search

Rebound

hashtag
Recon

chevron-rightnmap_scan.loghashtag
Open 10.129.229.114:53
Open 10.129.229.114:88
Open 10.129.229.114:135
Open 10.129.229.114:139
Open 10.129.229.114:389
Open 10.129.229.114:445
Open 10.129.229.114:464
Open 10.129.229.114:593
Open 10.129.229.114:636
Open 10.129.229.114:3268
Open 10.129.229.114:3269
Open 10.129.229.114:5985
Open 10.129.229.114:9389
Open 10.129.229.114:47001
%Open 10.129.229.114:49665
Open 10.129.229.114:49664
Open 10.129.229.114:49667
Open 10.129.229.114:49666
Open 10.129.229.114:49673
Open 10.129.229.114:49696
Open 10.129.229.114:49694
Open 10.129.229.114:49695
Open 10.129.229.114:49709
Open 10.129.229.114:49724
Open 10.129.229.114:49745
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.129.229.114

PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2024-12-01 02:07:27Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-12-01T02:08:38+00:00; +7h13m01s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-08-25T22:48:10
| Not valid after:  2024-08-24T22:48:10
| MD5:   6605:cbae:f659:f555:d80b:7a18:adfb:6ce8
| SHA-1: af8b:ec72:779e:7a0f:41ad:0302:eff5:a6ab:22f0:1c74
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-08-25T22:48:10
| Not valid after:  2024-08-24T22:48:10
| MD5:   6605:cbae:f659:f555:d80b:7a18:adfb:6ce8
| SHA-1: af8b:ec72:779e:7a0f:41ad:0302:eff5:a6ab:22f0:1c74
|_ssl-date: 2024-12-01T02:08:37+00:00; +7h13m01s from scanner time.
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-08-25T22:48:10
| Not valid after:  2024-08-24T22:48:10
| MD5:   6605:cbae:f659:f555:d80b:7a18:adfb:6ce8
| SHA-1: af8b:ec72:779e:7a0f:41ad:0302:eff5:a6ab:22f0:1c74
|_ssl-date: 2024-12-01T02:08:33+00:00; +7h13m00s from scanner time.
3269/tcp  open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-08-25T22:48:10
| Not valid after:  2024-08-24T22:48:10
| MD5:   6605:cbae:f659:f555:d80b:7a18:adfb:6ce8
| SHA-1: af8b:ec72:779e:7a0f:41ad:0302:eff5:a6ab:22f0:1c74
|_ssl-date: 2024-12-01T02:08:38+00:00; +7h13m00s from scanner time.
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
47001/tcp open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
49673/tcp open  msrpc         syn-ack Microsoft Windows RPC
49694/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49695/tcp open  msrpc         syn-ack Microsoft Windows RPC
49696/tcp open  msrpc         syn-ack Microsoft Windows RPC
49709/tcp open  msrpc         syn-ack Microsoft Windows RPC
49724/tcp open  msrpc         syn-ack Microsoft Windows RPC
49745/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-12-01T02:08:26
|_  start_date: N/A
|_clock-skew: mean: 7h13m00s, deviation: 0s, median: 7h12m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 21647/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 46113/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 37861/udp): CLEAN (Timeout)
|   Check 4 (port 36123/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

hashtag
SMB

└─$ netexec smb rebound.htb -u 'guest' -p '' --shares
SMB         10.129.229.114  445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:False)
SMB         10.129.229.114  445    DC01             [+] rebound.htb\guest:
SMB         10.129.229.114  445    DC01             [*] Enumerated shares
SMB         10.129.229.114  445    DC01             Share           Permissions     Remark
SMB         10.129.229.114  445    DC01             -----           -----------     ------
SMB         10.129.229.114  445    DC01             ADMIN$                          Remote Admin
SMB         10.129.229.114  445    DC01             C$                              Default share
SMB         10.129.229.114  445    DC01             IPC$            READ            Remote IPC
SMB         10.129.229.114  445    DC01             NETLOGON                        Logon server share
SMB         10.129.229.114  445    DC01             Shared          READ
SMB         10.129.229.114  445    DC01             SYSVOL                          Logon server share
└─$ smbclient -U guest //10.129.229.114/Shared
Password for [WORKGROUP\guest]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Fri Aug 25 17:46:36 2023
  ..                                  D        0  Fri Aug 25 17:46:36 2023

                4607743 blocks of size 4096. 1021377 blocks available

hashtag
Enumerate Users

We can try enumerating for users with RID Bruteforcearrow-up-right enumeration.

hashtag
kerberoasting

hashtag
asreproast

Now that we have users we can try to asreproastarrow-up-righting

It's not crackable

hashtag
NoPreAuth

We can try NoPreAuth kerberoasting

https://www.thehacker.recipes/ad/movement/kerberos/kerberoast#kerberoast-w-o-pre-authenticationarrow-up-right

John didn't even start hashes with $18$, $23 ldap_monitor was cracked:

Creds: ldap_monitor:1GR8t@$$4u

Nothing useful from SMB, just some policies.

