✅Active (Easy)
Report-Penetration
Vulnerable Exploit: Group Policy Preference Exploit CVE MS14-025
System Vulnerable: 10.10.10.100
Vulnerability Explanation: By allow unauthorize user have read permission to SYSVOL folder which contain group policy and it's vulnerable to CVE-MS14-025. We were able to compromise service account by extract the hash and cracked. Any domain user could request for service ticket. By using weak password policy and improper configure user on service account.
Privilege Escalation Vulnerability: Kerberoasting
Vulnerability Fix: Apply patch on system, implement strong password policy and using least privilege for service account.
Severity: Critical
Step to Compromise the Host:
Reconnaissance
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-02 02:09 EST
Nmap scan report for 10.10.10.100
Host is up (0.040s latency).
Not shown: 65513 closed ports
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2021-12-02 07:10:18Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49169/tcp open msrpc Microsoft Windows RPC
49171/tcp open msrpc Microsoft Windows RPC
49182/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -1s
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2021-12-02T07:11:13
|_ start_date: 2021-12-02T07:08:10
Enumeration
Port 445 SMB
smbclient connection to Replication
Abuse Group Policy Preference
Exploitation GPP
Crack the hash with gpp-decrypt
Privilege Escalation
Kerberos
Crack hash kerberos
Last updated