Forest
Easy Windows Active Directory HTB Box
Reconnaissance
As always we start off by performing a port scan using Nmap to enumerate open ports, versions and services
As we can see we're probably facing a DC because of some ports that are open — TCP 80 (Kerberos)
| TCP 389,3268 (LDAP) | TCP 5985 (WinRM)...
We can also enumerate the Domain Name which is htb.local so we'll add it to our /etc/hosts
Let's start off by enumerating the DNS records using my own function script written in bash:
We use the script but no useful information is shown so we'll move on to enumerating RCP with rpcenum using a null session in order to enumerate domain users
Well add every user to an user.txt to try perform an AS-REP Roasting attack!
AS-REP Roasting Attack
AS-REP Roasting targets Kerberos accounts with pre-authentication disabled.
Normally, users have to prove who they are before the domain gives them a ticket. But if pre-auth is off, the server sends back a Kerberos response encrypted with the user's hash — no password needed.
We can grab that response and crack it offline to get the user's password.
And you may ask, well how do I know when to do it?
We already found valid usernames. Now we’re checking if any of them are misconfigured and can give us the Kerberos hashes, so let's try to perform the attack using impacket-GetNPUsers
We successfully performed the AS-REP Roast attack and go the hash for the user svc-alfresco so let's crack it using john as we typed the -format john flag
And we cracked the password!! — s3rvice , let's check if we can login into the system using Evil-WinRM
Enumeration using BloodHound
Let's open BloodHound in order to enumerate possible ways to escalate ourselves to Administrator
First we upload SharpHound to the target victim via the evil-winrm command upload and then
Let's download this data to our attacker machine and upload it to BloodHound via File Ingest
And then we can see the Graph in order to check possible Escalation paths to Domain Admin by clicking on Cypher -> Active Directory -> Shortest path to domain admin
WriteDacl Abuse on Domain Object
From the BloodHound graph, I see that svc-alfresco is a member of several nested groups that eventually lead to EXCHANGE WINDOWS PERMISSIONS. This group has WriteDacl permissions on the domain object HTB.LOCAL.
I choose this path because it's clean, doesn't require membership in high-privilege groups like Domain Admins or Account Operators, and avoids touching sensitive users directly. Instead, I modify the ACL of the domain itself.
1. Create a Domain User
We create a new user account that we’ll later escalate:
2. Add User to Privileged Group
To gain the necessary control, we add delorian to the Exchange Windows Permissions group:
3. Prepare Credentials in PowerShell
We convert the password to a secure string and store it as a credential object:
4. Abuse WriteDACL with PowerView
We upload PowerView.ps1
Then we execute the following command to give delorian the required DCSync rights:
5. DCSync with Impacket
From our attacker machine, we perform a DCSync using Impacket’s secretsdump.py:
6. Pass-the-Hash (Evil-WinRM)
Now we can use the extracted NT hash to authenticate as Administrator via Pass-the-Hash:
Hope you liked this Write-Up and found it useful
Thank you for reading!!
Last updated