Flight - Hack The Box
Nmap
Initial Nmap scan revealed SMB, Kerberos, HTTP and LDAP ports and a domain name.
DNS
Using ‘dig’, I was able to obtain Domain controller’s name.
VHost Enumeration
The website was static. So I did directory brute-force which revealed nothing. Then did vhost enumeration which revealed ‘school’ domain.
Exploitation
SMB Authentication
I set up a responder to listen for SMB authentication requests and obtain the hash. Then inside the school.flight.htb website, used LFI vulnerability to access fake share with my attacker IP, which revealed target hash.
Then simply cracked the hash with hashcat.
User Enumeration and Password Spray
So this was a service account which did not have many permissions. Using crackmapexec I generated a userList.
The userList can also be generated with impacket-lookupsid
Then using cracked service account password, I applied password spraying attack which revealed one of the users had same password.
NTLM Theft
The user had write access to a share which is probably commonly accessed.
Using ‘ntlm_theft’ tool I uploaded a phishing file inside the share, then started responder which allowed me to capture the hash of a user.
Then using hashcat again, I cracked the hash.
SMB Shares
The c.bum user had write access to the Web share.
So I generated a PHP Reverse shell and uploaded it to the target share, which allowed me to execute commands on target computer.
Get an Interactive Shell
To get an interactive shell, I uploaded nc64.exe file and started netcat listener. Then running the command from the webshell, I got an interactive reverse shell.
Getting User
The shell was running as service account. So we had to run runas to get the c.bum user but we can not anwser the password prompt. So the solution was to use RunAsCs tool to get a reverse shell.
Lateral Movement
While analyzing the computer, found inetpub page which is a .NET website (external websites was PHP).
Using ‘icacls’ tool, I found c.bum user had write access here.
So I thought there was probably an internal website. So run ‘netstat’ command to check ports. Port 8000 was common for web applications.
Port Forwarding
So I had to do remote port forwarding to access internal website. I uploaded chisel to the target. Then started chisel server with reverse option.
Then connected to server with client.
Reverse Shell
Then uploaded and put ASPX reverse shell to here. Visiting the page from the site got me reverse shell.
So I could see that it was a system account. I knew it because the prefix was not domain name. To test it I ran responder and tried to access fake share which revealed computer account hash.
From now on we have 2 choises.
- Use SeImpersonatePrivilege to privilege escalation (JuicyPatato etc.)
- Using rubeus, simply ask for tgt and using this tgt apply DCSync attack.
TGT Delegation and DCSync
So using Rubeus I obtained Domain Controller’s ticket.
Then, first used ‘ntpdate’ to sync date with target DC to be able to use kerberos. Later, base64 decoded the file and converted the ticket to ccache file. Then using the ccache file I simply applied DCSync attack with ‘secretdumps.py’.
Finally, used dumped hash to get a system shell and got root flag.
Pwned
The machine was fully compromised.