NorthBridge Systems
Challenge Lab (Hard) - by Kyle Gray
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
Objective / Scope
NorthBridge Systems is a managed service provider that has engaged the Hack Smarter Red Team to perform a security assessment against a portion of their environment. The assessment is to be conducted from an assumed breach perspective, as you have been provided credentials for a dedicated service account created specifically for this engagement.
Your point of contact at NorthBridge Systems has authorized testing on the following hosts. Any host outside this scope is considered out of scope and should not be accessed.
NORTHDC01 (Domain controller)
NORTHJMP01 (Jump box user by the IT team)
The primary objective of the security assessment is to compromise the domain controller (NORTHDC01) in order to demonstrate the effectiveness (or lack thereof) of the recent security hardening activities.
To track your progress in the assessment, there are flags located at C:\Users\Administrator\Desktop on each host.
As you progress through the environment, make sure to document these flags so your point of contact knows you have compromised the environment.
Your success in this assessment will directly inform their future cybersecurity budget! No pressure!
Starting Credentials
Summary
Recon
NORTHJMP01
Nmap
We use rustscan -b 500 -a 10.1.109.80 -- -sC -sV -Pn to enumerate all TCP ports on the NORTHJMP01 machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
With the results of our RustScan we identify a Windows host named NORTHJMP01 on domain northbridge.corp exposing ports 135,445 RPC/SMB and and 3389 RDP.
SMB
Since we have credentials from the scenario, we will test whether we can authenticate via SMB using these credentials, for which we will use NetExec.
We can authenticate as _securitytestingsvc. Next, we try to enumerate the shares. The Network Shares share stands out.
Next, we generate an /etc/hosts entry with the following command. This ensure consistent name resolution during enumeration and exploitation.
We add the following line to our /etc/hosts file.
We can enumerate the share using the spider_plus module, however, I’ll leave its exploration of the share as an exercise for the reader.
NORTHDC01
Nmap
We use rustscan -b 500 -a 10.1.235.111 -- -sC -sV -Pn to enumerate all TCP ports on the NORTHDC01 machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
With the results of our RustScan we identify a Windows host named NORTHDC01 ondomain northbridge.corpexposing DNS on 53, Kerberos on 88, Active Directory LDAP on 389 (AD), LDAPS/tcpwrapped on 636, kpasswd5 on 464, Microsoft RPC / MSRPC endpoints on 135, NetBIOS/SMB on 139 and 445 (SMB2 message signing required). Furthermore we have RPC-over-HTTP on 5985 .NET message framing on 9389, RDP on 3389 and several ephemeral MSRPC ports 49664, 49668, etc.
SMB
Here we will also test whether we can authenticate via SMB using these credentials, for which we will use NetExec.
We do not find any interesting shares on the DC.
We'll also generate an /etc/hosts entry with the following command. We do this to ensure consistent name resolution during enumeration and exploitation.
We add the following line to our /etc/hosts file.
Bloodhound
After having roughly enumerated SMB, we move on to Bloodhound. We use the credentials of _securitytestingsvc to enumerate the domain.
The user provided is not in any special group with special permissions. It also appears that the user is not in the REMOTE MANAGEMENT USERS group.
The Cypher query shortest path from owned object (after marking our user as owned) also does not provide any information about a possible escalation path.
We look for the Domain Admins and find two: Administrator and ERHODEST0.
LDAP
For LDAP enumeration we will use the tool ldapdomaindump.
There is one group that particiular stands out, the NORTHJMP01PRIV group used to grant local administrators access to NORTHJMP01. This might come in handy later.
Access as _svrautomationsvc on NORTHJMP01
Despite not recognizing membership in the REMOTE MANAGEMENT USERS group from our Bloodhound output, we attempt to use the credentials to establish a session with the target via RDP and are able to connect.
In the root directory, the Scripts folder stands out, which would not normally be there. In this folder, we have an AD Domain Backup folder and a Server Build Automation folder.
AD Domain Backup
In this directory, we have three files: a Readme.txt, a file named Password, and a Powershell script called Invoke-NorthADBackup.ps1.
The README explains that the AD backup script was updated to replace hardcoded credentials with a SecureString. It also documents how the secure password file is generated and referenced, and notes that any questions should be directed to Emily Rhodes.
The script loads a stored password, authenticates as the northbridge_backupsvc user, ensures the backup directory exists, and runs a system state backup using wbadmin.
Server Build Automation
In this directory, we have two files: again a Readme.txt and a Powershell script called ServerBuildAutomation.ps1.
