ROASTED

https://tryhackme.com/room/vulnnetroasted

Walkthrough for "VulnNet: Roasted"

Operating System: Windows

Recon

nmap-auto $TARGET all

There is a lot of information here, here are some of the key takeaways:

  • Port 139/445 > Samba service active

  • Port 88 > Microsoft Windows Kerberos

  • Port 389/3268 > Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local0., Site: Default-First-Site-Name)

Enumeration

SMB

Checking SMB first as the obvious choice, listing out the shares shows:

The following shares are accessible and have content that can be pulled and read:

Reading these files shows a plethora of useful information, primarily user information. The tool crackmapexec, which is used to collect active directory information, can be used to get further information on usernames with the following command:

  • Alexa Whitehat: a-whitehat

  • Jack Goldenhand: j-goldenhand

  • Tony Skid: t-skid

  • Johnny Leet: j-leet

These usernames along with the other users could be used to try to make a userlist to do further enumeration or exploitation with:

Another tool that can be used to do the same thing is Impackets' lookupsid.py module:

Kerberos

Since I have crafted a list of possible usernames and there is an open Kerberos service, I can attempt to conduct "Kerberoasting", an attack method for cracking hashes for service accounts in active directory. This will attempt to get tickets from the Domain Controller, and crack them using a tool like hashcat or johntheripper to get the actual passwords.

Using Impacket, an open source tool installed on Kali, I can use modules like GetUserSPNs or GetNPUsers to try to get some ticket responses, the first requiring a password and the latter not requiring one. The module GetNPUsers is for ASREPRoast, which is used to crack user passwords if a user has the DONT_REQ_PREAUTH attribute which allows the KDC to respond with KRB_AS_REP user hashes even without a password.

The user "t-skid" returned a TGT hash which can then be cracked in hashcat. Using the command hashcat -h | grep -i "kerberos" shows a number of options, the correct one is "18200 | Kerberos 5, etype 23, AS-REP"

Use the following command to crack the hash:

This gives the password for user t-skid: tj072889*

Username: t-skid

Password: tj072889*

Exploitation

After getting the initial credentials, I tried to enumerate other shares that were previously blocked. The share NETLOGON was accessible this time and contained a file called ResetPassword.vbs. The following commands worked to login and retrieve the file:

The retrieved file shows the following:

In the beginning of the script are the credentials for user a-whitehat:

Username: a-whitehat

Password: bNdKVkjv3RR9ht

User a-whitehat actually has privileges to do a number of things including read and write to the ADMIN$ share. This can be shown through the following command:

Logging into the ADMIN$ share and navigating to the \Users\enterprise-core-vn\Desktop\ path shows the user flag user.txt.

user.txt: THM{726b7c0baaac1455d05c827b5561f4ed}

Privilege Escalation

Trying to print out the system flag from here straight out failed due to an "Access Denied" prompt. No worries, since user a-whitehat has write access to SMB an an administrator, it's possible to use the Impacket module secretsdump to get the SAM hashes. These hashes could potentially be used to get a shell on the box.

The NTHash of the Administrator is the fourth section under the "Dumping local SAM hashes". This can be used with the tool evil-winrm, a powerful shell creator utilizing Windows Remote Management, to gain an administrator shell

Navigating to C:\Users\Administrator\Desktop can find the system.txt flag!

system.txt: THM{16f45e3934293a57645f8d7bf71d8d4c}

PreviousPOSTEXPLOITNextTEMPEST

Last updated