TryHackMe - Attacktive Directory Write-up

https://tryhackme.com/r/room/attacktivedirectory

This write-up will focus on overall solving methodology, and not by-task basis.

Different tools are showcased to perform the same objective.

Enumeration

My target machine IP: 10.10.98.165

Check for domain name and naming contexts

First thing first, nmap scan.

nmap -n -sV --script "ldap* and not brute" 10.10.98.165 -vv -oN nmap.output

We've obtained some naming contexts and domain:

Alternative way to look for naming contexts:

Check NULL bind

Results show that it is unsuccessful.

Shares enumeration

The result shows us that we're not allowed to view the shares anonymously. We'll need to get some credentials in this case.

User enumeration

Mini wordlists are provided by author in order to save us some time.

Username wordlist: https://raw.githubusercontent.com/Sq00ky/attacktive-directory-tools/master/userlist.txt

Password wordlist: https://raw.githubusercontent.com/Sq00ky/attacktive-directory-tools/master/passwordlist.txt

The tools that can be used are kerbrute and ldapsearch.

To install Kerbrute:

Using the wordlists provided, we can run kerbrute to get some usernames:

Some notable accounts are svc-admin (service admin) and backup.

Alternatively, ldapsearch can be run. But since we were not able to perform NULL bind, hence there will be no results shown with this method.

More information

We can get more info with enum4linux:

enum4linux 10.10.98.165

This tool help us to gather loads of information in an automated and easier manner.

Initial Foothold

Get password hash

Now since we've got some usernames in hand, we can try to perform AS-REP Roasting attack. The tool will first send authentication requests to the user accounts and figure out the ones that doesn't require Kerberos pre-authentication.

If successful, we'll get Kerberos TGT that has the user's password hash embeded. We can then extract the hash and crack it offline.

The hint in earlier tasks told us that svc-admin might be interesting for us, let's parse that value for our tool. Just press "Enter" without inputting any values when password is asked.

Hooray! Ticket returned alongside with the hash.

I'll put it into a text file called svc-admin.hash.

Cracking the hash

Here's a useful link to search for what type of hash we obtained: hashcat wiki

The prefix told us that the mode that we need to use is 18200:

Remember the password list provided by the author earlier? We'll use that.

Password for svc-admin is management2005.

Looking into shares

This time, we have a valid credentials to login into the share.

For easier enumeration in the share, we'll switch to smbmap.

To install: sudo pip3 install smbmap

We've obtained a username called backup earlier, so it makes sense for us to have a look at the backup share first.

Recursive listing reveals a credential text file.

Login to the share and retrieve the file.

I wasn't quite sure what encoding is used, so I dumped it into cyberchef, and the magic wand appeared.

Upon clicking on the wand, we know that it's a base64 encoding.

Boom! It's the credential for user account backup: [email protected]:backup2517860

Alternative method of decoding base64 hash:

Privilege Escalation

Get admin credentials

As mentioned by the author:

A backup account has a unique permission that allows all Active Directory changes to be synced with this user account. This includes password hashes.

Hmm, this means that we can try dumping all the password hashes that this backup account contains.

Ahhh, look what we've gotten, Administrator's hash.

Pass the hash

Now, we can perform pass-the-hash attack with the NTLM hash.

Successful login!

Flags

Time to retrieve the flags from each user's Desktop.

Administrator:

svc-admin:

backup:

That's it, hope you enjoyed :)

PreviousBrewing...

Last updated

Was this helpful?