search

Monteverde

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 -Pn 10.129.228.111
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-05 03:03 EDT
Nmap scan report for 10.129.228.111
Host is up (0.0092s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49667/tcp open  unknown
49673/tcp open  unknown
49674/tcp open  unknown
49676/tcp open  unknown
49697/tcp open  unknown

hashtag
Username List -> User Creds

With enum4linux and null credentials, we can enumerate the possible users and the domain name:

We can get a list of usernames here. I tried ASREP-Roasting, but nothing came of it. We can also check if any user has their password as their username with cracpmapexec, which returns something interesting:

Seems that we have access to one user. When we enumerate the shares, we can see that we have access to the users and azure_uploads files. The latter has nothing in it, but the users file has loads of files:

We can see that there's an azure.xml file here. It contains a user credential:

I also noticed that this uses Azure to do stuff, so let's keep that in mind for now. Anyways, we can login via evil-winrm with mhope and this password.

hashtag
Privilege Escalation

hashtag
Azure Admins + Azure Connect

When we view our groups within the domain, we see that mhope is part of the Azure Admins group:

Within the C:\Program Files directory, there are also some files pertaining to Azure:

I googled on how to exploit these services. After some trial and error, I stumbled on this:

https://vbscrub.com/2020/01/14/azure-ad-connect-database-exploit-priv-esc/vbscrub.comchevron-right

Since Azure AD Connect was present, it means that there's a database of which the credentials are being stored. As Azure Admins, we probably have access to these passwords, which can be enumerated and decrypted.

LogoReleases · VbScrub/AdSyncDecryptGitHubchevron-right

We just need to transfer the AdDecrypt.exe file along with mcrypt.dll to the machine. Then, following the PoC, we need to run this within C:\Program Files\Microsoft Azure AD Sync\Bin.

Then, using this password, we can login via evil-winrm.

Rooted!

PreviousMetaNextNineveh

Last updated