Monteverde
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 -Pn 10.129.228.111
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-05 03:03 EDT
Nmap scan report for 10.129.228.111
Host is up (0.0092s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49667/tcp open unknown
49673/tcp open unknown
49674/tcp open unknown
49676/tcp open unknown
49697/tcp open unknownUsername List -> User Creds
With enum4linux and null credentials, we can enumerate the possible users and the domain name:
We can get a list of usernames here. I tried ASREP-Roasting, but nothing came of it. We can also check if any user has their password as their username with cracpmapexec, which returns something interesting:
Seems that we have access to one user. When we enumerate the shares, we can see that we have access to the users and azure_uploads files. The latter has nothing in it, but the users file has loads of files:
We can see that there's an azure.xml file here. It contains a user credential:
I also noticed that this uses Azure to do stuff, so let's keep that in mind for now. Anyways, we can login via evil-winrm with mhope and this password.
Privilege Escalation
Azure Admins + Azure Connect
When we view our groups within the domain, we see that mhope is part of the Azure Admins group:
Within the C:\Program Files directory, there are also some files pertaining to Azure:
I googled on how to exploit these services. After some trial and error, I stumbled on this:
Since Azure AD Connect was present, it means that there's a database of which the credentials are being stored. As Azure Admins, we probably have access to these passwords, which can be enumerated and decrypted.
We just need to transfer the AdDecrypt.exe file along with mcrypt.dll to the machine. Then, following the PoC, we need to run this within C:\Program Files\Microsoft Azure AD Sync\Bin.
Then, using this password, we can login via evil-winrm.
Rooted!
Last updated