hokkaido - Proving Grounds Practice
Enumeration
Nmap
Initial nmap scan revealed common DC ports were open.
Exploitation
Kerbrute user enumeration
I tried different methods at first but non of them worked. Then I tried kerberos user enumeration with kerbrute and found info user.
Default Credentials
Later, I tried info:info credentials and it worked. I could access some of the shares.
I also applied RID brute forcing to create a user list.
Kerberoasting
Later, I applied kerberoasting attack using impacket-GetUserSPNs and obtained 2 kerberos tickets.
I was able to crack discovery user’s hash.
MSSQL Impersonation
Later, I logged in to MSSQL server.
I had no privileges but I could impersonate a service user. So I applied necessary steps and impersonated the user.
# check who you can impersonate
SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE';
# execute as
EXECUTE AS LOGIN '<USER>';
GenericWrite - Targeted Kerberoasting
Hrapp-service user had genericWrite permissions over hazel.green user.
So I applied targeted kerberoasting and cracked her password.
ForceChangePassword
Hazel.green could force change molly.smith’s password.
So I updated her password. And found out she had RDP privileges.
Then simply logged in to RDP session and read user flag.
Privilege Escalation
Server Operator
molly.smith was Tier 1 admin. So I could execute cmd as administrator. However, she was not in local administrators group.
I opened and administrator cmd and checked groups and privileges. Server Operator group seemed exploitable.
So at first I checked a service that runs with SYSTEM privileges.
sc.exe qc AppReadiness
Then checked if Server Operator group had privileges using PsService.exe (https://learn.microsoft.com/en-us/sysinternals/downloads/psservice)
After learning that Server Operator can modify it, I modified AppReadiness service to add molly.smith to local administrators group and started the service.
I simply obtained administrator flag.