Resolute
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.85.209
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-05 03:38 EDT
Nmap scan report for 10.129.85.209
Host is up (0.015s latency).
Not shown: 65512 closed tcp ports (conn-refused)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49671/tcp open unknown
49676/tcp open unknown
49677/tcp open unknown
49684/tcp open unknown
49733/tcp open unknownUser List + ASREP-Roast
Using enum4linux and null credentials, we can find a list of users and an interesting description:
We have a password lf Welcome123! and a username list, so password spraying with crackmapexec is next.
We have a user melanie who has the weak password. We can login as this user using evil-winrm.
Grab the user flag.
Privilege Escalation
PSTranscripts
Within the C:\ directory, there are some hidden directories:
Within this file, there is a PowerShell transcript, which contains credentials.
With these credentials, we can login as ryan.
DNS Admin
As ryan, we are part of the Contractors and FnsAdmins group:
Also, there's a note within the desktop:
This means that we have control over DNS and can change the DLL file with a reverse shell. We should also be able to start and stop the service.
We can use this guide to get a SYSTEM shell.
First, let's create a reverse shell DLL file via msfvenom. Afterwards, we need to host it using smbserver.py.
Then, following the PoC, we can use dnscmd to set the server to use our DLL over SMB and restart the service to get a SYSTEM shell:
