search

Authority

hashtag
Recon

chevron-rightnmap_scan.loghashtag
Open 10.129.229.56:53
Open 10.129.229.56:80
Open 10.129.229.56:88
Open 10.129.229.56:135
Open 10.129.229.56:139
Open 10.129.229.56:389
Open 10.129.229.56:445
Open 10.129.229.56:464
Open 10.129.229.56:593
Open 10.129.229.56:636
Open 10.129.229.56:9389
Open 10.129.229.56:8443
Open 10.129.229.56:49664
Open 10.129.229.56:49666
Open 10.129.229.56:49667
Open 10.129.229.56:49665
Open 10.129.229.56:49674
Open 10.129.229.56:49675
Open 10.129.229.56:49672
Open 10.129.229.56:49682
Open 10.129.229.56:49679
Open 10.129.229.56:49695
Open 10.129.229.56:49698
Open 10.129.229.56:47001
Open 10.129.229.56:51678
Open 10.129.229.56:51704
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.129.229.56

PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
80/tcp    open  http          syn-ack Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2024-12-07 20:28:02Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Issuer: commonName=htb-AUTHORITY-CA/domainComponent=htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2022-08-09T23:03:21
| Not valid after:  2024-08-09T23:13:21
|_ssl-date: 2024-12-07T20:29:08+00:00; +4h00m00s from scanner time.
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2024-12-07T20:29:09+00:00; +4h00m00s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Issuer: commonName=htb-AUTHORITY-CA/domainComponent=htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2022-08-09T23:03:21
| Not valid after:  2024-08-09T23:13:21
| MD5:   d494:7710:6f6b:8100:e4e1:9cf2:aa40:dae1
| SHA-1: dded:b994:b80c:83a9:db0b:e7d3:5853:ff8e:54c6:2d0b
8443/tcp  open  ssl/http      syn-ack Apache Tomcat (language: en)
|_http-title: Site doesn't have a title (text/html;charset=ISO-8859-1).
|_ssl-date: TLS randomness does not represent time
|_http-favicon: Unknown favicon MD5: F588322AAF157D82BB030AF1EFFD8CF9
| ssl-cert: Subject: commonName=172.16.2.118
| Issuer: commonName=172.16.2.118
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-05T19:06:27
| Not valid after:  2026-12-08T06:44:51
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
47001/tcp open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
49672/tcp open  msrpc         syn-ack Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49675/tcp open  msrpc         syn-ack Microsoft Windows RPC
49679/tcp open  msrpc         syn-ack Microsoft Windows RPC
49682/tcp open  msrpc         syn-ack Microsoft Windows RPC
49695/tcp open  msrpc         syn-ack Microsoft Windows RPC
49698/tcp open  msrpc         syn-ack Microsoft Windows RPC
51678/tcp open  msrpc         syn-ack Microsoft Windows RPC
51704/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: AUTHORITY; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 3h59m59s, deviation: 0s, median: 3h59m59s
| smb2-time: 
|   date: 2024-12-07T20:29:03
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 5733/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 61876/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 45641/udp): CLEAN (Failed to receive data)
|   Check 4 (port 29090/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

hashtag
SMB

We have access to SMB with non authorized user. There's Development share we have read access to so let's dump that.

└─$ netexec smb authority.htb -u 'anonymous' -p '' --shares --smb-timeout 1000
SMB         10.129.229.56   445    AUTHORITY        [*] Windows 10 / Server 2019 Build 17763 x64 (name:AUTHORITY) (domain:authority.htb) (signing:True) (SMBv1:False)
SMB         10.129.229.56   445    AUTHORITY        [+] authority.htb\anonymous:
SMB         10.129.229.56   445    AUTHORITY        [*] Enumerated shares
SMB         10.129.229.56   445    AUTHORITY        Share           Permissions     Remark
SMB         10.129.229.56   445    AUTHORITY        -----           -----------     ------
SMB         10.129.229.56   445    AUTHORITY        ADMIN$                          Remote Admin
SMB         10.129.229.56   445    AUTHORITY        C$                              Default share
SMB         10.129.229.56   445    AUTHORITY        Department Shares
SMB         10.129.229.56   445    AUTHORITY        Development     READ
SMB         10.129.229.56   445    AUTHORITY        IPC$            READ            Remote IPC
SMB         10.129.229.56   445    AUTHORITY        NETLOGON                        Logon server share
SMB         10.129.229.56   445    AUTHORITY        SYSVOL                          Logon server share
Writeup-1.png

Creds: T0mc@tAdm1n:T0mc@tR00t

Defaults contain some kind of ansible credentials.

Writeup-3.png

Creds: !@#$%^&*:!@#$%^&*

https://www.bengrewell.com/cracking-ansible-vault-secrets-with-hashcat/arrow-up-right

Creds: svc_pwm:pWm_@dm!N_!23

Password: DevT3st@123

hashtag
HTTPs (8443)

Writeup.png

PWMarrow-up-right is an open source password self-service application for LDAP directories.

From dropdown arrow we see version is PWM v2.0.3 bc96802e, it's few versions behind at the moment https://github.com/pwm-project/pwm/releasesarrow-up-right

Credentials from SMB doesn't work.

Writeup-2.png

Second ansible credentials is also incorrect.

Password pWm_@dm!N_!23 logs us in.

Writeup-4.png

We can download the configuration file which contains some kind of password.

Writeup-5.png

There's additional username, but can't login with found credentials.

Hash is not going to crack any time soon so Im giving up on that.

There are too many settings and it's overwhelming to explore, more down you go the less you understand and most of it is left to defaults AFAIK. Connection contains LDAP Proxy Password, but it's protected. We are able to add LDAP URLs, so we could try adding ourselves and see what we get.

Writeup-6.png

Add ldap://10.10.14.113:636 to urls and then test, wait for callback:

New credentials.. but looks like password starts after DC TLD.

Creds: svc_ldap:lDaP_1n_th3_cle4r!

hashtag
WinRM

hashtag
User.txt

hashtag
Privilege Escalation

We could try the default enumeration with winpeas + bloodhound, but considering the name we are 110% dealing with misconfigured certificates.

https://github.com/ly4k/Certipy?tab=readme-ov-file#esc1arrow-up-righthttps://www.thehacker.recipes/ad/movement/adcs/certificate-templates#esc1-template-allows-sanarrow-up-righthttps://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse/esc1arrow-up-right

'AUTHORITY.HTB\Domain Computers' can enroll, enrollee supplies subject and template allows client authentication

To abuse this we need a computer on a network and we should be able to create one.

https://www.thehacker.recipes/ad/movement/builtins/machineaccountquota#create-a-computer-accountarrow-up-right

Verify that it was created:

Perform the ESC1 attack

https://www.thehacker.recipes/ad/movement/schannel/passthecertarrow-up-right

hashtag
Path 1

One option is to add yourself to domain and add yourself to and groups. or add existing pwned users to any groups.

Note: We could have added ourself to Administrators and then used psexec from impacket

hashtag
Path 2

We can also abuse the delegations

Now we can request the Silver Ticket

hashtag
Root.txt

PreviousAppsanityNextBackend

Last updated