what's going on everyone this is another hack the box walkthrough this time it's
forest it's a Windows machine and it's got quite a fair amount of system and
user owns the reason I'm showing this box is because it's very good for
showing a tool called bloodhound which allows you to map out Windows domains
very useful in a real life scenario so getting straight into this first thing I
always do is nmap scan of the top 5,000 ports the reason I do that is to make
sure I've got something to get working with before I do a full scan if I need
to so straightaway here you can see that it's quite a few services on this
Windows machine you got domain you've got Kerberos you got SMB or LDAP and
when you've got this amount of services you know there's a lot there you can
potentially enumerate so to do this I use quite an old tool called enum for
Linux so just pump the IP address into that and it will start trying to
enumerate things using no authentication and various other methods if you scroll
down in this tool it does find you a load of users that you can potentially
use on this Windows machine so you can see there's loads of mailboxes which
suggests that this machine might be an exchange server you can see a load of
other users Lucinda marks aunty service alfresco and
with these users you know you might want to brute force them but looking at the
port listings you know brute-forcing tends not to be the method you want to
go down it's quite it's quite loud on a network it's quite time consuming and
you've got a Kerberos service here so before you brute force you can actually
do something called a Kerberos authentication attack or a s rep roast
it's known as I've got another video on this but we're gonna try it now so take
all of those users put them into a list I've already done that like so and we're
going to pump that list into an impact module called get MP users the out fires
gonna be hashes a s roast so that's going to grab the hashes and put it into
that file the format is going to be John because we're going to crack this with
John and users file was gonna be the users file I
just made then dcpip is gonna be the IP address of the box
the domain is hacked the box and debug in case anything goes wrong we need to
see what's going on so what this library is going to do is it's going to take the
users it's gonna try and get a Kerberos ticket for these users without using
their password so this vulnerability is known as AAS retro Singh and if it is
enabled by an administrator this is a vulnerable component on their
machine so just go ahead and run that and you start seeing that a lot of the
users don't require preauth which is a good thing so if we have a look into
that AS retro style however I've called it hashes yet you see that one user was
actually allowed to give their ticket without a password and that's the
service out fresco user so we can take this Kerberos ticket here and we can
crack that within John so if you just make a file a scrap copy that in there
save it and then we want to run it in John so you want to use John with a word
list of rocky text it's a common one in Kali Linux quite a big one you want to
use the format of krb 5s rep because that's the a s reparation format that
john takes and then the hash that we just used which was in s rep so what
this is gonna do it's gonna crack that Kerberos ticket try and find the
password that's stored in rocky text it's a big you know directory of
directory a listing of potential passwords and when it finds it it's
gonna spit it out and show you what it is
so this user as a service user typically these do have some sort of privilege on
the network so it could be a good foothold into the network you can see
that that's now cracked so service alfresco the password is literally
service with a three instead of an e so now using this you might think okay
let's try and use SMB that doesn't work on this box so this is kind of a rabbit
hole you might be trying to go down if you try and connect with SMB it's
actually disallowed so that forces you to try to find another way in so looking
at the port list thing you can see this five nine eight
five port and that's actually wing R M so this is another way you can get into
the box using win RM I didn't know how to do this to start with so I went and
googled it and there's a great tool called evil win RM you will see in the
description if you want to download that it's a really good tool for essentially
getting a little shell on the machine so this is how you run it evil win RM the
five flag with your IP address and then the user and the password ignore all
that error and that's going to provide you with a shell on the machine so if we
go into the desktop we should be able to see the users flag so you can see the
user dot text so if we just do a type and then use a dot txt
that's one flag dot so that's the user sorted now we need to privilege escalate
to get system access on this machine so this is called forest it's going to be
something to do with domain the way to do it is by using a sharp pound or
bloodhound pay low to ingest a load of directory stuff and have a look at the
best way to get to the domain administrator so we need to get the
blood humming gesture on this machine to start doing some work so the best way to
do this is by setting up a simple HTTP server this is running within my desktop
on Kali here and it's going to be serving the bloodhound more sorry sharp
hand library which you can see here so going back to the box if we use this
command invoke web request URI the URL is going to be my IP address and the
port of that server is running on and then sharp and ps1 because that
correlates to my desktop here and the out file is going to put it in the
desktop of servant alfresco so that should run fine takes a while to upload
and that's done so if you just do a dir not
door probably moving over a Miss if you do it wrong come on it takes a while to
then do that so dir is what I meant to say you'll see that sharp hound on ps1
is now in there so now if you run this command we do a double dot to put kind
of the sharp hound in memory you don't need this invoked bit yet that's going
to load it into the PowerShell memory and now you can run the invoke part of
that command in both bloodhound and
that's going to start running bloodhound the ingest is to try and get a load of
domain information using the different ways it does it what this is going to
output if we now do a dir again is a zip file or a lot of JSON files that should
turn into a zip like so so we want to
get that zip file off of the machine now and you know I do have a HTTP server but
that's not really useful because it's a command line and we don't want to be
playing around too much the best way to do this is using an SMB server so you
can set your own SMB server up using SMB so dot pi which comes with Kali the SMB
share is going to be called higher and it's just going to be on the desktop
directory using dot dash so so that SMB server up that's now running and we can
now go ahead and go back to the win RM and use net use X with higher to set
