RazorBlack
https://tryhackme.com/room/raz0rblack
Nmap
Kerberos user enumeration
Hitting kerberos first we perform user enumeration making use of kerbrute.
After a short while we obtain a couple of usernames.
No Pre-Authentication
As such, we are able to pull the krb5asrep hash from the user account which can next be used against John for cracking.
Hash Cracking #1
A few minutes of cracking against the rockyou.txt word list we soon reveal the plain text password.
Service Prinicpal Names
With a set of valid credentials we find we are unable to proceed with SMB. Using the same credentials to check for Service Principla Names using Impacket's GetUserSPNs.py we are able to pull a hash for the user xyan1d3.
Hash Cracking #2
Taking the krb5tgs hash we are able to again crack with John and the rockyou.txt list.
WinRM
SeBackupPrivilege
Performing basic enumeration steps we find our current user is a member of the "Backup Operators" group and have privileges for SeBackupPrivilege.
This privilege grants us the ability to create backups of files on the system. Knowing this, a high value file would be the ntds.dit file which is a database of hashes for domain objects / users. As the ntds.dit file is in constant use we will be unable to create a backup using normal methods as the system will lock the file.
What we can do instead is create a Distributed Shell File (DSH). This file will contain the appropriate commands for us to run the diskshadow utility against the C: drive and ultimately the ntds.dit file.
First created a file called viper.dsh on the attacking machine. Then insert the following contents:
Once completed use the command unix2dos to convert the file to DOS format.
Then on the target system create a directory called 'temp' in c:\temp. After this upload the viper.dsh file.
Then execute diskshadow against the file.
After creating the shadow copy we can then use robocopy to copy the ntds database to our current working directory.
From here we need to extract the SYSTEM hive which will be required for extracting the hashes with Impacket later.
After the registry hives have been saved we can download to our attacking machine.
Back on the attacking machine use the following command with Impacket's secretsdump.py to extract the hashes from ntds.dit.
WinRM (Administrator)
With the Administrators hash we can utilize Evil-WinRm again to login as the Domain Administrator.
Last updated
Was this helpful?
