Administrator - Hack The Box
Enumeration
Nmap
Initial Nmap scan revealed FTP, SMB, LDAP, Kerberos and WinRM ports open, which indicates target is Domain Controller.
After nmap scan I did try many things such as SMB Enumeration, LDAP Search, Rid Brute, AS-REP Roasting and none of them worked. So I ran bloodhound.
Exploitation
Exploitation phase included many lateral movements. So I am going to explain them step by step.
Getting Michael
Current user olivia had generic all permissions over michael. So I force-changed michael’s password.
Getting Benjamin
Michael can change benjamin’s password forcibly. So I changed benjamin’s password.
FTP
Benjamin had permission to login and read from FTP server.
PwSafe
The downloaded backup file was encrypted. So using pwsafe2john I decrypted it.
And using pwsafe I got the emily’s password.
Got The User
Privilege Escalation
Targeted Kerberoasting
Checking bloodhound again, I found emily had generic write permissions over ethan. So we can apply targeted kerberoasting attack.
Simply we assign a random SPN to target user then apply kerberoasting.
DCSync
After cracking the ticket I know that ethan can apply DCSync attack. So simply I ran secretsdump and got the administrator shell.
Got The Admin
Pwned
The machine was pwned.