that share that we've just created up on this box and that copy/paste didn't work
so it's this command net use we're going to use the share or X and then we need
to be going - - 10 which is my IP address and then 1415 and then higher
and now that share should be connected to the X directory on this machine so
now we should simply be able to do a copy so copy that zip file just do a CP
that file to X and you'll see that this is reloading now and you'll see that
this bloodhound file is now on my desktop so we've got the file off the
machine now I need to run it within bloodhound I've already done this
because sometimes it takes quite a while to compile the graph but once you've got
bloodhound running just click on import the data and this will come up when you
click find short path to domain admin so this is the mapping tool really really
cool you can see here is the service alfresco user and this maps out where
its privileges lie so you can see that the service alfresco user is a member of
the service accounts the service accounts is a member of privileged IT
accounts that's a member of account operators who has a generic all-access
to exchange windows so that means this account also this group here has full
read/write access to exchange windows permissions so that's a vulnerability
because we can use our membership within this group as service of alfresco and
actually add ourselves through the exchange windows permissions group and
this group is vulnerable because it's got a write dackel to the domain it may
sound a bit confusing but it's not if you want out of Google of this stuff
it's ready available if you just type in Google write dackel and generica land
things you'll see descriptions of this anyway if you click on write dackel
within bloodhound it will give you some idea of what you might want to do to
abuse it if you click on abused info it talks about using the DC sync privileges
and essentially if you set yourself to have DC sync privileges you can act as a
domain controller but you're a user which obviously means you would be able
to get password hashes because you know DC sync password hashes to make sure
people can log-in so there's a really cool tool that will actually put you in
that group and allow you to do things automatically you know I love doing
things automatically manual is hard
so let's just do this or Matt automatically the first thing we're
going to want to do though before we go ahead and set those permissions up is
add Mimi Kats to the machine because we're gonna be running that in a minute
so we do that by using cert URL there you go
so we're gonna use this command cert util URL cache split minus F and then
that's my web server again it's the mini cache directory which links to my
desktop here and then x64 mmm Keswick C and we're calling the output file file
dot exe so go ahead and run that you'll
see that it's now uploaded if we do a dir again you'll see that we now have a
file wxe so Mimi cat is now on the machine at this point just take the time
to get rid of this SMB server we're not going to need that again and you know it
messes things up in the future so I'm just gonna go ahead and get rid of that
because if you need to connect to SMB using your Kali that's already using the
s and B port so you wouldn't be able to do that anyway next up we want to
actually run this Mimi cats but we can't do it because we need the privileges so
I talked about that automatic pwnage earlier there's a really cool tool
called ACL phone and you can see that on its github this is also in the
description this will actually take in the bloodhound output and automatically
point things for you and set you up as a privilege user so looking at this you
use a CL poem the F flag which is going to be kind of your user so service
alfresco on the hack of the Box domain the target is going to be hack the box
domain the TT is just telling it that this is a domain rather than like a user
or a computer the database is going to be your neo4j bloodhound installation so
it's gonna be localhost and the user is neo4j
my sub-skill password or password 1 2 3 the server we're attacking is this and
the password for this alfresco user is service so if you go ahead and run that
you will see they ingest that bloodhound output or input and it gives you two
paths that you can potentially to make yourself a privileged user on
that domain so go ahead and just type in 0 does it sing it looks a bloodhound
you remember off you're a member of a member of bar glad those groups that we
looked at earlier it adds the user to the exchange trusted
sub system and then it does that DC sync recommendation that bloodhound gave use
so if we now go back to this win RM and we run file you may have to go back in
to win RM let's just check that take that run you can't just run it like that
and this is something that actually fought me for quite a while trying to
figure out the right syntax to run it and I think this is done on purpose so
the way to run this is by using an exit clause at the end so let me just go back
into the users desktop because that's where the file was you want to run it
for you see with the command LS dump DC sync and we're gonna get those hashes
from the DC the user administrator because we want to get the administrator
users hash because that will escalate our privileges and then put the exit on
the end because obviously we'll just do what we we saw it do okay so that didn't
work because the machine has a piece of code on it that actually stops you
running it after a minute so it will actually revert your privileges back so
now I need to run AC pone again because this box is a bit tricky like that so we
just go ahead and rerun that it will give us the DC rights again and we'll
should be able to run this and get the administrator hash which we do so you've
got the ntlm hash here now you might be tempted to crack this but it's actually
not necessary so there's tools out there like a PS
exec SMB sorry crack Mac exec things like that that will actually allow you
just to use the m2m passion login as the administrator user so that's what I'm
gonna do so PS exec which comes with Kali by
default the administrator user on the IP address
then you use the hashes flag with the ntlm hash both in the NT m NT LM NT part
and the other part go ahead and enter that in and you should have access to
the box so that's just setting up your access takes a while and there you go
you've now got your access on the box if you do a Who am I
you'll see that where the system user so we have put in the Box now you obviously
want to get that root flag so if we go into the C directories we go to users we
want to go to administrator we want to go to their desktop and if we do a dir
we should see the root text which we do so then we use type to see this text
file root text and that's the hash completed the box
own the box done that's how you hack it in 17 minutes hope you learned something
thanks for watching guys check out bloodhound really good tool for network
mapping I use it in day to day engagements all the time
thanks for watching give us a like and subscribe thank you