TombWatcher - Hack The Box
Enumeration
Initial Credentials
At the start of the pentest an unprivileged user credential is given, as in every Active Directory test.
Nmap
Initial nmap scan revealed common ports for Active Directory.
SMB Enumeration
The user could login via SMB and read IPC$ Share.
So I applied RID Brute forcing and created a user list.
BloodHound
Later I ran bloodhound python for further enumeration.
Exploitation
From now on, there will be many lateral movements. I will explain them step by step.
WriteSPN
The initial user had writeSPN privileges over alfred. I used targetedKerberoast tool to obtain his ticket.
Then used hashcat to crack it.
AddSelf
The alfred user could add himself to Infrastructure group.
I used bloodyAD tool to add him to the group.
ReadGMSAPassword
The Infrastructure group had privileges to read GMSAPassword of the ansible_dev$.
I used netexec’s gmsa module to read the password hash.
Force Change Password
ansible_dev$ account had ForceChangePassword privileges over sam.
I used pth-net rpc to change the password. Because I only have password hash of the ansible_dev$.
WriteOwner
The sam was writeowner of the john.
So using sam, I gained full privileges over John and changed his password.
User Flag
The john could PSRemote. So, I got the user flag.
Privilege Escalation
The John had GenericAll privileges over ADCS OU, but that OU had no members.
Enumerating Certificates
I enumerated certificates using certipy-ad and could not find any vulnerable certificates. Then enumearted all templates and found that an SID with no name had object control over WebServer template.
Recovering Deleted AD Object
At first, I checked if the object was deleted. I ran command from this github repo.
Object was deleted and it was cert_admin user. I found this post and used commands from there to recover the object.
Then ran bloodhound again and found it was in ADCS OU.
So as john I can simply change its password.
ADCS - ESC15
Then I ran certipy-ad again using cert_admin credentials.
The WebServer template was vulnerable to ESC15.
So I opened official wiki of certipy. First, I tried the method a and it did not work. Then tried method B and got the administrator hash.
Root Flag
We got the root.
Pwned
Easy, peasy