Monteverde
Medium Windows Active Directory box on HackTheBox
Reconniassance
We will start off by performing a Service and Version scan on all 65535 TCP ports using nmap
As we can see we're probably facing a DC (Domain Controller) because all of the simultaneously open ports: TCP Port 88 (Kerberos) | TCP Port 135 (RPC) | TCP Port 5985 (WinRM)...
We can also enumerate the Domain Name which is MEGABANK.LOCAL so we'll add it to our /etc/hosts
We already know that methodology is the most important on Pentesting so let's enumerate everything, starting off by TCP Port 53 (DNS) and check if any record contains useful information using dig
But we don't seem to find anything useful here, so let's move on onto TCP Port 88 (Kerberos) using the Kerbrute tool to try and find possible users:
And we found the administrator user, let's now enumerate TCP Port 135 (RPC) with a NULL session using rpcclient
We found a list of valid users which we copied into a users.txt file
As we already found valid users, let's try to perform a AS-REP Roast attack
AS-REP Roasting targets Kerberos accounts with pre-authentication disabled.
Normally, users have to prove who they are before the domain gives them a ticket. But if pre-auth is off, the server sends back a Kerberos response encrypted with the user's hash — no password needed.
We can grab that response and crack it offline to get the user's password.
And you may ask, well how do I know when to do it?
We already found valid usernames. Now we’re checking if any of them are misconfigured and can give us the Kerberos hashes, so let's try to perform the attack using impacket-GetNPUsers
But it doesn't seem to work, so let's move on into TCP Port 445 (SMB) using Netexec (Newer versrion of CrackMapExec) as LDAP will not show any useful information either.
Users as passwords
But we find nothing new that we already enumerated, so let's try and see if any user is using their username as their password which is something I recommend that can even happen in real pentests.
And success! We find that the user SABatchJobs is using SABatchJobs as the password for the account, we will enumerate all the readable shares using smbclient in order to extract more information.
And we found that the \mhope\ shared folder contains a file called azure.xml which contains the following content:
Password Spraying
We notice a cleartext password — 4n0therD4y@n0th3r$ so let's perform a password spray attack using kerbrute
And we can see the password is valid for the user mhope
Using Netexec we noticed that this user has the WinRM connection available:
Therefore, we can authenticate into the system using Evil-WinRM
Privilege Escalation
With a bit of enumeration using whoami /all we notice some useful information:
It seems that we are onto the Azure Admins group, as this AD is running on Azure, let's move onto the C:\Program Files\ directory to enumerate possible privilege escalation clues:
Microsoft Azure AD Sync Abuse
After researching on Microsoft Azure AD Sync for a bit, I found an exploit that let's us see the cleartext passwords of the Domain Administrators, which is a potential privilege escalation method
For more research on this exploit ill leave the link to it's explanation
Download AdDecrypt.zip
Upload it to the victim machine
Move to the target directory, otherwise it won't work
Execute the exploit and retrieve the cleartext password
Now let's login onto the administrator account using the d0m@in4dminyeah! password through Evil-WinRM and retrieve the flags!
Overall realistic and interesting box, recommended for studying for the OSCP\eCPPTv3, thank you for reading this write-up and see you in the next time <3!!
Last updated