Inside the Readme.txt we find the credentials of _svrautomationsvc.
The Readme.txt explains that the script automates server provisioning by creating and staging computer accounts, joining them to the domain, and configuring standard software, security settings, and a temporary local admin account. It requires an account with delegated permissions in the Servers OU, and servers must later be moved to their final OU; LAPS integration is planned for future versions. As an example the account _svrautomationsvc was used for that.
We test if we can authenticate with the credentials usin NetExec via SMB and are successful.
Access as MLEET1 (local administrator) on NORTHJMP01
We take a closer look at our domain enumeration results in Bloodhound and examine the user _svrautomationsvc. This user has the outbound object control WriteAccountRestrictions to NORTHJMP01.
WriteAccountRestrictions gives a principal permission to modify the User-Account-Restrictions property set of an AD object.
Or in other words this permission lets us set the RBCD configuration on target objects by modifying the msDS-AllowedToActOnBehalfOfOtherIdentity attribute, allowing us an RBCD attack.
WriteAccountRestrictions, which refers to theUser-Account-Restrictionsproperty set, which contains enough permissions to modify themsDS-Allowed-To-Act-On-Behalf-Of-Other-Identityattribute of the target objects, for Kerberos RBCD attacks
Further resources:
Create a controlled computer account
We try to create a a computer account under our control, but the machine account quota has been already exceeded.
If we take a closer look a the readme and powershell script found in C:\Scripts\Server Build Automation the _svrautomationsvc seems to have delegated permission to create machine accounts in the ServerProvisoning OU:
So we adapt our bloodyAD command to create a compter object in that specific OU as _svrautomationsvc and are successful.
RBCD Attack
First, We modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on NORTHJMP01$ to add SRV0XB0B$ as a delegated principal.
Next, we use GetST.py to obtain a service ticket for the CIFS service on NORTHJMP01 while impersonating user ERHODEST0 - a domain admin - through the delegated machine account SRV0XB0B$.
But that user is protected against Kerberos delegation...
Recalling the LDAP and Bloodhound enumeration we have another set of privileged users we can make use of. The users part of the NORTHJMP01 group, granting local administrators access to NORTHJMP01. See Recon.
We try to impersonate MLEET1 and are successful.
We use the resulting credential cache, and are able to authenticate.
Shell as local administrator on NORTHJMP01
Unfortunately, we are unable to establish a session with MLEET1 using wmiexec2.py...
However, we can add a user for whom we already have credentials to the local administrator group. Using Netexec via SMB. It is possible that this will fail and be detected by Windows Defender. However, it seems that this can be circumvented by using --no-output.
So we try again to get a session using wmiexec2.py, this time as user _securitytestingsvc.
We are successful.
And we see that we are now part of the local administrators and can find the first flag on NORTHJMP01 at C:\Users\Administrator\Desktop\user.txt.
Access as _backupsvc on NORTHDC01
From the initial enumeration, which we did not show in Recon, a backup service running by the user _backupsvc caught our attention.
This user is part of BACKUP OPERATORS group.
Members of this group are able to access the SAM and SYSTEM hive, which holds valuable hashes, we might be able to access on the DC.
Members of the Backup Operators group can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to and shut down the computer. This group can’t be renamed, deleted, or removed. By default, this built-in group has no members, and it can perform backup and restore operations on domain controllers.
Now that we are part of the local administrator group, we can also try to dump DPAPI credentials using NetExec. And we are able to retrieve the credentials from backup_svc.
We test if we can authenticate with the credentials using NetExec via SMB on NORTHDC01 and are successful.
Shell as Administrator on NORTHDC01
To gather the SAM, SYSTEM, and SECURITY hives remotely, we follow this resource:
We start an an SMB server.
Next, we use impackets reg.py to connect to the DC and backup the hives to our share.
We extract local Windows user credentials offline by dumping and parsing the SAM, SYSTEM, and SECURITY hives using impackets secretsdump.py. We are able to retrieve the local administrator nt hash as well as the hash of NORTHDC01$ machine.
With the hash of the NORTHDC01$ machine we are able to perform a DCSync attack.
We remotely try to pull the NTLM secrets of ERHODEST0 from the Domain Controller using its machine account and provided hash.
Next, we try to authenticate with the resulting hash, but the account is restriced. We are not allowed to authenticate using that hash.
We give it another try with the Administrator account...
We try to authenticate again with the hash as Administrator and are succesful.
To get a session as the Administrator we use wmiexec2.py.
We find the final flag at C:\Users\Administrator\Desktop\root.txt.
Last updated
Was this helpful?