Rebound
Recon
SMB
Enumerate Users
We can try enumerating for users with RID Bruteforce enumeration.
kerberoasting
asreproast
Now that we have users we can try to asreproasting
It's not crackable
NoPreAuth
We can try NoPreAuth kerberoasting
https://www.thehacker.recipes/ad/movement/kerberos/kerberoast#kerberoast-w-o-pre-authentication
John didn't even start hashes with $18$, $23 ldap_monitor was cracked:
Creds:
ldap_monitor:1GR8t@$$4u
Nothing useful from SMB, just some policies.
We are able to login into LDAP with Kerberos, but we must fix clock skew.
Bloodhound
Enumerate AD with Bloodhound.
No special privileges on this user
This user can't do much.
Sometimes user's may have same passwords:
Creds:
oorend:1GR8t@$$4u
Update bloodhound
Bloodhound surprisingly is showing nothing 🤔
💀Skill issue, I forgot to use -c all.... all collection method fails because of ObjectProps 💀, run without it.
Following oorend user Outbound Permission I ended up on winrm_svc user (there's also batch user, but it can't Remote PS) who can use winrm, meaning we can get shell on the box. But what Service Users group is unknown to me for now... After some searching it doesn't seem like a builtin role.
Powerview Enumeration
We can try to enumerate with powerview
Get information about Access Policies for user
The user oorend has Self permissions on the ServiceMgmt object (CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb). This means oorend can modify certain attributes of ServiceMgmt, potentially enabling privilege escalation by resetting credentials or modifying SPNs.
The object ServiceMgmt has FullControl permissions on the Service Users. This grants complete control over the OU and its objects, allowing for significant modifications and potential privilege escalation.
Still no idea what group does, but we'll probably need to get there first.
Add oorend to servicemgmt group
Command was failing because insufficient permissions, when we are already in the group?...
GenericAll abuse
Alternative would have been to use Shadow Credentials attack with Certipy, but because of PKINIT not enabled it's failing (I think(?))
It's also possible to do shadow credentials attack with bloodyAD
User.txt
Privilege Escalation
Update bloodhound data with winrm_svc
Linpeas didn't find other logged in users, but SI (Session ID) has 2 values: 0 and 1; meaning there's another user logged on.
Sharphound provided more data then python version:
Bloodhound is also showing it now.
Note: This might have been skill issue again, I was in Pathfinding with DC01 -> WINRM_SVC and that's probably why I didn't see this connection...
tbrady user has a ReadGMSAPassword, if we can get that user tho.
Usually if normal commands that are not working that should be working it's because it's not allowed to run remote, RunasCs can be used to bypass this restriction.
https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz#credential-dumping mimikatz attack fails
Stealing credentials
krbrelayx can't be used here as connection happens on DC itself and python doesn't exist on DC. KrbRelay is C# tool so it's going to work for us.
-l 9 means to Run a command simulating the /netonly flag of runas.exe source
I think we don't need to provide real credentials and uwu word is just filler for RunasCs to work properly, it's going to spawn process locally and that's cool with us.
Crack the password
Creds:
tbrady:543BOMBOMBUNmanda
GMSA (tbrady)
https://www.netexec.wiki/ldap-protocol/dump-gmsa
Creds:
delegator$:4ba33add1108fe560429fc27a1bcab6b
Privilege Escalation (2)
Delegations
https://www.thehacker.recipes/ad/movement/kerberos/delegations/: Kerberos delegations allow services to access other services on behalf of domain users.
https://www.thehacker.recipes/ad/movement/kerberos/delegations/constrained: If a service account, configured with constrained delegation to another service, is compromised, an attacker can impersonate any user (e.g. domain admin, except users protected against delegation) in the environment to access another service the initial one can delegate to.
The administrator has NOT_DELEGATED, so it's a protected account against this type of attacks.
Hmmm... ChatGPT:
https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd: If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.
Service account doesn't have mentioned attribute, but I think the attack will still be valid
To make this work we need user with SPN, so can use ldap_monitor.
Note: If you are getting
invalid server addressmake sure you havedc01in/etc/hostsor in DNS... (Windows things I guess...)
Verify that it was added:
This delegation can act as behalf on users, but not administrator. We can try to impersonate the DC service account itself.
The ticket is forwardable and essentially acts like a Silver Ticket.
There's second step to using this ticket: https://www.thehacker.recipes/ad/movement/kerberos/delegations/constrained#_2-additional-s4u2proxy
Root.txt
Help
Last updated