Heist

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 -Pn 192.168.240.165
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-07 13:09 +08
Nmap scan report for 192.168.240.165
Host is up (0.17s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
3389/tcp  open  ms-wbt-server
5985/tcp  open  wsman
8080/tcp  open  http-proxy
9389/tcp  open  adws
49666/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown
49674/tcp open  unknown
49687/tcp open  unknown
49740/tcp open  unknown

This is an AD machine. There were no null credentials accepted by any service. Also, RDP is open.

Secure Web Browser -> NTLM Capture

Port 8080 hosted a Secure Web Browser application:

This looks vulnerable to SSRF, and it is.

We can view the exact request this is sending:

This might be poisanable with responder, and I tested it:

This hash can be cracked instantly:

We can then evil-winrm into the box:

Privilege Escalation

Bloodhound -> ReadGMSAPassword

Remember to add this entry to the /etc/hosts file:

Afterwards, we can run bloodhound-python on this domain:

After the data is uploaded, we can see that enox is part of the Web Admins group:

This group has the ReadGMSAPassword privilege over the DC:

There is one service account present on the domain, and it is svc_apache:

To abuse this, we can use GMSAPasswordReader.exe to read the password.

We can then evil-winrm in as this user:

SeRestorePrivilege -> RDP Shell

This service user has the SeRestorePrivilege enabled:

To exploit this, we can follow the methodology on PayloadAllTheThings:

We can execute these commands:

Afterwards we need RDP access. We don't actually need to login, we just need to access the login page:

Just press the button on the bottom right, and it will spawn a SYSTEM shell:

If you want to get a proper shell, then we can just add enox to the Domain Admins and Administrators groups with net.exe. Rooted!

PreviousDVR4NextHelpdesk

Last updated