Sam
https://www.cyberseclabs.co.uk/labs/info/Sam/
Nmap
SMB
As we have SMB open we can do some quick checks for null authentication.
We are able to enumerate the backups share on the host and then connect to it with the following command to gain a SMB shell with null authentication.
SAM
As it looks like a backup of the system we should see if the SAM and SYSTEM files have been backed up. Normally these files are locked when the system is running but if backed up hopefully we will be able to download them.
First we need to go the directory Windows\System32\Config
and then use the get
command to download the files.
Kali Linux comes pre-installed with a tool called samdump2
. We can combine the SYSTEM and SAM file with this tool to extract local user accounts and hashes.
Once completed we can cat
the file to confirm if we have extracted account hashes.
Password Cracking
From here we can remove the '*disabled*' lines so they do not effect the outcome of cracking tools such as John
.
We can then use the following command with John
to attempt to crack the hashes.
We have the following credentials cracked: jamie:rangers
.
Initial Foothold
As port 5985 is open we can attempt to connect with Evil-WinRM
.
Privilege Escalation
I checked systeminfo
in which we have no access to perform.
I then run powerup.ps1 and JAWS.ps1 and was not able to identify any interesting points of escalation. However, after running the services
command we see something worth looking into.
The services monitor1 and monitor2 are not default services and should be looked into. I queried monitor1 with sc.exe
and received the following:
As the service is run by LocalSystem this will be an ideal candidate for privilege escalation if we can replace the binary with one of our own.
Lets move to the directory and see if we can delete the binary and if we can we should be able to replace it with a malicious binary.
I was able to delete the binary. I will now create a reverse shell with msfvenom
, name it monitor1.exe
and attempt to start the service.
After this has completed we can then upload it with Evil-WinRM
.
Create a netcat
listener on the attacking machine to the port defined in the msfvenom
payload.
Then start the service with sc.exe
on the victim machine.
We can now grab the system flags.
As the Administrator account was disabled on the system we can now enable the account. Change the password and login with the Administrator account.
Last updated