DC EXT

DarkHaven Technologies - Range (Medium) - by Ryan Yager

Range: DarkHaven (Medium)www.hacksmarter.org

The following post by 0xb0b is licensed under CC BY 4.0

---

Entry Point

Continue here if you were able to fully compromise CA.EXT.DARKHAVEN.LOCAL and gain access as ldap_svc

Reference:

CA | Writeups0xb0b.gitbook.io

Recon

We use rustscan -b 500 -a dc.ext.darkhaven.local --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.

A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.

rustscan -b 500 -a dc.ext.darkhaven.local --top -- -sC -sV -Pn

The target machine is the domain controller of the ext.darkhaven.local domain with exposed services including DNS 53, Kerberos 88/464, an IIS /10.0 web server on port 80, multiple MSRPC endpoints 135, 593, 49664+, SMB 139/445, LDAP and LDAPS 389/636/3268/3269 tied to Active Directory, RDP 3389, WinRM on 5985, and .NET Remoting 9389.

10.10.10.136     DC.ext.darkhaven.local ext.darkhaven.local DC

Access as ldap_svc

From compromising the CA host we were able to retrieve the credentials of ldap_svc. But we were not able to successfully authenticate with that since the account is restricted using a password.

nxc smb dc.ext.darkhaven.local -u 'ldap_svc' -p 'REDACTED' --smb-timeout 30

To work around this, Kerberos authentication can be used instead. By requesting a Ticket Granting Ticket (TGT), we authenticate via Kerberos, which does not enforce the same logon restrictions.

Request a Kerberos TGT for the ldap_svc account:

getTGT.py 'ext.darkhaven.local/ldap_svc:6trfgvb**hs#@jskKFHJAh34' -dc-ip dc.ext.darkhaven.local

Set the Kerberos ticket cache environment variable

export KRB5CCNAME=ldap_svc.ccache

Authenticate to SMB using Kerberos and we succesfully logged in. We see we are an administrator.

nxc smb dc.ext.darkhaven.local -u ldap_svc -k --use-kcache

Access as administrator

Since we are an administrator we try to dump all secrets using secretsdump.py.

secretsdump.py -k -no-pass dc.ext.darkhaven.local

We retrieve the local administrator hash and connect to the external DC via evil-winrm.

We find the flag at C:\Users\Administrator\Desktop\root.txt.

Post Compromise

Access as ldap_svc on DC02

Besides the flag we find binary on the Desktop of the administrator.

We download it to oour machine...

And inspect it via strings.

strings ldap_sync.exe 

Inside that binary we find hardcoded credentials of ldap_svc. But the password is a different one. It seems to perform an ldap sync between the DCs by reading the comments.

We try to authenticate to the other DCs and are successful with DC02.DARKHAVEN.TECH.

nxc smb dc02.darkhaven.tech -u 'ldap_svc' -p 'REDACTED' --smb-timeout 30

From here, we can move on to DC02 and DC01 of DARKHAVEN.TECH.

DC02 + DC01 | Writeups0xb0b.gitbook.io