Personal WebsiteLinkedin

EscapeTwo

Enumeration

The FQDN of AD seems to be sequel.htb. Modify /etc/hosts file:

Port 88

Using kerbrute we can enumerate users:

Effectively the account rose exists as show in MACHINE INFORMATION box.

Port 445

Using rose credentials, we can try to enumerate some shares thanks to SMBMAP:

Under the "Accounting Department" share we will find 2 interesting files:

If we try to open it, we encounter an error... Mmhh strange... Seems not to be an XLSX file. In fact are zip files:

Unzipping the accounts.xlsx file, we will find an interesting XML file containing juicy data:

Foothold (sa)

Port 1433

Try to access MSSQL using sa user:

As user "sa" enable the xp_cmdshell:

Under C: there is the SQL2019 directory:

and here we will find the sql configuration file:

Privilege Escalation (ryan)

Create two files containing users and passwords found so far:

and go on with a passwords spray attack 🎇

And finally get the user flag:

Privilege Escalation (Administrator)

Using this valid pair of domain credential, start internal enumeration with Bloodhound:

Use this QUERY to find the shortest path from owned principals (RYAN) to value targets:

Ryan has WriteOwner rights on CA_SVC and CA_SVC is a certificate issuer, because is member of Cert Publishers Group. So we can set the owner of the CA_SVC to be Ryan:

WriteOwner: Provides the ability to take ownership of an object.

The owner of an object can gain full control rights on the object. The right to assume ownership of the object. The user must be an object trustee.

Let’s grant the user ryan full control over the ca_svc principal using Impacket’s dacledit tool.

Now that we have the FullControl on a certificate publisher, enumerate Certificate Template in order to escalate privilege inside the domain.

First of all, enumerate certificate templates available and enabled and import ZIP output inside BloodHound:

In the image below, we can see that the user “ca_svc” is a member of the “Cert Publishers” group and has GenericAll rights for the DUNDERMIFFLINAUTHENTICATION template.

Follow the ESC4 ADCS Privilege Escalation Path, but before use Shadow Credentials attack.

We will get NThash of ca_svc below:

Leveraging the WriteProperty right we have as a ca_svc because member of Cert Publishers, we go ahead and, using KRB5CCNAME file to impersonate ca_svc, exploit the rights we have on the misconfigured template by editing the template with the 'template' module from Certipy in order to make this template vulnerable to ESC1 attacks:

Now finally use the ca_svc user's credential hash to obtain an authentication ticket for the target system via a Kerberos request:

Get the Administrator's hash from the certificate:

And finally evil-winrm and got the root flag 🎉

PreviousChemistryNextChallenges

Last updated