---
description: >-
  Active Directory Machine that requires good enumeration techniques to find the
  vulnerabilities.
---

# Flight

## Gaining Access

As usual, we begin with our enumeration process.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/DiyVLRZZ4rkEZXFR0vVE/image.png" alt=""><figcaption></figcaption></figure>

Loads of ports open as per a normal AD machine. Nothing about the SMB shares was found.

### Finding Hidden Domain

When viewing the website, we can see the bottom of the page to get a possible domain.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/XGsYc0bzi4Ry9Xl0Hybd/image.png" alt=""><figcaption></figcaption></figure>

With this, we could fuzz out some hidden vhosts on the machine with gobuster. Turns out there is a `school.flight.htb` present. We can add both of these into our hosts file and proceed to enumerate the school website.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/fCj5t8dTNXt0R7uOLNiq/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/VzsWrcnK4F50PtccHKah/image.png" alt=""><figcaption></figcaption></figure>

### Responder Hash

When clicking the about us page, we can see the URL and find that it might contain a LFI or RFI. This is because a .php page that has a ?view parameter has generally always been suspicious in HTB.



<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Y7Tzfq342MTTtkmIJbTI/image.png" alt=""><figcaption></figcaption></figure>

We can set up a quick Python server and check this URL to find that we can receive a hit from the server.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/ejjhMhUz9Qp6poIP0duD/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/yRrzzw7wHUijb0uokAPj/image.png" alt=""><figcaption></figcaption></figure>

Since this is a AD machine, perhaps we can get some shares and intercept the response using Responder.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/1oWsB8DEDneGJUowjWt7/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/UEEdwFiFhvjOVbCulWfj/image.png" alt=""><figcaption></figcaption></figure>

We can crack this easily using John.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/sl3AGQNoBBQDAlYTqwaX/image.png" alt=""><figcaption></figcaption></figure>

### SMB Shares

With these credentials, we can view the shares that are present on this machine.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/hlA64rDwHsgLv80B89Lg/image.png" alt=""><figcaption></figcaption></figure>

The ones to investigate are Users, Web and Shared.&#x20;

#### Users

In users, we can find that there is C.Bum user.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/OXZ8FBRNnO08FWS2wdt1/image.png" alt=""><figcaption></figcaption></figure>

### Desktop.ini

We can't do anything with that directory, though. The rest of the directories contain nothing of interest at all. Web only contains source code for the websites that also have nothing, while Shared was empty.

At this point, I was stuck for quite a while. Went back to enumeration of possible SMB server version vulnerablities. The credentials cannot be used to login as well, so there has to be anotehr set of credentials elsewhere.

I was thinking if it was possible to intercept some kind of reponse to retrieve more credentials, when I remembered about cetain expliots using the Desktop.ini file. What this file does is essentially contain the information regarding the icons used on the desktop, and we seem to be able to download and replace this for this machine.

As such, the next step was to replace this file with our own malicious file to make it query our responder share to intercept another hash.

{% embed url="https://book.hacktricks.xyz/windows-hardening/ntlm/places-to-steal-ntlm-creds#desktop.ini" %}

Based on that, we can create our own malicious .ini file and replace the one that is in the Shared share.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/dStEqNpBjnYa6YcLeZR1/image.png" alt=""><figcaption></figcaption></figure>

However, I cannot put this file on the directory using svc\_apache, so we would need to enumerate some other users first.

### Finding Users

Crackmapexec can enumerate users using the credentials we found.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/vRehq0xjqFTmBQm9akpv/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/HDZ8AZkY29tK0SKCKiBn/image.png" alt=""><figcaption></figcaption></figure>

Then we can gather these users into a file and brute force, checking for any password re-use. We can find that the S.Moon user seems to work.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/bQikolRvP4tKtdIqXl7r/image.png" alt=""><figcaption></figcaption></figure>

### Retrieving Hash

Now, we can upload our file as S.Moon and proceed to retrieve the hash.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/wOgrP6BqOuM2Vkvm4bm6/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/qosmKgwsk3KWprWxJVxJ/image.png" alt=""><figcaption></figcaption></figure>

Cracking, the hash, we get C.Bum's password.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Pxsy3ectd1Mi1nvZc8Bh/image.png" alt=""><figcaption></figcaption></figure>

We still cannot evil-winrm in, so we need to find another way. In the meantime, one can capture the flag using the c.bum credentials to access his desktop.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/ivZcu2LOwuAr4uC1JEyP/image.png" alt=""><figcaption></figcaption></figure>

### Gaining Shell

Since we do have another share called Web, perhaps we can upload a simple web shell as C.bum onto it to achieve some form of RCE.

