Intelligence - Medium
Introduction@Intelligence:~$
Enumeration
Nmap
Nmap show a lot of services running on the machine, LDAP , Kerberos, HTTP, SMB and others. We also have hostname and virtual host in the nmap output. Add them to /etc/hosts file.
Web Enumeration
There are two pdf to download. Inside both files are not interesting but if we lookup meta data of the two file, we can see creator name.
Save in a file and let's check these two user are valid or not.
Both accounts are valid. Now try to query the domain for users with Do not require Kerberos pre-authentication set and export their TGTs for cracking.
Both accounts have not set to Do not require pre-auth. This mean, we can't perform Kerberoasting attack, it requires a user with Pre-Authentication enabled.
Now look at the name of PDF files, we can see a pattern. 2020-01-01-upload.pdf
It's just a date and we can generate list of dates and bruteforce for other pdf files.
Getting PDF Files
generate_dates.sh
This script can generate dates 2020 to 2022. Now we need to concat that dates with -upload.pdf and save in a file named as file_name.txt
file_name.txt output
The next step is to bruteforce with that file using ffuf to know which pdf file is exists.
I used markdown format as output because we can grep easily that format with awk command. You can see ouput in below.
We only need the urls from the forth field, I used awk to grep that urls and saved in a file.
Now we can use wget to download all pdf in urls file.
Now we get all the pdf and let's grep the creators name for all pdf.
Save all username in a file and check again which users are valid.
All 30 accounts are valid.I checked which account is set Do not require Kerberos pre-authentication but unfortunately even one account is not set.
Enumerating in PDF
When I grep some password in pdf, I see this.
In another pdf, I also found this
It tell us about a script which is placed by Ted user. They are in the process of locking down in service accounts.
Now we have the password and multiple user. We should try to perform Password Spraying attack on all users with the new password we got.
We got one user valid with that password and we can also access shared folder of that user.
In Tiffany’s directory we can find the user flag.
Privilege Escalation
In IT share folder
We will get a powershell file
It look like kind of cronjob running every 5min. It check for DNS records locally and if any of these records start with web then it will request the DNS record via HTTP request using current user’s credentials (probably Ted). If the response code is not 200 (OK) then it will send an email to Ted user mentioning that the host (DNS) is down.
If we map a DNS record to our own host (IP) and when the HTTP request is made to check the status of the DNS then we will receive a request (because our IP is mapped with that DNS) and in turn then we can send NTLM authentication request back to the IP address.So if we can add a dns in the record we can get the Ted.Graves hash using responder.
To add a DNS record we will use dnstool.py
Now our DNS is in record. Run responder and wait about 5 min, we will get Ted.Graves hash in responder.
Now we get the hash and crack with john.
We got the password of Ted user. Now we can try the gMSADumper to read the password of svc_int (service account).
Now we have the hash, I tried to crack to get the password but unfortunately I didn't get anything.
Getting Silver Ticket
Let’s use pass the hash technique to impersonate administrator and get the silver ticket. To generate silver ticket we need one more thing, that is SPN (Service Principle Name).
SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name.
We will use bloodhound tool to dump AD environment to find the SPN.
It dump all the information in json format. We are looking for SPN, it should have in computers.json file.
As you can see the last line, svc_int is allowed to delegate with WWW/dc.intelligence.htb . Now we can able to get the silver ticket.
We get an error because TGT’s are time constraint. We need to match our time with servers time.
We got the silver ticket and it is saved in current directory.
Export the saved ticket, so that Kerberos clients can use it.
Now we pwned it.
Resource
https://github.com/dirkjanm/krbrelayx
https://adsecurity.org/?p=2011
https://github.com/micahvandeusen/gMSADumper
https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64
Last updated