From 72c6dea08c12f5c4bae0be6a512302fde9efb16c Mon Sep 17 00:00:00 2001
From: ARZ <60057481+AbdullahRizwan101@users.noreply.github.com>
Date: Sun, 26 Dec 2021 01:18:24 +0500
Subject: [PATCH] Update Resolute.md
---
HackTheBox/Resolute.md | 88 ++++++++++++++++++++++++++++++++++++++----
1 file changed, 81 insertions(+), 7 deletions(-)
diff --git a/HackTheBox/Resolute.md b/HackTheBox/Resolute.md
index 38a884c..608677d 100644
--- a/HackTheBox/Resolute.md
+++ b/HackTheBox/Resolute.md
@@ -61,6 +61,8 @@ So running kerbrute we found 24 usernames that are valid out of 27
+## Foothold
+
If we go back to enum4linux result we see in the description a password for `marko` user
@@ -91,15 +93,87 @@ Then I realized that I didn't check `winrm`
And we can actually use it to get a remote session using `evil-winrm`
-
-
-
So to enumrate AD , we have two options either running `sharphound` powershell script or `python bloodhound injestor`
-## References
+Import the json files that this script generates and after that search the username so that we can mark it as `pwned` and see if we can find a path to higher targets by running the pre-built query
-```
-melanie:Welcome123!
-```
+
+
+Running the query we don't see anything interesting that we can do with this user
+
+
+
+
+But if we look at `ryan` user , he's in the group `Contractors`
+
+
+
+And if we further explore this group , that is a member of `DNSAdminsGroup`
+
+
+
+## Privilege Escalation (ryan)
+
+Getting on the machine through `evil-winrm` we can see a hidden directory called `PSTranscripts` through `dir -Force`
+
+
+
+
+
+We can find a text file by going into this directory
+
+
+
+Reading this file we will be able to get the password for ryan
+
+
+
+
+
+
+
+## Privilege Escalation (Administrator)
+
+We know that ryan is a member of contractors group and that group is a member of DNSAdmins group so that makes ryan a member of that group
+
+
+
+This can lead to privilege escalation to SYSTEM user as having the permission to control dns service we can load a malicious dll file by generating it through `msfvenom` and hosting it through smb share and then loading it with `dnscmd` then stopping the dns service with `sc.exe stop dns` and restarting it with `sc.exe start dns` to start dnsservice with our malicious dll file
+
+Generating the dll file
+
+
+
+Using impacket's smbserver to start smbserver
+
+
+
+Now there was an issue with this box , don't know if it's the same with other users, when I was following this article for abusing DNSAdmins group it wouldn't give me the reverse shell neither it would execute commands from the payload `msfvenom -p windows/x64/exec cmd='net group "Administrator" melanie /add' -f dll > dns.dll`
+
+Also when we download the dll on the machine it would be removed under a minute so we needed to be quick , so the way I got SYSTEM was , I stopped the dns service first then loaded the dll then started the dns service and saw the response on smbserver and got a shell on netcat
+
+
+
+
+
+
+
+To get a proper shell we can now just add ryan to `Domain Admins` group or local group `Administrators`
+
+
+
+We can verify it with `net user ryan`
+
+
+
+Again , we need to be quick to dump hashes and perform pass the hash attack because it will revert back the changes
+
+
+
+
+
+
+## References
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-dnsadmins-to-system-to-domain-compromise