Search
https://app.hackthebox.com/machines/Search
Nmap
Kerbrute
Starting out we hit some valid usernames whe running kerbrute against the target system. I was unable to proceed with the found usernames so we move onto enumerating the web server.
Basic reconnaissance against the web server shows some team members who may have valid accounts within Active Directory.
The potential users have been listed below.
As we are not aware of the naming convention used for Active Directory user accounts we need to generate a list of possible combinations.
Username Generation
Username generation can be completed with usernamer. usernamer will take an input list of usernames and generate combinations based on likely naming convetions
URL: https://github.com/jseidl/usernamer
After generating the usernames we can the new list with kerbrute against. Revealing the naming convention of Firstname.Surname.
However, after multiple brute force attempts I was unable to proceed.
Information within images
After some time we head back over to the web server and after some time, we find one of the displayed images contains credential information for a internal user.
Keywords identified are "Hope Sharp" and "IsolationIsKey?". Considering we know the naming context for this Domain we try the potential credentials with crackmapexec.
Service Prinicipal Names
With valid credentials we check for SPN's using Impacket GetUserSPNs.py and pull a krb5tgs hash for the user web_svc.
Using hashcat on mode 13100 we are able to soon crack the hash with the rockyou.txt wordlist.
Credentials:web_svc:@3ONEmillionbaby
Password Spraying
I tested for some timed with the web_svc account and was unable to progress anywhere meaningful. Spraying the password against all known uses (who have been enumerated with valid credentials) we get a hit for edgar.jacobs.
Credentials: edgar.jacobs:@3ONEmillionbaby
Protected Worksheets
Using these credentials against SMB with smbmap we recursively lists all available shares.
Where under Edgar's Desktop redirected folders we see "Phishing_Attempt.xlsx".
Using smbmap we download the file of interest.
Opening the Phishing_attempt.xlsx file we see under the worksheet "passwords" that column "C" is missing. As well as the worksheet being password protected.
Some research shows there is various ways of removing the worksheet protection when the password is not known:
[`https://www.ablebits.com/office-addins-blog/protect-unprotect-excel-sheet-password/#unlock-excel-spreadsheet-vba`](https://www.ablebits.com/office-addins-blog/protect-unprotect-excel-sheet-password/#unlock-excel-spreadsheet-vba)
I opted for the copy and paste method where you highlight all cells and simply paste into a net worksheet. Revealing passwords as shown below.
Password Spraying #2
Spraying the password list against the list of known users we get a hit for Sierra.Frye.
Credentials:
Bloodhound
With valid credentials we can perform BloodHound enumeration externally with Bloodhound.py
GitHub: https://github.com/fox-it/BloodHound.py
After completing the BloodHound enumeration the results are uploaded to the console and reviewed. We see we are a member of the "Remote Management Users".
No luck, WinRM is not running externally on the target system.
GMSAPassword
Further enumeration shows effective members of the group ITSEC have the ability to read the GMSA password of BIR-ADFS-GMSA.
gMSADUmper is a python script that can be utilized to read the msDS-ManagedPassword **** attribute and decrypt with the msDS-ManagedPasswordID attribute.
gMSADumper: https://github.com/micahvandeusen/gMSADumper
After successfully reading and decrypting the GMSA password we are left with the following credentials: BIR-ADFS-GMSA$:::e1e9fd9e46d0d747e1595167eedcec0f
However, from here I was unable to proceed with the credentials.
Certificates
Going back to further enumeration we use smbmap to list available shares using Sierra's credentials and find some certificate files within the redirected folders share.
After downloading we are prompted for a password on the .pfx file.
pfx2john is used to convert the file to a hash usable by john.
Cracking the hash:
We can now import the certificate file into Firefox. A password will be prompted to complete the action where we provide the same password shown above.
PowerShell Web Access
Moving over to the /staff web page we are given the opportunity to provide the certificate file.
We are then progressed a PowerShell web access console. Logging in with Sierra's credentials and the computer name as "research" allows logon.
User.txt
We are then able to grab the user.txt flag.
Lateral Movement with PowerShell
I was unable to find a method of privilege escalation as Sierra and BloodHound was not providing any paths for potential escalation.
I decided to proceed with gaining command execution as BIR-ADFS-GMSA$ using PowerShell remoting.
Even though we already have the credentials for BIR-ADFS-GMSA$ I used the following PowerShell snippet linked below to build a credential variable from the GMSA read ability for use with Invoke-Command.
URL: https://www.thehacker.recipes/ad/movement/dacl/readgmsapassword
Invoke-ACLScanner
Whilst working as BIR-ADFS-GMSA$ I then bypassed AMSI and run Powerview's Invoke-ACL Scanner to look for ACL's of interest.
Looking through the results we see that BIR-ADFS-GMSA$ has GenericAll privileges over the user Tristan.Davies wo is a Domain Administrator. Weird how this attack path was not picked up by BloodHound.
As we have GenericAll over Tristan.Davies we can change the user's password.
To gain full shell access I disabled the firewall with our now acquired Domain Administrator account.
Check the WSMAN is running with Nmap.
root.txt
Then proceeded to login with Evil-WinRM.
Then grabbed the root.txt flag.
Last updated
