Full Compromise of CORP Domain
Last updated
Recon
We now have local administrator access on the machine, but to fully compromise the Active Directory, we'll need a Domain Administrator account.
Since Windows Defender is active, we need a way to whitelist our malicious files. To keep the challenge level high for other players on the network, instead of turning off Windows Defender, we can add an exclusion folder using the following command:
After setting up the exclusion folder, we copied a few tools to begin Active Directory Enumeration and Exploitation. We started by running Mimikatz to dump hashes, secrets, and extract data from lsass.
Next, we ran SharpHound to gather data to map the Active Directory in Bloodhound. To exfiltrate the collected data from the machine, we created a shared folder pointing to the Downloads directory using the following command:
Finally, we can use smbclient to access the shared folder and retrieve the data collected by our tools:
After importing the data into the Bloodhound database, we can run a series of queries to identify the most effective attack paths.
We begin by searching for Kerberoastable accounts to see if any accounts are vulnerable to Kerberos ticket-granting service attacks.
We can use the cypher in Bloodhound CE.
The following command will give all kerberoastable accounts:
A Kerberoasting attack targets the password hash of an Active Directory account that has a Service Principal Name (SPN). This method involves using an authenticated domain user to request a Kerberos service ticket from the Ticket Granting Service (TGS).
The returned ticket is encrypted with the service account’s hash, which can then be cracked using tools like hashcat after capturing the TGS ticket.
A key benefit of this attack is that it doesn’t require privileged access—any domain user can request service tickets from the TGS, making it an effective way to attempt password recovery.
Using Rubeus provided in resources we can perform kerberoasting.
After capturing the hashes, we utilize hashcat to crack them. After some time, we successfully retrieve the password for the svcScanning account.
Breaching vpn.thereserve.loc (10.200.XXX.12)
Next, we start a listener via netcat on 1337.
And prepare the following payload to connect back to our machine.
We have a reverse shell. Let's upgrade it for better functionality.
Privilege Escalation and Persistence
Enumeration of the target reveals that the user www-data has permission to use cp with sudo.
The next step is to check GTFOBins to see if we can exploit this sudo permission for cp.
With the following command, we are able to write to any file:
Next, we search for any existing users on the machine and find a user named ubuntu.
Looking at the home directory of Ubuntu, we are able to read it and there is a .ssh folder.
The plan is to add our own public SSH key to the .ssh/authorized_keys file for the ubuntu user, allowing us to SSH into the account directly.
This is our key:
Before proceeding, we retrieve the existing keys of other participants and users from the authorized_keys file. This allows us to append our key without disrupting the persistence of other users on the network and to remain undetected. Additionally, this ensures that the user ubuntu can still SSH into the machine as usual.
Before making any modifications, we should check if the authorized_keys file exists and examine its current content to avoid accidental overwrites.
Note: Append your key. DO NOT overwrite the existing keys.
You can break the vpn machine and will require a full network reset.
Append our SSH public key to .ssh/authorized_keys.
After successfully adding our SSH key to the authorized_keys file, we can now SSH into the machine as the ubuntu user.
Enumeration of the target reveals that the ubuntu user is allowed to run any command without providing a password using sudo.
Lateral Movement
To pivot through the network using SSH dynamic port forwarding, we can use the following command to redirect traffic through port 9050:
This command sets up a SOCKS proxy on port 9050 using SSH, allowing us to route traffic through the target machine. The -D 9050 option creates the dynamic port forward, and the -i rtc option specifies the private key for authentication.
To continue our investigation and move closer to fully compromising the corporate domain, we use sshuttle to pivot through the network. This allows us to avoid relying on ProxyChains, simplifying the process for further network exploration and exploitation.
To verify that our network pivoting with sshuttle is working correctly, we use Nmap to scan a known port on a known machine within the target network.
This helps ensure that we have successfully established connectivity and can continue with further enumeration and exploitation from our current position.
We are now able to log in using Remmina with the svcScanning credentials, granting us further access to the target environment for continued enumeration and potential exploitation.
Upon examining the user groups, we discover that the svcScanning account is a member of the Local Administrators group. This grants us elevated privileges on the machine, allowing for deeper access and potential control over the system.
Flags 5 - 6
NOTE: We are now able to obtain the following flags by following the instructions on the e-citizen platform:
Flag 5: Foothold on Corporate Division Tier 1 Infrastructure
Flag 6: Administrative access to Corporate Division Tier 1 Infrastructure
Breaching CORPDC (10.200.XXX.102)
Running impackets-secretsdumps with the user svcScanning in the hope to get any credentials of svcBackups or another high value target.
We proceed by running impacket-secretsdump with the svcScanning credentials. The goal is to extract any valuable credentials, particularly targeting svcBackups or other high-value accounts that might provide further access or lead to a Domain Administrator account.
We get svcBackups credentials with dcsync capabilities.
With this user we run again impacket-secretsdump and are able to retrieve the local Administrator hash.
By leveraging the Pass-the-Hash (PTH) technique with the local Administrator hash, we use Evil-WinRM to directly connect to the child domain controller, corpdc.
This allows us to gain access to the domain controller and potentially perform further actions to escalate privileges or compromise the domain.
Running the following commands to add our own user and adding it to the Domain Admins:
Flags 7 - 8
NOTE: We are now able to obtain the following flags by following the instructions on the e-citizen platform:
Flag 7: Foothold on Corporate Division Tier 0 Infrastructure
Flag 8: Administrative access to Corporate Division Tier 0 Infrastructure
