search

Administrator

hashtag
Recon

chevron-rightnmap_scan.loghashtag
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Making sure 'closed' isn't just a state of mind.

[~] The config file is expected to be at "/home/rustscan/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.129.178.45:21
Open 10.129.178.45:53
Open 10.129.178.45:88
Open 10.129.178.45:139
Open 10.129.178.45:135
Open 10.129.178.45:389
Open 10.129.178.45:445
Open 10.129.178.45:464
Open 10.129.178.45:593
Open 10.129.178.45:3268
Open 10.129.178.45:5985
Open 10.129.178.45:9389
Open 10.129.178.45:47001
Open 10.129.178.45:56394
Open 10.129.178.45:56361
Open 10.129.178.45:56347
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.129.178.45
Depending on the complexity of the script, results may take some time to appear.
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2024-11-10 19:13 UTC
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:13
Completed NSE at 19:13, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:13
Completed NSE at 19:13, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:13
Completed NSE at 19:13, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 19:13
Completed Parallel DNS resolution of 1 host. at 19:13, 0.12s elapsed
DNS resolution of 1 IPs took 0.12s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 19:13
Scanning 10.129.178.45 [16 ports]
Discovered open port 445/tcp on 10.129.178.45
Discovered open port 53/tcp on 10.129.178.45
Discovered open port 21/tcp on 10.129.178.45
Discovered open port 135/tcp on 10.129.178.45
Discovered open port 139/tcp on 10.129.178.45
Discovered open port 5985/tcp on 10.129.178.45
Discovered open port 464/tcp on 10.129.178.45
Discovered open port 593/tcp on 10.129.178.45
Discovered open port 47001/tcp on 10.129.178.45
Discovered open port 88/tcp on 10.129.178.45
Discovered open port 3268/tcp on 10.129.178.45
Discovered open port 56361/tcp on 10.129.178.45
Discovered open port 56394/tcp on 10.129.178.45
Discovered open port 9389/tcp on 10.129.178.45
Discovered open port 56347/tcp on 10.129.178.45
Discovered open port 389/tcp on 10.129.178.45
Completed Connect Scan at 19:13, 1.26s elapsed (16 total ports)
Initiating Service scan at 19:13
Scanning 16 services on 10.129.178.45
Completed Service scan at 19:14, 55.22s elapsed (16 services on 1 host)
NSE: Script scanning 10.129.178.45.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:14
Completed NSE at 19:14, 9.58s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:14
Completed NSE at 19:14, 1.78s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:14
Completed NSE at 19:14, 0.00s elapsed
Nmap scan report for 10.129.178.45
Host is up, received user-set (0.076s latency).
Scanned at 2024-11-10 19:13:06 UTC for 68s

PORT      STATE SERVICE       REASON  VERSION
21/tcp    open  ftp           syn-ack Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp    open  domain        syn-ack Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2024-11-11 02:13:16Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
47001/tcp open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
56347/tcp open  msrpc         syn-ack Microsoft Windows RPC
56361/tcp open  msrpc         syn-ack Microsoft Windows RPC
56394/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-11-11T02:14:06
|_  start_date: N/A
|_clock-skew: 7h00m00s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 13338/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 2870/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 61556/udp): CLEAN (Timeout)
|   Check 4 (port 49009/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:14
Completed NSE at 19:14, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:14
Completed NSE at 19:14, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:14
Completed NSE at 19:14, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 69.30 seconds

Note: As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Olivia / ichliebedich

Creds: Olivia:ichliebedich

hashtag
DNS

└─$ dig any administrator.htb @10.129.178.45 | grep -v ';'
administrator.htb.      600     IN      A       10.129.178.45
administrator.htb.      3600    IN      NS      dc.administrator.htb.
administrator.htb.      3600    IN      SOA     dc.administrator.htb. hostmaster.administrator.htb. 126 900 600 86400 3600
dc.administrator.htb.   3600    IN      A       10.129.178.45

hashtag
AD Enumeration

└─$ cicada-mastertul -u Olivia -p ichliebedich -d administrator.htb -t 10.129.178.45 --full
                                |__ by - theblxckcicada __|
----------------------------------------------------
Target IP: 10.129.178.45
Domain: administrator.htb
Username: Olivia
Password: ichliebedich
Full Mode Enabled
---------------------------------------------------------------------------------------
[!x!] Scanning 10.129.178.45
[!] Enumerating SMB...
[-] Could not connect to SMB
[!] Connecting to WinRM...
[-] Could not connect to WinRM
[!] Enumerating Lookupsids using impacket...
[+] Lookupsids saved to /home/woyag/Desktop/Rooms/Administrator/mastertul/10.129.178.45/lookupsid_results/lookupsid_file.txt
[+] Users list saved to /home/woyag/Desktop/Rooms/Administrator/mastertul/10.129.178.45/lookupsid_results/users.txt
[!] Enumerating NPUsers using impacket...
[-] No NPUsers found
[!] Enumerating UserSPNs using impacket...
[-] No UserSPNs found
[!] Collecting Bloodhound Files...
[+] Bloodhound saved to /home/woyag/Desktop/Rooms/Administrator/mastertul/10.129.178.45/bloodhound_results
[!] Enumerating LDAP...
[+] LDAP saved to /home/woyag/Desktop/Rooms/Administrator/mastertul/10.129.178.45/ldap_results
 [!x!] Cleaning up...
Writeup.png
Writeup-1.png

hashtag
Password Reset

Reset password for users:

Creds: michael:Password123$

Creds: benjamin:Password123$

Gather data as Benjamin:

Nothing new...

hashtag
FTP

FTP server was over, but we didn't have access.

hashtag
pwsafe

https://github.com/pwsafe/pwsafearrow-up-righthttps://pwsafe.orgarrow-up-right

Great, it only works on Windows...

After installing it it prompts for password, luckily john supports it:

Interestingly the application doesn't like snip tools and as soon as it's triggered windows is hidden. Settings can be modified once logged in.

Writeup-2.png
Username
Password

alexander

UrkIbagoxMyUGw0aPlj9B0AXSea4Sw

emily

UXLCI5iETUsIBoFVTj8yQFKoHjXmb

emma

WwANQWnmJnGV07WQN8bMS7FMAbjNur

NOTE Turns out there's also a Linux version:

hashtag
Privilege Escalation (ethan)

Emily is able to use winrm and the bloodhound reveals we can take over administrator.

Writeup-3.png

Credentials are valid, but password reset didn't work.

Try targetedKerberoast suggested by Bloodhound.

Creds: ethan:limpbizkit

hashtag
Privilege Escalation (admin)

hashtag
Flags

PreviousAcuteNextAgile

Last updated