mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-10 06:34:17 +00:00
Add files via upload
This commit is contained in:
ARZ
GitHub
parent
9cb8e4c78e
commit
a54d4206ff
1 changed files with 189 additions and 0 deletions
189
HackTheBox/Monteverde.md
Normal file
189
HackTheBox/Monteverde.md
Normal file
|
|
@ -0,0 +1,189 @@
|
|||
# HackTheBox - Monteverde
|
||||
|
||||
## NMAP
|
||||
|
||||
```bash
|
||||
PORT STATE SERVICE VERSION
|
||||
53/tcp open domain?
|
||||
| fingerprint-strings:
|
||||
| DNSVersionBindReqTCP:
|
||||
| version
|
||||
|_ bind
|
||||
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2021-12-11 11:29:48Z)
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
|
||||
445/tcp open microsoft-ds?
|
||||
464/tcp open kpasswd5?
|
||||
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
|
||||
636/tcp open tcpwrapped
|
||||
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
|
||||
3269/tcp open tcpwrapped
|
||||
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|
||||
|_http-server-header: Microsoft-HTTPAPI/2.0
|
||||
|_http-title: Not Found
|
||||
9389/tcp open mc-nmf .NET Message Framing
|
||||
49667/tcp open msrpc Microsoft Windows RPC
|
||||
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
|
||||
49674/tcp open msrpc Microsoft Windows RPC
|
||||
49676/tcp open msrpc Microsoft Windows RPC
|
||||
49696/tcp open msrpc Microsoft Windows RPC
|
||||
59490/tcp open msrpc Microsoft Windows RPC
|
||||
Host script results:
|
||||
|_clock-skew: -1s
|
||||
| smb2-security-mode:
|
||||
| 2.02:
|
||||
|_ Message signing enabled and required
|
||||
| smb2-time:
|
||||
| date: 2021-12-11T11:32:09
|
||||
|_ start_date: N/A
|
||||
|
||||
NSE: Script Post-scanning.
|
||||
```
|
||||
|
||||
From the nmap scan we can see that port 88 is open which is used by kerberos so this machine is an active directory machine
|
||||
|
||||
## PORT 139/445 (SMB)
|
||||
|
||||
We can try to see if we can login to smb share through unauthenticated user
|
||||
|
||||
<img src="https://i.imgur.com/uLMLvqY.png"/>
|
||||
|
||||
We were logged in but don't see any share so moving on , we can try to use `enum4linux` or `windapsearch` which can enumerate users from `LDAP` queries, from the nmap scan we can find the domain name which is `MEGABANK.local` so put that in `/etc/hosts` file
|
||||
|
||||
<img src="https://i.imgur.com/ascUJe4.png"/>
|
||||
|
||||
This will list service accounts and domain users, let's try doing it with enum4linux-ng
|
||||
|
||||
<img src="https://i.imgur.com/AovizRf.png"/>
|
||||
|
||||
Now this tool provides us better results so I'll go with this and note the usernames in a text file
|
||||
|
||||
<img src="https://i.imgur.com/JLz21lM.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/uwyRAg7.png"/>'
|
||||
|
||||
Next I tried to see which users have pre-authentication disabled on them so I can get a hash of the user account
|
||||
|
||||
```bash
|
||||
python3 GetNPUsers.py -dc-ip 10.10.10.172 MEGABANK.local/arz -usersfile ~/Notes/CTFs/HTB/Medium/Monteverde/users.txt
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/ExajSLn.png"/>
|
||||
|
||||
But we didn't had any luck doing AS-REP roasting , next we could try some common passowrds and brute force it against smb , I created a list of common passwords
|
||||
|
||||
```
|
||||
12345678
|
||||
admin
|
||||
dgalanos
|
||||
roleary
|
||||
smorgan
|
||||
password
|
||||
password123
|
||||
Password
|
||||
Password123
|
||||
1234567
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/mxUfCRV.png"/>
|
||||
|
||||
But it didn't work , so I tried to use the usernames as a password list
|
||||
|
||||
<img src="https://i.imgur.com/88g93wf.png"/>