I tried this method using a cmd.php basic web shell.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/rdgeL6UDVM8dNeQQBcC1/image.png" alt=""><figcaption></figcaption></figure>

This works in getting me a shell as svc\_apache.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/8XegJrnwVLzSTDcG1J5L/image.png" alt=""><figcaption></figcaption></figure>

I guess we can just get a reverse shell as svc\_apache. Use whatever method you'd like, I decided for the lazy nc.exe method.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/IEyYKOvB8dXPljf1IKqg/image.png" alt=""><figcaption></figcaption></figure>

As this user, because we have credentials for another user, we can use the runas.exe binary to gain RCE as C.Bum and proceed from there.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/u5mM6j3PESvDMayuN39C/image.png" alt=""><figcaption></figcaption></figure>

We would receive a shell as c.bum on whatever port we are on.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/HU090JyL0l1FZIujIvat/image.png" alt=""><figcaption></figcaption></figure>

{% embed url="https://github.com/antonioCoco/RunasCs" %}

## Privilege Escalation

Now that we are c.bum, we can look around this machine.

Within the C:\inetpub directory, there's an interesting folder called development.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/LjLKbVcjn6wvdqDDBCaJ/image.png" alt=""><figcaption></figcaption></figure>

This was interesting as it suggested that perhaps there was another port listening on the localhost.  Sure enough, there was a service listening on port 8000 that was not detected by nmap earlier.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/VuCDh6lwRhdy4cQChzp7/image.png" alt=""><figcaption></figcaption></figure>

When curled, it reveals a webpage tha matches the index.html file in the development server. For now, we can do some port forwarding to access it.

### Port Forwarding

For this machine, I used chisel to tunnel and we can access the website on 127.0.0.1:8000.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/q5bDcUbGcsla8cUtNg2K/image.png" alt=""><figcaption></figcaption></figure>

When viewing the web service, we can see that there are errors because there is no default configuration for this IIS server.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/xakkVpYTaungn5IxX1Xo/image.png" alt=""><figcaption></figcaption></figure>

Since this is an IIS server, we can actually generate a aspx reverse shell using MSFVenom and upload it to that directory to gain another reverse shell.

### ASP Shell

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/s0Ho689JVSpyna5PIhGD/image.png" alt=""><figcaption></figcaption></figure>

Then, upload this to the website through wget and put it within the C:\inetpub\development directory which can be accessed through the chisel server.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/93TPcIsxmAuzG1cuee8a/image.png" alt=""><figcaption></figcaption></figure>

Afterwards, we would receive a shell as another service account.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Y6QaukXDo7oCMt3O1dLk/image.png" alt=""><figcaption></figcaption></figure>

### JuicyPotato

A quick check on the privileges of this user reveals we have the SeImpersonatePrivilege.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Lyv0rTfpHTz0AnQf8a7W/image.png" alt=""><figcaption></figcaption></figure>

There are no printers on this machine, so we have to go with JuicyPotato to impersonate the administrator and finish this machine. The usage of PrintSpoofer does not work on this machine.

For this machine, I used JuicyPotatoNG, which is sort of a faster version of the default JuicyPotato exploit.

{% embed url="https://github.com/antonioCoco/JuicyPotatoNG" %}

Then, we can easily become the administrator!

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/mnhKvHXOJNe71XNYZ6TV/image.png" alt=""><figcaption></figcaption></figure>

This machine was really long, but really interesting as well. Simple exploits that required a bit more enumeration and time then the average.
