# Lessons Learned - Gather clues along the way for future features that may be exploited - Here there an early indication of LAPS from the initial SMB share - `openssl` can be used to inspect `.pfx` or PKCS12 files also also to split them into `.crt` and `.key` files - `evil-winrm` allows authentication with `.crt` and `.key` files - Membership to the `LAPS_Readers` group allows user to read LAPS password - `nxc` has a LAPS module --- # After-Action Attack Sequence - BLUF: SMB null auth; `zip2john`; `pfx2john`; use `openssl` to split `.pfx` into `.crt` and `.key` files; use `evil-winrm` with `-S` flag for HTTPS and `-c xxx.crt -k xxx.key`; creds in `PSReadLine`; read LAPS password for administrator access - SMB null authentication shows clues of LAPS being enabled and also a `winrm_backup.zip` - `.zip` is passphrase protected; use`zip2john` and crack passphrase with `hashcat` - unzip the `.zip` reveals a passphrase protected `.pfx` file; use `pfx2john` and crack passphrase with `hashcat` - Use `openssl` to split `.pfx` into `.crt` and `.key` files - Use `evil-winrm` with `.crt` and `.key` files to open a shell as `legacyy` - `winpeas` reveals `..\PSReadLine\console_history.txt` in `appdata\roaming` that includes creds for `svc_deploy` - Use `evil-winrm` to open a shell as `svc_deploy` - `svc_deploy` is a member of `LAPS_Readers` - use `nxc ldap [...] -M laps` to disclose LAPS password - Use `evil-winrm` to open a shell as `administrator` with the LAPS password --- # Discover Ports & Services - `ping` test ![[images/Pasted image 20260608193143.png]] - `nmap` scan - light ![[images/Pasted image 20260608193258.png]] - create comma separated port list ![[images/Pasted image 20260608193347.png]] - `nmap` scan - detailed ![[images/Pasted image 20260608193646.png]] --- # Service Enum ## Port 445 (SMB) ### Null Auth - `guest` has access to non-default `shares` share ![[images/Pasted image 20260608194002.png]] - connect to `shares` with `smbclient` ![[images/Pasted image 20260608194136.png]] ### Users - `rid-brute` reveals some users ![[images/Pasted image 20260608194257.png]] - let's create a clean `users.txt` ![[images/Pasted image 20260608194507.png]] - same username and password doesn't work ![[images/Pasted image 20260608204308.png]] --- # Pillaging - `winrm_backup.zip` is passphrase protected ![[images/Pasted image 20260608194802.png]] - use `zip2john` on `winrm_backup.zip`![[images/Pasted image 20260608195013.png]] - crack with `john` > this gives us a `.pfx` file ![[images/Pasted image 20260608195206.png]] - try to use `certipy-ad auth -pfx` on `legacyy_dev_auth.pfx` ![[images/Pasted image 20260608200103.png]] - looks like we are missing a password or this is pkcs12 - try to view `.pfx` with `openssl` > we need a password ![[images/Pasted image 20260608200151.png]] - use `pfx2john` on `legacyy_dev_auth.pfx` then `john` to crack ![[images/Pasted image 20260608200726.png]] - use `openssl pkcs12` with above pfx passphrase to extract `cert.pem` and `key.pem` ![[images/Pasted image 20260608201821.png]] - try to use `certipy-ad auth -pfx` on `legacyy_dev_auth.pfx` again while passing in the passphrase > having issues even when using `faketime` ![[images/Pasted image 20260608201915.png]] - `legacyy` is a user - hmmm ## reset re: `.pfx` - re-extract pub cert and priv key from `.pfx` file without `-noenc` flag for `.key` ```bash openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out legacyy_dev_auth.key-enc openssl rsa -in legacyy_dev_auth.key-enc -out legacyy_dev_auth.key openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out legacyy_dev_auth.crt ``` ![[images/Pasted image 20260608210115.png]] --- # AD Attack Chain ## Shell as `legacyy` - use with `evil-winrm` with `.crt` and `.key` ```bash evil-winrm -i 10.129.11.193 -S -c legacyy_dev_auth.crt -k legacyy_dev_auth.key ``` ![[images/Pasted image 20260608210426.png]] - explore home share ![[images/Pasted image 20260608210512.png]] - view users ![[images/Pasted image 20260609192658.png]] - upload `winpeas.exe` ![[images/Pasted image 20260609192911.png]] - `C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt ` has a `PSCredential` object for `svc_deploy` - confirm creds for `svc_deploy` - smb works ![[images/Pasted image 20260609202306.png]] - winrm does too ![[images/Pasted image 20260609202313.png]] ## Shell as `svc_deploy` ### ASREP Roasting - Nothing ![[images/Pasted image 20260609195625.png]] ### Kerberoasting - Nothing![[images/Pasted image 20260609195614.png]] ### ADCS - Failure with `nxc ldap [..] -M adcs` ![[images/Pasted image 20260609202410.png]] - SSL error with `certipy-ad find` ![[images/Pasted image 20260609200006.png]] ### Revisit SMB - Check smb shares > nothing new ![[images/Pasted image 20260609202430.png]] ### Open shell with `evil-winrm` - `evil-winrm` needs the `-S` flag to enable SSL because only port 5896 is open - `svc_deploy` is in the `LAPS_Readers` group ![[images/Pasted image 20260609200235.png]] - grab LAPS password with below ```bash nxc ldap 10.129.11.193 -u svc_deploy -p password -d timelapse.htb -M laps ``` ![[images/Pasted image 20260609202800.png]] ## Shell as `administrator` - Use `evil-winrm` ```bash evil-winrm -i 10.129.11.193 -S -u administrator -p LAPS_password ``` ![[images/Pasted image 20260609202823.png]]