> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/hard/search.md). # Search ## Gaining Access Nmap scan revealed standard AD ports, and that port 80 was open. ### Hope Sharp This website was another corporate domain. When scrolling through it, I found this image that was rather interesting. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b1235c4b34d42339c23ba0de745fd2d886c40149%2Fimage.png?alt=media) If you look closely, there was a task with **Send password to Hope Sharp**. Then, **IsolationIsKey?** was the next line. This tells me that there was an interesting password to find. As such, I created a bunch of possible usernames with the name Hope Sharp, and used `crackmapexec` to brute force these credentials. Found that `hope.sharp` was the username: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-fc9d1dcab4cbc70951f0ba5c45f8d7cbe08c1fcb%2Fimage.png?alt=media) Additionaly, running `feroxbuster` on the website reveals some directories: ``` 301 2l 10w 150c http://10.10.11.129/images 301 2l 10w 146c http://10.10.11.129/js 301 2l 10w 147c http://10.10.11.129/css 301 2l 10w 149c http://10.10.11.129/fonts 403 29l 92w 1233c http://10.10.11.129/staff ``` The `/staff` endpoint was interesting, but it was returning a 403 code. ### Bloodhound After getting these credentials, I wanted to use Bloodhound to map out all objects within the domain. Since I don't have a shell yet, I used `bloodhound-python`. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f326085a618368e0629b309f80187c4412578139%2Fimage.png?alt=media) With Bloodhound, I found 2 interesting pieces of information. One was that a user named tristan.davies was a domain admin. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7b87904ccef774d10c95461120b8cb995930acd0%2Fimage.png?alt=media) Another was that the `web_svc` user was Kerberoastable. We can then use `GetUserSPNs.py` to gain a hash and crack it. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1fb21b7c8788e9422b8f0b0524599c62fddf481f%2Fimage.png?alt=media) ### web\_svc shares With this user's credentials, I enumerated the shares that were available. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e13cbaffd62d09ae0004d6719acd3eb21c5cb0cb%2Fimage.png?alt=media) I still don't have access to the **helpdesk** share, so I looked at the rest. Within the RedirectedFolders$ share, I found a ton of usernames. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2074c318583644246a16a12a2b12083a1b3c4a61%2Fimage.png?alt=media) Then, we can find out if the passwords we have are valid for any other users. I found that `edgar.jacobs` had the same password as the `web_svc` user. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cb726e68e17bb74922e47e25e6e45eda501e2526%2Fimage.png?alt=media) ### Helpdesk Share With this new user, I was finally able to access the helpdesk share. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d73f5b4642bcdcc1bb925b0ae9c0862df261ed62%2Fimage.png?alt=media) Within the share, I found a .xlsx file. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ee33faf6579931d3dbe0f2a9a5b44e8682f5c3a9%2Fimage.png?alt=media) Reading this file, I found out some usernames and names of users on the domain. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f2f564dbe91229bab6db390e5a3a31888261b687%2Fimage.png?alt=media) There was something odd however. Where was column C? The spreadsheet shows A,B and D. Perhaps column C was hidden on purpose because it contained other information. I was unable to expand it or view it, thus confirming it was locked. ### Excel Bypass This was a good read: {% embed url="" %} One cool thing about most .xlsx files is that they are actually ZIP files in disguise. We can bypass this content protection by copying the file as a .zip file, and then unzipping it. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c8b0096c1fe1363b74da94a051def2780d30a3dc%2Fimage.png?alt=media) Then from every single .xml file, we can remove the `sheetProtection` tag completely. Afterwards, we just need to compress and zip the files back together into another .xlsx file. We can then view the hidden column C. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c674ca8186d79b07821dc23e4baee0c04246f640%2Fimage.png?alt=media) We can then brute force all of these passwords with `crackmapexec` and find that one works! ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-78a86013f081ac19d25468d9b8c4cfc73f205e08%2Fimage.png?alt=media) Using the RedirectedFolder$ share, we can sign in as the `sierra.frye` user and retrieve theuser flag. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-27854ee5b4741767923d798d66660f0fa3b0de12%2Fimage.png?alt=media) ## Privilege Escalation Looking around this user's directory, I was able to find a .pfx and .p12 file. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-304b35592647418d45a0a864dc3fac5fb140f9ba%2Fimage.png?alt=media) ### Certificate Loading Because these are certificates, perhaps they can be loaded into our browser for viewing of hidden websites. However, they are password protected. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3c3a8f867d0dc267f063ae30a43dc92093502e92%2Fimage.png?alt=media) We can easily crack this with `pfx2john` and `john`. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-eeb88a3f5db614682d4f5ebd45ceeed8130f79f6%2Fimage.png?alt=media) Then we can load this in to our browsers. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2919482dd3c607ad8df539920bb8c97c84214e18%2Fimage.png?alt=media) Now, we can access the /staff page we were rejected from earlier. This would reveal a Powershell Web Access page. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-aa923724466db982cb2cc1ab858cf8679da11820%2Fimage.png?alt=media) We can login as `sierra.frye` usingthe credentials we found earlier. For Computer Name, I guessed search and research based on the certificates I found, and **research** worked. ### Powershell Web Access Now, we had a CLI as Sierra.frye. !['](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-0f156fc83c4eb8a4e576e648361ac692683f3585%2Fimage.png?alt=media) Looking back to Bloodhound, I found that this user was able to ReadGMSAPassword for the `bir-adfs-gmsa` user, in which the latter had GenericAll privileges over the domain admin `tristan.davies`. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-11abccb692c59d335f85679b09cb75e1d3ee36be%2Fimage.png?alt=media) We can read the password using the Active Directory Powershell module. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-11c99c79ace2ef9678c10b3db582f98e73e0c395%2Fimage.png?alt=media) Then, we can store the password in a variable (because it's UTF-8 characters and hard to type) and just use Powershell to execute commands remotely. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-460b9edd22f4cf81006fb43b53c8ccbbe573c21e%2Fimage.png?alt=media) ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3bcb011e15abd5a20261fc1f3aef5ca745c1a009%2Fimage.png?alt=media) Then, because we have `GenericAll` permissions over `tristan.davies`, we can just reset his password. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b22aaf444d26a6f68daab59c66d947dd4e028843%2Fimage.png?alt=media) Lastly, we can use `wmiexec.py` to gain a shell as the domain admin. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ed6b02a39485adbc7106910b737e642376aeec79%2Fimage.png?alt=media)