✅Forest (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: ASREP Roasting
System Vulnerable: 10.10.10.161
Vulnerability Explanation: By enumerating on rpcclient, we could collection all validate user in the environment and perform ASREP Roasting and crack the hash for plaintext password.
Privilege Escalation Vulnerability: DCSync Attack
Vulnerability Fix: Implement strong password policy and review group permission
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 53 domain
Verify and Resolve domain. We got forest.htb.local and htb.local.
Port 445 SMB
Port 135 RPC
We connect to rpcclient with null auth. There are a lot of command we can query.
Enumerate user with enumdomusers
Enumerate group with enumdomgroups
We can enumerate member of the group and information about user
Now we have a list of user which we will sort out SM and Health first.
Exploitation
Kerberos PreAuth
Crack hash
Crackmapexec to verify credential
Evil-Winrm
Privilege Escalation
Start HTTP Server to share Sharphound.exe file for enumerate on domain.
We have full permission on user svc-alfresco folder.
Let download and execute sharphound.exe
Let start smb server on our kali machine and transfer file from our victim machine.
Start Bloodhound
Shortest Path to Domain Admin
It's part of account operators group. We can create a new user and assign to group.
Let download powerview to exploit DcSync privileges.
Let start our HTTP Server to share Powerview and download to execute on victim machine.
Let run secretdump to dump all the hash with user salt.
run psexec
Last updated