Intelligence HTB Walkthrough

Sep 29, 2024    #box   #htb   #medium   #active-directory   #windows   #kerberos   #kcd   #dns  

Hack The Box Intelligence Walkthrough/Writeup:

How I use variables & wordlists:

1. Enumeration:

NMAP:

DNS 53:

LDAP 389:

SMB 445:

HTTP 80:

Fuzzing for Uploads using FFUF (Finding IDORs):

Explanation of Vulnerability Indirect Object Reference (IDOR):

This type of vulnerability is called an Indirect Object Reference or (IDOR)

Scripting a simple mass down-loader to download the PDF’s:

import requests

# Days from 01 to 31
days = [str(day).zfill(2) for day in range(1, 32)]

# Months from 01 to 12
months = [str(month).zfill(2) for month in range(1, 13)]

# Loop through days and months
for d in days:
    for m in months:
        # Construct the URL:
        url = f"http://10.129.95.154/Documents/2020-{m}-{d}-upload.pdf"
        response = requests.get(url)

        # Check if the request was successful:
        if response.status_code == 200:
            print(f"Downloading {url}")

            # Save the file locally & print message:
            file_name = f"2020-{m}-{d}-upload.pdf"
            with open(file_name, 'wb') as file:
                file.write(response.content)

        # If we get a 404 response print that no file was found:
        elif response.status_code == 404:
            print(f"No file found at {url}")

Converting the PDF’s to text using pdftotext for easier processing:

Finding a default password & a username in a pdf:

Extracting Usernames from the creator field of the PDF’s:

Command Breakdown

  1. exiftool -Creator -csv *pdf

    • exiftool: Run the tool
    • -Creator: Extracts the Creator metadata field from the files.
    • -csv: Outputs the data in CSV format.
      • This is the most important part for the rest of the command to work:
        • The CSV format provides a structured way to output the metadata in rows and columns. When extracting metadata from multiple PDFs, each PDF’s metadata is presented as a row, and each field (like “Creator”) is a column. This makes it easier to process the data programmatically.
        • Simplicity: When using tools like cut, itā€™s easier to extract specific fields by referring to column numbers (e.g., -f2 for the second column), which is straightforward with CSV formatting.
    • *pdf: Targets all PDF files in the current directory.

  2. | cut -d, -f2

    • |: Pipes the output from the previous command into the next.
    • cut: Extracts specific fields from the CSV output.
    • -d,: Uses a comma as the delimiter (since it’s CSV data).
    • -f2: Selects the second field, which contains the creator name.

  3. | sort: Sorts the creator names alphabetically.

  4. | uniq: Removes duplicate names, leaving only unique entries.

  5. > userNames.txt

    • Redirects the final output (unique creator names) into a file named userNames.txt

2. Foothold:

Credential Stuffing with netexec:

Credentialed SMB Enumeration:

Enumerating Users Share:

Finding a user script:

3. Lateral Movement & Privilege Escalation:

Adding a Malicious DNS Entry using dnstool.py:

Why can we just add malicious DNS entries to a Domain Controller?:

Cracking Teds Hash using Hashcat:

Running Bloodhound as Ted Graves:

Using gMSADumper.py to dump the gMSA Password:

What is gMSA & gMSA Password?:

4. Ownership:

1. Clock Synchronization To Ensure Kerberos Tickets Are Valid:

2. Kerberos Constrained Delegation (KCD) Attack:

Constrained Delegation KCD Attack Explained:

  1. Compromise a Service Account:

    • We need to gain control of a service account that has been configured for constrained delegation.
    • We have control over svc_int$ computer account

  2. Identify Delegation Targets:

    • Enumerates the services which our compromised account is allowed to delegate to.
      • We know we can delegate to WWW/dc.intelligence.htb which is a service running on the Domain Controller

  3. Request a TGT: Handled by impacket-getST

    • We requests a Ticket Granting Ticket (TGT) for the compromised service account.

  4. Request a Service Ticket: impacket-getST

    • Using the TGT, the we requests a service ticket for one of the allowed delegation targets.
    • We specify the user they want to impersonate in this case it will be the Administrator account.

  5. S4U2Self: impacket-getST

    • The Key Distribution Center (KDC) performs an S4U2Self (Service for User to Self) operation.
    • This creates a service ticket as if the impersonated user (Administrator) had requested it.

  6. S4U2Proxy: impacket-getST

    • The KDC then performs an S4U2Proxy (Service for User to Proxy) operation.
    • This allows the service ticket to be used for delegation to the target service.

  7. Access Target Service:

    • We can now use this ticket to access the target service, appearing as the impersonated user.

3. Load the .ccache into memory with the KRB5CCNAME variable:

4. Getting a shell using impacket-psexec:

5. Ownership:

Dumping NTDS using netexec and our kerberos credentials:

6. Persistence:

Creating a windows scheduled task to enable a backdoor.

Lessons Learned:

What did I learn?

  1. I learned that users may or may not be able to add DNS entries (super clear I know.)
  2. I never had considered using DNS as a means to for spoofing before which was a cool thing to do.

What silly mistakes did I make?

  1. I didn’t specify the SPN the first time when running the KCD attack.
  2. I ran bloodhound a little too late. This was mainly due to having issues with bloodhound.py but after setting it up in a venv it was fine.

Sign off:

Remember, folks as always: with great power comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

ā€“ Bloodstiller

ā€“ Get in touch bloodstiller at proton dot me


Next: Manager HTB Walkthrough