HackSmarter MaritiniAD Walkthrough

Scenario :

An adult beverage company “Martini Bars” recently had a corporate breach and the compliance and risk team dictates they perform a penetration test at one of their branch offices. The Hack Smarter team has been authorized to perform an internal black box pentest.

Foothold :

First thing first we run an nmap scan :

nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN Open_Ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN Nmap_sV_sC_Results.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN Nmap_Vuln_Results.txt

From the initial scan , we can tell this is an Active Directory box , port 88 for kerberos , 389 for ldab , this is probably the DC . since this is an AD machine i usually follow this checklist :

Scan All TCP Ports . 
Check ldap , rpc , smb with anonymous access to get users.
Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

Of course there are other steps with more details in my methdology , but for now we can start with anonymous access , first checking to get a list of usernames to try asreproasting . But before that we need to add the Hostname as well as the domain name to our /etc/hosts

Now let’s check for users via anonymous access :

We do get a list of usernames , now to keep usernames only :

nxc smb $target -u 'guest' -p '' --rid-brute   | grep -i 'sidtypeuser' | awk '{print$6}' | cut -d '\' -f 2 | tee users.txt

Now let’s try ASREProasting :

impacket-GetNPUsers  DRY.MARTINI.BARS/ -dc-ip $target -usersfile users.txt -outputfile Hashes.txt

All users dont have the UF_DONT_REQUIRE_PREAUTH which means ASREPROASTING isn’t possible in this case . Now let’s check the shares :

Perfect , we see the Notes share that we can enumerate since we have R/W .

Perfect we find a new user , once we validate it using NXC , first thing i like to check is Kerberoasting :

We can use Jhon or Hashcat to crack the hash .

Perfect now we got our new user , we see that he is not Admin , let’s see if we can login via Winrm .

Perfect , now let’s login and check for privilege escalation vectors .

Privilege Escalation :

I tried login in , tried multiple tools , PowerUp.ps1 , Winpeas , checked the groups and Tokens for pivesc but nothing worked .

Now before running Bloodhound , what i like to do is check for password reuse whenever i have a valid password , we can do that using the netexec and the list of usernames we got earlier .

Perfect we see that the user Athena.T0 also uses the same password , and this user is Administrator on this machine which is also the DC .

Now we can either login using this user via RDP or Winrm or just dump all Hashes since the user is Admin .

Ah forgot , the flag is just the KRBTGT Hash , so no need to even login .

That was it for this AD Lab , see you in the next one :)