Blackfield

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 -Pn 10.129.105.19
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 06:53 EDT
Nmap scan report for 10.129.105.19
Host is up (0.0078s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT     STATE SERVICE
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
389/tcp  open  ldap
445/tcp  open  microsoft-ds
593/tcp  open  http-rpc-epmap
3268/tcp open  globalcatLDAP
5985/tcp open  wsman

ASREP-Roasting

enum4linux doesn't reveal much for us with NULL credentials, and only revealed the domain name:

But we can find some shares using smbmap:

When we connect to the profiles$ share, we find a huge list of directories and usernames:

There aren't any files within these directories, so I just compiled all the usernames into a list. There were over 300 different usernames. I tried to brute force SMB with crackmapexec, but no username served as a password.

When trying ASREP-Roasting, it worked and we could get a hash for the support user.

We can crack this hash using john.

Bloodhound -> Change Password

This user had no access to any new shares. However, we can use bloodhound-python to find more information about the domain and this user.

After uploading the data to Bloodhound, we can view what the support user can do. It appears support has ForceChangePassword privileges over audit2020.

rpcclient can be used to exploit this and change the password of this user to something else. Take note that there's a password policy present, and it can reject the change if the password does not meet the requirements:

Forensic Share

With this new password, we can check what shares are available to our new user:

We can read the forensic share:

Within the memory_analysis file, there was a lsass.zip file:

Local Security Authority Subsystem Service (LSASS) is a process that deals with Windows Security, and it does store the authentication credentials like hashes or Kerberos tickets in memory. If this is a memory dump, then we might be able to view the passwords by dumping it out.

We can download the file and then unzip it.

Then, using pypykatz, we can dump it out without going to a Windows machine to run mimikatz. Here's the interesting parts of the dump:

Unfortunately, the hash for the administrator doesn't work. However, the one for svc_backup works and we can login:

Privilege Escalation

SeBackupPrivilege Fail

We can check the user privileges to see that we have a lot enabled.

We have the SeBackupPrivilege enabled, which allows us to save the sam and system files from the registry. We can then use secretsdump.py to retrieve the updated hashes for the Administrator.

Within evil-winrm, run the following:

Once we have these files on our system, use secretsdump.py to extract the hashes.

When trying to pass the hash however, this hash does not work.

NTDS Dump

Since we can save any file, let's try to save the Administrator's NTDS.dit file instead. There are a few walkthroughs out there on how to exploit this using diskshadow.

LogoWindows Privilege Escalation: SeBackupPrivilegeHacking Articles

This would involve creating a Disk Z: that would contain the ntds.dit file that we want. Put this into a text file:

Then, run robocopy to copy the ntds.dit file over amd download it.

We can then use secretsdump.py again to read the hashes.

This time, the hash works and we can get a shell using evil-winrm.

PreviousAcuteNextBreadCrumbs

Last updated