TimeLapse
Easy Windows Active Directory Box on HackTheBox
Reconnaissance
As always we start off by performing a TCP Port scan to enumerate services and versions running on open ports, with the use of Nmap
After reading the scan for a bit we can already know that we're facing a DC (Domain Controller) because of the simultaneously open ports like TCP Port 53 (DNS) TCP Port 88 (Kerberos) TCP Port 135 (RPC) TCP Port 389 (LDAP) ...
We can also see the domain name which is timelapse.htb se we'lld add it to our /etc/hosts file
As I always say when pentesting Active Directory, methodology is the most important so we'll enumerate as much as we can, starting off by TCP Port 53 (DNS) using dig to try and enumerate useful information out of records
But we don't seem to find anything useful here, so let's move on to port 88 (Kerberos) and let's try to perfrom a user enumeration bruteforce with the tool Kerbrute (Available here)
And we found 2 valid users: Guest and Administrator so let's keep enumerating
Let's go with TCP Port 135 (RPC) now using rpcclient
But we see that our access is denied...
Now let's move on into TCP Port 389 (LDAP) using ldapsearch to enumerate possible useful information with the use of a NULL Session
We don't seem to find anything useful here neither so it's time to enumerate TCP Port 445 (SMB) with the use of NetExec (Newer version of CrackMapExec)
We see some valid shares and one uncommon share named Shares so let's try to see whats inside using smbclient
We extracted some files but the ones that catch our attention are winrm_backup.zip and 2 .docx files: LAPS_OperationsGuide.docx LAPS_TechnicalSpecification.docx LAPS_Datasheet.docx
After reading the .docx files for a bit I found nothing useful so let's move on to the zip
Zip Password Cracking
As the zip file asks us for a password we'll try to crack it with zip2john and then john
And we cracked the passwrd — supremelegacy so let's unzip the file
And we found another file: legacyy_dev_auth.pfx
PFX Cracking
And some people may ask, what is a PFX file?
A PFX file, also known as a PKCS#12 file, is a password-protected archive that stores a digital certificate and its corresponding private key
So let's crack it with the use of pfx2john and john
And we found another password — thuglegacy so let's extract the files for legacyy_dev_auth.pfx using openssl
And now we've got both files: the certificate and the key so we'll try and use these to login via WinRM using Evil-WinRM to the user legacyy shown on cert.pem
And we're in!
User pivoting
After some manual enumeration we find some useful information in the command line history
such as a valid password — E3R$Q62^12p7PLlC%KWaxuaV and a valid user — svc_deploy so let's try to pivot to this user using evil-winrm as we did earlier with the legacyy user
And we successfully pivoted to the svc_deploy user using manual enumeration!
Privilege Escalation — LAPS Abuse
After manual enumeration in this user, we find that it's a strange group — LAPS_Readers
so let's find if we can abuse LAPS, but first let's explain this is:
LAPS (Local Administrator Password Solution) is a Microsoft feature that automatically sets a unique, random password for the local Administrator account on each domain-joined computer.
We'll use the following github repository: AdmPwd.PS in order to abuse LAPS we will need to download the whole folder to the victim
Now let's aim for DC01 to see if we can retrieve the password
And we found a valid password!! — 3H&)(xW48CNE68L9,0,bL0Wo
Let's try to login via WinRM using Evil-WinRM
And we're in!!! Now we can retrieve the flag and confirm that we Pwned this box completely!!
Hope you found this write-up useful and see you next time!! <3
Last updated