[Music] what's going on everyone welcome to
another hack the box walkthrough video this time is active the IP address is 10
10 10 100 and it's an easy machine although it does have some good things
to show you so Group Policy preferences Kerbal roasting stuff that we do in the
real world it's really useful to know so let's get straight into this first thing
I do like always is an nmap quick scan using the F flag a fast scan to get some
port results back to begin with we can do a bigger scan if we need to later so
on first glimpse of this nothing really irregular is there you can tell it's
probably a domain controller because it's got things like DNS and LDAP and
Kerberos things that you typically see on domain controllers so we don't have a
user yet so the first thing you might want to think about is trying to
authenticate with anonymous users so with the SMB service when you use
something like enum for Linux that uses null sessions to try and gain some
information what I did was use crack Mac exec with the smv flag the IP address
and the using of blank and pass with a blank and the shares flag so this is
going to present to you any shares that you can access on the domain controller
without a user you will find that you can only see this replication shares
only got read access whereas the others do not have any access and this is
typical on a normal network well not having replication as read but the other
ones not be able to see it as an anonymous user so as we can read this
share let's go ahead and look at what's in it so to do that you can use SMB
clients with the IP address and the replication share and we can go in there
just enter again and that puts you in as an anonymous user so if you do LS you'll
see that there's a directory called active dot h TB
so let's go inside that and also remember that active dot h TB is
domain name LS you will see these folders so these folders are typically
what you might see in the sysvol folder that we don't have access to so
straightaway here you might think what can I gain from the sysvol folder
because clearly this is a replication of that folder well what I would do is SME
client replication again but use this see flag with East command here because
I let and I'll give you all of the files and folders within this share so what
we're looking for here is going to be called Group Policy preferences
so it's this file here groups are XML so Group Policy preferences is a legacy way
for IT administrators to administer their network and put out group policy
so this is typically found in machine preferences groups and then groups XML
so the policy the group policy ideas here and then the machine preferences
groups XML inside this XML sometimes there's our administrators username and
encrypted password which we can decrypt so that's what we're going to do let's
take this directory here and go back to our other SME client and just CD into
that directory just doing LS make sure there we are
and then we want to get groups and that's gonna download it onto your Kali
machine so if I just exit this so we can see that we can cat groups which we've
just downloaded and you'll see that we've got a user here which is SVC TGS
with the domain active to hack the box and this C password is what we're
interested in if there's a vulnerable group policy preferences file the group
XML this is what we're interested in this encrypted password here because
Microsoft have released the decryption key for this so you can again use Kali
by taking this string the C password string putting into GPP decrypt
and that will give you the password for that user this is a pretty big floor
that you see on some big network so this is something to remember when you're
doing actually actual client work so the user is SVC TGS the CE password we've
just decrypted which is GPP still standing strong now we want to try and
get into the box is this user so firstly let's see what more access we have to
the box so like we did before with a crack map exact this time we're going to
be using a user rather than trying the numbers login so end of that and you'll
see that we now have access to users sis
file net logon and we still have access to replication with this user so on
domain controller typically you will see sis file you'll see net logon you won't
see replication you won't see users so we've already looked in replication so
now to now have a look in users because this could be an interesting shared
folder because this isn't something that's typically seen on a domain
controller so to do that we can use SMB client again we can use user share at
the end rather than replication and we can do the U flag with the user that
we've just cracked the password for so that's not gonna ask for their password
so I'm just gonna go ahead and copy and paste that into that in and we now have
access to the users share as sv c TGS this user so now you can see that this
share that's being shared is actually the users directory within this domain
controller so obviously the first thing you gonna want to try is going into the
administrator user so that's CD into that LS and we have access tonight so
this means we don't have access for all of these folders in the share so let's
go back and try and access the SVC TGS you
which of course we do have access to so now if we go to the desktop we should be
able to get the flag which we do so if we now do I can't play it's free if we
now do get user the text that's downloading the user's doc text file we
can exit out of here and just do a cat navigator screen and just do a cat users
dot text user dot X and that's the flag so now we have the user flag but we
don't have the administrator flag so we need to escalate our privileges so you
can take a while and think about how you might do this but the username of the
user that we've just cracked here the password is actually SVC TGS so TGS is
tickets it's Kerberos tickets so that suggests
this SVC for service and TGS for Kerberos tickets it's a service account
for giving out Kerberos tickets so we need to do Kerberos thinking quite
evidently and to do that you can use the in packet library which is in the
description if you want to download it and don't already have it and in that
library you've got a tool called get user SPMS to use that tool with request
the DC IP address that we're using and then the domain the user and the
password that's got a Kerberos and it's going to give you a Kerberos ticket
which is this so this string here is encrypted with the users ntlm hat this
administrator user so take this hash put it into a file call it hash Tex or
something I've already put it in there so just go
ahead and copy and paste save it and now we want to put this into hash cap to try
and crack this string and get the actual password which is going to be for this
administrator user which we've managed to get with the SVC TGS user so the hash
cat command you need for this hash cap - M
this number to show it's a Kerberos hash then the hash table text which we just
created which includes this hash then minus a zero the word list which I'm
using rocku which is standard in Kali and then use the false flag to just
bypass any errors and you don't have to use pot disable I'm gonna using that
because I've already cracked this hash I just want to show you it cracking so
this is what it should look like starts running you can press s and see the
status and eventually this is going to crack the Kerberos ticket and give you
the administrator password so this is gonna take a while so I'm just gonna be
quiet and come back when it's done okay so hash cat has now cracked the Kerberos
ticket you can see here that the password is Ticketmaster 1968 and you
will see its cracks because it says cracked here but you can see the parts
of it anyway so take this password you know the user was administrator because
you can see the name here is administrator which we use by using the
get SPMS now we want to login to the box as this
administrator user and get the final flag so to do this you can do it a
number of ways but to be honest the easiest just using Metasploit use the PS
exec library here or what module options set your our hosts to 10 10 10 100 the
our ports always going to be 4 4 5 usually don't change anything else other
than the username which is administrator and the password which is that
ticketmaster 1968 which we just cracked so once that's all set put in exploit
that will open up a meterpreter session for you like so I'm really not good at
clearing this screen am I you can see that we're in a folder that we probably
don't want to be so that's just CD out of that and CEO that again do another LS
and this is a more recognizable file system structure so we want to be going
into users because want to get this flag the user we want
to go to is administrator within LS will see ya desktop is there so I go desktop
and LS we should see the root flag which we do root up text so if you just wanna
cat that there is your root hash and you have full access to the active machine
because we've privilege escalated so you've seen group policy preferences
you've seen how to Kerberos by using the SVG SVC user who can access Kerberos
tickets for the administrator user we've cracked it we have full access nice and
easy ten minutes thanks for watching guys
come back for more give us a like and subscribe I appreciate it
thank you [Music]