Forest

Quick Summary

Hey guys, here’s my write-up about Forest Box it was a great box and very realistic

started with enumerating users over RPC, attack Kerberos with AS-REP Roasting

and a privilege escalation is possible when our user is in Exchange Windows permissions security group

Recon

Nmap

Start with scanning all ports

nmap -p- 10.10.10.161 --min-rate=10000

then enumerate version

looks like we are dealing with a domain controller

DNS Enumeration

can resolve htb.local and forest.htb.local from this DNS server

SMB Enumeration

Since we have netbios-ssn open on port 139 let’s run smbmap and see what we get. If you’re not on kali you can get smbmap from here

I also tried smbclient but got nothing

RPC Enumeration

Here, we can see MSRPC port 135 is open so we can enumerate information out of AD using rpcclient and null authentication

rpcclient -U "" -N 10.10.10.161 to get a list of users we useenumdomusers

and we can list groups also

AS-REP Roasting

So what is AS-REP Roasting attack:

technique against Kerberos that allows password hashes to be retrieved for users that do not require pre-authentication. If the user has “Do not use Kerberos pre-authentication” enabled, then an attacker can recover a Kerberos AS-REP encrypted with the users RC4-HMAC’d password and he can attempt to crack this ticket offline.

By default, Do Not Require Pre-Authentication is disabled for the domain user.

I have a list of accounts from my RPC enumeration above.

now we can use GetNPUsers.py from Impacket to try to get a hash for each user, and I find one for the svc-alfresco account:

Crack Hash

Now I can use hashcat to break the hash:

we get password s3rvice

WinRM

now we can use Evil-WinRM to connect to the box

From here I can grab user.txt:

Privesc to Administrator

Enumeration

I used SharpHound to collect data for BloodHound.

so what is BloodHound:

BloodHound is a tool for visualizing an Active Directory environment as a graph. This representation then offers all the power of graph theory to unravel new attack paths.

It can be used on engagements to identify different attack paths in Active Directory (AD), this encompasses access control lists (ACLs), users, groups, trust relationships and unique AD objects. The tool can be leveraged by both blue and red teams to find different paths to targets. The subsections below explain the different and how to properly utilize the different ingestors

let's upload it and invoke it

now we will download the results to my box actually evil-winrm made it easy through the command download

you can install bloodhound from here

you can pull the data file to bloodhound or use upload button

In querries field you can request user, domain or group to see which is link with which.

for example svc-alfresco@htb.local right click on “shortest path to go here” and you will see domain user and group linked with svc-alfresco user.

I’ll click “Find Shorter Paths to Domain Admin”, and get the following graph:

Exchange and high privileges

Because my user is in Service Account, which is a member of Privileged IT Account, which is a member of Account Operators, it’s basically like my user is a member of Account Operators. And Account Operators has Generic All privilege on the Exchange Windows Permissions group.

I found this great article post-blog to abusing Exchange

in bloodhound we can click “Abuse Info” tab in the pop up that displays:

Grant DCSync Privileges

first we will add our user to "Exchange Windows Permissions" group

we will upload powerview and invoke it to complete our attack

And I can see the user in the new group:

I run secretsdump.py to get hashes:

Shell

And we owned root ! That’s it ,

Feedback is appreciated !

PreviousWhat is Kerberos and how it works (ar)NextRabbit

Last updated

Was this helpful?