|
||||
|
||||
And this found as a valid username and password for smb , so I tried it on winrm to see if I can get a shell and sadly they weren't valid for winrm
|
||||
|
||||
<img src="https://i.imgur.com/7DDNerC.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/cAS3Z7A.png"/>
|
||||
|
||||
We have read access to `azure_uploads` but it was emtpy
|
||||
|
||||
<img src="https://i.imgur.com/GdqKo7l.png"/>
|
||||
|
||||
## Foothold
|
||||
|
||||
Checking the `users$` share we see a `azure.xml` file in `mhope` 's directory
|
||||
|
||||
<img src="https://i.imgur.com/fthQiHp.png"/>
|
||||
|
||||
On reading the xml we can find a clear text password
|
||||
|
||||
<img src="https://i.imgur.com/09tY5r0.png"/>
|
||||
|
||||
So let's run crackmapexec again to see if we got the correct password
|
||||
|
||||
<img src="https://i.imgur.com/bx9HE1a.png"/>
|
||||
|
||||
Using `evil-winrm` we can use that to login over winrm , after logging in we can see that this user is in `Azure Admins` group
|
||||
|
||||
<img src="https://i.imgur.com/ZiXIvSO.png"/>
|
||||
|
||||
Upload `Sharphound.ps1` file which is used for collecting information of AD and then using that info we can enumerate the AD using `bloodhound`
|
||||
|
||||
<img src="https://i.imgur.com/IO39L01.png"/>
|
||||
|
||||
```powershell
|
||||
Invoke-Bloodhound -CollectionMethod All -Domain MEGABANK.local -ZipFileName loot.zip
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/hcYJRf3.png"/>
|
||||
|
||||
We can download this archive file by using evil-winrm's download function in which we have to provide absolute path of the file
|
||||
|
||||
<img src="https://i.imgur.com/euT3S5F.png"/>
|
||||
|
||||
Now let's launch `neo4j console` and `bloodhound` , import the json files that you get after extracting the archive
|
||||
|
||||
<img src="https://i.imgur.com/s4wygU1.png"/>
|
||||
|
||||
Running any one of the built-in queries to see if data is actually loaded
|
||||
|
||||
<img src="https://i.imgur.com/pW0YTB0.png"/>
|
||||
|
||||
But here I didn't find anything that would help me escalate privileges
|
||||
|
||||
<img src="https://i.imgur.com/eRY82TY.png"/>
|
||||
|
||||
## Privilege Escalation
|
||||
|
||||
Now remeber that we saw mhope was in Azure admins group so maybe we have to abuse that ,searching of Azure AD related exploit I found an article which would exploit the database and give us the plaintext password
|
||||
|
||||
<img src="https://i.imgur.com/BwbZJTG.png"/>
|
||||
|
||||
Download the executable for this exploit from here
|
||||
|
||||
https://github.com/VbScrub/AdSyncDecrypt/releases
|
||||
|
||||
<img src="https://i.imgur.com/jdBsHAp.png"/>
|
||||
|
||||
And now uploading the exe and the dll file , in order to run this we need to be in this location `C:\Program Files\Microsoft Azure AD Sync\Bin` and from here execute the exe (doesn't matter where we upload it)
|
||||
|
||||
<img src="https://i.imgur.com/EANqNET.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/64O8bgU.png"/>
|
||||
|
||||
This gives us the adminstrator's password
|
||||
|
||||
<img src="https://i.imgur.com/oZk1HoM.png"/>
|
||||
|
||||
We can then further extract user hashes
|
||||
|
||||
<img src="https://i.imgur.com/HJAqL8C.png"/>
|
||||
|
||||
|
||||
## References
|
||||
|
||||
https://vbscrub.com/2020/01/14/azure-ad-connect-database-exploit-priv-esc/
|
||||
|
||||
|
||||
```
|
||||
SABatchJobs:SABatchJobs
|
||||
|
||||
|
||||
smbclient -U 'SABatchJobs' \\\\10.10.10.172\\azure_uploads
|
||||
smbclient -U SABatchJobs -L \\\\10.10.10.172\
|
||||
```
|
||||
|
||||
Administrator:d0m@in4dminyeah!
|
||||
Loading…
Reference in a new issue