search
Read BlogpostsLet's Connect

windowsNara

Owed DC using Misconfigured Certificate Templates - ESC1

hashtag
Summary

  • Anonymous Read and Write was enabled in the/Nara directory via SMB.

    • Found an important.txt file that indicates every employee to check the Documents folder regularly.

  • Having write access, we can upload INK file and grab the NTML hash of users.

    • uploaded a file, and got NTML hash on Responder

    • Decrypted the hash to get plain text password

  • Bloodhound revealed that Tracy had GenericAll privileges to Remote Access Group.

  • Got the winrm access to the machine after adding Tracy to the Remote Access group.

  • found a secured encrypted secret int he box which was later decrypted get plan text password.

  • it turns out DC had a CA, so we can attempt to perform domain escalation using Misconfigured Certificate Templates - ESC1

hashtag
🧵Let's Unpack

hashtag
Enumeration

Using SMBClient (unauth) to enumeration /nara directory

smbclient -N -L  //192.168.181.30//                   

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        nara            Disk      company share
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
  
 smb: > ls
  .                                   D        0  Sun Jul 30 16:31:58 2023
  ..                                DHS        0  Sun Jul 30 16:46:51 2023
  Documents                           D        0  Sun Jul 30 16:03:13 2023
  Important.txt                       A     2200  Sun Jul 30 16:05:31 2023
  IT                                  D        0  Sun Jul 30 18:22:50 2023

hashtag
Initial Foothold

Important.txt indicates that every employee should regularly check the Documents folder regularly (for new compliance documents). Since we have write access, we can plan an attack here.

  • Create a malicious INK file using the ntml_theftarrow-up-right tool.

  • Spin up responder to get a callback from victim having their NTML hash.

  • Crack the hash to get the password in plaintext.

Remote access is not enabled for this user, so these credentials cannot be used to gain entry into the box. Let's keep digging!

Let's use bloodhound-python to get more vectors on lateral movement.

hashtag
Findings of BloodHound

  • TRACY.WHITE@NARA-SECURITY.COM has GenericAll privileges to the group REMOTE ACCESS@NARA-SECURITY.COM

To abuse this permission, we can add ourselves to the Remote Access Group and gain an initial foothold into the machine via winrm

Now we can winrm into the machine.

Got a file in automation.txt in "C:Users\Tracy.White\Documents".

This appear to be a encrypted password. We can use this script to decrypt it

Sadly, this user had no interesting misconfiguration listed by Bloodhound :(

hashtag
Privilege Escalation/Lateral Movement

From here, I had to refer to Walkthrough for further impersonating privilege as an administrator. 😿

It turns out there is a CA on a Domain Controller. We can use certipy-ad arrow-up-rightto get more vector of lateral movement.

BloodHound UI shows that the Enrollment group as GenericAll on the NARAUSER template, which is also known as the ESC4 scenario (full control over a template). Additionally, any user-supplied subject is allowed, so it is also directly vulnerable to ESC1 from any user in the enrollment group.

Read more about this class of vulnerability here

LogoAD CS Domain Escalation - HackTricksbook.hacktricks.xyzchevron-right

We can now use this hash to move laterally into a machine impersonating an administrator.

PreviousKevinNextJacko

Last updated