Authority

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.9.12        
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-17 10:01 +08
Warning: 10.129.9.12 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.9.12
Host is up (0.17s latency).
Not shown: 65501 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
53/tcp    open     domain
80/tcp    open     http
88/tcp    open     kerberos-sec
135/tcp   open     msrpc
139/tcp   open     netbios-ssn
389/tcp   open     ldap
445/tcp   open     microsoft-ds
464/tcp   open     kpasswd5
593/tcp   open     http-rpc-epmap
636/tcp   open     ldapssl
3268/tcp  open     globalcatLDAP
3269/tcp  open     globalcatLDAPssl
5985/tcp  open     wsman
8443/tcp  open     https-alt
9389/tcp  open     adws
47001/tcp open     winrm
49664/tcp open     unknown
49665/tcp open     unknown
49666/tcp open     unknown
49667/tcp open     unknown
49671/tcp open     unknown
49686/tcp open     unknown
49687/tcp open     unknown
49689/tcp open     unknown
49690/tcp open     unknown
49707/tcp open     unknown
49710/tcp open     unknown
60905/tcp open     unknown
64054/tcp open     unknown

This looks like an AD machine. Did a detailed scan to fully enumerate everything.

We can add all the domain names into our /etc/hosts file.

SMB Shares -> Ansible Creds

SMB allowed access to a few shares with no credentials:

There were quite a few items within the Development share, such as Ansible files nad stuff like that. Within the /Automation/Ansible/PWM/templates folder, we can find Tomcat creds:

Within the ansible_inventory file of PWM, we can find some credentials for Ansible:

This suggests using WinRM, and I do know it is possible to execute commands using Ansible's WinRM module. Within the default directory, there's a main.yml file with some hashes:

We can try to crack these hashes using using ansible-vault decrypt and john. However, each vault has its own password that we need to crack. I read the source code to find the format required for this, including the newlines:

Then, we can run john to crack this:

This would give us the output:

We can repeat the process for the rest of the hashes. This would find two more credentials:

Web Enumeration -> Responder

Port 80 just shows an IIS Server. Port 8443 uses TLS and redirects me a login at /pwm/private/login:

We have the credentials for this, so let's try to edit the configurations. WIthin the LDAP config, we can change the LDAP URL:

This looks vulnerable to some hash capturing via responder. I replaced the LDAP URL with ldap://10.10.14.9:389 and then clicked on 'Test LDAP Profile', and responder captured a hash:

With this, we can evil-winrm in to the machine:

Privilege Escalation

ESC1 + Add Computer -> Reset DA Password

Within the machine, there are some certificates available:

This sort of guided me towards exploiting vulnerable certificate templates. I used certipy to find the CA stuff.

Then, I looked through the certificates to see if there were any vulnerabilities. There was one vulnerability that it picked up on:

The svc_ldap user can add new computers (most of the time Domain Users can do this), thus allowing us to request for the certificate needed.

First, add the new computer:

Then, use this to request for the template.

We are unable to request for a TGT using this certificate however.

This means that Rubeus would fail as well. In this case, let's try to Pass the Certificate to reset the administrator's password.

LogoGitHub - AlmondOffSec/PassTheCert: Proof-of-Concept tool to authenticate to an LDAP/S server with a certificate through SchannelGitHub

First, generate the key and cert files:

Then, reset the administrator password:

Rooted!

PreviousHTB Season 2NextBookworm

Last updated