Manager
Created by Geiseric
The following post by 0xb0b is licensed under CC BY 4.0
Recon
The target host has multiple open ports indicating a Windows environment, including services such as DNS, web hosting with Microsoft IIS, Active Directory LDAP, Microsoft SQL Server 2019, RPC services, and others, suggesting potential avenues for further exploration and exploitation. We are dealing with a domain controller and received the domain and computer name from the Nmap scan:
manager.htb
dc01.manager.htb
When enumerating the website, nothing could be detected apart from static web pages.
We are probably dealing with an active directory challenge. We can enumerate some users using Kerbrute. For this, we use the xato-net-10-million-usernames.txt from SecLists.
Initial Foothold
We use the output to create a user list.
Next, we try a password spray on the SMB port. We do this with the help of NetExec. We will also use the usernames as the password list. Maybe a user has used his username as a password. We issue the parameter --no-brute only to insert the password as the username. We have a hit for the user operator.
Let's see if we can use the credentials found to operate other services in addition to SMB. We can log in to the MSSQL service.
We can use xp_dirtree to display the folders and files on the system. In the wwwroot folder, we find the web.config and a backup zip.
Unfortunately, the web.config, which is a common location for stored credentials, cannot be retrieved directly. But the backup.
In the backup, we find an old config, and this contains the credentials for the user raven.
Using Evil-WinRM we can log in to the system and find the user flag on the user's desktop.
Privilege Escalation
We use Certipy to find a vulnerable configuration for ADCS.
We see that raven has dangerous permissions that allow the ESC7 attack.
A detailed explanation of the attack can be found here:
To issue the attack we place the commands in a simple script, since they have to be issued very quickly in succession. You have to set the password, and if already requests were made the request_id has to be adjusted.
By executing the script we get the Administrator certificate
With that, we can retrieve the admin hash. The next commands have to be queued in quick succession and might fail. We have to synchronize our time with the DC.
We use Evil-WinRM to login as the Administrator by passing the retrieved hash. On the Desktop of the administrator, we find the final flag.
Last updated
Was this helpful?