HTB - Sauna

Zweilosec's writeup on the easy-difficulty Windows machine Sauna from https://hackthebox.eu

Overview

A fairly easy Windows machine that requires a little 'outside the box' thinking in order to get the initial foothold. After that, simple enumeration will give everything else that is needed.

Useful Skills and Tools

Useful Impacket Scripts

psexec.py

  • You can use psexec to pass-the-(NT)hash to get system privileges. A valid administrator account username and hash are needed.

  • sudo python3 psexec.py -hashes :<password_hash> Administrator@10.10.10.175

secretsdump.py

  • Use this to dump password hashes from NTDS.DIT from a domain server. Requires valid user credentials.

  • python3 ./secretsdump.py <domain_name>/<username>@10.10.10.175

  • Adding the flag -just-dc-ntlm will make it dump only the Lanman and NT hashes.

GetNPUsers.py

  • Extracts the Kerberos krb5asrep hashes for users from the domain controller. This requires a valid DOMAINNAME/username pair to run. Will only extract hashes for users that do not require Kerberos pre-authentication.

  • python3 GetNPUsers.py -outputfile <out_file> -format hashcat -usersfile <username_file> -no-pass -dc-ip 10.10.10.175 <domain_name>/<user_name>

  • In this example the output will be in hashcat format.

Extracting Windows Auto-logon credentials with reg query

The command reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" will output any stored Windows Auto-logon credentials.

Using hashcat to crack Kerberos hashes

  • In order to crack krb5asrep type hashes the -m 18200 option is needed.

  • hashcat -m 18200 -a 0 <input_file> <wordlist> --force

Enumerating valid usernames through kerberos using MetaSploit

In the Metasploit console the auxiliary(gather/kerberos_enumusers) tool enumerates valid users against Kerberos from a list. This scanner also checks if each user has "pre-auth required" enabled.

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.175. The options I regularly use are: -p-which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN saves the output with a filename of <name>.

Lots of ports were open on this machine! Based on the plethora of related ports, it was fairly easy to guess that this machine was a Windows-based domain server.

ldapsearch enumeration

Hmm... not much to go off from LDAP, though I was able to find one potential user named Hugo Smith (unfortunately there was no Windows username to go with it.)

Egotistical Bank website

On port 80 I found a website hosted for Egotistical Bank. Most of this site consisted of template pages with lots of lorem ipsum paragraphs and very little information. One page caught my eye, however.

I found a list of potential users on the 'About Us' page under the "Meet The Team" heading. Since these were potentially employees at Egotistical Bank I used some common username formats to turn these names into potential usernames, then proceeded to test if any of them were valid.

This was my list of possible usernames based on common business formats I have seen in the past. There was also one user's name (Hugo Smith) that I had gotten from from ldapsearch that was not on the website, so I added it to the list as well.

Road to User

Finding user creds

Finding user credentials was pretty fast and straightforward for this machine, despite not having a lot of information to go on. I used my list of potential usernames and used the Metasploit module auxiliary/gather/kerberos_enumusers to check if any of these usernames were valid, and if they had Kerberos pre-authentication turned off. This setting is a security feature of Kerberos which gives protection against password-guessing brute force attacks.

After running this scan, I only got back one hit for a valid username hsmith. I now had a valid username and the business format for other potential usernames . One oddity I noticed: the scan would crash Metasploit for some reason when it got to the name fsmith (I tried this multiple times with and without that name to be sure). I kept this username on the possibly valid list just in case.

Since fsmith crashed Metasploit I was hoping that it was because there was something in the output that it didn't understand. I decided to use another script that would give the same information to me, but would also dump the Kerberos hashes for any users who did not require the pre-authentication check. I used the GetNPUsers.py tool from the Impacket python examples collection to try to get the krb5asrep hashes using . In order to pull these hashes you need a valid username in the format DOMAINNAME/username. Luckily I had the domain name from my early enumeration and a valid username that Metasploit had gotten from the domain controller. I set my output to be saved in hashcat format so I could use that tool to try to quickly crack the hash.

At first I thought that I was just getting back the same results as the Metasploit module until I counted the number of names that it was outputting results for. I realized that there was one result unaccounted for so I looked in the output directory and opened my output file sauna.hashto see if I had gotten any hits.

It contained the Kerberos hash for the user fsmith! I had been right in my hunch that it was still a valid username despite the odd Metasploit behavior earlier.

I am not sure why GetNPUsers.py doesn't inform you when it finds a valid user and gets the hash, so pay attention to your output files!

Next I fired up hashcat to try to crack the password hash. The option -m 18200 is the flag which tells hashcat that this is a krb5asrep type hash and -a 0 makes it use the words straight from the specified wordlist without any mangling rules applied.

Including the time spent building the dictionary file and getting everything loaded, this hash took less than two minutes to be cracked using hashcat. The password for fmsith was apparently Thestrokes23 (to see it in the output above you have to scroll all the way to the right...the output shows it at the end of the hash string).

User.txt

Now that I had a username and password, I could try to log into the server using evil-winrm. This tool connects to the Windows Remote Management service that is usually open on port 5985.

Luckily for me fsmith was a member of the Remote Management Users group and I was able to log in. Next I collected my hard-earned loot.

Path to Power (Gaining Administrator Access)

Enumeration as User fsmith

After running the command whoami /all my next step when gaining access as a new user is to try to do as much enumeration as possible. The Windows Privilege Escalation Awesome Scripts (Winpeas) tool is a collection of scripts that make this enumeration extremely simple. In this case, it made moving laterally to another user very easy to complete.

Auto-logon is a terrible, terrible service that should never be used, but makes it convenient for users when they are the only ones who use a computer. As the name implies, Windows will automatically log the user on by caching their credentials. I verified this output by looking up the registry key where this information is stored using the reg query command. Auto-logon credentials are stored in the keyHKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon.

For some reason there was a discrepancy between the username of the account that had auto-logon enabled (svc_loanmanager), and the account that had a user folder on the machine (svc_loanmgr). I decided to try logging in using svc_loanmgr since that was the name of the user's folder.

Moving laterally to user svc_loanmgr

If you have credentials you can use Impacket's secretsdump.py to try to dump password hashes. These hashes can then be used to either crack and retrieve the passwords or in a pass-the-hash attack.

After successfully extracting the password hash for the Administrator account I decided to practice doing a pass-the-hash attack (I didn't attempt to crack the hashes to extract the passwords so I cannot say how long it might take!).

Getting a shell

The blog at https://en.hackndo.com/pass-the-hash/ has a nice write-up on how and why pass-the-hash attacks work. I used the psexec.py tool from Impacket's examples, though there are many tools for doing this attack against Windows.

Not only did this tool log me in, but it also elevated my privilege to nt authority\system!

Root.txt

The final thing to do after gaining full control over this machine was to get my proof.

Thanks to egotisticalSW for creating this fun and easy Windows machine. It offered a few chances to learn some new things while giving the opportunity to brush up on Windows enumeration skills.

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - ServmonNextHTB - Remote

Last updated

Was this helpful?