Proxy
Use your AD knowledge to exploit a careless service account and own the Domain Controller. -by h4sh3m00 &stefan.apostol
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
Every request has to go through someone... but what if that someone is you? Route your way through an Active Directory environment, intercept what you shouldn't, and pull the strings from behind the proxy. Nothing gets through without your say.
Summary
Summary
In Proxy we assess an Active Directory environment where a service account processes files dropped into a shared folder. With only VPN access and no credentials, we enumerate the domain controller DC01.ctf.local and find anonymous SMB access to a writeable share IT-Shared. Files on the share reveal that svc.scanner polls the directory every two minutes, parsing metadata and icons of new files.
We plant a coercion file pointing to our SMB server, capture the NTLMv2 hash of svc.scanner, and crack it offline with hashcat. BloodHound shows svc.scanner has constrained delegation with protocol transition over cifs/DC01.ctf.local. We abuse this via S4U2Self + S4U2Proxy to impersonate Administrator, authenticate to the DC with the resulting Kerberos ticket, and land a SYSTEM shell. We retrieve the final flag and dump NTDS via secretsdump.py.
Recon
We use rustscan -b 500 -a 10.112.149.68 --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
The target 10.112.149.68 is a Windows-based Domain Controller (DC01.ctf.local). DNS is exposed on port 53(Simple DNS Plus) and Kerberos on ports 88 and 464 (kpasswd), confirming the host's role as an Active Directory DC for the domain ctf.local. LDAP and LDAPS services are available on ports 389, 636, 3268, and 3269. SMB is exposed via ports 139 and 445 with message signing enabled and required. Remote management and access are available through RDP on port 3389 (NetBIOS_Computer_Name: DC01, Product_Version: 10.0.17763 — Windows Server 2019). The host also exposes a .NET Message Framing service on port 9389 (AD Web Services), RPC over HTTP on ports 593 and 49670, and several MSRPC endpoints on ports 135, 49668, 49671, 49672, and 49697. No web (HTTP/HTTPS) or WinRM services were detected on the scanned ports.
We try to authenticate anonymously and via guest to SMB via Netexec and are successful. We are able to enumerate one readable and writeable share called IT-Shared.
We will also perfom an RID brute force to enumerate a batch of users for possible later use.
Furthermore we will generate an /etc/hosts entry.
We connect to the share and have three files available. We download all of them.
The IT-Credentials-Backup.txt holds two credential pairs.
Furhermore we can deduce from the IT-Onboarding-Checklist.txt that the svc.scanner runs every 2 minutes. It enumerates IT-Shared for new files to process. Maybe some NTLM-Theft is possible. It especially focusses on metadata and icons.
We test the found credentials but we are only able to authenticate as Guest.
Access as svc.scanner
First we try some payloads from ntlm_thef.py, but without success.
We run an smbserver instead of responder.
And prepare a test.ps1 file that connects to our share.
We connect to the share again and place the powershell script.
After a short duartion we get a NTLMv2 hash.
Fortunately we are able to crack it
We test the credentials using NetExec and are successful.
Bloodhound Enumeration
With domain credentials gathered we try to enumerate the domain using BloodHound.
Here we can see that svc.scanner has AllowedToDelegate permission to the DC machine. We can abuse this trust to request a service ticket on behalf of the Administrator and authenticate to the DC in their context
Shell as Administrator
We request the Administrator service ticket as follows.
We export the KRB5CCNAME environment variable to point Impacket at the newly obtained .ccache file, so subsequent tools authenticate using the Administrator's Kerberos ticket instead of a password.
Using the cached ticket we use smbexec.py to authenticat to DC01 over SMB with Kerberos -k -no-pass as the Administrator and spawns a semi-interactive SYSTEM shell on the Domain Controller. We find the flag at the Desktop of the Administrator.
Finally, we'll run a DCSync..
Last updated