Support
Nmap Scan
$ nmap -sC -sV -Pn -oN nmap 10.10.11.174
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-23 10:25 +08
Nmap scan report for 10.10.11.174
Host is up (0.0061s latency).
Not shown: 989 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-05-23 02:20:28Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -5m34s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-05-23T02:20:29
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 52.64 secondsInitial Access
Guest Access to SMB Server
We can see that there is a share that the guestaccount can access.
After entering the share folder, we can see there are these files.
We will then download all the files to our local machine.
After enumerating, we realised that there is 1 binary that is not publicly available which is UserInfo.exe.zip. After unzipping, we can see that UserInfo.exe is a binary which is using .NET Framework.
So, we can try to decompile the executable. However, I am bad at doing RE stuff so I resorted to running the executable on kali and capturing the authentication process.
Capturing LDAP Simple Authentication Credentials
So we will run wireshark first, then we run the command.
We should be able to see the password.
From there we can use ldapsearch to enumerate more information about the domain:
However, this will give us too much information. But we can filter using grep .
From there we can compile all the users to a single list:
Next we can try to do AS-REP Roasting to see if there is any account that is vulnerable.
Credential hidden in LDAP field
However, there are no accounts that are AS-REP Roastable, so we will continue to enumerate from ldap search. There is a field that is very suspicious as the other accounts do not have this field except support. They have this field info which looks like a password
After trying that as the password, it turns out to be correct.
Since the user is also in Remote Management User Group, we can use evil-winrm to get a shell.
Privilege Escalation
Abusing GenericAll
We will use both Powermad and PowerView to abuse this.
FIrstly, Import both PowerView.ps1 and Powermad.ps1. Then follow the following screenshots.
Then we can use Rebeus to generate the ticket for us.
After that we will take the content of the last ticket after removing all the newlines and whitespaces
We will then convert it into a .ccache file to be used to login as the administrator user
Last updated