search

Resourced

hashtag
Nmap Scan

$ nmap -sC -sV -p- --min-rate 10000 -Pn -oN nmap 192.168.206.175
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-10 13:21 +08
Nmap scan report for 192.168.206.175
Host is up (0.012s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-06-10 05:21:26Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: resourced.local0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: resourced.local0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2024-06-10T05:22:54+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=ResourceDC.resourced.local
| Not valid before: 2024-03-21T10:42:07
|_Not valid after:  2024-09-20T10:42:07
| rdp-ntlm-info: 
|   Target_Name: resourced
|   NetBIOS_Domain_Name: resourced
|   NetBIOS_Computer_Name: RESOURCEDC
|   DNS_Domain_Name: resourced.local
|   DNS_Computer_Name: ResourceDC.resourced.local
|   DNS_Tree_Name: resourced.local
|   Product_Version: 10.0.17763
|_  System_Time: 2024-06-10T05:22:14+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49675/tcp open  msrpc         Microsoft Windows RPC
49693/tcp open  msrpc         Microsoft Windows RPC
49712/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: RESOURCEDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-06-10T05:22:15
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 111.48 seconds

hashtag
Initial Access

hashtag
Enum4Linux

hashtag
Null Session

We got a list of users from the enumeration.

We will also list the shares that the user can see.

We can see that there is a Password Audit share folder that we can access using that user.

hashtag
Getting NTLM Hashes

After going in we can see that, there are 2 folders. We will just download everything.

From these 4 files, we can use impacket-secretsdump to get the NTLM hash for all the users.

LogoExtracting and Cracking NTDS.ditMediumchevron-right

After running this command, we are able to extract all to ntlm-extract.ntds.

After removing all the stuff that is not necessarily, we are left with the hashes.

So the next thing to do is password spray to winrm and there is one user that is pwned.

After logging in, we are able to get the shell as L.Livingstone.

hashtag
Privilege Escalation

hashtag
Bloodhound

From BloodHound, we can see that the user has GenericAll control over the whole target itself.

hashtag
Abusing GenericAll

Firstly, we will import Powermad and Powerview modules.

Next we will create a new account

Then, we will use PowerView to retrieve the security identifier (SID) of the newly created computer account

We now need to build a generic ACE with the attacker-added computer SID as the principal, and get the binary bytes for the new DACL/ACE

Next, we need to set this newly created security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the computer account we are taking over, again using PowerView.

Next, we will download Rubeus to the target machine.

We can then use Rubeus to has the plaintext password into its RC4_HMAC form.

We will use Rubeus' s4u module to get a service ticket for the service name we want to "pretend" to be "administrator" for. This ticket is injected.

We will first remove all the whitespaces for the last ticket's content and store into a file.

LogoRemove All Whitespace - Delete Spaces, Tabs, Newlines - Online - Browserling Web Developer Toolswww.browserling.comchevron-right

We will then convert ticket content into a .ccache file in order to login as administrator.

PreviousKyotoNextSquid

Last updated