Blog

Authority

A Windows Machine with a heavy emphasis on ADCS and LDAP(s)

Enumeration 

┌──(kali㉿kali)-[~/Desktop/CTF/Boxes/authority]
└─$ nmap -sC -sV -Pn 10.10.11.222         
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-16 03:56 EDT
Nmap scan report for 10.10.11.222
Host is up (0.029s latency).
Not shown: 987 closed tcp ports (conn-refused)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-07-16 11:56:13Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2023-07-16T11:57:02+00:00; +4h00m00s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
|_ssl-date: 2023-07-16T11:57:02+00:00; +4h00m00s from scanner time.
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2023-07-16T11:57:02+00:00; +4h00m00s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2023-07-16T11:57:02+00:00; +4h00m00s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
8443/tcp open  ssl/https-alt
| ssl-cert: Subject: commonName=172.16.2.118
| Not valid before: 2023-07-14T09:39:23
|_Not valid after:  2025-07-15T21:17:47
|_ssl-date: TLS randomness does not represent time
| fingerprint-strings: 
|   FourOhFourRequest, GetRequest: 
|     HTTP/1.1 200 
|     Content-Type: text/html;charset=ISO-8859-1
|     Content-Length: 82
|     Date: Sun, 16 Jul 2023 11:56:19 GMT
|     Connection: close
|     <html><head><meta http-equiv="refresh" content="0;URL='/pwm'"/></head></html>
|   HTTPOptions: 
|     HTTP/1.1 200 
|     Allow: GET, HEAD, POST, OPTIONS
|     Content-Length: 0
|     Date: Sun, 16 Jul 2023 11:56:19 GMT
|     Connection: close
|   RTSPRequest: 
|     HTTP/1.1 400 
|     Content-Type: text/html;charset=utf-8
|     Content-Language: en
|     Content-Length: 1936
|     Date: Sun, 16 Jul 2023 11:56:24 GMT
|     Connection: close
|     <!doctype html><html lang="en"><head><title>HTTP Status 400 
|     Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 
|_    Request</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Invalid character found in the HTTP protocol [RTSP&#47;1.00x0d0x0a0x0d0x0a...]</p><p><b>Description</b> The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid
|_http-title: Site doesn't have a title (text/html;charset=ISO-8859-1).
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8443-TCP:V=7.93%T=SSL%I=7%D=7/16%Time=64B3A2A3%P=x86_64-pc-linux-gn
SF:u%r(GetRequest,DB,"HTTP/1\.1\x20200\x20\r\nContent-Type:\x20text/html;c
SF:harset=ISO-8859-1\r\nContent-Length:\x2082\r\nDate:\x20Sun,\x2016\x20Ju
SF:l\x202023\x2011:56:19\x20GMT\r\nConnection:\x20close\r\n\r\n\n\n\n\n\n<
SF:html><head><meta\x20http-equiv=\"refresh\"\x20content=\"0;URL='/pwm'\"/
SF:></head></html>")%r(HTTPOptions,7D,"HTTP/1\.1\x20200\x20\r\nAllow:\x20G
SF:ET,\x20HEAD,\x20POST,\x20OPTIONS\r\nContent-Length:\x200\r\nDate:\x20Su
SF:n,\x2016\x20Jul\x202023\x2011:56:19\x20GMT\r\nConnection:\x20close\r\n\
SF:r\n")%r(FourOhFourRequest,DB,"HTTP/1\.1\x20200\x20\r\nContent-Type:\x20
SF:text/html;charset=ISO-8859-1\r\nContent-Length:\x2082\r\nDate:\x20Sun,\
SF:x2016\x20Jul\x202023\x2011:56:19\x20GMT\r\nConnection:\x20close\r\n\r\n
SF:\n\n\n\n\n<html><head><meta\x20http-equiv=\"refresh\"\x20content=\"0;UR
SF:L='/pwm'\"/></head></html>")%r(RTSPRequest,82C,"HTTP/1\.1\x20400\x20\r\
SF:nContent-Type:\x20text/html;charset=utf-8\r\nContent-Language:\x20en\r\
SF:nContent-Length:\x201936\r\nDate:\x20Sun,\x2016\x20Jul\x202023\x2011:56
SF::24\x20GMT\r\nConnection:\x20close\r\n\r\n<!doctype\x20html><html\x20la
SF:ng=\"en\"><head><title>HTTP\x20Status\x20400\x20\xe2\x80\x93\x20Bad\x20
SF:Request</title><style\x20type=\"text/css\">body\x20{font-family:Tahoma,
SF:Arial,sans-serif;}\x20h1,\x20h2,\x20h3,\x20b\x20{color:white;background
SF:-color:#525D76;}\x20h1\x20{font-size:22px;}\x20h2\x20{font-size:16px;}\
SF:x20h3\x20{font-size:14px;}\x20p\x20{font-size:12px;}\x20a\x20{color:bla
SF:ck;}\x20\.line\x20{height:1px;background-color:#525D76;border:none;}</s
SF:tyle></head><body><h1>HTTP\x20Status\x20400\x20\xe2\x80\x93\x20Bad\x20R
SF:equest</h1><hr\x20class=\"line\"\x20/><p><b>Type</b>\x20Exception\x20Re
SF:port</p><p><b>Message</b>\x20Invalid\x20character\x20found\x20in\x20the
SF:\x20HTTP\x20protocol\x20\[RTSP&#47;1\.00x0d0x0a0x0d0x0a\.\.\.\]</p><p><
SF:b>Description</b>\x20The\x20server\x20cannot\x20or\x20will\x20not\x20pr
SF:ocess\x20the\x20request\x20due\x20to\x20something\x20that\x20is\x20perc
SF:eived\x20to\x20be\x20a\x20client\x20error\x20\(e\.g\.,\x20malformed\x20
SF:request\x20syntax,\x20invalid\x20");
Service Info: Host: AUTHORITY; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   311: 
|_    Message signing enabled and required
|_clock-skew: mean: 3h59m59s, deviation: 0s, median: 3h59m59s
| smb2-time: 
|   date: 2023-07-16T11:56:57
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.91 seconds

