Forest

Overview

This Hack The Box machine is built on Windows operating system and revolves around Active Directory and Kerberos. Great thing about this machine just like other similar ones is that it can be very close to real-life. Active Directory is used across many Enterprise environments as their credential backbone and is a service that can allow different types of attacks if it is not setup correctly. Along with this (spoiler I know), it has Microsoft Exchange in the same box; this is something that is not common in my opinion unless it is small environment like a small business and there is not enough budget for a server farm. With the move to cloud services like Office 365, using Exchange will slowly decrease (I hope) unless you are in an 'Exchange Hybrid' model.

For people not well versed in Active Directory and Windows, and even if you are, there is some reading to do, or at least I recommend to do so, which is why I've added some resources below and also other links to some tools.

Some great resources around this are below:

Resources:

  1. Active Directory Kill Chain Attack & Defense

  2. MITRE ATT&CK: Kerberoasting

  3. An Introduction to SMB for Network Security Analysts

  4. [MS-SAMR]: Security Account Manager (SAM) Remote Protocol (Client-to-Server)

  5. Configure SAM-R required permissions

  6. Mitigating Exchange Permission Paths to Domain Admins in Active Directory

Let's get started!

Initial Enumeration: Footprinting and Scanning

First of, we need to identify how to reach the system. In other words, we need to identify what are the services available from this machine.

Let's start by adding this machine's IP address to the hosts file and create an alias:

My go-to tools in this phase, which are typically used by many to start enumerating, are:

masscan: very nice port scanning tool that allows finding open ports quickly. To me this is a tool to narrow down the scope of the enumeration so we can focus on open ports only when using nmap.

Here, I am designating the interface to use when communicating to the HTB machine (-e) which will be the HTB VPN interface, along with -p to designate the port range to target but I will target ALL TCP and UDP Ports, and the transmission rate of packets per second (--rate).

Similar to this, you could also run something like this:

nmap -p- --min-rate=1000 -T4

nmap: I think most people in the information technology and security space know what nmap does. It is a very versatile Port scanning tool which also allows you to use scripts to further target the services found. Just like anything, it can be a useful tool while it can also be damaging if the user is not careful.

What I typically start with when using nmap is:

MASSCAN

As you can see, we found some UDP High Ports that at the moment we do not see a use for them. Below is an example of how you can filter these out and create a usable list that can make our lives easier. If you notice the output versus the list of ports I used in nmap, they are not in the same order as the below is for your benefit.

NMAP

As you can see from the open ports found, we have the following which are very important:

Along with these, given that RPC and Dynamic RPC (on the TCP High Ports) are available, means to us that SAMR is also available. Why is this important? Well, SAMR or RPC over SMB, or Security Account Manager Remote Protocol, could potentially allow account enumeration with no authentication. That's a big deal, especially when Microsoft recommends to have this locked down (see Resource #5).

With that being said, let's move forward with Impacket's SAMRDump script to get user account information. This step will give you a lot of good information.

SAMRDUMP

As mentioned, enumerating through SAMR gave us visibility over all users including mailbox accounts. From this we can also build a user list easily:

Exploitation and Gaining Access

Since Kerberos is available and we saw krbtgt user, let's check if all accounts have Kerberos Pre-Authentication enabled. By default, Kerberos Pre-Authentication is enabled, and has to be manually disabled per account (to my understanding). A great explanation was done by one of the Hack The Box members (kudos to VbScrub) and is worth watching, GetNPUsers & Kerberos Pre-Auth Explained. Using GetNPUsers.py will help us test this and if one is found, it will let us retrieve their TGT to then crack it. Kerberoasting

GETNPUSERS

We just found the user htb.local\svc-alfresco (a service account) and its TGT; let's try to crack it

JOHN THE RIPPER

We have svc-alfresco:s3rvice credential pair. Let's test it and its permissions to SMB and at the same time see if these credentials are valid while enumerating what it has access to (I could've used smbmap too).

SMBCLIENT

Looks like I can enumerate shares but I do not have permissions to C$ Share through SMB. Let's try to test credentials/gain access through WinRM. To do this, you need to have evil-winrm installed. Worth going through its documentation as it is one of many other tools that are very versatile.

EVIL-WINRM

AND we found the USER flag using svc-alfresco which resided in the account's Desktop directory.

Privilege Escalation

We need to get a deeper understanding of this AD environment and the accounts rights. There is a vulnerability in Exchange environments and two groups that would allow some accesses that should not happen, like account modification, and to escalate privileges, accounts in these groups would only need DCSync permissions, quite possible to do. Explained further in Resource #6.

