Nmap
Like always, I’m going to scan the IP Address by using nmap but I’m going to scan the full port first. Then, I’m going to scan the only open ports.
# Nmap 7.94 scan initiated Thu Sep 28 15:06:39 2023 as: nmap -p135,139,3268,389,445,464,49667,49673,49674,49677,49689,49696,53,593,5985,80,88,9389 -sCV -oN nmap/sauna 10.10.10.175
Nmap scan report for sauna (10.10.10.175)
Host is up (0.032s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Egotistical Bank :: Home
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-09-28 14:06:45Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49677/tcp open msrpc Microsoft Windows RPC
49689/tcp open msrpc Microsoft Windows RPC
49696/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 6h59m58s
| smb2-time:
| date: 2023-09-28T14:07:34
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Sep 28 15:08:14 2023 -- 1 IP address (1 host up) scanned in 95.23 seconds
The scan reveals a large number of open ports. Judging by the open ports, it appears that this is a Domain Controller. Additionally, Nmap discovered the domain name EGOTISTICAL-BANK.LOCAL0, which I added to my /etc/hosts file.
Http: Egotistical Bank
Next, I navigated to port 80 using my browser and was greeted with a website resembling a bank. I attempted to determine the backend language by modifying the index page extension, but it turned out to be a static HTML page.
While running gobuster in the background for directory brute-forcing, I did not uncover anything particularly useful. However, I did notice a potential username on the website’s about.html page. I compiled a list of these usernames and saved it as users.txt.
LDAP: ldapsearch
Remembering that LDAP ports were open on the machine, I used anonymous enumeration to find additional users. This process revealed another user, Hugo Smith, which I added to the users.txt file.
USER: username-anarchy
I then modified the users.txt file slightly to use it with username-anarchy, which generates a list of usernames based on first and last names. The output was saved to a file called gen_usernames.txt.
SMB: crackmapexec
Next, I executed CrackMapExec with the -k flag (which enables Kerberos authentication) to test the user list. This scan revealed that one of the users is vulnerable to an ASREPRoast attack.
ASREPRoast: GetNPUsers.py
I then ran the Impacket script GetNPUsers.py to dump the hash for the fsmith user, saving it to a file named hash.txt. After successfully dumping the hash, I cracked it using hashcat.
Evil-winrm: fsmith
Since port 5985 (Windows Remote Management, or WinRM) was open and I already had valid credentials, I connected using the fsmith user.
BloodHound
After successfully logging in, I deployed the SharpHound binary on the target machine to enumerate the Active Directory. I executed the binary and saved the output in a ZIP file.
To retrieve the ZIP file, I started an uploadserver on my machine and used PSUpload.ps1 to transfer the file. I verified its integrity using md5sum.
For analysis, I launched the neo4j console with sudo privileges. On a fresh neo4j installation, you must set a new password by visiting http://localhost:7474; the default credentials are neo4j:neo4j.
After logging into BloodHound, I imported the ZIP file by clicking the Upload Data button in the navigation bar. Once imported, I searched for the [email protected] node, right-clicked on it, and selected Mark User as Owned.
I then analyzed the data from the owned fsmith account by navigating to Shortest Paths to High Value Targets from the Analysis section.
Although the graph view was a bit confusing, I noted that the user svc_loanmgr appeared capable of performing a DCSync attack.
Unfortunately, I couldn’t find a way to compromise the svc_loanmgr user, leaving me somewhat stumped.
First Method: PrintNightmare
SMB: printer
I then checked the SMB shares on the machine. Although listing the shares using NULL authentication failed, using valid fsmith credentials succeeded. The shares indicated that a printer was connected.
PrintNightmare
It occurred to me that I might be able to exploit the printer, given the known PrintNightmare vulnerability (assigned CVE-2021-1675 and CVE-2021-34527), which affects the print spooler service. First, I checked if the Print Spooler service was running by executing Get-Service -Name Spooler.
After some research, I found an exploit for this vulnerability. I chose the reverse shell option and created a DLL payload using msfvenom.
I set up a listener using Metasploit, transferred both the exploit and the payload to the target machine, and executed the exploit.
Second Method: DCSync attack
Returning to the graph view, I saw that compromising svc_loanmgr was necessary to leverage the DCSync attack.
winPEAS
Since I was already logged in as fsmith, I uploaded the winPEAS binary to enumerate the system. winPEAS revealed plaintext AutoLogon credentials for the svc_loanmgr user.
Impacket: secretsdump.py
With valid credentials for svc_loanmgr, I used the Impacket script secretsdump.py to dump the hashes of all users on the machine.
PsExec
After dumping the hashes, I employed another Impacket script, psexec.py, to log in as Administrator using a Pass-the-Hash attack.
