn -oN Nmap/script-scan

PORT     STATE SERVICE      VERSION
53/tcp   open  domain       Simple DNS Plus
88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-11 02:24:26Z)
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK)
5985/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-07-11T02:24:32
|_  start_date: 2024-07-11T02:18:59
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 2h27m07s, deviation: 4h02m31s, median: 7m06s
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: Resolute
|   NetBIOS computer name: RESOLUTE\x00
|   Domain name: megabank.local
|   Forest name: megabank.local
|   FQDN: Resolute.megabank.local
|_  System time: 2024-07-10T19:24:30-07:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required

DNS Enumeration

Zone transfer failed

RPC Enumeration

I got a username list from rpcclient and filtered them.

SMB Enumeration

I didn't get anything as anonymous login failed

I also try password spraying with the same usernames as passwords but failed

KERBEROS Enumeration

I tried ASREP-Roasting attack but no thing

Initial Access

When I run out all the options I know to get a foothold, I decided to query the users info I got from rpccclient, maybe a password exists in description field or something

we found the password Welcome123!, Let's confirm access with user marko

It seems like this password doesn't belong to him, So I will spray it to the list of users we have

So, we have now valid credentials melanie:Welcome123!, Let's see if we have remote access to that box

Yes, we have :)

User Flag: f65ae23b0313053bb9xxxxxxxxxxxxxxxx

Privilege Escalation

When I landed on windows box joined to Active Directory, I run bloodhound.py to collect info about the domain and provide it to bloodhound GUI

Start neo4j database and then run bloodhound to open GUI

provide the data collected as zip file to bloodhound

user ryan has a profile on the box, Let's enumerate him in bloodhound

Click on unrolled group membership to see nested group membership

  • ryan is a member of DNSADMINS group via nested group membership, So If I could takeover this account, the path to Domain Admins is clear

I found no database, PowerShell history file, no stored credentials or scripts located somewhere however, I learned a trick before that I always make on windows machine which is looking for hidden files as I do in Linux

PSTranscripts is not a standard directory, Let's explore it

That .txt file looks very interesting, Let's see

Let's check if these credential are valid

And successfully got the ryan account.

  • we can then abuse our membership in DNS Admins group, we can alter the .dll of dns service running as SYSTEM to add ourselves in Domain Admins group or get a reverse shell as SYSTEM

Before we start the attack, Let's first confirm we have control on dns service

The object SID that has control of dns service is S-1-5-21-1392959593-3013219662-3596683436-1105 I look at bloodhound to get the SID of user ryan and see if the two SIDs match each other

So, we have control of DNS service, Let's start the attack.

Generate malicious dll to add ryan to domain admins

upload the malicious dll to the box via winrm

Load our dll

Start meterpreter listener

Stop and start dns service to get the dll executed

My exploit failed for some reason but after few moments, I realized that there was a script that revert everything and delete my payload, So I created a one-linear command to get my payload executed before it was deleted

Root Flag: 2ef8121d16eb0fabebxxxxxxxxxxxxxxxx

Reverst.ps1

  • This the script which was preventing us as it does the following:

    • Reset ryan, melanie and administrator password

    • Reset dns settings

We can see the plaintext password of administrator

Access the machine as admin with plaintext password.

PreviousHTB - MonteverdeNextHTB - Sniper

Last updated