HTB | Breach

Machine - https://app.hackthebox.com/machines/Breach

IP - 10.129.61.210

Machine Information - The User flag for this Box is located in a non-standard directory, C:\share\transfer\.

NMAP

 nmap -sC -sV -p 53,80,88,135,139,445,464,593,636,3268,3269,3389,5985,9389,49664,49668,49677,4992 10.129.61.210 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-10-15 03:43 UTC
Nmap scan report for ip-10-129-61-210.ap-south-1.compute.internal (10.129.61.210)
Host is up (0.12s latency).

PORT      STATE    SERVICE       VERSION
53/tcp    open     domain        Simple DNS Plus
80/tcp    open     http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
88/tcp    open     kerberos-sec  Microsoft Windows Kerberos (server time: 2025-10-15 03:43:48Z)
135/tcp   open     msrpc         Microsoft Windows RPC
139/tcp   open     netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open     microsoft-ds?
464/tcp   open     kpasswd5?
593/tcp   open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open     tcpwrapped
3268/tcp  open     ldap          Microsoft Windows Active Directory LDAP (Domain: breach.vl0., Site: Default-First-Site-Name)
3269/tcp  open     tcpwrapped
3389/tcp  open     ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=BREACHDC.breach.vl
| Not valid before: 2025-09-07T08:04:48
|_Not valid after:  2026-03-09T08:04:48
|_ssl-date: 2025-10-15T03:45:18+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: BREACH
|   NetBIOS_Domain_Name: BREACH
|   NetBIOS_Computer_Name: BREACHDC
|   DNS_Domain_Name: breach.vl
|   DNS_Computer_Name: BREACHDC.breach.vl
|   DNS_Tree_Name: breach.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2025-10-15T03:44:39+00:00
4992/tcp  filtered unknown
5985/tcp  open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
|_http-title: Not Found
9389/tcp  open     mc-nmf        .NET Message Framing
49664/tcp open     msrpc         Microsoft Windows RPC
49668/tcp open     msrpc         Microsoft Windows RPC
49677/tcp open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
Service Info: Host: BREACHDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-10-15T03:44:40
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 100.80 seconds

Port 80

This is a basic IIS webpage

SMB

We can do null auth but do not have access to enum shares or rid brute force

Let’s check for guest Login and we can not only authenticate but we can enum shares

and also rid-brute

Let’s copy the name, and use smbclient to look for files in the share share

We can see three folders in this share, but finance and software are both empty. Transfer, on the other hand, has some directories,

We can’t list the contents of these directories, but we can make an educated assumption that these users might be connecting to this share and browsing it on a regular basis.

Foothold/shell

Shell as juila.wong

NTLM theft

Let’s upload the files generated via https://github.com/Greenwolf/ntlm_theft

now let’s upload the files and wait for the call back on our listner

Let’s try to crack hash and we got the password

Now we can login as juila.wong on smb and got the user.txt

Priveleage Esclation

Shell as ?

Kerberoasting

Since we have the valid credential we can perform the Kerberoasting

and we have the hash for svc_mssql

Let’s try to crack the hash and got the password

Strangely on my initial scan iI did’t see the mssql open but it open now

Let’s login via svc_mssql

we can use xp_dirtree

Sliver Attack

we have the credentials for the user that this service is running as, a new vector of attack opens up for us — a silver ticket attack.

How does this work?

When a TGS is presented to the MSSQL service, as long as it is encrypted with the NT hash of the svc_mssql user, it is trusted. Since we have the password for the user, we can easily calculate the NT hash, and forge a ticket, which will allow us to impersonate any user, even a domain admin, in the context of this service.

Domain admins should have admin privileges over the MSSQL database, so that should get us one step closer to owning this DC.

To perform this, we need the domain SID

Now we need NTLM of svc account for that i used this online tool can generate a ticket ( I try to generate tickets for all the user but Christine.Bruc authenticates)

and now we get the mssql shell as Administrator

and we are the sa

let’s enable the xp_cmdshell

and we get the shell

SeImpersonatePrivilege

We can see that SeImpersonatePrivilege is enabled

and we are nt authority\\system

and we got the root.txt

PreviousHTB | BabyNextHTB | Job

Last updated