search

Intelligence

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.95.154
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-05 04:35 EDT
Nmap scan report for 10.129.95.154
Host is up (0.0068s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49668/tcp open  unknown
49691/tcp open  unknown
49692/tcp open  unknown
49702/tcp open  unknown
49714/tcp open  unknown
52403/tcp open  unknown

We can enumerate the HTTP page.

hashtag
HTTP -> PDF Analysis

Page is some kind of company website.

We can add intelligence.htb to our /etc/hosts file as well. Within the page, I noticed there were some downloads:

When we download them, we would get redirected to a PDF which did not have anything useful on it.

The more interesting part is the URL. For the above document, I was redirected to http://10.129.95.154/documents/2020-01-01-upload.pdf. We can fuzz this and see what other PDFs are present. We can create a wordlist using this:

Afterwards,we can use wfuzz to enumerate out all the valid files:

Afterwards, we can use the names of the valid files to create a wordlist, remove the RETURN control character and use a basic bash for loop to download all of these files.

Afterwards, we need a way to convert all of these to text so we can read them. This can be done using pdftotext.

Then, we can use grep to find keywords in these files.

We have a credential, and also searching for security tells me there's some type of vulnerability with the service accounts:

So now we have to find usernames. Within each PDF file, there seems to be a unique user that created it.

We can just do exiftool -creator *.pdf to find all the users, and redirect the output into a wordlist. There are about 83 users:

Then, we do password spraying with crackmapexec.

hashtag
Tiffany SMB -> Poison DNS

We cannot login using evil-winrm with this, so let's enumerate the SMB shares.

We see that we have access to IT. Within it, there's only one file:

Here's the script:

Earlier I found a hint that the user Ted was running this script continuously. What I find the weirdest is that the URI specified is not hard-coded to point to intelligence.htb, but rather it uses $(record.Name). Also, this sends an email to every record within DNS.

This variable is drawn from the DNS records of the machine, and the DNS port is open to us. The next guess would be to somehow poison the DNS records to allow us to retrieve a hash via responder. I referred to PayloadAllTheThings, and found a tool called dnstool.py that can be used for changing DNS records.

In short, we can add a node to the DNS records via LDAP which makes intelligence.htb point to our machine instead.

LogoGitHub - dirkjanm/krbrelayx: Kerberos relaying and unconstrained delegation abuse toolkitGitHubchevron-right

Then, we can start responder and wait. Eventually, we would capture a hash that we can crack.

We now have a new user. We still cannot login though.

hashtag
BloodHound

Since we've exhausted all possible leads, using bloodhound would be the next logical step.

Then we can start neo4j and bloodhound. After uploading the information, let's view what Ted.Graves has access to. We find that they are part of the ITSupport group.

This group has ReadGMSAPassword privileges over svc_int.

USing gMSADumper.py, we can get a hash for this user:

This cannot be cracked, but Pass The Hash can still be done.

hashtag
Privilege Escalation

hashtag
getST

When checking this node, we see that it is allowed to delegate for the DC.

We don't have a shell to the machine, but with this we can request service tickets for the administrator. We can use getST.py to do this.

LogoAbusing Kerberos From Linux - An Overview of Available Tools - OnSecurityOnSecuritychevron-right

Then, we can request a ticket to impersonate the admin.

Then we can get a shell using psexec.py.

PreviousHawkNextInterface

Last updated