HackTheBox — Support Writeup
So this is my write-up on one of the HackTheBox machines called Support. Let’s go!
Initial
As usual first we start with an NMAP scan.
We can see that there is a bunch of ports, and we can see that this is a Windows machine.
Let’s enumerate the services one by one. For a Windows machine, I always ran enum4linux
in the background to fasten my enumeration process.
First, let’s enumerate the SMB service to look for some shares we can perhaps access. We can do this with the smbclient
tool. I ran smbclient -L //[target]
to list shares available on the system.
We can see that there are several shares available. Let’s see if we can access them using anonymous login. We can do this using this command smbclient -N //[target]/[sharename]
.
After trying each one of the shares, I managed to access the support-tools
share, and inside it, we can see a bunch of tools.
Maybe we can upload a backdoor to the share and execute it from somewhere to gain access to the system. I tried to upload a file into the share, but it was denied.
Maybe we can use the “Support Tools” already available there later. But for now, let’s download all of the tools inside.
I tried to enumerate the domain using rpcclient
null authentication. I can’t get anything because of a lack of privilege.
Using dig
(specify the global-server IP and set the query type to any
to query all the available DNS record types associated with a domain) we are able to see the domain controller name. It was dc.support.htb
. We can add it to our hosts file.
Foothold
Since I didn’t find anything interesting, I decided to analyze the tools given to us in the support-tools share. One of the tools is UserInfo.exe, I analyze it with Ghidra and found something interesting.
There’s a user called support
that can use LDAP, and it’s using some type of password.
After searching for a bit, I found an encrypted password for the support
user and a key in the Protected segment of the binary.
static Protected()
{
Protected.enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
Protected.key = Encoding.ASCII.GetBytes("armando");
}
And I think we can use the getPassword function to decrypt it.
public static string getPassword()
{
byte[] array = Convert.FromBase64String(Protected.enc_password);
byte[] array2 = array;
for (int i = 0; i < array.Length; i++)
{
array2[i] = (array[i] ^ Protected.key[i % Protected.key.Length] ^ 223);
}
return Encoding.Default.GetString(array2);
}
I used C# online compiler and rewrite the getPassword function to get the decrypted password.
Decrypted password: nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
I tried to log in as the support
the user using the decrypted password using evil-winrm
but it didn't work.
Since we already got the user and password for the LDAP, we can now try to enumerate it. We can use tools like ldapsearch
to do it.
Source: https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap
ldapsearch -x -H ldap://support.htb -D 'support\ldap' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b 'CN=Users,DC=support,DC=htb' | tee ldapsearch.log
We got a lot of users from it like smith.rosario
, hernandez.stanley
, and so much more, but the most interesting part is, there’s an info
segment in the support
user part, and it looks like a password. Perhaps we can try to use it to log in.
Ironside47pleasure40Watchful
Again using evil-winrm
I tried to log in as support
user with the new password, and this time, we are in.
We can grab the flag for the user in C:\Users\support\Desktop\user.txt
.
Getting the NT AUTHORITY/SYSTEM user
Now that we are inside, we can try to use Bloodhound
for further enumeration. Bloodhound will make our life so much easier because it can give us visualization of relationships within an Active Directory environment.
To get data inside Bloodhound, we can use a lot of tools. I will just use Sharphound.
We can upload SharpHound.exe
to the target machine using evil-winrm
upload feature.
Run it. SharpHound will start collecting data from the machine.
We can download it using evil-winrm
download feature and add it to our Bloodhound instance.
Since we are the support
user, we are inside the SHARED SUPPORT ACCOUNT@support.htb
. We can also see it by running Get-ADPrincipalGroupMembership support
on Powershell.
We now know that we got GenericAll
permission to the dc.support.htb
Domain Controller which means we have full rights to the dc.support.htb
object.
Since we have full rights, that means we can write stuff to the dc.support.htb
. Based on https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution, it's possible to gain code execution with elevated privileges on a remote computer if you have WRITE privilege on that computer’s AD object. We have that, and now, we can try to exploit it. Just follow the steps, and you will get the Administrator
account :D (you can use impacket if you use linux).
Thoughts
It was a great machine for learning Active Directory. I still got so much to learn about exploiting Windows Machine and this machine teaches me a lot.
Thank you for reading this write-up, stay safe everyone!