search

Hack The Box - Resolute

hashtag
1. Intro

Hack The Box Resolute (10.10.10.169) is a Windows box released on 07 Dec 2019. The box covers attacks against a poorly configured AD environment.

Figure 1
Figure 2 - User Flag
Figure 3 - Root Flag

hashtag
2. The Setup

Note: The attacker IP address changed a number of times throughout this tutorial due to VPN issues.

hashtag
3. Scanning

We begin by trying to enumerate any open ports and services running on our target. To do this we use nmap with the following command: nmap -sV -A -p- -Pn -T4 -v 10.10.10.169

hashtag
4. Service Enumeration

From our nmap scan we can see that our host is running several Windows Server related ports like, 88, 389, 135, 445, 3268, 5985 are open. Before we continue with our enumeration, we quickly verify that we can ping the full internal Microsoft domain name (MEGABANK.LOCAL) from our Kali box. If we get no reply - Figure 4, we need to add a static DNS entry to our /etc/hosts file for the full domain referencing the IP address of their DC, Figure 6.

Figure 4 - Before Adding DNS Entry
Figure 5 - Before Adding DNS Entry
Figure 6 - After Adding DNS Entry
Figure 7 - After Adding DNS Entry

hashtag
4.1 Samba (SMB)

We start our enumeration phase with Enum4Linux using the following command:

enum4linux 10.10.10.169

This allowed us to gather a list of users, groups , domains and shares on the system. Furthermore we can see from line 77:

that the password Welcome123! was used when creating the account. However, upon trying to login to this account using winrm it was noted that the credentials appeared to have been changed since then and are now invalid.

Moving on we next check out the file shares - https://www.hackingarticles.in/a-little-guide-to-smbenumeration/arrow-up-right After some trial and error it was discovered that SMB null session authentication was disabled - Figure 8.

Figure 8

hashtag
4.2 Lightweight Directory Access Protocol (LDAP)

Next we try to gather some more specific information about the Active Directory environment. The go to tools I use for this are

Using ldeep we can gather a list of domains, users and groups.

Figure 9

Unfortunately we weren't able to dump any user hashes. however we note the information shown above and continue

hashtag
4.3 Kerberos

After some trial and error - https://www.tarlogic.com/en/blog/how-to-attack-kerberos/arrow-up-right it became apparent that this avenue wasn't going to result in much.

hashtag
4.4 Password Spraying

Next we will attempt to bruteforce the SMB accounts using the metasploit module SMB LOGIN CHECKarrow-up-right. We start by using the password we found earlier in Section 4.1 - Welcome123! as a lot of administrators tend to reuse the same password when creating accounts. Thus the probability of another user having been created with the same password seemed a reasonable p[lace to start.

Figure 10

As can be seen from Figure 13 we found one successful set of credentials melanie:Welcome123!

hashtag
5. Getting User Flag

Using evil-winrmarrow-up-right we log using credentials melanie:Welcome123! and navigate to the Desktop folder where we retrieve our User Flag.

Figure 11

hashtag
6. Privilege Escalation

Checking the user permissions doesn't result to much.

Figure 12

Note: Various priv escalation scripts were used but none resulted in anything useful.

Checking for hidden folders in the C directory we find a powershell transcripts folder:

Figure 13

Navigating this folder leads us to a file 'PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt'.

Upon inspecting this file a set of creds is found: ryan:Serv3r4Admin4cc123!

Figure 14

Checking that these creds are valid we can see that we are able to successfully login to the account belonging to Ryan.

Figure 15

hashtag
6.1 Abusing DNSAdmins privilege for escalation in Active Directory

Figure 16

There is a well known privilege escalation technique involving the DNS feature implemented in AD environments. Essentially the way it works is by abusing the privileges of a user who is member of the DNSAdmins group (as is the case in this scenario - refer to Figure 16) or have write privileges to a DNS server. These permissions can be manipulated resulting in the attacker being able to load an arbitrary DLL with SYSTEM privileges on the DNS server. If you are unfamiliar with this technique, the following articles cover it in depth:

hashtag
6.2 The Exploit

Making use of the metasploit SMB Deliveryarrow-up-right module we can create our malicious dll file and serve it to the client like so:

Figure 18

Our next step is to import that DLL in the DNS Server using the compromised account. This is done like so:

Figure 19

Having successfully injected the malicious DLL file the last step is to restart the service to execute our payload.

Figure 20 - Restart DNS Service
Figure 21 - Successfully Gained Reverse Shell as System

hashtag
7. Capturing Root Flag

Finally we navigate to the Desktop folder to retrieve the root.txt flag

Figure 22 - root.txt

PreviousHack The Box - ControlNextHack The Box - Sauna

Last updated

Was this helpful?