search

Hack The Box - Monteverde

hashtag
1. Intro

Hack The Box Monteverde (10.10.10.172) is a new Windows box released on 11th Jan. The box covers attacks against poorly configured Azure AD environments. For those who are not aware of this, the idea is essentially allowing Active Directory users to authenticate with their AD credentials against Microsoft services such as Azure, Office365, Sharepoint, and various other services which support Azure AD.

Figure 1
Figure 2 - User Flag
Figure 3 - Root Flag

hashtag
2. The Setup

Note: The attacker IP address changed a number of times throughout this tutorial due to VPN issues.

hashtag
3. Scanning

We begin by trying to enumerate any open ports and services running on our target. To do this we use nmap with the following command: nmap -sV -A -p- -Pn -T4 -v 10.10.10.172

hashtag
4. Service Enumeration

From our nmap scan we can see that our host is running several Windows Server related ports like, 88, 389, 135, 445, 3268, 5985 are open.

Before we continue with our enumeration, we quickly verify that we can ping the full internal Microsoft domain name (MEGABANK.LOCAL) from our Kali box. If we get no reply - Figure 4, we need to add a static DNS entry to our /etc/hosts file for the full domain referencing the IP address of their DC, Figure 6.

Figure 4 - Before Adding DNS Entry
Figure 5 Before Adding DNS Entry
Figure 6
Figure 7

hashtag
4.1 Samba (SMB)

We start our enumeration phase with Enum4Linux using the following command:

enum4linux 10.10.10.172

This allowed us to gather a list of users, groups , domains and shares on the system. Next we will check out the file shares - https://www.hackingarticles.in/a-little-guide-to-smbenumeration/arrow-up-right After some trial and error it was discovered that SMB null session authentication was disabled - Figure 8.

Figure 8

hashtag
4.2 Lightweight Directory Access Protocol (LDAP)

Next we try to gather some more specific information about the Active Directory environment. The go to tools I use for this are

Using ldeep we can gather a list of domains, users and groups.

Figure 9
Figure 10
Figure 11 - Disabled Users

Unfortunately we weren't able to dump any user hashes. however we note the information shown above and continue.

hashtag
4.3 Kerberos

One common attack against Kerberos is AS-REP Roasting. AS-REP Roasting is an attack against Kerberos for user accounts that do not require preauthentication. This means that if you can enumerate any accounts in a Windows domain that don’t require Kerberos preauthentication, you can easily request a piece of encrypted information for said accounts such as password hashes and efficiently crack the material offline, revealing the user’s password.This is explained in pretty thorough detail in Harmj0y’s post herearrow-up-right. Next we will make use of Impackets “GetNPusers“ script and supply it with the list of usernames that we have gathered so far. The script GetNPUsers.py can be used from a Linux machine in order to harvest the non-preauth AS_REP responses and hopefully capture some hashes.

Figure 12

Unfortunately we weren't able to dump any user hashes due to all of the users.

hashtag
4.4 Password Spraying

Next we will attempt to bruteforce the SMB accounts using crackmaparrow-up-right. It's also always a good idea to use any information we've found throughout the enumeration phase first as passwords so in this case we will add the usernames to our password wordlist.

Figure 13

As can be seen from Figure 13 we found one successful set of credentials SABatchJobs:SABatchJobs

hashtag
5. Getting User Flag

Next we enumerate the SMB shares using these credentials

Figure 14

Enumerating some more we see that we have access to the following directories - Figure 15

  • azure_uploads

  • NETLOGON

  • SYSVOL

  • users$

Figure 15

Next we want to check if there are any interesting files in any of these directories. To do this we will make use of smbclient again with the following command:

Figure 16

Note: All remaining shares were enumerated but for the purposes of this tutorial they have been omitted as they don't add any value.

Reviewing the output we notice a file 'azure.xml' in user mhope directory. Again using smbclient we pull a copy of this file and review the contents:

Figure 17

As can be seen in Figure 17 the file contains a password in clear text. Knowing that password reuse is very common we attempt to login to the account belonging to mhope with credentials mhope/4n0therD4y@n0th3r$, using https://github.com/Hackplayers/evil-winrmarrow-up-right - Figure 18.

Figure 18

Now that we have a shell we can navigate to Desktop and retrieve the User flag

Figure 19

hashtag
6. Privilege Escalation

Checking the user permissions we see that we are part of the Azure admins group.

Figure 20

There is a well known priv escalation technique that can take advantage of misconfigured Azure AD environments that implement Password Hash Synchronization.

If you are unfamiliar with this topic I highly recommend watching Dirk-janarrow-up-right, Troopers 2019 presentationarrow-up-right, where he demonstrates how he discovered how to reverse the account’s password from the SQL DB and made a script that would do the hard work.

hashtag
6.1 Password Hash Synchronization (Summary)

Password Hash Synchronization (PHS) is one of the sign-in methods you can configure with Azure. The passwords from on-premise AD are actually sent to the cloud, similar to how domain controllers synchronize passwords between each other via replication. This is done from a service account that is created with the installation of AD Connect.

Figure 21

This introduces a unique attack path where if the synchronization account is compromised, it has enough privileges which potentially could lead to the compromise of the on-premise AD forest, as that account is granted replication rights which are needed for DCSYNC. DCSyncarrow-up-right impersonates the behaviour of the Domain Controller and requests account password data from the targeted Domain Controller. Putting it simple all this means is that if you are able to compromise a server containing the Azure AD Connect service, and gain access to either the ADSyncAdmins or local Administrators groups (which our user mhope is a part of), what you have is the ability to retrieve the credentials for an account capable of performing a DCSync.

hashtag
6.2 The Exploit

Having all the necessary elements in place to perform this attack we can use the following exploit - https://github.com/zflemingg1/Azure-Exploits/tree/master/Azure-ADConnectDumparrow-up-right which was built off of Adam Chesters blog arrow-up-rightcovering this topic in depth.

Figure 22

As can be seen from Figure 22 our exploit was able to successfully retrieve the credentials for the administrator account. administrator/d0m@in4dminyeah!

hashtag
7. Capturing Root Flag

Having successfully captured the Administrator password hash we can once again make use of evil-winm to give us an administrator shell and allow us to capture the root flag.

Figure 23 - Root Flag

PreviousVulnhub - MyExpenseNextHack The Box - Control

Last updated