Authority HTB Walkthrough

Oct 31, 2024    #box   #htb   #medium   #windows   #ldap   #ca   #certificate   #ansible   #rbcd   #machineaccountquota   #pkinit   #rbcd   #esc1  

Authority Hack The Box Walkthrough/Writeup:

How I use variables & Wordlists:

1. Enumeration:

NMAP:

Basic Scans:

Comprehensive Scans:

LDAP 389:

Using LDAP anonymous bind to enumerate further:

DNS 53:

kerberos 88:

Using Kerbrute to bruteforce Usernames:

HTTP 80:

HTTPS-ALT 8443:

Discovering a password manager service:

SMB 445:

Attempting to connect with NULL & Guest sessions:

Enumerating the development share:

Finding Hard-Coded Creds & Hashes Ansible files:

Discovering the CA Admin Username/Email:

Discovering the Ansible Username:

Hard Coded TomCat Creds:

Ansible Hashes:

Cracking Ansible Vault Hashes Using Ansible2John & John The Ripper:

Converting Ansible Vault Hashes to John format using ansible2john:

  1. Place each hash in it’s own file:
  2. Run ansible2john on each file:
    • ansible2john ansible1.hashes > ansible.hashes

Cracking Ansible Vault Hashes Using John:

Using Ansible Vault to decrypt the hashes.

Re-cap of process ansible hash cracking process:

Logging into PWM:

Stealing LDAP Credentials VIA PWM:

2. Foothold:

Re-running ldapire now that we have creds to enumerate users and groups:

Connecting via evil-winrm as svc_ldap:

Doing a bloodhound capture using SharpHound:

Reading the bloodhound results:

Enumerating the Certificate Authority with certipy-ad (CA):

3. Privilege Escalation:

Enumerating MachineAccountQuota using netexec:

MachineAccountQuota Primer:

  1. Default Behavior:

    • Purpose: Limits the number of machine accounts (computers) a non-administrative user can join to a domain.
    • Value: The MachineAccountQuota has been set to 10 by default since Windows 2000
    • +Any authenticated domain user can leverage this quota+:
      • No special permissions are required beyond basic domain user rights
      • Default Value: By default, users in the “Authenticated Users” group can create 10 computer accounts in Active Directory.
    • Location: Managed via Active Directory settings and group policies.

  2. Security Implications:

    • Attackers can potentially add rogue machines to a domain, which may be used for privilege escalation or lateral movement.
      • Think Resource Based Constrained Delegation attacks:
    • Each computer account could potentially be used for lateral movement or persistence.
    • Rogue computer accounts can be leveraged for relay attacks or resource access

  3. Mitigation Strategies:

    • Reduce the MAQ value to 0 for enhanced security
    • Implement a formal process for adding computers to the domain
    • Monitor computer account creation events (Event ID 4741 )
    • Regularly audit computer accounts for suspicious entries
    • How to Modify MAQ using AD cmdlet:
      • Set-ADDomain -Identity yourdomain.com -Replace @{"ms-DS-MachineAccountQuota"="0"}

How to enumerate MAQ value:

Creating a computer with impacket-addcomputer:

Using certipy-ad & ESC1 Attack Chain to elevate privileges to Administrator:

  1. I retrieve the vulnerable certificate name:

    • CorpVPN

  2. I sync my clock with the target:

    • sudo ntpdate -s $domain

  3. I request a cert:

    • certipy-ad req -username bloodstiller$ -password $pass -ca AUTHORITY-CA -dc-ip $dcip -template CorpVPN -upn administrator@$domain -dns $domain
    • +Note+: How we have used the name of the certificate we found in step 1 CorpVPN
    • I get the below errors:

  4. Troubleshooting the issue:

Using addcomputer.py to start the attack chain again:

Let’s start this process over using addcomputer.py:

4. Ownership:

Understanding the KDC_ERR_PADATA_TYPE_NOSUPP error:

What does this actually mean though?

So what’s a PKINIT and an EKUā€¦glad you asked.

Public Key Cryptography for Initial Authentication in kerberos (PKINIT) Primer:

PKINIT is a kerberos extension that allows users to authenticate to a kerberos Key Distribution Center (KDC) using X.509 public key certificates instead of the traditional kerberos username and password, & guess what we have an X.509 certificate that certipy extracted for us.

How PKINIT Works:
PKINIT Requirements
The main benefits of PKINIT include:
PKINIT Resources:

But what is an EKUā€¦..glad you asked my hacking bretherin.

Extended Key Usage (EKU) Primer:

What is in an EKU?
Importance of Correct EKU Configuration:
EKUs and PKINIT:
EKU resources:

So how do we move forward with our attack chain?

Secure Channel (Schannel) Primer:

Last primer I promise. I’m sorry, there are just a lot of parts here and unless we understand we are just script kiddies aren’t we.

We got there, primers done I promise.

Schannel Resources:

Using PassTheCert & certipy to get our ticket:

Extracting the key & cert from the .pfx file using certipy:

Creating a new computer for an RBCD attack using PassTheCert:

Performing the RBCD attack with impacket-getST:

Why did this work?

The key points are:

Lessons Learned:

What did I learn?

  1. I learned about what to do if PKINIT is disabled. I really enjoyed this box, it wasn’t a case of just follow the attack path.

  2. I learned about decrypting ansible hashes, I have never done that before.

What silly mistakes did I make?

  1. Not too many this times. It just took time to understand and make this work as there were more moving parts I had to understand to get everything working

Sign off:

Remember, folks as always: with great power comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

ā€“ Bloodstiller

ā€“ Get in touch bloodstiller at proton dot me


Next: EvilCUPS HTB Walkthrough