Skip to main content
Image

​
Starting Credentials

This is an assumed breach scenario. Use the credentials below:

​
Active Directory Layout

This lab consists of 3 machines (mimicking an OSCP set), consisting of 1 domain controller and 2 domain joined machines. Running an nmap scan across all of the given hosts, we can create the following table to give us an idea of what our attack surface looks like:

​
Enumeration

With AD enumeration, I always like to start by using nxcspraywith the given credentials and see if we have any low hanging fruit access: Image No WinRM or automatic admin access here, so we will continue basic AD enumeration, starting with looking for SMB shares:
As we can see, there are only default shares IPC$, NETLOGON, SYSVOL. So nothing interesting to pursue here. Moving on to other types of enumeration, we can pull down other users with nxc to build a full users list:
We can also pull down bloodhound information:

​
Initial Foodhold: GenericWrite on Lion

Using the bloodhound data we just pulled down, we find that our user shannon has the following interaction on another domain user, lion : Image We see that Shannon has GenericWrite over Lion, which means we can compromise the Lion user via Targeted Kerberoast:

First, we need to request a krb5tgs for the user lion using targetedKerberoast.py
Image
Then we can crack that hash with hashcat to retrieve Lion’s plaintext password:
Image

​
Access as Lion on WS01

First, spraying our new creds against the hosts and WinRM, we find that lion has shell access on WS01!
Image We can use evil-winrm to grab a shell
Image Looking in our home directory, we find that we have a .accdb database file in our downloads folder! Image We can pull this file down to our kali machine using the evil-winrm download functionality: Image

​
Lateral Movement: Lion → Kanon via DB File

What is a .accdb file? An .accdb file is a standard database file created by Microsoft Access (version 2007 and newer, including Microsoft 365). For our sake, it basically is a DB that might contain sensitive information. To read this type of file, we can use this github repo, which conveniently provides a python script to access .accdb files, even those that are password protected (which I presume this one might be). We can confirm this by running the accdbpy.py tool trying to list tables from our extracted files: Image As expected, this DB is password protected. Fortunately, to crack the password of this file, we can use office2john:
Image
Now, we can dump the Users table to find another set of credentials! This time for the user kanon:
Image

​
Access as Kanon on WS01

Spraying the creds we obtained from the .accdb database, we see that we get access to the same machine (WS01) via WinRM as kanon: Image Enumerating kanon’s user directory, we don’t get as lucky as last time, as there isn’t much here to go off of: Image

​
Privilege Escalation on WS01

Beyond files in the user’s directory, we can upload a privesc script, such as PrivescCheck.ps1 to see if we can pick up any other low hanging fruits on this machine.
Running the checks, we see that one main thing gets picked up: Image According to the script, we can perform ChangeConfig, Start, Stopon the wuauserv service. This means that we should be able to change the config a little bit to obtain a SYSTEM shell! First, let’s generate our shell:
Now, we can upload this shell to the target machine and more importantly, change the config path of the service to a binary path of our choice (in this case, our shell):
Now that we have changed the binary path, we can restart the service to drop into a SYSTEM shell! Image Image The next step I want to do is dump secrets on this machine in hopes that there are some other domain users that might have logged into this machine at one point. To do this, we can add a new admin user using net user: Image It’s important to note we technically can’t dump secrets yet (despite being an administrator): Note: There is no “Pwn3d!” in the nxc output Image To fix this, we can add the following registry key on the machine via our SYSTEM shell:
And now we can easily dump secrets! Image Looking at secretsdump output, we find cleartext credentials for erika ! Image

​
Access as Erika on FORENSICS01

Spraying these newfound creds, we find that we have WinRM access on the FORENSICS01 workstation! Image As soon as we grab a shell, we see that our user erika has the SeDebugPrivilege privilege! Image This privilege allows us to run tools like mimikatz because having SeDebug bypasses standard Windows process memory-protection boundaries, granting us full access to open a handle and read the memory of protected system processes like lsass.exe , which holds the credentials we are so interested in! So going off of that theory, we can put it into practice and extract the NTLM hash of the local administrator on the machine!
Image

​
Access as Administrator on FORENSICS01

Using the hash we just found, we can perform pass-the-hash to gain WinRM access on the same FORENSICS01 machine. Performing the same enumeration as the other machine, we can use tree . /f to list out all the files in our Administrator folder: Image Looking at the output of notes.txtlike there are some iocs from previous attackers left behind: Image

​
Privilege Escalation to Domain Administrator

The notes.txt file above mentions that the ticket file (.kirbi) is for the domain admin! We can use this to forge our own ccache domain admin ticket on kali and login as the domain admin: First, we need to convert the .kirbi file to a .ccache:
Describing our ticket with klist, we see that we are the Administrator@LAINOSCP.LOCAL as anticipated!
Image Now we can use this ticket to dump the domain controller secrets, and claim the domain administrator NTLM hash!
Image That’s the box! While there wasn’t anything crazy new here, it is always very cool to see how different machines mash together vulnerabilities across AD to create a path to domain administrator. Great job on another set, Lain!