We are able to login into LDAP with Kerberos, but we must fix clock skew.

hashtag
Bloodhound

Enumerate AD with Bloodhound.

No special privileges on this user

Writeup.png

This user can't do much.

Sometimes user's may have same passwords:

Creds: oorend:1GR8t@$$4u

Update bloodhound

Bloodhound surprisingly is showing nothing 🤔

💀Skill issue, I forgot to use -c all.... all collection method fails because of ObjectProps 💀, run without it.

Following oorend user Outbound Permission I ended up on winrm_svc user (there's also batch user, but it can't Remote PS) who can use winrm, meaning we can get shell on the box. But what Service Users group is unknown to me for now... After some searching it doesn't seem like a builtin role.

Writeup-1.png

hashtag
Powerview Enumeration

We can try to enumerate with powerview

Get information about Access Policies for user

The user oorend has Self permissions on the ServiceMgmt object (CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb). This means oorend can modify certain attributes of ServiceMgmt, potentially enabling privilege escalation by resetting credentials or modifying SPNs.

The object ServiceMgmt has FullControl permissions on the Service Users. This grants complete control over the OU and its objects, allowing for significant modifications and potential privilege escalation.

Still no idea what group does, but we'll probably need to get there first.

Add oorend to servicemgmt group

Command was failing because insufficient permissions, when we are already in the group?...

hashtag
GenericAll abuse

Alternative would have been to use Shadow Credentials attack with Certipy, but because of PKINIT not enabled it's failing (I think(?))

It's also possible to do shadow credentials attack with bloodyAD

hashtag
User.txt

hashtag
Privilege Escalation

Update bloodhound data with winrm_svc

Linpeas didn't find other logged in users, but SI (Session ID) has 2 values: 0 and 1; meaning there's another user logged on.

Sharphound provided more data then python version:

Writeup-2.png

Bloodhound is also showing it now.

Writeup-3.png

Note: This might have been skill issue again, I was in Pathfinding with DC01 -> WINRM_SVC and that's probably why I didn't see this connection...

tbrady user has a ReadGMSAPassword, if we can get that user tho.

Writeup-4.png

Usually if normal commands that are not working that should be working it's because it's not allowed to run remote, RunasCs can be used to bypass this restriction.

https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz#credential-dumpingarrow-up-right mimikatz attack fails

hashtag
Stealing credentials

krbrelayxarrow-up-right can't be used here as connection happens on DC itself and python doesn't exist on DC. KrbRelayarrow-up-right is C# tool so it's going to work for us.

-l 9 means to Run a command simulating the /netonly flag of runas.exe sourcearrow-up-right

I think we don't need to provide real credentials and uwu word is just filler for RunasCs to work properly, it's going to spawn process locally and that's cool with us.

Crack the password

Creds: tbrady:543BOMBOMBUNmanda

hashtag
GMSA (tbrady)

https://www.netexec.wiki/ldap-protocol/dump-gmsaarrow-up-right

Creds: delegator$:4ba33add1108fe560429fc27a1bcab6b

hashtag
Privilege Escalation (2)

hashtag
Delegations

https://www.thehacker.recipes/ad/movement/kerberos/delegations/arrow-up-right: Kerberos delegations allow services to access other services on behalf of domain users.

https://www.thehacker.recipes/ad/movement/kerberos/delegations/constrainedarrow-up-right: If a service account, configured with constrained delegation to another service, is compromised, an attacker can impersonate any user (e.g. domain admin, except users protected against delegation) in the environment to access another service the initial one can delegate to.

The administrator has NOT_DELEGATED, so it's a protected account against this type of attacks.

Hmmm... ChatGPT:Writeup-5.png

https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcdarrow-up-right: If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLsarrow-up-right), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.

Service account doesn't have mentioned attribute, but I think the attack will still be valid

To make this work we need user with SPN, so can use ldap_monitor.

Note: If you are getting invalid server address make sure you have dc01 in /etc/hosts or in DNS... (Windows things I guess...)

Verify that it was added:

This delegation can act as behalf on users, but not administrator. We can try to impersonate the DC service account itself.

The ticket is forwardable and essentially acts like a Silver Ticket.

There's second step to using this ticket: https://www.thehacker.recipes/ad/movement/kerberos/delegations/constrained#_2-additional-s4u2proxyarrow-up-right

hashtag
Root.txt

hashtag
Help

PreviousRansomNextRedPanda

Last updated