Skip to main content
Image

​
Enumeration / Info Gathering

Initial nmap scanning revealed a Windows domain controller with the usual suspects: DNS (53), Kerberos (88), RPC (135), SMB (445), LDAP (389/636), and RDP (3389). The domain identified as thm.local with hostname labyrinth.thm.local.
Nothing crazy here, but it is good to note that we have 2 http ports open (80/443) and RDP. Surprisingly no WinRM so we will have to get a shell through SMB or just RDP in. We shall see!

​
SMB

First thing I’m going to look at is null authentication and guest auth before looking at the web servers We do get authentication as a guest, but the shares don’t really give anything important. We can come back to this as a last resort to enumerate, but out of all the default shares this one probably isn’t going to be anything good.

​
HTTP

We find only one directory, that being aspnet_client Though on both 80 and 443 they are the same 403 result Doing some more enumeration (both subdir and dir) we find the following:
Unfortunately, it’s looking like the same story here (unsurprisingly) I also found this article, which is a list of aspnet_client information and fuzzing. Regardless, we get a hit! This is a version for asp net and it appears to be very vulnerable! Another thing I forgot to check is the SSL Certificate on the web server. Though unfortunately it doesn’t look like anything too crazy. Knowing there is a CA is interesting, and maybe we can callback to it later.

​
General AD Attacks

Since we have Guest authentication, that is kind of all we need to start launching some attacks. For example, we can find a HUGE list of users by rid-bruting We can create user list with the following command:
The list of users doesn’t help us a ton at this point. We could do some password guessing attempts (Season + Year + Special Char) but I’m going to hold off at this point. I’m going to see if I can fire off other attacks. Hmm, asreproasting and kerberoasting don’t work, time to move on to other attacks.

​
LDAPSearch

We get a bunch of information back including Descriptions of user objects

​
Exploitation

FINALLY we have a password. We can spray this across the network and we find two valid logins! Woohoo!

​
SMB Enumeration part two

Confirming that the credentials we found work on SMB:

​
Bloodhound

Pulling down bloodhound data:

​
ASReproasting

We get a bunch of hashes but none of them crack unfortunately

​
SUSANNA_MCKNIGHT PWNED

Checking RDP on our cred users we find we actually have RDP access w/ susanna! This is confirmed by bloodhound (notice she is a part of the Remote Desktop Users group):

​
Lateral Movement

We can RDP in as Susanna and get user flag.

​
PrivEsc

For PrivEsc, we can actually callback to the HTTPS CA Authority! How could we forget! We can use Certipy to locate any vulnerable CA templates that may be present on the DC.
It’s vulnerable to ESC1! — https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc1
We get a hash for the Carey_fields DA. However, this one doesn’t work for some reason. Instead, we have to get the hash for bradley, which is the user we saw before to FINALLY pwn this machine. I had a hard time RPDing in with just the hash, but smb/psexec worked just fine:
And that’s it, thanks for sticking around! This box was a fun one and I learned a lot of new stuff, especially with ldapsearch! I hope you enjoyed, and of course Happy Hacking!