From the following nmap scan, we can infer a few things about this machine.

  • It is most likely a domain controller seeing how DNS (Port 53), Kerberos (Port 88) with the domain name authority.htb.

  • LDAP/LDAPS is also enabled

  • A HTTPS website is also available at Port 8443 which redirects us to the /pwm endpoint.

  • SMB is also enabled

Initial Foothold

Enumerating SMB

We can start by enumerating SMB with smbmap to check share permissions with null session.

We see that the we have READ access to the Development share using a null session (non-authenticated). We can then proceed to connect to the SMB using smbclient.

After downloading and browsing the files, we notice a few things

  • The parent folder is named Automation, which seems to be using Ansible Playbook files (.yml) to automate certain tasks

  • Inside the automation folder, we discover encrypted ansible credentials at Automation/Ansible/PWM/defaults/main.yml

Decrypting Ansible Credentials

We can use Ansible2John to convert the encrypted Ansible hashes into a hash format acceptable by JohnTheRipper.

We can now decrypt the ansible credentials using the ansible-vault's decrypt function.

We seem to have a valid pair of credentials for the user svc_pwm.

PWM Enumeration (Port 8443)

Using the credentials obtained earlier, we can try to login onto PWM's Configuration Manager.

Accessing PWM's Configuration Manager

From the get-go, we notice that the PWM is in configuration mode.

This likely means that we might be able to change the configuration in some way or another which is proven as we are able to download the pwm configuration file.

Looking through the file, we notice that svc_ldap's password is specified in the file but is encoded.

Googling online, we can find a article that states that we can actually reveal the plaintext password by setting and enabling the storePlaintextValues property to True.

We can then add the following lines into our pwm configuration file and upload it again to apply the new configuration.

The plaintext password for svc_ldap is then revealed.

svc_ldap's password in plaintext

We can then check whether svc_ldap is a valid user using crackmapexec and use evil-winrm to get the user flag.

Privilege Escalation

Quickly browsing the file directory, we see that there is a C:\Certs folder. This seems to imply the use of ADCS.

Using certipy, we can find vulnerable certificate templates that can be potentially exploited.

Looking at the certipy output, we see that the CorpVpn Template is vulnerable to ESC1 via domain computers.

We also notice that the user svc_ldap has SeMachineAccountPrivilege, which allows a domain user to add domain computers to the domain.

To exploit this vulnerability we first have to

  1. Create a rogue domain computer using impacket's AddComputer

  2. Request the certificate and impersonate the Administrator using the rogue domain computer

  3. Authenticate using the certificate and retrieve the NT hash of Administrator

However when we try to authenticate using the certificate, we receive an error "KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)".

With reference to this article, it states the following

A certificate can have several Extended Key Usages (EKUs). If a KDC must support smart card logon, its certificate must have the Smart Card Logon EKU. A failing PKINIT may be an indication that your targeted KDCs do not have certificates with the necessary EKU.

This essentially means that we cannot use our PFX certificates as a pre-authentication method to requests TGTs or NT hash of the account.

As such, we will have to perform PassTheCert.

For this exploit to work, we have to do the following

  1. Extract the private key and cert from the PFX file

  2. Impersonate Administrator with PassTheCert tool to add our exisiting user to the Domain Admins Group

  3. Perform a hashdump of the domain using Impacket's Secretsdump

With this, we can use evil-winrm to log in as Administrator, obtaining the root flag.

Reflection

Having done similar boxes that exploit ADCS in the past, this was a relatively straightforward box with a few twists at the end. However, certipy's req function was especially buggy and I received multiple errors which was only fixed after specifying the -dns-tcp and -dns parameters.

PreviousMirageNextCozyHosting

Last updated