Vault - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed SMB and some common Active Directory ports were open.
SMB Null
SMB Null session was available. Moreover, there was a share where we could both read and write.
The share was empty as seen below.
Exploitation
NTLM Theft
Because the share was empty and I had a write permission, I decided to put some files created by ntlm_theft while listening with responder.
The .lnk file worked and I obtained user’s NTLMv2 hash.
Then I simply cracked it using hashcat.
And obtained the user flag.
Privilege Escalation (1st way - GPO Abuse)
Bloodhound Python
After obtaining user credentials I executed bloodhount python.
Then I found out that the user had WriteDACL permissions over Default GPO.
GPO Abuse
At first I used impacket-dacledit to give myself GenericAll privileges over GPO.
impacket-dacledit -action 'write' -rights 'FullControl' -principal 'ANIRUDH' -target-dn 'CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=VAULT,DC=OFFSEC' 'vault.offsec'/'anirudh':'<PASSWORD>'
Then using pyGPOAbuse tool, I abused the default GPO which creates a scheduled task to add user named John with password H4x00r123...
And on user winrm shell, I used gpupdate /force command to update the GPO.
Then I simply logged in as John and read Admin flag.
Privilege Escalation (2nd way - SeRestore Privilege)
User had SeRestore Privilege and RDP port was open. So I could simply overwrite C:\Windows\System32\utilman.exe with cmd.exe.
Then I used rdektop to open lock screen.
And I simply clicked Windows+U on my keyboard and got SYSTEM Shell.
Privilege Escalation (Failed way - SeBackup Privilege)
Trying to dump Admin Hash
SeBackupPrivilege was enabled. We could simply copy SYSTEM and SAM and dump Administrator credentials.
I used below commands to copy SYSTEM and SAM.
cd c:\ProgramData
reg save hklm\sam sam_bak
reg save hklm\system system_bak
We could either use pypykatz or impacket-secretsdump to dump Administrator hash.
impacket-secretsdump -system system_bak -sam sam_bak LOCAL
pypykatz registry --sam sam_bak system_bak
However, we could not login as Administrator. Because only user that is allowed to have remote connections is anirudh user.
Trying Diskshadow and Robocopy
I then tried different method found in k4sth4/SeBackupPrivilege, which tries to create copy disk of disk C.
However, it also did not work.