DarkZero
Hard Windows Active Directory Box from HTB Season 9 (3/13)
Recon
We start off with the given creds: john.w RFulUtONCOL!
As always we start off by performing an nmap TCP scan
As we can see we're probably facing a DC (Domain Controller) because all of the simultaneously open ports: TCP Port 88 (Kerberos) | TCP Port 135 (RPC) | TCP Port 5985 (WinRM)...
We can also enumerate the Domain Name which is DC01.darkzero.htb so we'll add it to our /etc/hosts using netexec
We also see that the TCP Port 1433 (MSSQL) is open which can be dangerous if misconfigured but we'll enumerate that later on.
We already know that methodology is the most important on Red Teaming so let's enumerate everything, starting off by TCP Port 53 (DNS) and check if any record contains useful information using dig:
DC01.darkzero.htb resolves to another IP: 172.16.20.1 that is not reachable from our network, this means we will probably need to pivot
Well enumerate now TCP Port 445 | (SMB) using netexec
And we see that john.w, Guest and Administrator are the only available users, so we'll skip RPC Enumeration
Enumerating MSSQL
Let's use the impacket-mssqlclient tool for this step
After some enumeration we find this
Which means there are 2 DCs, DC01 and DC02.darkzero.ext, let's try and use the link to DC02
And then check if we can use xp_cmdhsell
And we got RCE!!!
Foothold
Let's try and set up our reverse shell using the xp_cmdshell on DC02.darkzero.ext with a powershell one-liner
Privilege Escalation on DC02 using msf CVE
Since we're already in, let's check the subnet that we saw earlier:
This confirms that we are inside of a subnet (172.16.20.0/24), for more comfort let's use msfvenom along with msfconsole's multi/handler
First, generate the payload
Set multi/handler listener
Set python server on port 80
Download and run the payload on DC02
And we get our upgraded meterpreter shell, for a quick privesc check let's try the exploit suggester module
After we run it and try some of the exploits, one successfully works giving us NT\ AUTHORITY SYSTEM on DC02
Hence giving us the first part of the machine and obtaining the user.txt
Persistence on DC02
After this, we establish persistence on DC02 using the hashdump command on meterpreter so we can PtH (Pass-The-Hash) later on:
Cross-Forest Abuse with Bloodhound
Now that we got our persistence settled up, let's enumerate weak permissions and privileges that we can abuse across forests
This means we got a BiDirectional Domain trust between Domains ,
The bidirectional trust allows
cross-domain authenticationWe can potentially compromise targets in
darkzero.htbAny
unconstrained delegationsystems in either domain become accessibleKerberostrust tickets can be abused for lateral movement
We found that unconstrained delegation is enabled!! this is a massive security misconfiguration so we're going to exploit it after establishing our port forwarding
We are going to set our pivoting server and agents with ligolo
Port Forwarding from DC02 to DC01
After pinging the DC01 from DC02 we see the following
So the IP Address assigned from this subnet to DC01 is 172.16.20.1
For this, we'll use the ligolo-mp tool on our kali attacker machine to set up our listener server
And then press enter on admin to connect, Then CTRL+N To create an agent with the following parameters
Then we change the bin file to an exe file so we can run it from DC02
Now we can upload it to the DC02 so we can pivot to the internal network
We successfully got our connection to our ligolo server as DC02
We add our route with Enter - Add Route and type the subnet there
Unconstrained Delegation abuse
First off we need to set Rubeus.exe on monitor mode on DC02 to capture the TGT from DC01
Set up our listener on the attacker machine
We upload it to DC02
Now we trigger authentication with coercer from DC01 to DC02 attempting to receive the TGT on DC02
And we successfully receive the TGT on Rubeus
DCSync Attack
Now lets import the ticket with Rubeus
Now with mimikatz let's DCSync so we can get Administrator access to DC01
Now we can PtH (Pass-TheHash) using evil-winrm and the hash obtained
And we have now maximum privileges on the machine.
Thank you for reading and see you next time!!
Last updated