# Search

## Gaining Access

Nmap scan revealed standard AD ports, and that port 80 was open.

### Hope Sharp

This website was another corporate domain. When scrolling through it, I found this image that was rather interesting.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b1235c4b34d42339c23ba0de745fd2d886c40149%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

If you look closely, there was a task with **Send password to Hope Sharp**. Then, **IsolationIsKey?** was the next line.

This tells me that there was an interesting password to find. As such, I created a bunch of possible usernames with the name Hope Sharp, and used `crackmapexec` to brute force these credentials. Found that `hope.sharp` was the username:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-fc9d1dcab4cbc70951f0ba5c45f8d7cbe08c1fcb%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Additionaly, running `feroxbuster` on the website reveals some directories:

```
301        2l       10w      150c http://10.10.11.129/images
301        2l       10w      146c http://10.10.11.129/js
301        2l       10w      147c http://10.10.11.129/css
301        2l       10w      149c http://10.10.11.129/fonts
403       29l       92w     1233c http://10.10.11.129/staff
```

The `/staff` endpoint was interesting, but it was returning a 403 code.

### Bloodhound

After getting these credentials, I wanted to use Bloodhound to map out all objects within the domain. Since I don't have a shell yet, I used `bloodhound-python`.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f326085a618368e0629b309f80187c4412578139%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

With Bloodhound, I found 2 interesting pieces of information. One was that a user named tristan.davies was a domain admin.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7b87904ccef774d10c95461120b8cb995930acd0%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Another was that the `web_svc` user was Kerberoastable. We can then use `GetUserSPNs.py` to gain a hash and crack it.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1fb21b7c8788e9422b8f0b0524599c62fddf481f%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

### web\_svc shares

With this user's credentials, I enumerated the shares that were available.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e13cbaffd62d09ae0004d6719acd3eb21c5cb0cb%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

I still don't have access to the **helpdesk** share, so I looked at the rest. Within the RedirectedFolders$ share, I found a ton of usernames.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2074c318583644246a16a12a2b12083a1b3c4a61%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then, we can find out if the passwords we have are valid for any other users. I found that `edgar.jacobs` had the same password as the `web_svc` user.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cb726e68e17bb74922e47e25e6e45eda501e2526%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

### Helpdesk Share

With this new user, I was finally able to access the helpdesk share.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d73f5b4642bcdcc1bb925b0ae9c0862df261ed62%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Within the share, I found a .xlsx file.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ee33faf6579931d3dbe0f2a9a5b44e8682f5c3a9%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Reading this file, I found out some usernames and names of users on the domain.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f2f564dbe91229bab6db390e5a3a31888261b687%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

There was something odd however. Where was column C? The spreadsheet shows A,B and D. Perhaps column C was hidden on purpose because it contained other information. I was unable to expand it or view it, thus confirming it was locked.

### Excel Bypass

This was a good read:

{% embed url="<https://yodalearning.com/tutorials/unprotect-excel/>" %}

One cool thing about most .xlsx files is that they are actually ZIP files in disguise. We can bypass this content protection by copying the file as a .zip file, and then unzipping it.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c8b0096c1fe1363b74da94a051def2780d30a3dc%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then from every single .xml file, we can remove the `sheetProtection` tag completely. Afterwards, we just need to compress and zip the files back together into another .xlsx file.

We can then view the hidden column C.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c674ca8186d79b07821dc23e4baee0c04246f640%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can then brute force all of these passwords with `crackmapexec` and find that one works!

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-78a86013f081ac19d25468d9b8c4cfc73f205e08%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Using the RedirectedFolder$ share, we can sign in as the `sierra.frye` user and retrieve theuser flag.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-27854ee5b4741767923d798d66660f0fa3b0de12%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

Looking around this user's directory, I was able to find a .pfx and .p12 file.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-304b35592647418d45a0a864dc3fac5fb140f9ba%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

### Certificate Loading

Because these are certificates, perhaps they can be loaded into our browser for viewing of hidden websites. However, they are password protected.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3c3a8f867d0dc267f063ae30a43dc92093502e92%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can easily crack this with `pfx2john` and `john`.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-eeb88a3f5db614682d4f5ebd45ceeed8130f79f6%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then we can load this in to our browsers.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2919482dd3c607ad8df539920bb8c97c84214e18%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Now, we can access the /staff page we were rejected from earlier. This would reveal a Powershell Web Access page.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-aa923724466db982cb2cc1ab858cf8679da11820%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can login as `sierra.frye` usingthe credentials we found earlier. For Computer Name, I guessed search and research based on the certificates I found, and **research** worked.

### Powershell Web Access

Now, we had a CLI as Sierra.frye.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-0f156fc83c4eb8a4e576e648361ac692683f3585%2Fimage.png?alt=media" alt=""><figcaption><p>'</p></figcaption></figure>

Looking back to Bloodhound, I found that this user was able to ReadGMSAPassword for the `bir-adfs-gmsa` user, in which the latter had GenericAll privileges over the domain admin `tristan.davies`.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-11abccb692c59d335f85679b09cb75e1d3ee36be%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can read the password using the Active Directory Powershell module.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-11c99c79ace2ef9678c10b3db582f98e73e0c395%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then, we can store the password in a variable (because it's UTF-8 characters and hard to type) and just use Powershell to execute commands remotely.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-460b9edd22f4cf81006fb43b53c8ccbbe573c21e%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3bcb011e15abd5a20261fc1f3aef5ca745c1a009%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then, because we have `GenericAll` permissions over `tristan.davies`, we can just reset his password.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b22aaf444d26a6f68daab59c66d947dd4e028843%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Lastly, we can use `wmiexec.py` to gain a shell as the domain admin.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ed6b02a39485adbc7106910b737e642376aeec79%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>
