Forest
Forest is a easy difficulty windows box that's a great introduction to Windows Active Directory
Recon
we start off by scanning Forest's IP 10.10.10.161 with nmap
From Our Results we get the following services and ports
Great! seeing as ldap is present we can assume that the target machine has Active Directory in addition we find that it's also running rpc with this in mind we can go on to enumerate rpc, For this we will be using rpcclient
Output
Great! using a null auth rpcclient we were able to enumerate all domain accounts currently present. Using the above output we can create a userlist, but where do we go from here? going back to our nmap results we see that we also have 88/tcp kerberos open. After a little Googling we can find the following article https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
Based on the article it's safe to assume we can performing AS-REP Roasting with GetNPUsers which does not require a preauthentication
From the output we've been able to get the hash for svc-alfresco and now to crack it
Exploit
And we have our user and pass, Doubling back to our nmap scan we also see that we have port 445/tcp allowing us to use WinRm. A great tool to establish a shell with WinRm is https://github.com/Hackplayers/evil-winrm and that is what we'll be using
And with this we have our shell!
and our first flag!
Post Exploitation
Now that we've been able get user our next step is to get Admin and the root flag
Knowing that it's a Domain we can use net groups to reveal what groups have what privileges
with this we can see the groups present and whats more we find that the Exchange servers group is present.
we can also see what groups our current user is a part of
Next we upload BloodHound to get more information about the environment
We can load up the graph to bloodhound and find a attack path
Given we are part of the group Priveleged IT Accounts we can add ourselves to Exchange servers group
with this we can perform a NTLMRelay attack
after invoking this we have to visit the following http://localhost/privexchange and provide the credentials for svc-alfresco
after a while we should get the SUCCEED message on the ntlmrelayx terminal
Perfect, from here we can get the Administrator users hash via dcsync
and to pass the hash we'll use wmiexec.py
And our root flag is
Useful Links
https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/
Last updated