HTB-Mantis (Hard)
Enumeration
Nmap
Nmap found a lot of ports.
Port 445
SMB
It can authenticate anonymously but return no shares.
RPC
rpcclient can also login with anonymous but when we query something, it display ACCESS_DENIED
Port 88 - Kerberos
User enumeration through kerbrute and we will get a couple of valid users
Port 1337 IIS Web Server
In full port scan, nmap display one more port which is 1337 running IIS webserver.
Bruteforcing with gobuster
Found a directory called secure_notes.
Web.config returned 404 and we can view dev_notes .
Notice in url, there is a base64 encoded
we will get mssql credential.
MSSQL login
We can login with impacket-mssqlclient tool but database is large and it hard to dump all the data.Insert we can use GUI version called dbeaver.
Dumping James User
Found one credentials James:J@m3s_P@ssW0rd! .Now we can check with crackmapexec it valid or not.
It not showing Pwn3d which mean we can't execute through smb.
Connect RPC client
With these credential, we can also dump a list of ASP-REP vulnerable users with getnpuser tool
But nothing found in this case. After some googling and found an article.
https://wizard32.net/blog/knock-and-pass-kerberos-exploitation.html
Generating Kerberos Ticket
Follow along in the blog, add dns in /etc/host , modified nameserver and run exploit.
Copy ticket to /tmp
cp TGT_james@htb.local.ccache /tmp/krb5cc_0
Getting System
Getting a shell with GoldenPac impacket tool.
Last updated