Hutch

Lots of systematic enumeration.

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.197.122
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-06 00:30 +08
Nmap scan report for 192.168.197.122
Host is up (0.17s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49666/tcp open  unknown
49667/tcp open  unknown
49671/tcp open  unknown
49672/tcp open  unknown
49674/tcp open  unknown
49687/tcp open  unknown

An AD machine.

Initial Enumeration -> Creds

Port 80 hosted a default IIS server:

Directory scans reveal nothing much. A detailed nmap scan on the port reveals that this does have a webdav instance:

LogoWebDav - HackTricksbook.hacktricks.xyz

However, we don't have any credentials for it:

For SMB, enum4linux reveals nothing of interest regarding the domain, but it does accept null credentials.

Now we can move onto LDAP, and we can check whether null credentials are accepted here using ldapsearch:

At the very end of the file, we can find some credentials:

This user's SAM Account Name is listed as fmcsorley, but we cannot use these credentials to evil-winrm in it seems.

Davtest -> RCE

Since we have credentials, we can try to place files on the website such as ASPX reverse shells (since this is running IIS). We can test these credentials with davtest:

davtest would place a few backdoors for us, and we can use that to execute commands on the machine:

Then, we can easily get a reverse shell as this user.

Privilege Escalation

LAPS-> Administrator Creds

On the machine, LAPS is installed.

We could potentially get the administrator's password from this. First, we need to see who can read it using PowerView.ps1:

The user fmcsorley can read the password. I checked using ldapsearch, and sure enough it was there:

We can then evil-winrm in using it:

Rooted!

PreviousHelpdeskNextInternal

Last updated