Search

Completed on April 23, 2022.

Overview

Hopefully you like this machine as much as I did. When I worked on it, I was getting ready to start working on the OSCP training (PEN-200), and was looking for practice before starting. At this point, I had finished the eCPPT almost month ago. As almost all the HTB machines, this one goes a bit overboard so it is definitely a good practice in my opinion. It requires a thorough enumeration more than the techniques used to pwn the system. The references I share below should help out understanding what is involved.

References

Enumeration

As we need to know what is available to us, we need to enumerate the exposed services to get some initial information and then dig deeper. Let's start by finding open ports…

…followed by further port scanning:

From the port scan we have lot of good information to start with. What we know so far is:

  • Domain: search.htb

  • Command Name: research

Enumerating HTTP/HTTPS

Inspecting TCP80 leads to a static page and references to jpg files:

Doing the same on TCP443 leads to the same page but there is a certificate bound to the service and the hostname research.search.htb associated with the certificate. This is the hostname related to the common name found in some services:

Note: Adding the CN research.search.htb to the hosts file.

As both http and https sites reference the same application, we find some “employees” that might come in handy:

For the sake of clarifying, exposing a web application on HTTP when it is supposed to on on HTTPS is not something that should not be done for security reasons. Pulling a list of employees to then create a username combination:

With these names we can build a list of common usernames based on typical naming conventions. See below if desired.

Username Combination

  • KLyons

  • DSantiago

  • SFrye

  • KStewart

  • KSpencer

  • DSimpson

  • BTompson

  • CStewart

  • K.Lyons

  • D.Santiago

  • S.Frye

  • K.Stewart

  • K.Spencer

  • D.Simpson

  • B.Tompson

  • C.Stewart

  • Keely.Lyons

  • Dax.Santiago

  • Sierra.Frye

  • Kyla.Stewart

  • Kaiara.Spencer

  • Dave.Simpson

  • Ben.Tompson

  • Cris.Stewart

As part of our enumeration on HTTP/HTTPS, let's enumerate directories:

From the directory/page enumeration, it is worth noting there is a ’certificate enrollment’ directory and most probably this is a user certificate enrollment service, but at the moment the key question is what is it for? While inspecting thoroughly, we found a picture with some notes and when we inspected the notes it had a message giving out a clue:

Looking suspicious enough to look into this user and what seems to be its password. Given our naming convention first.last, we can compose it as:

  • Hope Sharp -> hope.sharp

  • Password: 'IsolationIsKey?'

Enumerating LDAP

Regardless of having some potential access, we should try and enumerate LDAP with no credentials if we are looking to do an assessment, and even when the service asks for authentication, some good info can still be retrieved.

We can retrieve the naming contexts but anything else requires authentication. Use ldapsearch against the Users base Object to test credentials:

Along with some users, we can see user certificate information from the Administrator user.

Using Kerbrute and Enum4linux

Using the username list we created from the people found on the web application, we can try and confirm if those are valid users.

This gave us three AD accounts that exist. By using enum4linux, we found some interesting group memberships and other users retrieved through LDAP:

At this point, we could pull more information valuable using Bloodhound and might save us some effort, but we can leave for a later stage so we go through the process.

Gaining Access

Looking specifically at the shares this account has access to:

There we see there is a share that can be accessed with this credential. Let's take a look:

All of this leads to nowhere except that we know ‘sierra.frye’ has the user flag, so this user is probably the next step to a lateral movement.

Kerberoasting

Given the users we got from enum4linux, let's use it and attempt to get the SPN tickets:

Now with the SPN ticket for web_svc, let's try and crack this:

Once we cracked this SPN ticket, we had no success as it has the "same level of access" as hope.sharp. Let's attempt to use it for password spraying and see if an account has that same password:

We found another user with the same password as web_svc: Edgar.Jacobs:@3ONEmillionbaby

Let's see what can we see with this account:

As you get to see, there is a "phishing" related spreadsheet we need to inspect and for this I did not go fancy and simply used Google Sheets:

This is what seems to be a good password list to work with and test them out once more after composing a new list:

And we just found the following: SEARCH\Sierra.Frye:$$49=wide=STRAIGHT=jordan=28$$18

Let's attempt to use this account while first testing it through smbmap:

At this point, not only we found the user flag without a shell but we also found a PKCS12 certificate file (PFX file).

While trying to see the content of this certificate file, we cannot as it seems to have been created with a passphrase to decrypt the private key.

Once we have this passphrase and inspect the certificate, we see this is a user certificate and with the CA certificate file (of course, it is a PKCS12 certificate file). Now, with these certificates, we can try and access http://research.search.htb/staff which is what this certificate is for:

To use these certificate files, you will have to import them into the browser.

This will give us a Powershell session on the browser. Here we will try to get and change the Execution Policy and load PowerView into memory for future use:

Privilege Escalation

While enumerating directories we bump into a Home directory from what seems to be a group managed service account (GMSA):

Bloodhound

With this account, we should try and enumerate the domain a little more using Bloodhound:

Using the 'Shortest PAth to Domain Admins, we can see that 'Sierra'Frye', through the inherited rights from the ITSEC group, can read the gMSA password from BIR-ADFS-GMSA. This service account has the 'Generic All' rights against 'Tristan.Davies', a domain admin, which means the account can be modified.

When we try to dump the gMSA password with Sierra.Frye we get such hash:

Back to Powershell, we will try to use the 'ManagedPassword' and change Tristan.Davies password:

Lateral Movement

Having changed the password on Tristan.Davies, we can now access the account with no issues.

Accessing the system through SMB:

AND we got the root flag!!

PreviousIntelligenceNextStreamIO

Last updated

Was this helpful?