This information can be also found through LDAP and/or by using ldapdomaindump: EXCHANGE TRUSTED SUBSYSTEM and EXCHANGE WINDOWS PERMISSIONS.

Let's use Bloodhound/Sharphound through our current session in evil-winrm.

NOTE: To do this, you must first have Bloodhound setup and configured, a walkthrough by itself that I will skip. Also, pay close attention to the syntax when using Sharphound powershell script.

SHARPHOUND

This zip file needs to be uploaded into a clean Bloodhound database. After importing it and evaluating the paths for our own understanding of what we will see next, we can use aclpwn and see if it finds a permissions/membership path using svc-alfresco to see how it can achieve DomainAdmin-like permissions or DCSync.

Once you upload the zip file containing all the domain related information, the following is what you should see:

If you pulled all the AD information you should see similar numbers. To me, I wanted everything I could read!

Not necessary to go through all the queries as the important ones to analyze are 'Find Shortest Paths to Domain Admins' and 'Find Principals with DCSync Rights.

BUT the one you actually need is 'Find Shortest Paths to Domain Admins' as it explains why the following tool finds what it does. Basically, because of the group membership of svc-alfresco, you can delegate DCSync rights by modifying the DACL. I will explain soon.

ACLPWN

Important paths to flag from what aclpwn found (can be also seen by reviewing Sharphound's data in Bloodhound):

  1. Path [0]: (SVC-ALFRESCO@HTB.LOCAL)-[MemberOf]->(SERVICE ACCOUNTS@HTB.LOCAL)-[MemberOf]->(PRIVILEGED IT ACCOUNTS@HTB.LOCAL)-[MemberOf]->(ACCOUNT OPERATORS@HTB.LOCAL)-[GenericAll]->(EXCHANGE TRUSTED SUBSYSTEM@HTB.LOCAL)-[MemberOf]->(EXCHANGE WINDOWS PERMISSIONS@HTB.LOCAL)-[WriteDacl]->(HTB.LOCAL)

  2. Path [1]: (SVC-ALFRESCO@HTB.LOCAL)-[MemberOf]->(SERVICE ACCOUNTS@HTB.LOCAL)-[MemberOf]->(PRIVILEGED IT ACCOUNTS@HTB.LOCAL)-[MemberOf]->(ACCOUNT OPERATORS@HTB.LOCAL)-[GenericAll]->(EXCHANGE WINDOWS PERMISSIONS@HTB.LOCAL)-[WriteDacl]->(HTB.LOCAL)

I selected PATH 0, but as you can notice by examining each path, there is not much of a difference; path 0 is somewhat longer as relies on being a member of EXCHANGE TRUSTED SUBSYSTEM, and the good one is EXCHANGE WINDOWS PERMISSIONS, BUT the first is a member of EXCHANGE WINDOWS PERMISSIONS anyways.

Technically speaking, we used the permissions svc-alfresco already has to modify accounts by being an "indirect" member of EXCHANGE TRUSTED SUBSYSTEM and EXCHANGE WINDOWS PERMISSIONS to delegate rights to itself by modifying domain DACL and give DCSync rights to itself. I know, it sounds confusing to explain!! At least the last Bloodhound screenshot shows this better.

As we select a path and it was successful, we have to move fast and try to use it to dump secrets (NTDS.DIT). Let's use Impacket's Secretdump!

SECRETSDUMP

As we dumped "all secrets" available, notice a great one we need to use:

htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::

First thought of some people would be to try and crack this, but how about using it as is? There are different ways, one being through Metasploit's psexec and through one of the Impacket's SMB or Psexec scripts; I went for Metasploit. In escence, both will be doing a Pass-the-Hash attack.

To do this, we only need the following portion of the Administrator dump used as password: aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6

METASPLOIT

Using the Exploits: 'exploit/windows/smb/psexec' and the Payload 'windows/meterpreter/bind_tcp'

Notice the System and User information provided by Meterpreter. After that, let's switch to a "shell" to interactive with the system through Command-Prompt.

Game Over: System Rooted and ROOT Flag found!

Something important to mention here is, there are other "commands" in Meterpreter to fully own the system even when you already accessed it as the NT AUTHORITY\SYSTEM, but I am not mentioning them here as the intent is to find the Root Flag. Obviously, I'm limiting the effort to the scope of this exercise; find the USER and ROOT flags!

If you enjoyed my walkthrough, thought it was useful AND if you are a member of Hack The Box, feel free throw a 'Respect'. Thanks!

PreviousPostmanNextRegistry

Last updated

Was this helpful?