Resolute
Completed on 11 Dec 2019.
Overview
This Hack The Box machine is built on Windows operating system and revolves around Active Directory, LDAP, and also bad practices. Great thing about this machine just like other similar ones is that it can be very close to real-life. Active Directory is used across many Enterprise environments as their credential backbone and is a service that can allow different types of attacks if it is not setup correctly.
Resolute required a good amount of enumeration even after you gain access into the system. Along with this (spoiler I know), one finding that leads to privilege escalation is an specific group membership. Some HTB users went for this other approach, I went in a different direction.
For people not well versed in Active Directory and Windows, and even if you are, there is some reading to do, or at least I recommend to do so, which is why I've added some resources below and also other links to some tools.
Some great resources around this are below:
Resources:
Let's get started!
Initial Enumeration: Footprinting and Scanning
First of, we need to identify how to reach the system. In other words, we need to identify what are the services available from this machine.
Let's start by adding this machine's IP address to the hosts file and create an alias:
My go-to tools in this phase, which are typically used by many to start enumerating, are:
masscan: very nice port scanning tool that allows finding open ports quickly. To me this is a tool to narrow down the scope of the enumeration so we can focus on open ports only when using nmap.
Here, I am designating the interface to use when communicating to the HTB machine (-e) which will be the HTB VPN interface, along with -p to designate the port range to target but I will target ALL TCP and UDP Ports, and the transmission rate of packets per second (--rate).
Similar to this, you could also run something like this:
nmap -p- --min-rate=1000 -T4
nmap: I think most people in the information technology and security space know what nmap does. It is a very versatile Port scanning tool which also allows you to use scripts to further target the services found. Just like anything, it can be a useful tool while it can also be damaging if the user is not careful.
What I typically start with when using nmap is:
MASSCAN
As you can see, we found some UDP High Ports that at the moment we do not see a use for them. Below is an example of how you can filter these out and create a usable list that can make our lives easier. If you notice the output versus the list of ports I used in nmap, they are not in the same order as the below is for your benefit.
NMAP
As you can see from the open ports found, we have the following which are very important:
Along with these, given that RPC and Dynamic RPC (on the TCP High Ports) are available, means to us that SAMR is also available. Why is this important? Well, SAMR or RPC over SMB, or Security Account Manager Remote Protocol, could potentially allow account enumeration with no authentication. That's a big deal, especially when Microsoft recommends to have this locked down (see Resource #5).
With that being said, let's move forward with Impacket's SAMRDump script to get user account information. This step will give you a lot of good information and we could end up using it for things like an user list.
SAMRDUMP
As mentioned, from this information, I basically created my user list to hold on to it, but we need to move on to the next and see what we can get without credentials.
Let's move to LDAP. With LDAP, we can try ldapsearch and ldapdomaindump. The last command generates different files for better or easily readable information.
LDAPSEARCH
Dumping LDAP information unauthenticated while focusing on the findings as it is a lot what we can get from a domain.
As you can see, we can focus only on Marko as a potential password was added to the user's account Description attribute. That password is Welcome123!.
As we try it with smbclient, which will not be a focus here, we find that password is not good with the user Marko, but that password has to mean something or be useful.
Let's try doing "password spraying" against the user list we created from samrdump while relying on ldapdomaindump. I used this tool to test this password as...might as well do it and if successful we can leverage the data we get.
LDAPDOMAINDUMP
This attempt relied on a one-liner bash script, see below:
As you can see, the user melanie appears to be match for Welcome123!.
At first we can attempt to use this user/password combination against SMB but unfortunately it led us nowhere, but see below as an example using smbmap.
So let's take a look at some of the files created by ldapdomaindump. First, we'll look at the domain_users_by_group.html.
While focusing on the Remote Management Users, which provides the necessary permissions to access the system remotely using WinRM, we see the user melanie and the group Contractors. This means we can attempt to access the system through WinRM by using melanie (which we have a password for) and any other user that is a member of the group Contractors.
Let's see what the domain_users.html file has to say about users that are members of the Contractors group.
Let's also look at any other group memberships back in the domain_users_by_group.html.
And we see the Contractors group as a member of the DNSAdmins group. This means any user that belongs to Contractors, which is a member of the DNSAdmins group, can be used to abuse his membership to escalate to Administrator rights.
Exploitation and Gaining Access
Let's attempt to gain access with melanie through WinRM using evil-winrm, which per group membership of Remote Management Users, accessing the system through WinRM should be possible.
EVIL-WINRM
Well, not only we gained access but we found the user.txt flag file!!
Privilege Escalation
Since we gained access, we need to find ways to escalate privileges. At this point, it is early to try anything as we only have one set of credentials from a user that only has access privileges through WinRM. So let's keep enumerating!
We found a directory called PSTranscripts, which sounded interesting given what a Powershell Transcript file is. So when go through this Powershell Transcript file after downloading it, we find ryan and his password in cleartext:
After seeing the user ryan, which is a a member of the Contractors group, and this group is also a member of the DNSAdmins group, tells me the user is the one we could try to abuse and escalate privileges. One avenue we can attempt is to load an arbitrary DLL with SYSTEM privileges on the DNS server, which I provided a link as a reference.
This way was the one a lot of HTB users relied on, I parted from relying on the write privileges to a DNS server object that ryan gets from these group memberships.
As the the DNS Admin approach relies on, we can try a use a simpler method using Metasploit and the psexec_psh exploit will try and create a service in the host using a defined payload.
That being said, I'm not saying my approach is better but I'm simply sticking to the goal which is escalating privileges however means necessary.
Let's try this:
METASPLOIT
And we have a Meterpreter Shell, which also means the credentials found for the user ryan were good.
METERPRETER
Using Meterpreter we can do a lot of things, but in this case, let's simply see what system information we can get like the user we are running this shell as.
Here we can see privilege escalation worked using just psexec_psh as we are running this Meterpreter session as the NT AUTHORITY\SYSTEM user. Let's use the shell Meterpreter command to go to command-prompt on this host; something I didn't have to do but it is a good thing to show you can do this.
At this point, we got the root flag and owned the system. Goal Achieved!
Last updated
Was this helpful?