Heist
Nmap Scan
$ nmap -sC -sV -p- --min-rate 10000 -Pn -oN nmap 192.168.199.165
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-03 16:31 +08
Nmap scan report for 192.168.199.165
Host is up (0.013s latency).
Not shown: 65514 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-06-03 08:31:25Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: heist.offsec0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: heist.offsec0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC01.heist.offsec
| Not valid before: 2024-03-22T06:03:39
|_Not valid after: 2024-09-21T06:03:39
|_ssl-date: 2024-06-03T08:32:53+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: HEIST
| NetBIOS_Domain_Name: HEIST
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: heist.offsec
| DNS_Computer_Name: DC01.heist.offsec
| DNS_Tree_Name: heist.offsec
| Product_Version: 10.0.17763
|_ System_Time: 2024-06-03T08:32:13+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
8080/tcp open http Werkzeug httpd 2.0.1 (Python 3.9.0)
|_http-title: Super Secure Web Browser
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49677/tcp open msrpc Microsoft Windows RPC
49705/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-06-03T08:32:17
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 110.62 secondsInitial Access
Domain Name: heist.offsec
Server Name: DC01
Enum4linux
Anonymous
Guest
Port 8080
There is a website that is running on port 8080.
If we key in our own IP address, we can see that the website will display what is shown on that URL.
Getting NTLMv2 Hash
However, after trying multiple possible webshell (php, asp, aspx), it does not seems it is running on any of these platform. So the next step is trying to see if we can get a hash when we use responder.
We are able to get the NTLMv2 Hash of enox.
We can try to crack the hash using hashcat.
So the password for enox is california.
Logging in using evil-winrm
However, if we tried to login using RDP, we are not allowed.
Furthermore, when we check the shares using smb, we are returned with nothing special
But, when we checking using winrm, crackmapexec showed that this account is pwned. This means we are able to login using evil-winrm.
Lateral Movement
ReadGMSAPassword
After running sharphound on the target machine and extracting the zip into bloodhound. We can see that Enox is a member of Web Admins which have the rights to ReadGMSAPassword of SVC_APACHE$ user.
This is similar to one of the boxes we did previously (ReadGMSAPassword). We can try to follow the same steps.
Firstly, we need to add the DC's ip to host files
Next, we will download the github repository.
However, if we tried running with this tool, we will encount this problem.
This means that without LDAPS, this tool will not work as intended. So we need to find another tool to use.
From this github repo, there is a GMSAPasswordReader.exe which we can use to get the NTLM hash.
When we run it, we will get the NTLM Hash for svc_apache$.
Privilege Escalation
SeRestorePrivilege
When we are in the svc_apache$ user, we can see that the user have this file
After we run it, when we check our privilege, we have the SeRestorePrivilege enabled on our account.
After searching online about what this privilege do, we can see that it give permission to write access to any system file
After searching more, we can use this method to do Privilege escation
We will first overwrite utilman.exe to cmd.exe. This will ensure when we press Win+U when we are on the login page, we are able to get shell as administrator.
We will just RDP into the machine.
From here we do not need to login and by pressing Win+U we are able to get shell as NT Authority\System.
Last updated