Forest

#Windows #Enumeration #LDAP #BloodHound

Forest is an easy-rated Linux machine from HackTheBox, created by egre55 and mrb3n. In the current post, my IP is 10.10.14.131, and the target IP is 10.129.110.133

This machine features an apache server hosting a PHP website. The website doesn't look special until you intercept the registration process, where you can change a obvious parameter to change your privileges to that account, then when you fuzz the website, you find an admin login url. In that URL there is an sub-domain with error logs from Laravel, revealing in the process the API_KEY used for an exploit for RCE. Inside the machine, there are a lot of techniques used to pivot between users and the change your user to root.

Recon

The first steps are about getting basic information about the target, by using nmap and searching information from the website.

Local Terminal
$ ping -c 1 10.129.110.133
PING 10.129.110.133 (10.129.110.133) 56(84) bytes of data.
64 bytes from 10.129.110.133: icmp_seq=1 ttl=62 time=185 ms

--- 10.129.110.133 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 185.427/185.427/185.427/0.000 ms

By the TTL (Close to 128), we can assume that is a Window Machine.

Local Terminal
$ nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.159.205 -oG Ports

Nmap scan report for 10.129.159.205
Host is up, received echo-reply ttl 127 (0.16s latency).
Scanned at 2023-06-12 09:38:45 Pacific SA Standard Time for 19s
Not shown: 65511 closed tcp ports (reset)
PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
47001/tcp open  winrm            syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49665/tcp open  unknown          syn-ack ttl 127
49666/tcp open  unknown          syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
49671/tcp open  unknown          syn-ack ttl 127
49676/tcp open  unknown          syn-ack ttl 127
49677/tcp open  unknown          syn-ack ttl 127
49681/tcp open  unknown          syn-ack ttl 127
49695/tcp open  unknown          syn-ack ttl 127
63040/tcp open  unknown          syn-ack ttl 127

Read data files from: C:\Program Files (x86)\Nmap

From nmap we have a lot of information:

  • The port 53 (Simple DNS Plus) is open, this program could be vulnerable to Zone Transfer Attack.

  • Port 135 (MSRPC), the core of the "Remote Procedure Call", used to create and manage remote sessions

  • Port 385 (LDAP - Lightweight Directory Access Protocol), contain all the information about the Active Directory, enabling the access to files and devices inside the public or corporative intranet.

Through nmap we found the domain name, add it to "/etc/hosts" as "10.129.159.205 htb.local"

Ok, there is a Windows Server working.

LDAP Recon

From here, every command are specific steps to scan machines with LDAP orientation

AXFR does not show subdomains, this means that the target is not vulnerable to Zone Transfer Attack.

Now we will get information from RPCclient using first, a null session.

With this, we got a list with every user name, but we want this in a file, this can be done with the following command:

Exploring groups,

List with every group, there is an important group called "Domain Admins", let's see if we can get more information.

Only one user.

Nothing here... and so on, if you want to learn more about RPCclient, go to the following site

Reverse Shell

Now that we have a file called users_file with the list of users, we can use GetNPUsers.py

Logoimpacket/examples/GetNPUsers.py at master · fortra/impacketGitHub

There is one user, called svc-alfresco vulnerable to this kind of attack, save the hash in a file and then decrypt.

Information at the momment > user:pass svc-alfresco:s3rvice

Because the port 5985 (winrm) it's open, we can if it's valid to login inside the machine.

There is a plus, so it is valid.

And we are in!

Setting BloodHound

First, to be sure, we execute some commands to get information.

Local Terminal

asdasdd

asdasdd

asdasdd

asdasd

User Pivoting [mrb3n]

The user is from the group adm, maybe we can use an specific command or read some logs.

Usually the logs located at /var/log/audit/ are important, but they have a LOT of information, a good alternative is to use "grep" to find relevant data.

From here, we want a hash like "2F7573722F62696E2F656469746F72202D2D202F" between cmd= and Terminal=, to apply xxd -ps -r

Nothing here, now we will tesst with uid=1000

But there is another interesting rows, the ones that contain "TYPE=tty" and "data="

Privileges Escalation

At GTFOBin there is a way to escalate privileges with sudo using composer

Logocomposer | GTFOBinsgtfobins.github.io
PreviousExploreNextFriendzone

Last updated