CA

DarkHaven Technologies - Range (Medium) - by Ryan Yager

Range: DarkHaven (Medium)www.hacksmarter.org

The following post by 0xb0b is licensed under CC BY 4.0

---

Entry Point

Continue here if you were able to fully compromise WEB.EXT.DARKHAVEN.LOCAL and gain access as kwarren

Reference:

WEB | Writeups0xb0b.gitbook.io

Recon

We use rustscan -b 500 -a ca.ext.darkhaven.local --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.

A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.

rustscan -b 500 -a ca.ext.darkhaven.local --top -- -sC -sV -Pn

Recalling the credentials found of kwarren on the WEB machine and confirming access as that user. We look into our BloodHound results.

nxc smb web.ext.darkhaven.local -u kwarren -p 'REDACTED' --shares

BloodHound Enumeration

Here we see that the kwarren user is member of the group grp-gmsa-ca_svc_account_readers.

Access as administrator

With that permission we can potentially read the group managed service accounts password of the account.

ReadGMSAPassword | The Hacker Recipeswww.thehacker.recipes

This abuse stands out a bit from other abuse cases. It can be carried out when controlling an object that has enough permissions listed in the target gMSA account's msDS-GroupMSAMembership attribute's DACL. Usually, these objects are principals that were configured to be explictly allowed to use the gMSA account.

The attacker can then read the gMSA (group managed service accounts) password of the account if those requirements are met.

For this we are using NetExec and are able to retrieve the hash of ca_svc_account$.

nxc ldap dc.ext.darkhaven.local -u kwarren -p 'REDACTED' --gmsa

We are now able to authenticate as ca_svc_account$. This user is local admin on the target machine CA.

nxc smb ca.ext.darkhaven.local -u 'ca_svc_account$' -H 'REDACTED' --shares

Since we are local admin we try to dump the SAM secrets and retrieve the local admin hash.

nxc smb ca.ext.darkhaven.local -u 'ca_svc_account$' -H 'REDACTED' --sam

With that we are able to get a evil-winrm session and find the CA flag at C:\Users\Administrator\Desktop\root.txt.txt.

evil-winrm -i ca.ext.darkhaven.local -u 'Administrator' -H REDACTED

Post Compromise

Access as ldap_svc

On the machine we find a PowerShell commandline history. But due to encoding errors we cannot read the contents in our evil-winrm session.

For a workaround we will use Impackets smbclient. We'll connect as the local administrator, use the C$ share and download the commandline history to our system.

smbclient.py CA/[e-mail] -hashes :REDACTED

Inside that we identify several credentials for different users.

Among them for the ldap_svc account.

Unfortunately the account has the STATUS_ACCOUNT_RESTRICTION flag, we cannot authenticate yet.

nxc smb dc.ext.darkhaven.local -u 'ldap_svc' -p 'REDACTED' --smb-timeout 30

From here, we can move on to DC.EXT.DARKHAVEN.LOCAL.

DC EXT | Writeups0xb0b.gitbook.io