Sauna

Completed on February 15, 2020.

Overview

Back when I did this box 2 years ago, I used commands like type to look at the content of files, or normal command-line commands within powershell, as well as Metasploit. As I am redoing some sections for documentation purposes, I will use a different approach, such as using powershell commands, and avoid relying on methods that might not be helpful when going through exams like the OSCP.

Let's face it, writing documentation from something you wrote and worked on two years ago can be a headache.

Sauna can be a good HTB box to practice your enumeration process, both remote and local, as you can find what you need to do by carefully assessing the services and the system itself. It never hurts anyone to be thorough when enumerating.

References:

Enumeration

Finding Open Ports

To gather information about this machine, we start by finding any TCP/UDP open ports using masscan.

Port Scanning

To further get more information about these open ports we found, we used nmap SYN scan (-sS) with default script execution (-sC) and service version enumeration (-sV).

Before we do this, we gathered in a variable (PORTS) a list of the TCP ports found open to then use it for our scan. This step is not necessary but helpful.

From the service found, whenever LDAP(s) or SMB are accessible, I try to target these service first instead of going for others like HTTP. These services are known to be misconfigured frequently and allow access with no authentication.

Enumerating LDAP

While enumerating LDAP, we try to define the scope and reduce the data returned while providing necessary information. Here, we pulled the naming context information as well as the DNs available.

Pulling all the distinguished names in the directory.

Using Impacket's GetNPUsers

Now that we found the 'CN=Hugo Smith,DC=EGOTISTICAL-BANK,DC=LOCAL' distinguished name, we have to try using it.

We don't have a definitive samAccountName to go by, but from all the possible username combinations we could come up with, hsmith seemed to give a different response when trying to check for Kerberos Pre-Authentication with GetNPUsers.

Given this information, we should go to the web service available:

Egotistical Bank Homepage
Egotistical Bank 'About Us' page

The /about.html page shows the company employees, which could be Active Directory users as well. At the same time, oddly enough, it shows two users, 'Hugo Bear' and 'Fergus Smith', but no 'Hugo Smith'.

Given this information, we should attempt to use hbear and fsmith.

Exploitation and Gaining Access

Using Impacket's GetNPUsers

Knowing that the samAccountName valid for Hugo Smith is hsmith, we tried hbear with no success as it seems to not exist, so let's try fsmith and see if we get a Kerberos TGT by doing ASREPRoast attack.

AND we found a valid Kerberos Ticket. Let's try and crack it with John The Ripper.

Using John The Ripper

This step is self-explanatory. We are relying on a password/hash cracking tool to get fsmith's password by cracking the Kerberos Ticket from our previous Kerberoasting step.

Using Enum4Linux

With these credentials, let's keep enumerating with enum4linux, and try to gather user and group membership, operating system and share information.

At this point, we have a list of users (local and domain), groups, shares, and other useful information. While at it, if we pay close attention, we notice fsmith cannot be used to access the system using SMB.

Also, we noticed the both fsmith and svc_loanmgr are members of the Remote Management Users group, which means both have access to WinRM.

Sample output:

Given that gaining access through SMB is out of the question, we should attempt through WinRM.

And we got the user flag!

Privilege Escalation

Now that we are in the system, let's look at any paths to escalate privileges. Given that we have some domain accounts as well as local, we will need to do some more local enumeration.

Let's first use SharpHound and retrieve the data for further review:

Continuing with some manual enumeration:

From these accounts, we know already fsmith, so we only have hsmith and svc_loanmgr left to look at.

Between these two accounts, we can tell already from our remote enumeration that svc_loanmgr is a member of the Remote Management Users group but both can authenticate against the domain.

Let's try to find out if any cached credentials exist by looking at the Winlogon registry key:

And we immediately notice credentials in the registry when looking for cache credential counts.

We can attempt to use them to authenticate through WinRM but we need to use svc_loanmgr instead of svc_loanmanager used in the registry key value DefaultUserName as it does not exist, check the accounts privileges.

We don't see much here, but from what we found out through Bloodhound, svc_loanmgr has DCSync rights, let's take a look at the Bloodhound query and what Powersploit's PowerView provides.

Using BloodHound

Here, we use Bloodhound and the data retrieved previously from SharpHound.

Bloodhound's DCSync Query

The screenshot above shows the DCSync rights svc_loanmgr has, which are GetChanges and GetChangesAll. These ACLs are the same the Administrators, Enterprise Domain Controllers and Domain Controllers group members have.

Using PowerView

PowerView also shows we have DCSync access as svc_loanmgr. Let's move forward and retrieve the NTLM hashes.

Using Impacket's Secretsdump

Right there, we were able to extract the Administrator's NTLM hash from ntds.dit. Now we can use this hash to authenticate as the Administrator user through a Pass-the-Hash attack.

And we got root!

PreviousMonteverdeNextOpenKeyS

Last updated

Was this helpful?